Add incremental RST-to-MyST swap mechanism (sagitta) (#1868)

* feat(swap-sagitta): add incremental RST-to-MyST swap mechanism

Backport of the swap mechanism from feat/incremental-myst-swap onto
the sagitta release branch. Built directly on top of origin/sagitta,
so the underlying RST tree is sagitta's (not current's).

Mechanism:
- scripts/import_myst.py — import md from myst/* with md- prefix
- scripts/swap_sources.py — rename md-{name}.md → {name}.md before
  Sphinx builds, restore after; writes _build/_swap_state.json and
  _build/_swap_exclude.txt
- docs/Makefile — html/dirhtml/pdf/livehtml all run swap → build →
  trap restore; explicit `swap` and `restore` targets too
- docs/conf.py — MyST extensions enabled; swap exclude_patterns
  loader; _prefer_webp builder hook so html prefers webp over png

Content:
- 202 md-prefixed pages from origin/myst/sagitta (md-{name}.md
  alongside each {name}.rst counterpart)
- 1 plain MyST-only page from myst/sagitta where no .rst exists
  (already at canonical name on sagitta: docs/copyright.md)
- 240 .webp images from myst/sagitta (added alongside the existing
  PNG/JPG so RST builds keep their assets)
- docs/_swap.txt populated with all 202 stems → MyST is served by
  default, revert a page by removing its stem from _swap.txt

🤖 Generated by [robots](https://vyos.io)

* feat(conf): copy .md sources into HTML output for plain-text serving

Adds a build-finished hook that mirrors every .md file from the Sphinx
source tree into the HTML output directory verbatim, making unrendered
MyST sources accessible alongside HTML renders at the same URL path.

🤖 Generated by [robots](https://vyos.io)

* docs: address review feedback (backport from PR #1857)

Fix conversion artifacts, typos, and technical inaccuracies applicable
to the sagitta branch: curly quotes, typos (deamonless, cammans,
amdifferent, trough), incorrect firewall command paths, missing closing
brace in zone-policy, peer name inconsistencies, hardcoded passwords
replaced with vault references, and md-*.md exclusion in conf.py.

🤖 Generated by [robots](https://vyos.io)

* docs: port .readthedocs.yml jobs, _ext/vyos.py fallback and swap-script tests from PR #1857

Parity backport from PR #1857 (current) — three pieces were missing on
sagitta.

- .readthedocs.yml: add build.jobs.pre_build / post_build hooks that run
  scripts/swap_sources.py --swap before the Sphinx build and --restore
  after. Without this, the swap mechanism ships but never runs on RTD
  builds for this branch — the swap is a silent no-op.
- docs/_ext/vyos.py: CmdInclude.run() now falls back to nested_parse()
  when self.state._renderer is not present. Required for cfgcmd /
  opcmd / cmdincludemd directives to render correctly when included
  from MyST pages (the swap mechanism's whole point). Sagitta-only
  delta on _ext/vyos.py (the path = str(path) line on 224) is
  intentionally untouched.
- tests/test_import_myst.py, tests/test_swap_sources.py: tests for the
  swap scripts. The scripts on this branch are byte-identical to
  current's, so the same tests apply. Travels with the branch so CI
  catches per-branch regressions if the scripts ever drift.

🤖 Generated by [robots](https://vyos.io)

* fix(conf): skip md-*.md staging files in _copy_md_sources

Agent-Logs-Url: https://github.com/vyos/vyos-documentation/sessions/919695a7-688d-41b9-89f0-540684625dbc

Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>

15 files changed, 7158 insertions, 0 deletions

diff --git a/docs/configuration/protocols/md-babel.md b/docs/configuration/protocols/md-babel.md
new file mode 100644
index 00000000..8bca4a71
--- /dev/null
+++ b/docs/configuration/protocols/md-babel.md
@@ -0,0 +1,294 @@
+# Babel
+
+Babel is a modern routing protocol designed to be robust and efficient
+both in ordinary wired networks and in wireless mesh networks.
+By default, it uses hop-count on wired networks and a variant of ETX
+on wireless links, It can be configured to take radio diversity into account
+and to automatically compute a link's latency and include it in the metric.
+It is defined in `8966`.
+
+Babel a dual stack protocol.
+A single Babel instance is able to perform routing for both IPv4 and IPv6.
+
+## General Configuration
+
+VyOS does not have a special command to start the Babel process.
+The Babel process starts when the first Babel enabled interface is configured.
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\>
+
+This command specifies a Babel enabled interface by interface name. Both
+the sending and receiving of Babel packets will be enabled on the interface
+specified in this command.
+
+</div>
+
+## Optional Configuration
+
+<div class="cfgcmd">
+
+set protocols babel parameters diversity
+
+This command enables routing using radio frequency diversity.
+This is highly recommended in networks with many wireless nodes.
+
+> <div class="note">
+>
+> <div class="title">
+>
+> Note
+>
+> </div>
+>
+> If you enable this, you will probably want to
+> set diversity-factor and channel below.
+>
+> </div>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel parameters diversity-factor \<1-256\>
+
+This command sets the multiplicative factor used for diversity routing,
+in units of 1/256; lower values cause diversity to play a more important role
+in route selection.
+The default it 256, which means that diversity plays no role in route
+selection; you will probably want to set that to 128 or less on nodes
+with multiple independent radios.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel parameters resend-delay \<milliseconds\>
+
+This command specifies the time in milliseconds after which an 'important'
+request or update will be resent. The default is 2000 ms.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel parameters smoothing-half-life \<seconds\>
+
+This command specifies the time constant, in seconds, of the smoothing
+algorithm used for implementing hysteresis.
+Larger values reduce route oscillation at the cost of very slightly increasing
+convergence time. The value 0 disables hysteresis, and is suitable for wired
+networks. The default is 4 s.
+
+</div>
+
+## Interfaces Configuration
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> type \<auto[|wired|](##SUBST##|wired|)wireless\>
+
+This command sets the interface type:
+
+**auto** – automatically determines the interface type.
+**wired** – enables optimisations for wired interfaces.
+**wireless** – disables a number of optimisations that are only correct
+on wired interfaces. Specifying wireless is always correct,
+but may cause slower convergence and extra routing traffic.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> split-horizon \<default[|disable|](##SUBST##|disable|)enable\>
+
+This command specifies whether to perform split-horizon on the interface.
+Specifying no babel split-horizon is always correct, while babel split-horizon
+is an optimisation that should only be used on symmetric
+and transitive (wired) networks.
+
+**default** – enable split-horizon on wired interfaces, and disable
+split-horizon on wireless interfaces.
+**enable** – enable split-horizon on this interfaces.
+**disable** – disable split-horizon on this interfaces.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> hello-interval \<milliseconds\>
+
+This command specifies the time in milliseconds between two scheduled hellos.
+On wired links, Babel notices a link failure within two hello intervals;
+on wireless links, the link quality value is reestimated at every hello
+interval.
+The default is 4000 ms.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> update-interval \<milliseconds\>
+
+This command specifies the time in milliseconds between two scheduled updates.
+Since Babel makes extensive use of triggered updates,
+this can be set to fairly high values on links with little packet loss.
+The default is 20000 ms.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> rxcost \<1-65534\>
+
+This command specifies the base receive cost for this interface.
+For wireless interfaces, it specifies the multiplier used for computing
+the ETX reception cost (default 256);
+for wired interfaces, it specifies the cost that will be advertised to
+neighbours.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> rtt-decay \<1-256\>
+
+This command specifies the decay factor for the exponential moving average
+of RTT samples, in units of 1/256.
+Higher values discard old samples faster. The default is 42.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> rtt-min \<milliseconds\>
+
+This command specifies the minimum RTT, in milliseconds,
+starting from which we increase the cost to a neighbour.
+The additional cost is linear in (rtt - rtt-min). The default is 10 ms.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> rtt-max \<milliseconds\>
+
+This command specifies the maximum RTT, in milliseconds, above which
+we don't increase the cost to a neighbour. The default is 120 ms.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> max-rtt-penalty \<milliseconds\>
+
+This command specifies the maximum cost added to a neighbour because of RTT,
+i.e. when the RTT is higher or equal than rtt-max.
+The default is 150.
+Setting it to 0 effectively disables the use of a RTT-based cost.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> enable-timestamps
+
+This command enables sending timestamps with each Hello and IHU message
+in order to compute RTT values.
+It is recommended to enable timestamps on tunnel interfaces.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel interface \<interface\> channel \<1-254[|interfering|](##SUBST##|interfering|)noninterfering\>
+
+This command set the channel number that diversity routing uses for this
+interface (see diversity option above).
+
+**1-254** – interfaces with a channel number interfere with
+interfering interfaces and interfaces with the same channel number.
+**interfering** – interfering interfaces are assumed to interfere with all other channels except
+noninterfering channels.
+**noninterfering** – noninterfering interfaces are assumed to only interfere
+with themselves.
+
+</div>
+
+## Redistribution Configuration
+
+<div class="cfgcmd">
+
+set protocols babel redistribute \<ipv4|ipv6\> \<route source\>
+
+This command redistributes routing information from the given route source
+to the Babel process.
+
+IPv4 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospf, rip, static.
+
+IPv6 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospfv3, ripng, static.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel distribute-list \<ipv4[|ipv6\> access-list \<in|](##SUBST##|ipv6> access-list <in|)out\> \<number\>
+
+This command can be used to filter the Babel routes using access lists.
+`in` and `out` this is the direction in which the access
+lists are applied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel distribute-list \<ipv4[|ipv6\> interface \<interface\> access-list \<in|](##SUBST##|ipv6> interface <interface> access-list <in|)out\> \<number\>
+
+This command allows you apply access lists to a chosen interface to
+filter the Babel routes.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel distribute-list \<ipv4[|ipv6\> prefix-list \<in|](##SUBST##|ipv6> prefix-list <in|)out\> \<name\>
+
+This command can be used to filter the Babel routes using prefix lists.
+`in` and `out` this is the direction in which the prefix
+lists are applied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols babel distribute-list \<ipv4[|ipv6\> interface \<interface\> prefix-list \<in|](##SUBST##|ipv6> interface <interface> prefix-list <in|)out\> \<name\>
+
+This command allows you apply prefix lists to a chosen interface to
+filter the Babel routes.
+
+</div>
+
+## Configuration Example
+
+Simple Babel configuration using 2 nodes and redistributing connected interfaces.
+
+**Node 1:**
+
+``` none
+set interfaces loopback lo address 10.1.1.1/32
+set interfaces loopback lo address fd12:3456:dead:beef::1/128
+set protocols babel interface eth0 type wired
+set protocols babel redistribute ipv4 connected
+set protocols babel redistribute ipv6 connected
+```
+
+**Node 2:**
+
+``` none
+set interfaces loopback lo address 10.2.2.2/32
+set interfaces loopback lo address fd12:3456:beef:dead::2/128
+set protocols babel interface eth0 type wired
+set protocols babel redistribute ipv4 connected
+set protocols babel redistribute ipv6 connected
+```
diff --git a/docs/configuration/protocols/md-bfd.md b/docs/configuration/protocols/md-bfd.md
new file mode 100644
index 00000000..58582008
--- /dev/null
+++ b/docs/configuration/protocols/md-bfd.md
@@ -0,0 +1,259 @@
+lastproofread  
+2023-01-27
+
+# BFD
+
+`BFD (Bidirectional Forwarding Detection)` is described and extended by
+the following RFCs: `5880`, `5881` and `5883`.
+
+In the age of very fast networks, a second of unreachability may equal millions of lost packets.
+The idea behind BFD is to detect very quickly when a peer is down and take action extremely fast.
+
+BFD sends lots of small UDP packets very quickly to ensures that the peer is still alive.
+
+This allows avoiding the timers defined in BGP and OSPF protocol to expires.
+
+## Configure BFD
+
+<div class="cfgcmd">
+
+set protocols bfd peer \<address\>
+
+Set BFD peer IPv4 address or IPv6 address
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bfd peer \<address\> echo-mode
+
+Enables the echo transmission mode
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bfd peer \<address\> multihop
+
+Allow this BFD peer to not be directly connected
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bfd peer \<address\> source
+\[address \<address\> | interface \<interface\>\]
+
+Bind listener to specific interface/address, mandatory for IPv6
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bfd peer \<address\> interval echo-interval \<10-60000\>
+
+The minimal echo receive transmission interval that this system is
+capable of handling
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bfd peer \<address\> interval multiplier \<2-255\>
+
+Remote transmission interval will be multiplied by this value
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bfd peer \<address\> interval
+\[receive | transmit\] \<10-60000\>
+
+Interval in milliseconds
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bfd peer \<address\> shutdown
+
+Disable a BFD peer
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bfd peer \<address\> minimum-ttl \<1-254\>
+
+For multi hop sessions only. Configure the minimum expected TTL for an
+incoming BFD control packet.
+
+This feature serves the purpose of thightening the packet validation
+requirements to avoid receiving BFD control packets from other sessions.
+
+</div>
+
+### Enable BFD in BGP
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<neighbor\> bfd
+
+Enable BFD on a single BGP neighbor
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp peer-group \<neighbor\> bfd
+
+Enable BFD on a BGP peer group
+
+</div>
+
+### Enable BFD in OSPF
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> bfd
+
+Enable BFD for OSPF on an interface
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> bfd
+
+Enable BFD for OSPFv3 on an interface
+
+</div>
+
+### Enable BFD in ISIS
+
+<div class="cfgcmd">
+
+set protocols isis \<name\> interface \<interface\> bfd
+
+Enable BFD for ISIS on an interface
+
+</div>
+
+## Operational Commands
+
+<div class="opcmd">
+
+show bfd peers
+
+Show all BFD peers
+
+``` none
+BFD Peers:
+     peer 198.51.100.33 vrf default interface eth4.100
+             ID: 4182341893
+             Remote ID: 12678929647
+             Status: up
+             Uptime: 1 month(s), 16 hour(s), 29 minute(s), 38 second(s)
+             Diagnostics: ok
+             Remote diagnostics: ok
+             Local timers:
+                     Receive interval: 300ms
+                     Transmission interval: 300ms
+                     Echo transmission interval: 50ms
+             Remote timers:
+                     Receive interval: 300ms
+                     Transmission interval: 300ms
+                     Echo transmission interval: 0ms
+
+     peer 198.51.100.55 vrf default interface eth4.101
+             ID: 4618932327
+             Remote ID: 3312345688
+             Status: up
+             Uptime: 20 hour(s), 16 minute(s), 19 second(s)
+             Diagnostics: ok
+             Remote diagnostics: ok
+             Local timers:
+                     Receive interval: 300ms
+                     Transmission interval: 300ms
+                     Echo transmission interval: 50ms
+             Remote timers:
+                     Receive interval: 300ms
+                     Transmission interval: 300ms
+                     Echo transmission interval: 0ms
+```
+
+</div>
+
+## BFD Static Route Monitoring
+
+A monitored static route conditions the installation to the RIB on the BFD
+session running state: when BFD session is up the route is installed to RIB,
+but when the BFD session is down it is removed from the RIB.
+
+### Configuration
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> next-hop \<address\>
+bfd profile \<profile\>
+
+Configure a static route for \<subnet\> using gateway \<address\>
+and use the gateway address as BFD peer destination address.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> next-hop \<address\>
+bfd multi-hop source \<address\> profile \<profile\>
+
+Configure a static route for \<subnet\> using gateway \<address\>
+, use source address to indentify the peer when is multi-hop session
+and the gateway address as BFD peer destination address.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> next-hop \<address\>
+bfd profile \<profile\>
+
+Configure a static route for \<subnet\> using gateway \<address\>
+and use the gateway address as BFD peer destination address.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> next-hop \<address\>
+bfd multi-hop source \<address\> profile \<profile\>
+
+Configure a static route for \<subnet\> using gateway \<address\>
+, use source address to indentify the peer when is multi-hop session
+and the gateway address as BFD peer destination address.
+
+</div>
+
+## Operational Commands
+
+<div class="opcmd">
+
+show bfd static routes
+
+Showing BFD monitored static routes
+
+``` none
+Showing BFD monitored static routes:
+
+  Next hops:
+    VRF default IPv4 Unicast:
+        10.10.13.3/32 peer 192.168.2.3 (status: installed)
+        172.16.10.3/32 peer 192.168.10.1 (status: uninstalled)
+
+    VRF default IPv4 Multicast:
+
+    VRF default IPv6 Unicast:
+```
+
+</div>
diff --git a/docs/configuration/protocols/md-bgp.md b/docs/configuration/protocols/md-bgp.md
new file mode 100644
index 00000000..b5a91b3f
--- /dev/null
+++ b/docs/configuration/protocols/md-bgp.md
@@ -0,0 +1,1683 @@
+# BGP
+
+`BGP (Border Gateway Protocol)` is one of the Exterior Gateway Protocols
+and the de facto standard interdomain routing protocol. The latest BGP version
+is 4. BGP-4 is described in `1771` and updated by `4271`. `2858`
+adds multiprotocol support to BGP.
+
+VyOS makes use of `FRR (Free Range Routing)` and we would like to thank
+them for their effort!
+
+## Basic Concepts
+
+### Autonomous Systems
+
+From `1930`:
+
+> An AS is a connected group of one or more IP prefixes run by one or more
+> network operators which has a SINGLE and CLEARLY DEFINED routing policy.
+
+Each `AS (Autonomous System)` has an identifying number associated with it
+called an `ASN (Autonomous System Number)`. This is a two octet value
+ranging in value from 1 to 65535. The AS numbers 64512 through 65535 are defined
+as private AS numbers. Private AS numbers must not be advertised on the global
+Internet. The 2-byte AS number range has been exhausted. 4-byte AS numbers are
+specified in `6793`, and provide a pool of 4294967296 AS numbers.
+
+The `ASN (Autonomous System Number)` is one of the essential elements of
+BGP. BGP is a distance vector routing protocol, and the AS-Path framework
+provides distance vector metric and loop detection to BGP.
+
+<div class="cfgcmd">
+
+set protocols bgp system-as \<asn\>
+
+Set local `ASN (Autonomous System Number)` that this router represents.
+This is a a mandatory option!
+
+</div>
+
+### Address Families
+
+Multiprotocol extensions enable BGP to carry routing information for multiple
+network layer protocols. BGP supports an Address Family Identifier (AFI) for
+IPv4 and IPv6.
+
+### Route Selection
+
+The route selection process used by FRR's BGP implementation uses the following
+decision criterion, starting at the top of the list and going towards the
+bottom until one of the factors can be used.
+
+1.  **Weight check**
+
+    Prefer higher local weight routes to lower routes.
+
+2.  **Local preference check**
+
+    Prefer higher local preference routes to lower.
+
+3.  **Local route check**
+
+    Prefer local routes (statics, aggregates, redistributed) to received routes.
+
+4.  **AS path length check**
+
+    Prefer shortest hop-count AS_PATHs.
+
+5.  **Origin check**
+
+    Prefer the lowest origin type route. That is, prefer IGP origin routes to
+    EGP, to Incomplete routes.
+
+6.  **MED check**
+
+    Where routes with a MED were received from the same AS, prefer the route
+    with the lowest MED.
+
+7.  **External check**
+
+    Prefer the route received from an external, eBGP peer over routes received
+    from other types of peers.
+
+8.  **IGP cost check**
+
+    Prefer the route with the lower IGP cost.
+
+9.  **Multi-path check**
+
+    If multi-pathing is enabled, then check whether the routes not yet
+    distinguished in preference may be considered equal. If
+    `bgp bestpath as-path multipath-relax` is set, all such routes are
+    considered equal, otherwise routes received via iBGP with identical AS_PATHs
+    or routes received from eBGP neighbours in the same AS are considered equal.
+
+10. **Already-selected external check**
+
+    Where both routes were received from eBGP peers, then prefer the route
+    which is already selected. Note that this check is not applied if
+    `bgp bestpath compare-routerid` is configured. This check can
+    prevent some cases of oscillation.
+
+11. **Router-ID check**
+
+    Prefer the route with the lowest <span class="title-ref">router-ID</span>. If the route has an
+    <span class="title-ref">ORIGINATOR_ID</span> attribute, through iBGP reflection, then that router ID is
+    used, otherwise the <span class="title-ref">router-ID</span> of the peer the route was received from is
+    used.
+
+12. **Cluster-List length check**
+
+    The route with the shortest cluster-list length is used. The cluster-list
+    reflects the iBGP reflection path the route has taken.
+
+13. **Peer address**
+
+    Prefer the route received from the peer with the higher transport layer
+    address, as a last-resort tie-breaker.
+
+### Capability Negotiation
+
+When adding IPv6 routing information exchange feature to BGP. There were some
+proposals. `IETF (Internet Engineering Task Force)`
+`IDR (Inter Domain Routing)` adopted a proposal called Multiprotocol
+Extension for BGP. The specification is described in `2283`. The protocol
+does not define new protocols. It defines new attributes to existing BGP. When
+it is used exchanging IPv6 routing information it is called BGP-4+. When it is
+used for exchanging multicast routing information it is called MBGP.
+
+*bgpd* supports Multiprotocol Extension for BGP. So if a remote peer supports
+the protocol, *bgpd* can exchange IPv6 and/or multicast routing information.
+
+Traditional BGP did not have the feature to detect a remote peer's
+capabilities, e.g. whether it can handle prefix types other than IPv4 unicast
+routes. This was a big problem using Multiprotocol Extension for BGP in an
+operational network. `2842` adopted a feature called Capability
+Negotiation. *bgpd* use this Capability Negotiation to detect the remote peer's
+capabilities. If a peer is only configured as an IPv4 unicast neighbor, *bgpd*
+does not send these Capability Negotiation packets (at least not unless other
+optional BGP features require capability negotiation).
+
+By default, FRR will bring up peering with minimal common capability for the
+both sides. For example, if the local router has unicast and multicast
+capabilities and the remote router only has unicast capability the local router
+will establish the connection with unicast only capability. When there are no
+common capabilities, FRR sends Unsupported Capability error and then resets the
+connection.
+
+## Configuration
+
+### BGP Router Configuration
+
+First of all you must configure BGP router with the `ASN (Autonomous
+System Number)`. The AS number is an identifier for the autonomous system.
+The BGP protocol uses the AS number for detecting whether the BGP connection
+is internal or external. VyOS does not have a special command to start the BGP
+process. The BGP process starts when the first neighbor is configured.
+
+<div class="cfgcmd">
+
+set protocols bgp system-as \<asn\>
+
+Set local autonomous system number that this router represents. This is a
+mandatory option!
+
+</div>
+
+#### Peers Configuration
+
+##### Defining Peers
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> remote-as
+\<nasn\>
+
+This command creates a new neighbor whose remote-as is \<nasn\>. The neighbor
+address can be an IPv4 address or an IPv6 address or an interface to use
+for the connection. The command is applicable for peer and peer group.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> remote-as
+internal
+
+Create a peer as you would when you specify an ASN, except that if the
+peers ASN is different than mine as specified under the `protocols
+bgp <asn>` command the connection will be denied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> remote-as
+external
+
+Create a peer as you would when you specify an ASN, except that if the
+peers ASN is the same as mine as specified under the `protocols
+bgp <asn>` command the connection will be denied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> local-role
+\<role\> \[strict\]
+
+BGP roles are defined in RFC `9234` and provide an easy way to
+add route leak prevention, detection and mitigation. The local Role
+value is negotiated with the new BGP Role capability which has a
+built-in check of the corresponding value. In case of a mismatch the
+new OPEN Roles Mismatch Notification \<2, 11\> would be sent.
+The correct Role pairs are:
+
+Provider - Customer
+
+Peer - Peer
+
+RS-Server - RS-Client
+
+If `strict` is set the BGP session won’t become established
+until the BGP neighbor sets local Role on its side. This
+configuration parameter is defined in RFC `9234` and is used to
+enforce the corresponding configuration at your counter-parts side.
+
+Routes that are sent from provider, rs-server, or the peer local-role
+(or if received by customer, rs-client, or the peer local-role) will
+be marked with a new Only to Customer (OTC) attribute.
+
+Routes with this attribute can only be sent to your neighbor if your
+local-role is provider or rs-server. Routes with this attribute can
+be received only if your local-role is customer or rs-client.
+
+In case of peer-peer relationship routes can be received only if OTC
+value is equal to your neighbor AS number.
+
+All these rules with OTC will help to detect and mitigate route leaks
+and happen automatically if local-role is set.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> shutdown
+
+This command disable the peer or peer group. To reenable the peer use
+the delete form of this command.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> description
+\<text\>
+
+Set description of the peer or peer group.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> update-source
+\<address|](##SUBST##|interface> update-source
+<address|)interface\>
+
+Specify the IPv4 source address to use for the BGP session to this neighbor,
+may be specified as either an IPv4 address directly or as an interface name.
+
+</div>
+
+##### Capability Negotiation
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> capability
+dynamic
+
+This command would allow the dynamic update of capabilities over an
+established BGP session.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> capability
+extended-nexthop
+
+Allow bgp to negotiate the extended-nexthop capability with it’s peer.
+If you are peering over a IPv6 Link-Local address then this capability
+is turned on automatically. If you are peering over a IPv6 Global Address
+then turning on this command will allow BGP to install IPv4 routes with
+IPv6 nexthops if you do not have IPv4 configured on interfaces.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\>
+disable-capability-negotiation
+
+Suppress sending Capability Negotiation as OPEN message optional
+parameter to the peer. This command only affects the peer is
+configured other than IPv4 unicast configuration.
+
+When remote peer does not have capability negotiation feature,
+remote peer will not send any capabilities at all. In that case,
+bgp configures the peer with configured capabilities.
+
+You may prefer locally configured capabilities more than the negotiated
+capabilities even though remote peer sends capabilities. If the peer is
+configured by `override-capability`, VyOS ignores received
+capabilities then override negotiated capabilities with configured values.
+
+Additionally you should keep in mind that this feature fundamentally
+disables the ability to use widely deployed BGP features. BGP unnumbered,
+hostname support, AS4, Addpath, Route Refresh, ORF, Dynamic Capabilities,
+and graceful restart.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\>
+override-capability
+
+This command allow override the result of Capability Negotiation with
+local configuration. Ignore remote peer’s capability value.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\>
+strict-capability-match
+
+This command forces strictly compare remote capabilities and local
+capabilities. If capabilities are different, send Unsupported Capability
+error then reset connection.
+
+You may want to disable sending Capability Negotiation OPEN message
+optional parameter to the peer when remote peer does not implement
+Capability Negotiation. Please use `disable-capability-negotiation`
+command to disable the feature.
+
+</div>
+
+##### Peer Parameters
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> allowas-in number \<number\>
+
+This command accept incoming routes with AS path containing AS
+number with the same value as the current system AS. This is
+used when you want to use the same AS number in your sites,
+but you can’t connect them directly.
+
+The number parameter (1-10) configures the amount of accepted
+occurences of the system AS number in AS path.
+
+This command is only allowed for eBGP peers. It is not applicable
+for peer groups.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> as-override
+
+This command override AS number of the originating router with
+the local AS number.
+
+Usually this configuration is used in PEs (Provider Edge) to
+replace the incoming customer AS number so the connected CE (
+Customer Edge) can use the same AS number as the other customer
+sites. This allows customers of the provider network to use the
+same AS number across their sites.
+
+This command is only allowed for eBGP peers.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> attribute-unchanged \<as-path[|med|](##SUBST##|med|)next-hop\>
+
+This command specifies attributes to be left unchanged for
+advertisements sent to a peer or peer group.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> maximum-prefix \<number\>
+
+This command specifies a maximum number of prefixes we can receive
+from a given peer. If this number is exceeded, the BGP session
+will be destroyed. The number range is 1 to 4294967295.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> nexthop-self
+
+This command forces the BGP speaker to report itself as the
+next hop for an advertised route it advertised to a neighbor.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> remove-private-as
+
+This command removes the private ASN of routes that are advertised
+to the configured peer. It removes only private ASNs on routes
+advertised to EBGP peers.
+
+If the AS-Path for the route has only private ASNs, the private
+ASNs are removed.
+
+If the AS-Path for the route has a private ASN between public
+ASNs, it is assumed that this is a design choice, and the
+private ASN is not removed.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> soft-reconfiguration inbound
+
+Changes in BGP policies require the BGP session to be cleared. Clearing has a
+large negative impact on network operations. Soft reconfiguration enables you
+to generate inbound updates from a neighbor, change and activate BGP policies
+without clearing the BGP session.
+
+This command specifies that route updates received from this neighbor will be
+stored unmodified, regardless of the inbound policy. When inbound soft
+reconfiguration is enabled, the stored updates are processed by the new
+policy configuration to create new inbound updates.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+Storage of route updates uses memory. If you enable soft
+reconfiguration inbound for multiple neighbors, the amount of memory used
+can become significant.
+
+</div>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> weight \<number\>
+
+This command specifies a default weight value for the neighbor’s
+routes. The number range is 1 to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\>
+advertisement-interval \<seconds\>
+
+This command specifies the minimum route advertisement interval for
+the peer. The interval value is 0 to 600 seconds, with the default
+advertisement interval being 0.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\>
+disable-connected-check
+
+This command allows peerings between directly connected eBGP peers
+using loopback addresses without adjusting the default TTL of 1.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\>
+disable-send-community \<extended|](##SUBST##|interface>
+disable-send-community <extended|)standard\>
+
+This command specifies that the community attribute should not be sent
+in route updates to a peer. By default community attribute is sent.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> ebgp-multihop
+\<number\>
+
+This command allows sessions to be established with eBGP neighbors
+when they are multiple hops away. When the neighbor is not directly
+connected and this knob is not enabled, the session will not establish.
+The number of hops range is 1 to 255. This command is mutually
+exclusive with `ttl-security hops`.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> local-as \<asn\>
+\[no-prepend\] \[replace-as\]
+
+Specify an alternate AS for this BGP process when interacting with
+the specified peer or peer group. With no modifiers, the specified
+local-as is prepended to the received AS_PATH when receiving routing
+updates from the peer, and prepended to the outgoing AS_PATH (after
+the process local AS) when transmitting local routes to the peer.
+
+If the `no-prepend` attribute is specified, then the supplied
+local-as is not prepended to the received AS_PATH.
+
+If the `replace-as` attribute is specified, then only the supplied
+local-as is prepended to the AS_PATH when transmitting local-route
+updates to this peer.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+This command is only allowed for eBGP peers.
+
+</div>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> passive
+
+Configures the BGP speaker so that it only accepts inbound connections
+from, but does not initiate outbound connections to the peer or peer group.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> password
+\<text\>
+
+This command specifies a MD5 password to be used with the tcp socket that
+is being used to connect to the remote peer.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> ttl-security
+hops \<number\>
+
+This command enforces Generalized TTL Security Mechanism (GTSM),
+as specified in `5082`. With this command, only neighbors
+that are specified number of hops away will be allowed to
+become neighbors. The number of hops range is 1 to 254. This
+command is mutually exclusive with `ebgp-multihop`.
+
+</div>
+
+##### Peer Groups
+
+Peer groups are used to help improve scaling by generating the same update
+information to all members of a peer group. Note that this means that the
+routes generated by a member of a peer group will be sent back to that
+originating peer with the originator identifier attribute set to indicated
+the originating peer. All peers not associated with a specific peer group
+are treated as belonging to a default peer group, and will share updates.
+
+<div class="cfgcmd">
+
+set protocols bgp peer-group \<name\>
+
+This command defines a new peer group. You can specify to the group the same
+parameters that you can specify for specific neighbors.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+If you apply a parameter to an individual neighbor IP address, you
+override the action defined for a peer group that includes that IP
+address.
+
+</div>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> peer-group
+\<name\>
+
+This command bind specific peer to peer group with a given name.
+
+</div>
+
+#### Network Advertisement Configuration
+
+<div class="cfgcmd">
+
+set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\>
+network \<prefix\>
+
+This command is used for advertising IPv4 or IPv6 networks.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+By default, the BGP prefix is advertised even if it's not present
+in the routing table. This behaviour differs from the implementation of
+some vendors.
+
+</div>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters network-import-check
+
+This configuration modifies the behavior of the network statement. If you
+have this configured the underlying network must exist in the routing table.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> default-originate \[route-map \<name\>\]
+
+By default, VyOS does not advertise a default route (0.0.0.0/0) even if it is
+in routing table. When you want to announce default routes to the peer, use
+this command. Using optional argument `route-map` you can inject the
+default route to given neighbor only if the conditions in the route map are
+met.
+
+</div>
+
+#### Route Aggregation Configuration
+
+<div class="cfgcmd">
+
+set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\>
+aggregate-address \<prefix\>
+
+This command specifies an aggregate address. The router will also
+announce longer-prefixes inside of the aggregate address.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\>
+aggregate-address \<prefix\> as-set
+
+This command specifies an aggregate address with a mathematical set of
+autonomous systems. This command summarizes the AS_PATH attributes of
+all the individual routes.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\>
+aggregate-address \<prefix\> summary-only
+
+This command specifies an aggregate address and provides that
+longer-prefixes inside of the aggregate address are suppressed
+before sending BGP updates out to peers.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> unsuppress-map \<name\>
+
+This command applies route-map to selectively unsuppress prefixes
+suppressed by summarisation.
+
+</div>
+
+#### Redistribution Configuration
+
+<div class="cfgcmd">
+
+set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\>
+redistribute \<route source\>
+
+This command redistributes routing information from the given route source
+to the BGP process. There are six modes available for route source:
+connected, kernel, ospf, rip, static, table.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\>
+redistribute \<route source\> metric \<number\>
+
+This command specifies metric (MED) for redistributed routes. The
+metric range is 0 to 4294967295. There are six modes available for
+route source: connected, kernel, ospf, rip, static, table.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\>
+redistribute \<route source\> route-map \<name\>
+
+This command allows to use route map to filter redistributed routes.
+There are six modes available for route source: connected, kernel,
+ospf, rip, static, table.
+
+</div>
+
+#### General Configuration
+
+##### Common parameters
+
+<div class="cfgcmd">
+
+set protocols bgp parameters allow-martian-nexthop
+
+When a peer receives a martian nexthop as part of the NLRI for a route
+permit the nexthop to be used as such, instead of rejecting and resetting
+the connection.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters router-id \<id\>
+
+This command specifies the router-ID. If router ID is not specified it will
+use the highest interface IP address.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp address-family \<ipv4-unicast[|ipv6-unicast\>
+maximum-paths \<ebgp|](##SUBST##|ipv6-unicast>
+maximum-paths <ebgp|)ibgp\> \<number\>
+
+This command defines the maximum number of parallel routes that
+the BGP can support. In order for BGP to use the second path, the
+following attributes have to match: Weight, Local Preference, AS
+Path (both AS number and AS path length), Origin code, MED, IGP
+metric. Also, the next hop address for each path must be different.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters no-hard-administrative-reset
+
+Do not send Hard Reset CEASE Notification for "Administrative Reset"
+events. When set and Graceful Restart Notification capability is exchanged
+between the peers, Graceful Restart procedures apply, and routes will be retained.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters log-neighbor-changes
+
+This command enable logging neighbor up/down changes and reset reason.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters no-client-to-client-reflection
+
+This command disables route reflection between route reflector clients.
+By default, the clients of a route reflector are not required to be
+fully meshed and the routes from a client are reflected to other clients.
+However, if the clients are fully meshed, route reflection is not required.
+In this case, use the `no-client-to-client-reflection` command
+to disable client-to-client reflection.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters no-fast-external-failover
+
+Disable immediate session reset if peer's connected link goes down.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters no-ipv6-auto-ra
+
+By default, FRR sends router advertisement packets when Extended Next Hop is
+on or when a connection is established directly using the device name (Unnumbered BGP).
+Setting this option prevents FRR from sending router advertisement packets, but could break Unnumbered BGP.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp listen range \<prefix\> peer-group \<name\>
+
+This command is useful if one desires to loosen the requirement for BGP
+to have strictly defined neighbors. Specifically what is allowed is for
+the local router to listen to a range of IPv4 or IPv6 addresses defined
+by a prefix and to accept BGP open messages. When a TCP connection
+(and subsequently a BGP open message) from within this range tries to
+connect the local router then the local router will respond and connect
+with the parameters that are defined within the peer group. One must define
+a peer-group for each range that is listed. If no peer-group is defined
+then an error will keep you from committing the configuration.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp listen limit \<number\>
+
+This command goes hand in hand with the listen range command to limit the
+amount of BGP neighbors that are allowed to connect to the local router.
+The limit range is 1 to 5000.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters ebgp-requires-policy
+
+This command changes the eBGP behavior of FRR. By default FRR enables
+`8212` functionality which affects how eBGP routes are advertised,
+namely no routes are advertised across eBGP sessions without some
+sort of egress route-map/policy in place. In VyOS however we have this
+RFC functionality disabled by default so that we can preserve backwards
+compatibility with older versions of VyOS. With this option one can
+enable `8212` functionality to operate.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters labeled-unicast \<explicit-null |
+ipv4-explicit-null | ipv6-explicit-null\>
+
+By default, locally advertised prefixes use the implicit-null label to
+encode in the outgoing NLRI.
+
+The following command uses the explicit-null label value for all the
+BGP instances.
+
+</div>
+
+##### Administrative Distance
+
+<div class="cfgcmd">
+
+set protocols bgp parameters distance global
+\<external[|internal|](##SUBST##|internal|)local\> \<distance\>
+
+This command change distance value of BGP. The arguments are the distance
+values for external routes, internal routes and local routes respectively.
+The distance range is 1 to 255.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters distance prefix \<subnet\>
+distance \<distance\>
+
+This command sets the administrative distance for a particular route. The
+distance range is 1 to 255.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+Routes with a distance of 255 are effectively disabled and not
+installed into the kernel.
+
+</div>
+
+</div>
+
+##### Timers
+
+<div class="cfgcmd">
+
+set protocols bgp timers holdtime \<seconds\>
+
+This command specifies hold-time in seconds. The timer range is
+4 to 65535. The default value is 180 second. If you set value to 0
+VyOS will not hold routes.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp timers keepalive \<seconds\>
+
+This command specifies keep-alive time in seconds. The timer
+can range from 4 to 65535. The default value is 60 second.
+
+</div>
+
+##### Route Dampening
+
+When a route fails, a routing update is sent to withdraw the route from the
+network's routing tables. When the route is re-enabled, the change in
+availability is also advertised. A route that continually fails and returns
+requires a great deal of network traffic to update the network about the
+route's status.
+
+Route dampening wich described in `2439` enables you to identify routes
+that repeatedly fail and return. If route dampening is enabled, an unstable
+route accumulates penalties each time the route fails and returns. If the
+accumulated penalties exceed a threshold, the route is no longer advertised.
+This is route suppression. Routes that have been suppressed are re-entered
+into the routing table only when the amount of their penalty falls below a
+threshold.
+
+A penalty of 1000 is assessed each time the route fails. When the penalties
+reach a predefined threshold (suppress-value), the router stops advertising
+the route.
+
+Once a route is assessed a penalty, the penalty is decreased by half each time
+a predefined amount of time elapses (half-life-time). When the accumulated
+penalties fall below a predefined threshold (reuse-value), the route is
+unsuppressed and added back into the BGP routing table.
+
+No route is suppressed indefinitely. Maximum-suppress-time defines the maximum
+time a route can be suppressed before it is re-advertised.
+
+<div class="cfgcmd">
+
+set protocols bgp parameters dampening
+half-life \<minutes\>
+
+This command defines the amount of time in minutes after
+which a penalty is reduced by half. The timer range is
+10 to 45 minutes.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters dampening
+re-use \<seconds\>
+
+This command defines the accumulated penalty amount at which the
+route is re-advertised. The penalty range is 1 to 20000.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters dampening
+start-suppress-time \<seconds\>
+
+This command defines the accumulated penalty amount at which the
+route is suppressed. The penalty range is 1 to 20000.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters dampening
+max-suppress-time \<seconds\>
+
+This command defines the maximum time in minutes that a route is
+suppressed. The timer range is 1 to 255 minutes.
+
+</div>
+
+#### Route Selection Configuration
+
+<div class="cfgcmd">
+
+set protocols bgp parameters always-compare-med
+
+This command provides to compare the MED on routes, even when they were
+received from different neighbouring ASes. Setting this option makes the
+order of preference of routes more defined, and should eliminate MED
+induced oscillations.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters bestpath as-path confed
+
+This command specifies that the length of confederation path sets and
+sequences should be taken into account during the BGP best path
+decision process.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters bestpath as-path multipath-relax
+
+This command specifies that BGP decision process should consider paths
+of equal AS_PATH length candidates for multipath computation. Without
+the knob, the entire AS_PATH must match for multipath computation.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters bestpath as-path ignore
+
+Ignore AS_PATH length when selecting a route
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters bestpath compare-routerid
+
+Ensure that when comparing routes where both are equal on most metrics,
+including local-pref, AS_PATH length, IGP cost, MED, that the tie is
+broken based on router-ID.
+
+If this option is enabled, then the already-selected check, where
+already selected eBGP routes are preferred, is skipped.
+
+If a route has an ORIGINATOR_ID attribute because it has been reflected,
+that ORIGINATOR_ID will be used. Otherwise, the router-ID of the peer
+the route was received from will be used.
+
+The advantage of this is that the route-selection (at this point) will
+be more deterministic. The disadvantage is that a few or even one lowest-ID
+router may attract all traffic to otherwise-equal paths because of this
+check. It may increase the possibility of MED or IGP oscillation, unless
+other measures were taken to avoid these. The exact behaviour will be
+sensitive to the iBGP and reflection topology.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters bestpath med confed
+
+This command specifies that BGP considers the MED when comparing routes
+originated from different sub-ASs within the confederation to which this
+BGP speaker belongs. The default state, where the MED attribute is not
+considered.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters bestpath med missing-as-worst
+
+This command specifies that a route with a MED is always considered to be
+better than a route without a MED by causing the missing MED attribute to
+have a value of infinity. The default state, where the missing MED
+attribute is considered to have a value of zero.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters default local-pref
+\<local-pref value\>
+
+This command specifies the default local preference value. The local
+preference range is 0 to 4294967295.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters deterministic-med
+
+This command provides to compare different MED values that advertised by
+neighbours in the same AS for routes selection. When this command is
+enabled, routes from the same autonomous system are grouped together, and
+the best entries of each group are compared.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp address-family ipv4-unicast network
+\<prefix\> backdoor
+
+This command allows the router to prefer route to specified prefix learned
+via IGP through backdoor link instead of a route to the same prefix learned
+via EBGP.
+
+</div>
+
+#### Route Filtering Configuration
+
+In order to control and modify routing information that is exchanged between
+peers you can use route-map, filter-list, prefix-list, distribute-list.
+
+For inbound updates the order of preference is:
+
+> - route-map
+> - filter-list
+> - prefix-list, distribute-list
+
+For outbound updates the order of preference is:
+
+> - prefix-list, distribute-list
+> - filter-list
+> - route-map
+>
+> <div class="note">
+>
+> <div class="title">
+>
+> Note
+>
+> </div>
+>
+> The attributes `prefix-list` and `distribute-list`
+> are mutually exclusive, and only one command (distribute-list or
+> prefix-list) can be applied to each inbound or outbound direction for a
+> particular neighbor.
+>
+> </div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> distribute-list \<export|import\> \<number\>
+
+This command applies the access list filters named in \<number\> to the
+specified BGP neighbor to restrict the routing information that BGP learns
+and/or advertises. The arguments `export` and `import`
+specify the direction in which the access list are applied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> prefix-list \<export|import\> \<name\>
+
+This command applies the prfefix list filters named in \<name\> to the
+specified BGP neighbor to restrict the routing information that BGP learns
+and/or advertises. The arguments `export` and `import`
+specify the direction in which the prefix list are applied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> route-map \<export|import\> \<name\>
+
+This command applies the route map named in \<name\> to the specified BGP
+neighbor to control and modify routing information that is exchanged
+between peers. The arguments `export` and `import`
+specify the direction in which the route map are applied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> filter-list \<export|import\> \<name\>
+
+This command applies the AS path access list filters named in \<name\> to the
+specified BGP neighbor to restrict the routing information that BGP learns
+and/or advertises. The arguments `export` and `import`
+specify the direction in which the AS path access list are applied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address[|interface\> address-family
+\<ipv4-unicast|](##SUBST##|interface> address-family
+<ipv4-unicast|)ipv6-unicast\> capability orf \<receive|send\>
+
+This command enables the ORF capability (described in `5291`) on the
+local router, and enables ORF capability advertisement to the specified BGP
+peer. The `receive` keyword configures a router to advertise ORF
+receive capabilities. The `send` keyword configures a router to
+advertise ORF send capabilities. To advertise a filter from a sender, you
+must create an IP prefix list for the specified BGP peer applied in inbound
+derection.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address|interface\> solo
+
+This command prevents from sending back prefixes learned from the neighbor.
+
+</div>
+
+#### BGP Scaling Configuration
+
+BGP routers connected inside the same AS through BGP belong to an internal BGP
+session, or IBGP. In order to prevent routing table loops, IBGP speaker does
+not advertise IBGP-learned routes to other IBGP speaker (Split Horizon
+mechanism). As such, IBGP requires a full mesh of all peers. For large
+networks, this quickly becomes unscalable.
+
+There are two ways that help us to mitigate the BGPs full-mesh requirement in
+a network:
+
+> - Using BGP route-reflectors
+> - Using BGP confederation
+
+##### Route Reflector Configuration
+
+Introducing route reflectors removes the need for the full-mesh. When you
+configure a route reflector you have to tell the router whether the other IBGP
+router is a client or non-client. A client is an IBGP router that the route
+reflector will “reflect” routes to, the non-client is just a regular IBGP
+neighbor. Route reflectors mechanism is described in `4456` and updated
+by `7606`.
+
+<div class="cfgcmd">
+
+set protocols bgp neighbor \<address\> address-family
+\<ipv4-unicast|ipv6-unicast\> route-reflector-client
+
+This command specifies the given neighbor as route reflector client.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters cluster-id \<id\>
+
+This command specifies cluster ID which identifies a collection of route
+reflectors and their clients, and is used by route reflectors to avoid
+looping. By default cluster ID is set to the BGP router id value, but can be
+set to an arbitrary 32-bit value.
+
+</div>
+
+##### Confederation Configuration
+
+A BGP confederation divides our AS into sub-ASes to reduce the number of
+required IBGP peerings. Within a sub-AS we still require full-mesh IBGP but
+between these sub-ASes we use something that looks like EBGP but behaves like
+IBGP (called confederation BGP). Confederation mechanism is described in
+`5065`
+
+<div class="cfgcmd">
+
+set protocols bgp parameters confederation identifier
+\<asn\>
+
+This command specifies a BGP confederation identifier. \<asn\> is the number
+of the autonomous system that internally includes multiple sub-autonomous
+systems (a confederation).
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols bgp parameters confederation peers \<nsubasn\>
+
+This command sets other confederations \<nsubasn\> as members of autonomous
+system specified by `confederation identifier <asn>`.
+
+</div>
+
+## Operational Mode Commands
+
+### Show
+
+<div class="opcmd">
+
+show bgp \<ip|ipv6\>
+
+This command displays all entries in BGP routing table.
+
+</div>
+
+``` none
+BGP table version is 10, local router ID is 10.0.35.3, vrf id 0
+Default local pref 100, local AS 65000
+Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
+               i internal, r RIB-failure, S Stale, R Removed
+Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
+Origin codes:  i - IGP, e - EGP, ? - incomplete
+
+   Network          Next Hop            Metric LocPrf Weight Path
+*> 198.51.100.0/24  10.0.34.4                0             0 65004 i
+*> 203.0.113.0/24   10.0.35.5                0             0 65005 i
+
+Displayed  2 routes and 2 total paths
+```
+
+<div class="opcmd">
+
+show bgp \<ip[|ipv6\> \<address|](##SUBST##|ipv6> <address|)prefix\>
+
+This command displays information about the particular entry in the BGP
+routing table.
+
+</div>
+
+``` none
+BGP routing table entry for 198.51.100.0/24
+Paths: (1 available, best #1, table default)
+  Advertised to non peer-group peers:
+  10.0.13.1 10.0.23.2 10.0.34.4 10.0.35.5
+  65004
+    10.0.34.4 from 10.0.34.4 (10.0.34.4)
+      Origin IGP, metric 0, valid, external, best (First path received)
+      Last update: Wed Jan  6 12:18:53 2021
+```
+
+<div class="opcmd">
+
+show bgp cidr-only
+
+This command displays routes with classless interdomain routing (CIDR).
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> community \<value\>
+
+This command displays routes that belong to specified BGP communities.
+Valid value is a community number in the range from 1 to 4294967200,
+or AA:NN (autonomous system-community number/2-byte number), no-export,
+local-as, or no-advertise.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> community-list \<name\>
+
+This command displays routes that are permitted by the BGP
+community list.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> dampening dampened-paths
+
+This command displays BGP dampened routes.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> dampening flap-statistics
+
+This command displays information about flapping BGP routes.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> filter-list \<name\>
+
+This command displays BGP routes allowed by the specified AS Path
+access list.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> neighbors \<address\> advertised-routes
+
+This command displays BGP routes advertised to a neighbor.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> neighbors \<address\> received-routes
+
+This command displays BGP routes originating from the specified BGP
+neighbor before inbound policy is applied. To use this command inbound
+soft reconfiguration must be enabled.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> neighbors \<address\> routes
+
+This command displays BGP received-routes that are accepted after filtering.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> neighbors \<address\> dampened-routes
+
+This command displays dampened routes received from BGP neighbor.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> regexp \<text\>
+
+This command displays information about BGP routes whose AS path
+matches the specified regular expression.
+
+</div>
+
+<div class="opcmd">
+
+show bgp \<ipv4|ipv6\> summary
+
+This command displays the status of all BGP connections.
+
+</div>
+
+``` none
+IPv4 Unicast Summary:
+BGP router identifier 10.0.35.3, local AS number 65000 vrf-id 0
+BGP table version 11
+RIB entries 5, using 920 bytes of memory
+Peers 4, using 82 KiB of memory
+
+Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd
+10.0.13.1       4      65000     148     159        0    0    0 02:16:01            0
+10.0.23.2       4      65000     136     143        0    0    0 02:13:21            0
+10.0.34.4       4      65004     161     163        0    0    0 02:16:01            1
+10.0.35.5       4      65005     162     166        0    0    0 02:16:01            1
+
+Total number of neighbors 4
+```
+
+### Reset
+
+<div class="opcmd">
+
+reset bgp \<ipv4[|ipv6\> \<address\> \[soft \[in|](##SUBST##|ipv6> <address> [soft [in|)out\]\]
+
+This command resets BGP connections to the specified neighbor IP address.
+With argument `soft` this command initiates a soft reset. If
+you do not specify the `in` or `out` options, both
+inbound and outbound soft reconfiguration are triggered.
+
+</div>
+
+<div class="opcmd">
+
+reset ip bgp all
+
+This command resets all BGP connections of given router.
+
+</div>
+
+<div class="opcmd">
+
+reset bgp \<ipv4|ipv6\> external
+
+This command resets all external BGP peers of given router.
+
+</div>
+
+<div class="opcmd">
+
+reset bgp \<ipv4[|ipv6\> peer-group \<name\> \[soft \[in|](##SUBST##|ipv6> peer-group <name> [soft [in|)out\]\]
+
+This command resets BGP connections to the specified peer group.
+With argument `soft` this command initiates a soft reset. If
+you do not specify the `in` or `out` options, both
+inbound and outbound soft reconfiguration are triggered.
+
+</div>
+
+## Examples
+
+### IPv4 peering
+
+A simple eBGP configuration:
+
+**Node 1:**
+
+``` none
+set protocols bgp system-as 65534
+set protocols bgp neighbor 192.168.0.2 ebgp-multihop '2'
+set protocols bgp neighbor 192.168.0.2 remote-as '65535'
+set protocols bgp neighbor 192.168.0.2 update-source '192.168.0.1'
+set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast
+set protocols bgp address-family ipv4-unicast network '172.16.0.0/16'
+set protocols bgp parameters router-id '192.168.0.1'
+```
+
+**Node 2:**
+
+``` none
+set protocols bgp system-as 65535
+set protocols bgp neighbor 192.168.0.1 ebgp-multihop '2'
+set protocols bgp neighbor 192.168.0.1 remote-as '65534'
+set protocols bgp neighbor 192.168.0.1 update-source '192.168.0.2'
+set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast
+set protocols bgp address-family ipv4-unicast network '172.17.0.0/16'
+set protocols bgp parameters router-id '192.168.0.2'
+```
+
+Don't forget, the CIDR declared in the network statement MUST **exist in your
+routing table (dynamic or static), the best way to make sure that is true is
+creating a static route:**
+
+**Node 1:**
+
+``` none
+set protocols static route 172.16.0.0/16 blackhole distance '254'
+```
+
+**Node 2:**
+
+``` none
+set protocols static route 172.17.0.0/16 blackhole distance '254'
+```
+
+### IPv6 peering
+
+A simple BGP configuration via IPv6.
+
+**Node 1:**
+
+``` none
+set protocols bgp system-as 65534
+set protocols bgp neighbor 2001:db8::2 ebgp-multihop '2'
+set protocols bgp neighbor 2001:db8::2 remote-as '65535'
+set protocols bgp neighbor 2001:db8::2 update-source '2001:db8::1'
+set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast
+set protocols bgp address-family ipv6-unicast network '2001:db8:1::/48'
+set protocols bgp parameters router-id '10.1.1.1'
+```
+
+**Node 2:**
+
+``` none
+set protocols bgp system-as 65535
+set protocols bgp neighbor 2001:db8::1 ebgp-multihop '2'
+set protocols bgp neighbor 2001:db8::1 remote-as '65534'
+set protocols bgp neighbor 2001:db8::1 update-source '2001:db8::2'
+set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
+set protocols bgp address-family ipv6-unicast network '2001:db8:2::/48'
+set protocols bgp parameters router-id '10.1.1.2'
+```
+
+Don't forget, the CIDR declared in the network statement **MUST exist in your
+routing table (dynamic or static), the best way to make sure that is true is
+creating a static route:**
+
+**Node 1:**
+
+``` none
+set protocols static route6 2001:db8:1::/48 blackhole distance '254'
+```
+
+**Node 2:**
+
+``` none
+set protocols static route6 2001:db8:2::/48 blackhole distance '254'
+```
+
+### Route Filtering
+
+Route filter can be applied using a route-map:
+
+**Node1:**
+
+``` none
+set policy prefix-list AS65535-IN rule 10 action 'permit'
+set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16'
+set policy prefix-list AS65535-OUT rule 10 action 'deny'
+set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16'
+set policy prefix-list6 AS65535-IN rule 10 action 'permit'
+set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48'
+set policy prefix-list6 AS65535-OUT rule 10 action 'deny'
+set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48'
+
+set policy route-map AS65535-IN rule 10 action 'permit'
+set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN'
+set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN'
+set policy route-map AS65535-IN rule 20 action 'deny'
+set policy route-map AS65535-OUT rule 10 action 'deny'
+set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT'
+set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT'
+set policy route-map AS65535-OUT rule 20 action 'permit'
+
+set protocols bgp system-as 65534
+set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map export 'AS65535-OUT'
+set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map import 'AS65535-IN'
+set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map export 'AS65535-OUT'
+set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map import 'AS65535-IN'
+```
+
+**Node2:**
+
+``` none
+set policy prefix-list AS65534-IN rule 10 action 'permit'
+set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16'
+set policy prefix-list AS65534-OUT rule 10 action 'deny'
+set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16'
+set policy prefix-list6 AS65534-IN rule 10 action 'permit'
+set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48'
+set policy prefix-list6 AS65534-OUT rule 10 action 'deny'
+set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48'
+
+set policy route-map AS65534-IN rule 10 action 'permit'
+set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN'
+set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN'
+set policy route-map AS65534-IN rule 20 action 'deny'
+set policy route-map AS65534-OUT rule 10 action 'deny'
+set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT'
+set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT'
+set policy route-map AS65534-OUT rule 20 action 'permit'
+
+set protocols bgp system-as 65535
+set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map export 'AS65534-OUT'
+set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map import 'AS65534-IN'
+set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map export 'AS65534-OUT'
+set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map import 'AS65534-IN'
+```
+
+We could expand on this and also deny link local and multicast in the rule 20
+action deny.
diff --git a/docs/configuration/protocols/md-failover.md b/docs/configuration/protocols/md-failover.md
new file mode 100644
index 00000000..06ce402d
--- /dev/null
+++ b/docs/configuration/protocols/md-failover.md
@@ -0,0 +1,131 @@
+# Failover
+
+Failover routes are manually configured routes, but they only install
+to the routing table if the health-check target is alive.
+If the target is not alive the route is removed from the routing table
+until the target becomes available.
+
+## Failover Routes
+
+<div class="cfgcmd">
+
+set protocols failover route \<subnet\> next-hop \<address\> check
+target \<target-address\>
+
+Configure next-hop <span class="title-ref">\<address\></span> and <span class="title-ref">\<target-address\></span> for an IPv4 static
+route. Specify the target
+IPv4 address for health checking.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols failover route \<subnet\> next-hop \<address\> check
+timeout \<timeout\>
+
+Timeout in seconds between health target checks.
+
+Range is 1 to 300, default is 10.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols failover route \<subnet\> next-hop \<address\> check
+type \<protocol\>
+
+Defines protocols for checking ARP, ICMP, TCP
+
+Default is `icmp`.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols failover route \<subnet\> next-hop \<address\> check
+policy \<policy\>
+
+Policy for checking targets
+
+</div>
+
+- `all-available` all checking target addresses must be available to pass
+  this check
+
+- `any-available` any of the checking target addresses must be available
+  to pass this check
+
+  > Default is `any-available`.
+
+<div class="cfgcmd">
+
+set protocols failover route \<subnet\> next-hop \<address\>
+interface \<interface\>
+
+Next-hop interface for the route
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols failover route \<subnet\> next-hop \<address\>
+metric \<metric\>
+
+Route metric
+
+Default 1.
+
+</div>
+
+## Example
+
+**One gateway:**
+
+``` none
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1'
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5'
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp'
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0'
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10'
+```
+
+Show the route
+
+``` none
+vyos@vyos:~$ show ip route 203.0.113.1
+  Routing entry for 203.0.113.1/32
+  Known via "kernel", distance 0, metric 10, best
+  Last update 00:00:39 ago
+  * 192.0.2.1, via eth0
+```
+
+**Two gateways and different metrics:**
+
+``` none
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1'
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5'
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp'
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0'
+set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10'
+
+set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check target '198.51.100.99'
+set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check timeout '5'
+set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check type 'icmp'
+set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 interface 'eth2'
+set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 metric '20'
+```
+
+Show the route
+
+``` none
+vyos@vyos:~$ show ip route 203.0.113.1
+Routing entry for 203.0.113.1/32
+  Known via "kernel", distance 0, metric 10, best
+  Last update 00:08:06 ago
+  * 192.0.2.1, via eth0
+
+Routing entry for 203.0.113.1/32
+  Known via "kernel", distance 0, metric 20
+  Last update 00:08:14 ago
+  * 198.51.100.1, via eth2
+```
diff --git a/docs/configuration/protocols/md-igmp-proxy.md b/docs/configuration/protocols/md-igmp-proxy.md
new file mode 100644
index 00000000..f35f1747
--- /dev/null
+++ b/docs/configuration/protocols/md-igmp-proxy.md
@@ -0,0 +1,88 @@
+lastproofread  
+2023-11-13
+
+# IGMP Proxy
+
+`IGMP (Internet Group Management Protocol)` proxy sends IGMP host messages
+on behalf of a connected client. The configuration must define one, and only one
+upstream interface, and one or more downstream interfaces.
+
+## Configuration
+
+<div class="cfgcmd">
+
+set protocols igmp-proxy interface \<interface\> role
+\<upstream | downstream\>
+
+- **upstream:** The upstream network interface is the outgoing interface
+  which is responsible for communicating to available multicast data sources.
+  There can only be one upstream interface.
+- **downstream:** Downstream network interfaces are the distribution
+  interfaces to the destination networks, where multicast clients can join
+  groups and receive multicast data. One or more downstream interfaces must
+  be configured.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols igmp-proxy interface \<interface\> alt-subnet \<network\>
+
+Defines alternate sources for multicasting and IGMP data. The network address
+must be on the following format 'a.b.c.d/n'. By default, the router will
+accept data from sources on the same network as configured on an interface.
+If the multicast source lies on a remote network, one must define from where
+traffic should be accepted.
+
+This is especially useful for the upstream interface, since the source for
+multicast traffic is often from a remote location.
+
+This option can be supplied multiple times.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols igmp-proxy disable-quickleave
+
+Disables quickleave mode. In this mode the daemon will not send a Leave IGMP
+message upstream as soon as it receives a Leave message for any downstream
+interface. The daemon will not ask for Membership reports on the downstream
+interfaces, and if a report is received the group is not joined again the
+upstream.
+
+If it's vital that the daemon should act exactly like a real multicast client
+on the upstream interface, this function should be enabled.
+
+Enabling this function increases the risk of bandwidth saturation.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols igmp-proxy disable
+
+Disable this service.
+
+</div>
+
+### Example
+
+Interface <span class="title-ref">eth1</span> LAN is behind NAT. In order to subscribe <span class="title-ref">10.0.0.0/23</span> subnet
+multicast which is in <span class="title-ref">eth0</span> WAN we need to configure igmp-proxy.
+
+``` none
+set protocols igmp-proxy interface eth0 role upstream
+set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23
+set protocols igmp-proxy interface eth1 role downstream
+```
+
+## Operation
+
+<div class="opcmd">
+
+restart igmp-proxy
+
+Restart the IGMP proxy process.
+
+</div>
diff --git a/docs/configuration/protocols/md-index.md b/docs/configuration/protocols/md-index.md
new file mode 100644
index 00000000..60e20bc9
--- /dev/null
+++ b/docs/configuration/protocols/md-index.md
@@ -0,0 +1,20 @@
+# Protocols
+
+<div class="toctree" maxdepth="1" includehidden="">
+
+babel
+bfd
+bgp
+failover
+igmp-proxy
+isis
+mpls
+segment-routing
+ospf
+pim
+pim6
+rip
+rpki
+static
+
+</div>
diff --git a/docs/configuration/protocols/md-isis.md b/docs/configuration/protocols/md-isis.md
new file mode 100644
index 00000000..8081860a
--- /dev/null
+++ b/docs/configuration/protocols/md-isis.md
@@ -0,0 +1,662 @@
+# IS-IS
+
+`IS-IS (Intermediate System to Intermediate System)` is a link-state
+interior gateway protocol (IGP) which is described in ISO10589,
+`1195`, `5308`. IS-IS runs the Dijkstra shortest-path first (SPF)
+algorithm to create a database of the network’s topology, and
+from that database to determine the best (that is, lowest cost) path to a
+destination. The intermediate systems (the name for routers) exchange topology
+information with their directly conencted neighbors. IS-IS runs directly on
+the data link layer (Layer 2). IS-IS addresses are called
+`NETs (Network Entity Titles)` and can be 8 to 20 bytes long, but are
+generally 10 bytes long. The tree database that is created with IS-IS is
+similar to the one that is created with OSPF in that the paths chosen should
+be similar. Comparisons to OSPF are inevitable and often are reasonable ones
+to make in regards to the way a network will respond with either IGP.
+
+## General
+
+### Configuration
+
+#### Mandatory Settings
+
+For IS-IS top operate correctly, one must do the equivalent of a Router ID in
+CLNS. This Router ID is called the `NET (Network Entity Title)`. This
+must be unique for each and every router that is operating in IS-IS. It also
+must not be duplicated otherwise the same issues that occur within OSPF will
+occur within IS-IS when it comes to said duplication.
+
+<div class="cfgcmd">
+
+set protocols isis net \<network-entity-title\>
+
+This commad sets network entity title (NET) provided in ISO format.
+
+Here is an example `NET (Network Entity Title)` value:
+
+``` none
+49.0001.1921.6800.1002.00
+```
+
+The CLNS address consists of the following parts:
+
+- `AFI (Address family authority identifier)` - `49` The AFI value
+  49 is what IS-IS uses for private addressing.
+- Area identifier: `0001` IS-IS area number (numberical area `1`)
+- System identifier: `1921.6800.1002` - for system idetifiers we recommend
+  to use IP address or MAC address of the router itself. The way to construct
+  this is to keep all of the zeroes of the router IP address, and then change
+  the periods from being every three numbers to every four numbers. The
+  address that is listed here is `192.168.1.2`, which if expanded will turn
+  into `192.168.001.002`. Then all one has to do is move the dots to have
+  four numbers instead of three. This gives us `1921.6800.1002`.
+- `NET (Network Entity Title)` selector: `00` Must always be 00. This
+  setting indicates "this system" or "local system."
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\>
+
+This command enables IS-IS on this interface, and allows for
+adjacency to occur. Note that the name of IS-IS instance must be
+the same as the one used to configure the IS-IS process.
+
+</div>
+
+#### IS-IS Global Configuration
+
+<div class="cfgcmd">
+
+set protocols isis dynamic-hostname
+
+This command enables support for dynamic hostname TLV. Dynamic hostname
+mapping determined as described in `2763`, Dynamic Hostname
+Exchange Mechanism for IS-IS.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis level \<level-1[|level-1-2|](##SUBST##|level-1-2|)level-2\>
+
+This command defines the IS-IS router behavior:
+
+- **level-1** - Act as a station (Level 1) router only.
+- **level-1-2** - Act as a station (Level 1) router and area (Level 2) router.
+- **level-2-only** - Act as an area (Level 2) router only.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis lsp-mtu \<size\>
+
+This command configures the maximum size of generated
+`LSPs (Link State PDUs)`, in bytes. The size range is 128 to 4352.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis metric-style \<narrow[|transition|](##SUBST##|transition|)wide\>
+
+This command sets old-style (ISO 10589) or new style packet formats:
+
+- **narrow** - Use old style of TLVs with narrow metric.
+- **transition** - Send and accept both styles of TLVs during transition.
+- **wide** - Use new style of TLVs to carry wider metric.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis purge-originator
+
+This command enables `6232` purge originator identification. Enable
+purge originator identification (POI) by adding the type, length and value
+(TLV) with the Intermediate System (IS) identification to the LSPs that do
+not contain POI information. If an IS generates a purge, VyOS adds this TLV
+with the system ID of the IS to the purge.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis set-attached-bit
+
+This command sets ATT bit to 1 in Level1 LSPs. It is described in `3787`.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis set-overload-bit
+
+This command sets overload bit to avoid any transit traffic through this
+router. It is described in `3787`.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis name default-information originate \<ipv4|ipv6\>
+level-1
+
+This command will generate a default-route in L1 database.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis name default-information originate \<ipv4|ipv6\>
+level-2
+
+This command will generate a default-route in L2 database.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis ldp-sync
+
+This command will enable IGP-LDP synchronization globally for ISIS. This
+requires for LDP to be functional. This is described in `5443`. By
+default all interfaces operational in IS-IS are enabled for synchronization.
+Loopbacks are exempt.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis ldp-sync holddown \<seconds\>
+
+This command will change the hold down value globally for IGP-LDP
+synchronization during convergence/interface flap events.
+
+</div>
+
+#### Interface Configuration
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> circuit-type
+\<level-1[|level-1-2|](##SUBST##|level-1-2|)level-2-only\>
+
+This command specifies circuit type for interface:
+
+- **level-1** - Level-1 only adjacencies are formed.
+- **level-1-2** - Level-1-2 adjacencies are formed
+- **level-2-only** - Level-2 only adjacencies are formed
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> hello-interval
+\<seconds\>
+
+This command sets hello interval in seconds on a given interface.
+The range is 1 to 600.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> hello-multiplier
+\<seconds\>
+
+This command sets multiplier for hello holding time on a given
+interface. The range is 2 to 100.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> hello-padding
+
+This command configures padding on hello packets to accommodate asymmetrical
+maximum transfer units (MTUs) from different hosts as described in
+`3719`. This helps to prevent a premature adjacency Up state when one
+routing devices MTU does not meet the requirements to establish the adjacency.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> metric \<metric\>
+
+This command set default metric for circuit.
+
+The metric range is 1 to 16777215 (Max value depend if metric support narrow
+or wide value).
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> network
+point-to-point
+
+This command specifies network type to Point-to-Point. The default
+network type is broadcast.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> passive
+
+This command configures the passive mode for this interface.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> password
+plaintext-password \<text\>
+
+This command configures the authentication password for the interface.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> priority \<number\>
+
+This command sets priority for the interface for
+`DIS (Designated Intermediate System)` election. The priority
+range is 0 to 127.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> psnp-interval
+\<number\>
+
+This command sets PSNP interval in seconds. The interval range is 0
+to 127.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\>
+no-three-way-handshake
+
+This command disables Three-Way Handshake for P2P adjacencies which
+described in `5303`. Three-Way Handshake is enabled by default.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> ldp-sync disable
+
+This command disables IGP-LDP sync for this specific interface.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis interface \<interface\> ldp-sync holddown
+\<seconds\>
+
+This command will change the hold down value for IGP-LDP synchronization
+during convergence/interface flap events, but for this interface only.
+
+</div>
+
+#### Route Redistribution
+
+<div class="cfgcmd">
+
+set protocols isis redistribute ipv4 \<route source\> level-1
+
+This command redistributes routing information from the given route source
+into the ISIS database as Level-1. There are six modes available for route
+source: bgp, connected, kernel, ospf, rip, static.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis redistribute ipv4 \<route source\> level-2
+
+This command redistributes routing information from the given route source
+into the ISIS database as Level-2. There are six modes available for route
+source: bgp, connected, kernel, ospf, rip, static.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis redistribute ipv4 \<route source\>
+\<level-1|level-2\> metric \<number\>
+
+This command specifies metric for redistributed routes from the given route
+source. There are six modes available for route source: bgp, connected,
+kernel, ospf, rip, static. The metric range is 1 to 16777215.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis redistribute ipv4 \<route source\>
+\<level-1|level-2\> route-map \<name\>
+
+This command allows to use route map to filter redistributed routes from
+the given route source. There are six modes available for route source:
+bgp, connected, kernel, ospf, rip, static.
+
+</div>
+
+#### Timers
+
+<div class="cfgcmd">
+
+set protocols isis lsp-gen-interval \<seconds\>
+
+This command sets minimum interval in seconds between regenerating same
+LSP. The interval range is 1 to 120.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis lsp-refresh-interval \<seconds\>
+
+This command sets LSP refresh interval in seconds. IS-IS generates LSPs
+when the state of a link changes. However, to ensure that routing
+databases on all routers remain converged, LSPs in stable networks are
+generated on a regular basis even though there has been no change to
+the state of the links. The interval range is 1 to 65235. The default
+value is 900 seconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis max-lsp-lifetime \<seconds\>
+
+This command sets LSP maximum LSP lifetime in seconds. The interval range
+is 350 to 65535. LSPs remain in a database for 1200 seconds by default.
+If they are not refreshed by that time, they are deleted. You can change
+the LSP refresh interval or the LSP lifetime. The LSP refresh interval
+should be less than the LSP lifetime or else LSPs will time out before
+they are refreshed.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis spf-interval \<seconds\>
+
+This command sets minimum interval between consecutive SPF calculations in
+seconds.The interval range is 1 to 120.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis spf-delay-ietf holddown \<milliseconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis spf-delay-ietf init-delay
+\<milliseconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis spf-delay-ietf long-delay
+\<milliseconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis spf-delay-ietf short-delay
+\<milliseconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis spf-delay-ietf time-to-learn
+\<milliseconds\>
+
+This commands specifies the Finite State Machine (FSM) intended to
+control the timing of the execution of SPF calculations in response
+to IGP events. The process described in `8405`.
+
+</div>
+
+## Examples
+
+### Enable IS-IS
+
+**Node 1:**
+
+``` none
+set interfaces loopback lo address '192.168.255.255/32'
+set interfaces ethernet eth1 address '192.0.2.1/24'
+
+set protocols isis interface eth1
+set protocols isis interface lo
+set protocols isis net '49.0001.1921.6825.5255.00'
+```
+
+**Node 2:**
+
+``` none
+set interfaces ethernet eth1 address '192.0.2.2/24'
+
+set interfaces loopback lo address '192.168.255.254/32'
+set interfaces ethernet eth1 address '192.0.2.2/24'
+
+set protocols isis interface eth1
+set protocols isis interface lo
+set protocols isis net '49.0001.1921.6825.5254.00'
+```
+
+This gives us the following neighborships, Level 1 and Level 2:
+
+``` none
+Node-1@vyos:~$ show isis neighbor
+Area VyOS:
+  System Id           Interface   L  State        Holdtime SNPA
+ vyos                eth1        1  Up            28       0c87.6c09.0001
+ vyos                eth1        2  Up            28       0c87.6c09.0001
+
+Node-2@vyos:~$ show isis neighbor
+Area VyOS:
+  System Id           Interface   L  State        Holdtime SNPA
+ vyos                eth1        1  Up            29       0c33.0280.0001
+ vyos                eth1        2  Up            28       0c33.0280.0001
+```
+
+Here's the IP routes that are populated. Just the loopback:
+
+``` none
+Node-1@vyos:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+I   192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:02:22
+I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, weight 1, 00:02:22
+
+Node-2@vyos:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+I   192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:02:21
+I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, weight 1, 00:02:21
+```
+
+### Enable IS-IS and redistribute routes not natively in IS-IS
+
+**Node 1:**
+
+``` none
+set interfaces dummy dum0 address '203.0.113.1/24'
+set interfaces ethernet eth1 address '192.0.2.1/24'
+
+set policy prefix-list EXPORT-ISIS rule 10 action 'permit'
+set policy prefix-list EXPORT-ISIS rule 10 prefix '203.0.113.0/24'
+set policy route-map EXPORT-ISIS rule 10 action 'permit'
+set policy route-map EXPORT-ISIS rule 10 match ip address prefix-list 'EXPORT-ISIS'
+
+set protocols isis interface eth1
+set protocols isis net '49.0001.1921.6800.1002.00'
+set protocols isis redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS'
+```
+
+**Node 2:**
+
+``` none
+set interfaces ethernet eth1 address '192.0.2.2/24'
+
+set protocols isis interface eth1
+set protocols isis net '49.0001.1921.6800.2002.00'
+```
+
+Routes on Node 2:
+
+``` none
+Node-2@r2:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+       F - PBR, f - OpenFabric,
+       > - selected route, * - FIB route, q - queued route, r - rejected route
+
+I   203.0.113.0/24 [115/10] via 192.0.2.1, eth1, 00:03:42
+```
+
+### Enable IS-IS and IGP-LDP synchronization
+
+**Node 1:**
+
+``` none
+set interfaces loopback lo address 192.168.255.255/32
+set interfaces ethernet eth0 address 192.0.2.1/24
+
+set protocols isis interface eth0
+set protocols isis interface lo passive
+set protocols isis ldp-sync
+set protocols isis net 49.0001.1921.6825.5255.00
+
+set protocols mpls interface eth0
+set protocols mpls ldp discovery transport-ipv4-address 192.168.255.255
+set protocols mpls ldp interface lo
+set protocols mpls ldp interface eth0
+set protocols mpls ldp parameters transport-prefer-ipv4
+set protocols mpls ldp router-id 192.168.255.255
+```
+
+This gives us IGP-LDP synchronization for all non-loopback interfaces with
+a holddown timer of zero seconds:
+
+``` none
+Node-1@vyos:~$  show isis mpls ldp-sync
+eth0
+  LDP-IGP Synchronization enabled: yes
+  holddown timer in seconds: 0
+  State: Sync achieved
+```
+
+### Enable IS-IS with Segment Routing (Experimental)
+
+**Node 1:**
+
+``` none
+set interfaces loopback lo address '192.168.255.255/32'
+set interfaces ethernet eth1 address '192.0.2.1/24'
+
+set protocols isis interface eth1
+set protocols isis interface lo
+set protocols isis net '49.0001.1921.6825.5255.00'
+set protocols isis segment-routing global-block high-label-value '599'
+set protocols isis segment-routing global-block low-label-value '550'
+set protocols isis segment-routing prefix 192.168.255.255/32 index value '1'
+set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null
+set protocols mpls interface 'eth1'
+```
+
+**Node 2:**
+
+``` none
+set interfaces loopback lo address '192.168.255.254/32'
+set interfaces ethernet eth1 address '192.0.2.2/24'
+
+set protocols isis interface eth1
+set protocols isis interface lo
+set protocols isis net '49.0001.1921.6825.5254.00'
+set protocols isis segment-routing global-block high-label-value '599'
+set protocols isis segment-routing global-block low-label-value '550'
+set protocols isis segment-routing prefix 192.168.255.254/32 index value '2'
+set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null
+set protocols mpls interface 'eth1'
+```
+
+This gives us MPLS segment routing enabled and labels for far end loopbacks:
+
+``` none
+Node-1@vyos:~$ show mpls table
+ Inbound Label  Type        Nexthop                Outbound Label
+ ----------------------------------------------------------------------
+ 552            SR (IS-IS)  192.0.2.2              IPv4 Explicit Null <-- Node-2 loopback learned on Node-1
+ 15000          SR (IS-IS)  192.0.2.2              implicit-null
+ 15001          SR (IS-IS)  fe80::e87:6cff:fe09:1  implicit-null
+ 15002          SR (IS-IS)  192.0.2.2              implicit-null
+ 15003          SR (IS-IS)  fe80::e87:6cff:fe09:1  implicit-null
+
+Node-2@vyos:~$ show mpls table
+ Inbound Label  Type        Nexthop               Outbound Label
+ ---------------------------------------------------------------------
+ 551            SR (IS-IS)  192.0.2.1             IPv4 Explicit Null <-- Node-1 loopback learned on Node-2
+ 15000          SR (IS-IS)  192.0.2.1             implicit-null
+ 15001          SR (IS-IS)  fe80::e33:2ff:fe80:1  implicit-null
+ 15002          SR (IS-IS)  192.0.2.1             implicit-null
+ 15003          SR (IS-IS)  fe80::e33:2ff:fe80:1  implicit-null
+```
+
+Here is the routing tables showing the MPLS segment routing label operations:
+
+``` none
+Node-1@vyos:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+I   192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48
+I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39
+
+Node-2@vyos:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+I   192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46
+I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43
+```
diff --git a/docs/configuration/protocols/md-mpls.md b/docs/configuration/protocols/md-mpls.md
new file mode 100644
index 00000000..8b729d8c
--- /dev/null
+++ b/docs/configuration/protocols/md-mpls.md
@@ -0,0 +1,419 @@
+# MPLS
+
+`MPLS (Multi-Protocol Label Switching)` is a packet forwarding paradigm
+which differs from regular IP forwarding. Instead of IP addresses being used to
+make the decision on finding the exit interface, a router will instead use an
+exact match on a 32 bit/4 byte header called the MPLS label. This label is
+inserted between the ethernet (layer 2) header and the IP (layer 3) header.
+One can statically or dynamically assign label allocations, but we will focus
+on dynamic allocation of labels using some sort of label distribution protocol
+(such as the aptly named Label Distribution Protocol / LDP, Resource Reservation
+Protocol / RSVP, or Segment Routing through OSPF/ISIS). These protocols allow
+for the creation of a unidirectional/unicast path called a labeled switched
+path (initialized as LSP) throughout the network that operates very much like
+a tunnel through the network. An easy way of thinking about how an MPLS LSP
+actually forwards traffic throughout a network is to think of a GRE tunnel.
+They are not the same in how they operate, but they are the same in how they
+handle the tunneled packet. It would be good to think of MPLS as a tunneling
+technology that can be used to transport many different types of packets, to
+aid in traffic engineering by allowing one to specify paths throughout the
+network (using RSVP or SR), and to generally allow for easier intra/inter
+network transport of data packets.
+
+For more information on how MPLS label switching works, please go visit
+[Wikipedia (MPLS)](https://en.wikipedia.org/wiki/Multiprotocol_Label_Switching).
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+MPLS support in VyOS is not finished yet, and therefore its
+functionality is limited. Currently there is no support for MPLS enabled VPN
+services such as L2VPNs and mVPNs. RSVP support is also not present as the
+underlying routing stack (FRR) does not implement it. Currently VyOS
+implements LDP as described in RFC 5036; other LDP standard are the
+following ones: RFC 6720, RFC 6667, RFC 5919, RFC 5561, RFC 7552, RFC 4447.
+Because MPLS is already available (FRR also supports RFC 3031).
+
+</div>
+
+## Label Distribution Protocol
+
+The `MPLS (Multi-Protocol Label Switching)` architecture does not assume
+a single protocol to create MPLS paths. VyOS supports the Label Distribution
+Protocol (LDP) as implemented by FRR, based on `5036`.
+
+`LDP (Label Distribution Protocol)` is a TCP based MPLS signaling protocol
+that distributes labels creating MPLS label switched paths in a dynamic manner.
+LDP is not a routing protocol, as it relies on other routing protocols for
+forwarding decisions. LDP cannot bootstrap itself, and therefore relies on said
+routing protocols for communication with other routers that use LDP.
+
+In order to allow for LDP on the local router to exchange label advertisements
+with other routers, a TCP session will be established between automatically
+discovered and statically assigned routers. LDP will try to establish a TCP
+session to the **transport address** of other routers. Therefore for LDP to
+function properly please make sure the transport address is shown in the
+routing table and reachable to traffic at all times.
+
+It is highly recommended to use the same address for both the LDP router-id and
+the discovery transport address, but for VyOS MPLS LDP to work both parameters
+must be explicitly set in the configuration.
+
+Another thing to keep in mind with LDP is that much like BGP, it is a protocol
+that runs on top of TCP. It however does not have an ability to do something
+like a refresh capability like BGPs route refresh capability. Therefore one
+might have to reset the neighbor for a capability change or a configuration
+change to work.
+
+## Configuration Options
+
+<div class="cfgcmd">
+
+set protocols mpls interface \<interface\>
+
+Use this command to enable MPLS processing on the interface you define.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp interface \<interface\>
+
+Use this command to enable LDP on the interface you define.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp router-id \<address\>
+
+Use this command to configure the IP address used as the LDP router-id of the
+local device.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp discovery transport-ipv4-address \<address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp discovery transport-ipv6-address \<address\>
+
+Use this command to set the IPv4 or IPv6 transport-address used by LDP.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp neighbor \<address\> password \<password\>
+
+Use this command to configure authentication for LDP peers. Set the
+IP address of the LDP peer and a password that should be shared in
+order to become neighbors.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp neighbor \<address\> session-holdtime \<seconds\>
+
+Use this command to configure a specific session hold time for LDP peers.
+Set the IP address of the LDP peer and a session hold time that should be
+configured for it. You may have to reset the neighbor for this to work.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp neighbor \<address\> ttl-security
+\<disable | hop count\>
+
+Use this command to enable, disable, or specify hop count for TTL security
+for LDP peers. By default the value is set to 255 (or max TTL).
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp discovery hello-ipv4-interval \<seconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp discovery hello-ipv4-holdtime \<seconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp discovery hello-ipv6-interval \<seconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp discovery hello-ipv6-holdtime \<seconds\>
+
+Use these commands if you would like to set the discovery hello and hold time
+parameters.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp discovery session-ipv4-holdtime \<seconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp discovery session-ipv6-holdtime \<seconds\>
+
+Use this command if you would like to set the TCP session hold time intervals.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp import ipv4 import-filter filter-access-list
+\<access list number\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp import ipv6 import-filter filter-access-list6
+\<access list number\>
+
+Use these commands to control the importing of forwarding equivalence classes
+(FECs) for LDP from neighbors. This would be useful for example on only
+accepting the labeled routes that are needed and not ones that are not
+needed, such as accepting loopback interfaces and rejecting all others.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp export ipv4 export-filter filter-access-list
+\<access list number\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp export ipv6 export-filter filter-access-list6
+\<access list number\>
+
+Use these commands to control the exporting of forwarding equivalence classes
+(FECs) for LDP to neighbors. This would be useful for example on only
+announcing the labeled routes that are needed and not ones that are not
+needed, such as announcing loopback interfaces and no others.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp export ipv4 explicit-null
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp export ipv6 explicit-null
+
+Use this command if you would like for the router to advertise FECs with a
+label of 0 for explicit null operations.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp allocation ipv4 access-list
+\<access list number\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp allocation ipv6 access-list6
+\<access list number\>
+
+Use this command if you would like to control the local FEC allocations for
+LDP. A good example would be for your local router to not allocate a label for
+everything. Just a label for what it's useful. A good example would be just a
+loopback label.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp parameters cisco-interop-tlv
+
+Use this command to use a Cisco non-compliant format to send and interpret
+the Dual-Stack capability TLV for IPv6 LDP communications. This is related to
+`7552`.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp parameters ordered-control
+
+Use this command to use ordered label distribution control mode. FRR
+by default uses independent label distribution control mode for label
+distribution. This is related to `5036`.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp parameters transport-prefer-ipv4
+
+Use this command to prefer IPv4 for TCP peer transport connection for LDP
+when both an IPv4 and IPv6 LDP address are configured on the same interface.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp targeted-neighbor ipv4 enable
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp targeted-neighbor ipv6 enable
+
+Use this command to enable targeted LDP sessions to the local router. The
+router will then respond to any sessions that are trying to connect to it that
+are not a link local type of TCP connection.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp targeted-neighbor ipv4 address \<address\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp targeted-neighbor ipv6 address \<address\>
+
+Use this command to enable the local router to try and connect with a targeted
+LDP session to another router.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp targeted-neighbor ipv4 hello-holdtime
+\<seconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp targeted-neighbor ipv4 hello-interval
+\<seconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp targeted-neighbor ipv6 hello-holdtime
+\<seconds\>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols mpls ldp targeted-neighbor ipv6 hello-interval
+\<seconds\>
+
+Use these commands if you would like to set the discovery hello and hold time
+parameters for the targeted LDP neighbors.
+
+</div>
+
+### Sample configuration to setup LDP on VyOS
+
+``` none
+set protocols ospf area 0 network '192.168.255.252/32'                      <--- Routing for loopback
+set protocols ospf area 0 network '192.168.0.5/32'                          <--- Routing for an interface connecting to the network
+set protocols ospf parameters router-id '192.168.255.252'                   <--- Router ID setting for OSPF
+set protocols mpls interface 'eth1'                                         <--- Enable MPLS for an interface connecting to network
+set protocols mpls ldp discovery transport-ipv4-address '192.168.255.252'   <--- Transport address for LDP for TCP sessions to connect to
+set protocols mpls ldp interface 'eth1'                                     <--- Enable LDP for an interface connecting to network
+set protocols mpls ldp interface 'lo'                                       <--- Enable LDP on loopback for future services connectivity
+set protocols mpls ldp router-id '192.168.255.252'                          <--- Router ID setting for LDP
+set interfaces ethernet eth1 address '192.168.0.5/31'                       <--- Interface IP for connecting to network
+set interfaces loopback lo address '192.168.255.252/32'                     <--- Interface loopback IP for router ID and other uses
+```
+
+## Operational Mode Commands
+
+When LDP is working, you will be able to see label information in the outcome
+of `show ip route`. Besides that information, there are also specific *show*
+commands for LDP:
+
+### Show
+
+<div class="opcmd">
+
+show mpls ldp binding
+
+Use this command to see the Label Information Base.
+
+</div>
+
+<div class="opcmd">
+
+show mpls ldp discovery
+
+Use this command to see discovery hello information
+
+</div>
+
+<div class="opcmd">
+
+show mpls ldp interface
+
+Use this command to see LDP interface information
+
+</div>
+
+<div class="opcmd">
+
+show mpls ldp neighbor
+
+Use this command to see LDP neighbor information
+
+</div>
+
+<div class="opcmd">
+
+show mpls ldp neighbor detail
+
+Use this command to see detailed LDP neighbor information
+
+</div>
+
+### Reset
+
+<div class="opcmd">
+
+reset mpls ldp neighbor \<IPv4 or IPv6 address\>
+
+Use this command to reset an LDP neighbor/TCP session that is established
+
+</div>
diff --git a/docs/configuration/protocols/md-ospf.md b/docs/configuration/protocols/md-ospf.md
new file mode 100644
index 00000000..a70bd840
--- /dev/null
+++ b/docs/configuration/protocols/md-ospf.md
@@ -0,0 +1,1772 @@
+# OSPF
+
+`OSPF (Open Shortest Path First)` is a routing protocol for Internet
+Protocol (IP) networks. It uses a link state routing (LSR) algorithm and falls
+into the group of interior gateway protocols (IGPs), operating within a single
+autonomous system (AS). It is defined as OSPF Version 2 in `2328` (1998)
+for IPv4. Updates for IPv6 are specified as OSPF Version 3 in `5340`
+(2008). OSPF supports the `CIDR (Classless Inter-Domain Routing)`
+addressing model.
+
+OSPF is a widely used IGP in large enterprise networks.
+
+## OSPFv2 (IPv4)
+
+### Configuration
+
+#### General
+
+VyOS does not have a special command to start the OSPF process. The OSPF process
+starts when the first ospf enabled interface is configured.
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> network \<A.B.C.D/M\>
+
+This command specifies the OSPF enabled interface(s). If the interface has
+an address from defined range then the command enables OSPF on this
+interface so router can provide network information to the other ospf
+routers via this interface.
+
+This command is also used to enable the OSPF process. The area number can be
+specified in decimal notation in the range from 0 to 4294967295. Or it
+can be specified in dotted decimal notation similar to ip address.
+
+Prefix length in interface must be equal or bigger (i.e. smaller network)
+than prefix length in network statement. For example statement above doesn't
+enable ospf on interface with address 192.168.1.1/23, but it does on
+interface with address 192.168.1.129/25.
+
+In some cases it may be more convenient to enable OSPF on a per
+interface/subnet
+basis `set protocols ospf interface <interface> area <x.x.x.x | x>`
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf auto-cost reference-bandwidth \<number\>
+
+This command sets the reference bandwidth for cost calculations, where
+bandwidth can be in range from 1 to 4294967, specified in Mbits/s. The
+default is 100Mbit/s (i.e. a link of bandwidth 100Mbit/s or higher will
+have a cost of 1. Cost of lower bandwidth links will be scaled with
+reference to this cost).
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf parameters router-id \<rid\>
+
+This command sets the router-ID of the OSPF process. The router-ID may be an
+IP address of the router, but need not be – it can be any arbitrary 32bit
+number. However it MUST be unique within the entire OSPF domain to the OSPF
+speaker – bad things will happen if multiple OSPF speakers are configured
+with the same router-ID!
+
+</div>
+
+#### Optional
+
+<div class="cfgcmd">
+
+set protocols ospf default-information originate \[always\]
+\[metric \<number\>\] \[metric-type \<1|2\>\] \[route-map \<name\>\]
+
+Originate an AS-External (type-5) LSA describing a default route into all
+external-routing capable areas, of the specified metric and metric type.
+If the `always` keyword is given then the default is always
+advertised, even when there is no default present in the routing table.
+The argument `route-map` specifies to advertise the default route
+if the route map is satisfied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf distance global \<distance\>
+
+This command change distance value of OSPF globally.
+The distance range is 1 to 255.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf distance ospf \<external[|inter-area|](##SUBST##|inter-area|)intra-area\>
+\<distance\>
+
+This command change distance value of OSPF. The arguments are the distance
+values for external routes, inter-area routes and intra-area routes
+respectively. The distance range is 1 to 255.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+Routes with a distance of 255 are effectively disabled and not
+installed into the kernel.
+
+</div>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf log-adjacency-changes \[detail\]
+
+This command allows to log changes in adjacency. With the optional
+`detail` argument, all changes in adjacency status are shown.
+Without `detail`, only changes to full or regressions are shown.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf max-metric router-lsa
+\<administrative[|on-shutdown \<seconds\>|](##SUBST##|on-shutdown <seconds>|)on-startup \<seconds\>\>
+
+This enables `3137` support, where the OSPF process describes its
+transit links in its router-LSA as having infinite distance so that other
+routers will avoid calculating transit paths through the router while
+still being able to reach networks through the router.
+
+This support may be enabled administratively (and indefinitely) with the
+`administrative` command. It may also be enabled conditionally.
+Conditional enabling of max-metric router-lsas can be for a period of
+seconds after startup with the `on-startup <seconds>` command
+and/or for a period of seconds prior to shutdown with the
+`on-shutdown <seconds>` command. The time range is 5 to 86400.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf parameters abr-type
+\<cisco[|ibm|](##SUBST##|ibm|)shortcut|standard\>
+
+This command selects ABR model. OSPF router supports four ABR models:
+
+**cisco** – a router will be considered as ABR if it has several configured
+links to the networks in different areas one of which is a backbone area.
+Moreover, the link to the backbone area should be active (working).
+**ibm** – identical to "cisco" model but in this case a backbone area link
+may not be active.
+**standard** – router has several active links to different areas.
+**shortcut** – identical to "standard" but in this model a router is
+allowed to use a connected areas topology without involving a backbone
+area for inter-area connections.
+
+Detailed information about "cisco" and "ibm" models differences can be
+found in `3509`. A "shortcut" model allows ABR to create routes
+between areas based on the topology of the areas connected to this router
+but not using a backbone area in case if non-backbone route will be
+cheaper. For more information about "shortcut" model,
+see <span class="title-ref">ospf-shortcut-abr-02.txt</span>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf parameters rfc1583-compatibility
+
+`2328`, the successor to `1583`, suggests according to section
+G.2 (changes) in section 16.4.1 a change to the path preference algorithm
+that prevents possible routing loops that were possible in the old version
+of OSPFv2. More specifically it demands that inter-area paths and
+intra-area backbone path are now of equal preference but still both
+preferred to external paths.
+
+This command should NOT be set normally.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> passive \[disable\]
+
+This command specifies interface as passive. Passive interface advertises
+its address, but does not run the OSPF protocol (adjacencies are not formed
+and hello packets are not generated).
+
+The optional <span class="title-ref">disable</span> option allows to exclude interface from passive state.
+This command is used if the command `passive-interface default` was
+configured.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf passive-interface default
+
+This command specifies all interfaces as passive by default. Because this
+command changes the configuration logic to a default passive; therefore,
+interfaces where router adjacencies are expected need to be configured
+by setting the `passive disable` flag for the specific interface.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf maximum-paths \<1-64\>
+
+Use this command to control the maximum number of equal cost paths to reach
+a specific destination. The upper limit may differ if you change the value
+of MULTIPATH_NUM during compilation. The default is MULTIPATH_NUM (64).
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf refresh timers \<seconds\>
+
+The router automatically updates link-state information with its neighbors.
+Only an obsolete information is updated which age has exceeded a specific
+threshold. This parameter changes a threshold value, which by default is
+1800 seconds (half an hour). The value is applied to the whole OSPF router.
+The timer range is 10 to 1800.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf timers throttle spf
+\<delay[|initial-holdtime|](##SUBST##|initial-holdtime|)max-holdtime\> \<seconds\>
+
+This command sets the initial delay, the initial-holdtime and the
+maximum-holdtime between when SPF is calculated and the event which
+triggered the calculation. The times are specified in milliseconds and must
+be in the range of 0 to 600000 milliseconds. `delay` sets the
+initial SPF schedule delay in milliseconds. The default value is 200 ms.
+`initial-holdtime` sets the minimum hold time between two
+consecutive SPF calculations. The default value is 1000 ms.
+`max-holdtime` sets the maximum wait time between two
+consecutive SPF calculations. The default value is 10000 ms.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf ldp-sync
+
+This command will enable IGP-LDP synchronization globally for OSPF. This
+requires for LDP to be functional. This is described in `5443`. By
+default all interfaces operational in OSPF are enabled for synchronization.
+Loopbacks are exempt.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf ldp-sync holddown \<seconds\>
+
+This command will change the hold down value globally for IGP-LDP
+synchronization during convergence/interface flap events.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf capability opaque
+
+ospfd supports Opaque LSA `2370` as partial support for MPLS Traffic
+Engineering LSAs. The opaque-lsa capability must be enabled in the
+configuration.
+
+An alternate command could be "mpls-te on" (Traffic Engineering)
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+FRR offers only partial support for some of the routing
+protocol extensions that are used with MPLS-TE; it does not
+support a complete RSVP-TE solution.
+
+</div>
+
+</div>
+
+#### Area Configuration
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> area-type stub
+
+This command specifies the area to be a Stub Area. That is, an area where
+no router originates routes external to OSPF and hence an area where all
+external routes are via the ABR(s). Hence, ABRs for such an area do not
+need to pass AS-External LSAs (type-5) or ASBR-Summary LSAs (type-4) into
+the area. They need only pass Network-Summary (type-3) LSAs into such an
+area, along with a default-route summary.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> area-type stub no-summary
+
+This command specifies the area to be a Totally Stub Area. In addition to
+stub area limitations this area type prevents an ABR from injecting
+Network-Summary (type-3) LSAs into the specified stub area. Only default
+summary route is allowed.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> area-type stub default-cost
+\<number\>
+
+This command sets the cost of default-summary LSAs announced to stubby
+areas. The cost range is 0 to 16777215.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> area-type nssa
+
+This command specifies the area to be a Not So Stubby Area. External
+routing information is imported into an NSSA in Type-7 LSAs. Type-7 LSAs
+are similar to Type-5 AS-external LSAs, except that they can only be
+flooded into the NSSA. In order to further propagate the NSSA external
+information, the Type-7 LSA must be translated to a Type-5 AS-external-LSA
+by the NSSA ABR.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> area-type nssa no-summary
+
+This command specifies the area to be a NSSA Totally Stub Area. ABRs for
+such an area do not need to pass Network-Summary (type-3) LSAs (except the
+default summary route), ASBR-Summary LSAs (type-4) and AS-External LSAs
+(type-5) into the area. But Type-7 LSAs that convert to Type-5 at the NSSA
+ABR are allowed.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> area-type nssa default-cost
+\<number\>
+
+This command sets the default cost of LSAs announced to NSSA areas.
+The cost range is 0 to 16777215.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> area-type nssa translate
+\<always[|candidate|](##SUBST##|candidate|)never\>
+
+Specifies whether this NSSA border router will unconditionally translate
+Type-7 LSAs into Type-5 LSAs. When role is Always, Type-7 LSAs are
+translated into Type-5 LSAs regardless of the translator state of other
+NSSA border routers. When role is Candidate, this router participates in
+the translator election to determine if it will perform the translations
+duties. When role is Never, this router will never translate Type-7 LSAs
+into Type-5 LSAs.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> authentication plaintext-password
+
+This command specifies that simple password authentication should be used
+for the given area. The password must also be configured on a per-interface
+basis.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> authentication md5
+
+This command specify that OSPF packets must be authenticated with MD5 HMACs
+within the given area. Keying material must also be configured on a
+per-interface basis.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> range \<A.B.C.D/M\> \[cost \<number\>\]
+
+This command summarizes intra area paths from specified area into one
+summary-LSA (Type-3) announced to other areas. This command can be used
+only in ABR and ONLY router-LSAs (Type-1) and network-LSAs (Type-2)
+(i.e. LSAs with scope area) can be summarized. AS-external-LSAs (Type-5)
+can’t be summarized - their scope is AS. The optional argument
+`cost` specifies the aggregated link metric. The metric range is 0
+to 16777215.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> range \<A.B.C.D/M\> not-advertise
+
+This command instead of summarizing intra area paths filter them - i.e.
+intra area paths from this range are not advertised into other areas.
+This command makes sense in ABR only.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> export-list \<acl_number\>
+
+Filter Type-3 summary-LSAs announced to other areas originated from
+intra- area paths from specified area.
+This command makes sense in ABR only.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> import-list \<acl_number\>
+
+Same as export-list, but it applies to paths announced into specified
+area as Type-3 summary-LSAs.
+This command makes sense in ABR only.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> range \<A.B.C.D/M\> substitute
+\<E.F.G.H/M\>
+
+One Type-3 summary-LSA with routing info \<E.F.G.H/M\> is announced into
+backbone area if defined area contains at least one intra-area network
+(i.e. described with router-LSA or network-LSA) from range \<A.B.C.D/M\>.
+This command makes sense in ABR only.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> shortcut \<default[|disable|](##SUBST##|disable|)enable\>
+
+This parameter allows to "shortcut" routes (non-backbone) for inter-area
+routes. There are three modes available for routes shortcutting:
+
+**default** – this area will be used for shortcutting only if ABR does not
+have a link to the backbone area or this link was lost.
+**enable** – the area will be used for shortcutting every time the route
+that goes through it is cheaper.
+**disable** – this area is never used by ABR for routes shortcutting.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf area \<number\> virtual-link \<A.B.C.D\>
+
+Provides a backbone area coherence by virtual link establishment.
+
+In general, OSPF protocol requires a backbone area (area 0) to be coherent
+and fully connected. I.e. any backbone area router must have a route to any
+other backbone area router. Moreover, every ABR must have a link to
+backbone area. However, it is not always possible to have a physical link
+to a backbone area. In this case between two ABR (one of them has a link to
+the backbone area) in the area (not stub area) a virtual link is organized.
+
+\<number\> – area identifier through which a virtual link goes.
+\<A.B.C.D\> – ABR router-id with which a virtual link is established. Virtual
+link must be configured on both routers.
+
+Formally, a virtual link looks like a point-to-point network connecting two
+ABR from one area one of which physically connected to a backbone area.
+This pseudo-network is considered to belong to a backbone area.
+
+</div>
+
+#### Interface Configuration
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> area \<x.x.x.x | x\>
+
+Enable ospf on an interface and set associated area.
+
+If you have a lot of interfaces, and/or a lot of subnets, then enabling
+OSPF via this command may result in a slight performance improvement.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> authentication
+plaintext-password \<text\>
+
+This command sets OSPF authentication key to a simple password. After
+setting, all OSPF packets are authenticated. Key has length up to 8 chars.
+
+Simple text password authentication is insecure and deprecated in favour of
+MD5 HMAC authentication.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> authentication md5
+key-id \<id\> md5-key \<text\>
+
+This command specifys that MD5 HMAC authentication must be used on this
+interface. It sets OSPF authentication key to a cryptographic password.
+Key-id identifies secret key used to create the message digest. This ID
+is part of the protocol and must be consistent across routers on a link.
+The key can be long up to 16 chars (larger strings will be truncated),
+and is associated with the given key-id.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> bandwidth \<number\>
+
+This command sets the interface bandwidth for cost calculations, where
+bandwidth can be in range from 1 to 100000, specified in Mbits/s.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> cost \<number\>
+
+This command sets link cost for the specified interface. The cost value is
+set to router-LSA’s metric field and used for SPF calculation. The cost
+range is 1 to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> dead-interval \<number\>
+
+Set number of seconds for router Dead Interval timer value used for Wait
+Timer and Inactivity Timer. This value must be the same for all routers
+attached to a common network. The default value is 40 seconds. The
+interval range is 1 to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> hello-multiplier \<number\>
+
+The hello-multiplier specifies how many Hellos to send per second, from 1
+(every second) to 10 (every 100ms). Thus one can have 1s convergence time
+for OSPF. If this form is specified, then the hello-interval advertised in
+Hello packets is set to 0 and the hello-interval on received Hello packets
+is not checked, thus the hello-multiplier need NOT be the same across
+multiple routers on a common link.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> hello-interval \<number\>
+
+Set number of seconds for Hello Interval timer value. Setting this value,
+Hello packet will be sent every timer value seconds on the specified
+interface. This value must be the same for all routers attached to a
+common network. The default value is 10 seconds. The interval range is 1
+to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> bfd
+
+This command enables `BFD (Bidirectional Forwarding Detection)` on
+this OSPF link interface.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> mtu-ignore
+
+This command disables check of the MTU value in the OSPF DBD packets. Thus,
+use of this command allows the OSPF adjacency to reach the FULL state even
+though there is an interface MTU mismatch between two OSPF routers.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> network \<type\>
+
+This command allows to specify the distribution type for the network
+connected to this interface:
+
+**broadcast** – broadcast IP addresses distribution.
+**non-broadcast** – address distribution in NBMA networks topology.
+**point-to-multipoint** – address distribution in point-to-multipoint
+networks.
+**point-to-point** – address distribution in point-to-point networks.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> priority \<number\>
+
+This command sets Router Priority integer value. The router with the
+highest priority will be more eligible to become Designated Router.
+Setting the value to 0, makes the router ineligible to become
+Designated Router. The default value is 1. The interval range is 0 to 255.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> retransmit-interval
+\<number\>
+
+This command sets number of seconds for RxmtInterval timer value. This
+value is used when retransmitting Database Description and Link State
+Request packets if acknowledge was not received. The default value is 5
+seconds. The interval range is 3 to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> transmit-delay \<number\>
+
+This command sets number of seconds for InfTransDelay value. It allows to
+set and adjust for each interface the delay interval before starting the
+synchronizing process of the router's database with all neighbors. The
+default value is 1 seconds. The interval range is 3 to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> ldp-sync disable
+
+This command disables IGP-LDP sync for this specific interface.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf interface \<interface\> ldp-sync holddown
+\<seconds\>
+
+This command will change the hold down value for IGP-LDP synchronization
+during convergence/interface flap events, but for this interface only.
+
+</div>
+
+#### External Route Summarisation
+
+This feature summarises originated external LSAs (Type-5 and Type-7). Summary
+Route will be originated on-behalf of all matched external LSAs.
+
+<div class="cfgcmd">
+
+set protocols ospf aggregation timer \<seconds\>
+
+Configure aggregation delay timer interval.
+
+Summarisation starts only after this delay timer expiry.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf summary-address x.x.x.x/y \[tag (1-4294967295)\]
+
+This command enable/disables summarisation for the configured address range.
+
+Tag is the optional parameter. If tag configured Summary route will be
+originated with the configured tag.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf summary-address x.x.x.x/y no-advertise
+
+This command to ensure not advertise the summary lsa for the matched
+external LSAs.
+
+</div>
+
+#### Graceful Restart
+
+<div class="cfgcmd">
+
+set protocols ospf graceful-restart \[grace-period (1-1800)\]
+
+Configure Graceful Restart `3623` restarting support. When enabled,
+the default grace period is 120 seconds.
+
+To perform a graceful shutdown, the FRR `graceful-restart prepare ip ospf` EXEC-level command needs to be issued before restarting the
+ospfd daemon.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf graceful-restart helper enable \[router-id A.B.C.D\]
+
+Configure Graceful Restart `3623` helper support. By default, helper support
+is disabled for all neighbours. This config enables/disables helper support
+on this router for all neighbours.
+
+To enable/disable helper support for a specific neighbour, the router-id
+(A.B.C.D) has to be specified.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf graceful-restart helper no-strict-lsa-checking
+
+By default <span class="title-ref">strict-lsa-checking</span> is configured then the helper will abort
+the Graceful Restart when a LSA change occurs which affects the restarting
+router.
+
+This command disables it.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf graceful-restart helper supported-grace-time
+
+Supports as HELPER for configured grace period.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf graceful-restart helper planned-only
+
+It helps to support as HELPER only for planned restarts.
+
+By default, it supports both planned and unplanned outages.
+
+</div>
+
+#### Manual Neighbor Configuration
+
+OSPF routing devices normally discover their neighbors dynamically by
+listening to the broadcast or multicast hello packets on the network.
+Because an NBMA network does not support broadcast (or multicast), the
+device cannot discover its neighbors dynamically, so you must configure all
+the neighbors statically.
+
+<div class="cfgcmd">
+
+set protocols ospf neighbor \<A.B.C.D\>
+
+This command specifies the IP address of the neighboring device.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf neighbor \<A.B.C.D\> poll-interval \<seconds\>
+
+This command specifies the length of time, in seconds, before the routing
+device sends hello packets out of the interface before it establishes
+adjacency with a neighbor. The range is 1 to 65535 seconds. The default
+value is 60 seconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf neighbor \<A.B.C.D\> priority \<number\>
+
+This command specifies the router priority value of the nonbroadcast
+neighbor associated with the IP address specified. The default is 0.
+This keyword does not apply to point-to-multipoint interfaces.
+
+</div>
+
+#### Redistribution Configuration
+
+<div class="cfgcmd">
+
+set protocols ospf redistribute \<route source\>
+
+This command redistributes routing information from the given route source
+to the OSPF process. There are five modes available for route source: bgp,
+connected, kernel, rip, static.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf default-metric \<number\>
+
+This command specifies the default metric value of redistributed routes.
+The metric range is 0 to 16777214.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf redistribute \<route source\> metric \<number\>
+
+This command specifies metric for redistributed routes from the given
+route source. There are five modes available for route source: bgp,
+connected, kernel, rip, static. The metric range is 1 to 16777214.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf redistribute \<route source\> metric-type \<1|2\>
+
+This command specifies metric type for redistributed routes. Difference
+between two metric types that metric type 1 is a metric which is
+"commensurable" with inner OSPF links. When calculating a metric to the
+external destination, the full path metric is calculated as a metric sum
+path of a router which had advertised this link plus the link metric.
+Thus, a route with the least summary metric will be selected. If external
+link is advertised with metric type 2 the path is selected which lies
+through the router which advertised this link with the least metric
+despite of the fact that internal path to this router is longer (with more
+cost). However, if two routers advertised an external link and with metric
+type 2 the preference is given to the path which lies through the router
+with a shorter internal path. If two different routers advertised two
+links to the same external destimation but with different metric type,
+metric type 1 is preferred. If type of a metric left undefined the router
+will consider these external links to have a default metric type 2.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf redistribute \<route source\> route-map \<name\>
+
+This command allows to use route map to filter redistributed routes from
+the given route source. There are five modes available for route source:
+bgp, connected, kernel, rip, static.
+
+</div>
+
+#### Operational Mode Commands
+
+<div class="opcmd">
+
+show ip ospf neighbor
+
+This command displays the neighbors status.
+
+</div>
+
+``` none
+Neighbor ID     Pri State           Dead Time Address         Interface                        RXmtL RqstL DBsmL
+10.0.13.1         1 Full/DR           38.365s 10.0.13.1       eth0:10.0.13.3                       0     0     0
+10.0.23.2         1 Full/Backup       39.175s 10.0.23.2       eth1:10.0.23.3                       0     0     0
+```
+
+<div class="opcmd">
+
+show ip ospf neighbor detail
+
+This command displays the neighbors information in a detailed form, not
+just a summary table.
+
+</div>
+
+``` none
+Neighbor 10.0.13.1, interface address 10.0.13.1
+   In the area 0.0.0.0 via interface eth0
+   Neighbor priority is 1, State is Full, 5 state changes
+   Most recent state change statistics:
+     Progressive change 11m55s ago
+   DR is 10.0.13.1, BDR is 10.0.13.3
+   Options 2 *|-|-|-|-|-|E|-
+   Dead timer due in 34.854s
+   Database Summary List 0
+   Link State Request List 0
+   Link State Retransmission List 0
+   Thread Inactivity Timer on
+   Thread Database Description Retransmision off
+   Thread Link State Request Retransmission on
+   Thread Link State Update Retransmission on
+
+Neighbor 10.0.23.2, interface address 10.0.23.2
+  In the area 0.0.0.1 via interface eth1
+  Neighbor priority is 1, State is Full, 4 state changes
+  Most recent state change statistics:
+    Progressive change 41.193s ago
+  DR is 10.0.23.3, BDR is 10.0.23.2
+  Options 2 *|-|-|-|-|-|E|-
+  Dead timer due in 35.661s
+  Database Summary List 0
+  Link State Request List 0
+  Link State Retransmission List 0
+  Thread Inactivity Timer on
+  Thread Database Description Retransmision off
+  Thread Link State Request Retransmission on
+  Thread Link State Update Retransmission on
+```
+
+<div class="opcmd">
+
+show ip ospf neighbor \<A.B.C.D\>
+
+This command displays the neighbors information in a detailed form for a
+neighbor whose IP address is specified.
+
+</div>
+
+<div class="opcmd">
+
+show ip ospf neighbor \<interface\>
+
+This command displays the neighbors status for a neighbor on the specified
+interface.
+
+</div>
+
+<div class="opcmd">
+
+show ip ospf interface \[\<interface\>\]
+
+This command displays state and configuration of OSPF the specified
+interface, or all interfaces if no interface is given.
+
+</div>
+
+``` none
+eth0 is up
+  ifindex 2, MTU 1500 bytes, BW 4294967295 Mbit <UP,BROADCAST,RUNNING,MULTICAST>
+  Internet Address 10.0.13.3/24, Broadcast 10.0.13.255, Area 0.0.0.0
+  MTU mismatch detection: enabled
+  Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1
+  Transmit Delay is 1 sec, State Backup, Priority 1
+  Backup Designated Router (ID) 10.0.23.3, Interface Address 10.0.13.3
+  Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters
+  Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
+    Hello due in 4.470s
+  Neighbor Count is 1, Adjacent neighbor count is 1
+eth1 is up
+  ifindex 3, MTU 1500 bytes, BW 4294967295 Mbit <UP,BROADCAST,RUNNING,MULTICAST>
+  Internet Address 10.0.23.3/24, Broadcast 10.0.23.255, Area 0.0.0.1
+  MTU mismatch detection: enabled
+  Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1
+  Transmit Delay is 1 sec, State DR, Priority 1
+  Backup Designated Router (ID) 10.0.23.2, Interface Address 10.0.23.2
+  Saved Network-LSA sequence number 0x80000002
+  Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters
+  Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
+    Hello due in 4.563s
+  Neighbor Count is 1, Adjacent neighbor count is 1
+```
+
+<div class="opcmd">
+
+show ip ospf route \[detail\]
+
+This command displays the OSPF routing table, as determined by the most
+recent SPF calculation. With the optional `detail` argument,
+each route item's advertiser router and network attribute will be shown.
+
+</div>
+
+``` none
+============ OSPF network routing table ============
+N IA 10.0.12.0/24          [3] area: 0.0.0.0
+                           via 10.0.13.3, eth0
+N    10.0.13.0/24          [1] area: 0.0.0.0
+                           directly attached to eth0
+N IA 10.0.23.0/24          [2] area: 0.0.0.0
+                           via 10.0.13.3, eth0
+N    10.0.34.0/24          [2] area: 0.0.0.0
+                           via 10.0.13.3, eth0
+
+============ OSPF router routing table =============
+R    10.0.23.3             [1] area: 0.0.0.0, ABR
+                           via 10.0.13.3, eth0
+R    10.0.34.4             [2] area: 0.0.0.0, ASBR
+                           via 10.0.13.3, eth0
+
+============ OSPF external routing table ===========
+N E2 172.16.0.0/24         [2/20] tag: 0
+                           via 10.0.13.3, eth0
+```
+
+The table consists of following data:
+
+**OSPF network routing table** – includes a list of acquired routes for all
+accessible networks (or aggregated area ranges) of OSPF system. "IA" flag
+means that route destination is in the area to which the router is not
+connected, i.e. it’s an inter-area path. In square brackets a summary metric
+for all links through which a path lies to this network is specified. "via"
+prefix defines a router-gateway, i.e. the first router on the way to the
+destination (next hop).
+**OSPF router routing table** – includes a list of acquired routes to all
+accessible ABRs and ASBRs.
+**OSPF external routing table** – includes a list of acquired routes that are
+external to the OSPF process. "E" flag points to the external link metric type
+(E1 – metric type 1, E2 – metric type 2). External link metric is printed in
+the "\<metric of the router which advertised the link\>/\<link metric\>" format.
+
+<div class="opcmd">
+
+show ip ospf border-routers
+
+This command displays a table of paths to area boundary and autonomous
+system boundary routers.
+
+</div>
+
+<div class="opcmd">
+
+show ip ospf database
+
+This command displays a summary table with a database contents (LSA).
+
+</div>
+
+``` none
+OSPF Router with ID (10.0.13.1)
+
+         Router Link States (Area 0.0.0.0)
+
+Link ID         ADV Router      Age  Seq#       CkSum  Link count
+10.0.13.1       10.0.13.1        984 0x80000005 0xd915 1
+10.0.23.3       10.0.23.3       1186 0x80000008 0xfe62 2
+10.0.34.4       10.0.34.4       1063 0x80000004 0x4e3f 1
+
+         Net Link States (Area 0.0.0.0)
+
+Link ID         ADV Router      Age  Seq#       CkSum
+10.0.13.1       10.0.13.1        994 0x80000003 0x30bb
+10.0.34.4       10.0.34.4       1188 0x80000001 0x9411
+
+         Summary Link States (Area 0.0.0.0)
+
+Link ID         ADV Router      Age  Seq#       CkSum  Route
+10.0.12.0       10.0.23.3       1608 0x80000001 0x6ab6 10.0.12.0/24
+10.0.23.0       10.0.23.3        981 0x80000003 0xe232 10.0.23.0/24
+
+         AS External Link States
+
+Link ID         ADV Router      Age  Seq#       CkSum  Route
+172.16.0.0      10.0.34.4       1063 0x80000001 0xc40d E2 172.16.0.0/24 [0x0]
+```
+
+<div class="opcmd">
+
+show ip ospf database \<type\> \[A.B.C.D\]
+\[adv-router \<A.B.C.D\>|self-originate\]
+
+This command displays a database contents for a specific link advertisement
+type.
+
+The type can be the following:
+asbr-summary, external, network, nssa-external, opaque-area, opaque-as,
+opaque-link, router, summary.
+
+\[A.B.C.D\] – link-state-id. With this specified the command displays portion
+of the network environment that is being described by the advertisement.
+The value entered depends on the advertisement’s LS type. It must be
+entered in the form of an IP address.
+
+`adv-router <A.B.C.D>` – router id, which link advertisements need
+to be reviewed.
+
+`self-originate` displays only self-originated LSAs from the local
+router.
+
+</div>
+
+``` none
+OSPF Router with ID (10.0.13.1)
+
+      Router Link States (Area 0.0.0.0)
+
+LS age: 1213
+Options: 0x2  : *|-|-|-|-|-|E|-
+LS Flags: 0x3
+Flags: 0x0
+LS Type: router-LSA
+Link State ID: 10.0.13.1
+Advertising Router: 10.0.13.1
+LS Seq Number: 80000009
+Checksum: 0xd119
+Length: 36
+
+Number of Links: 1
+
+Link connected to: a Transit Network
+(Link ID) Designated Router address: 10.0.13.1
+(Link Data) Router Interface address: 10.0.13.1
+Number of TOS metrics: 0
+TOS 0 Metric: 1
+```
+
+<div class="opcmd">
+
+show ip ospf database max-age
+
+This command displays LSAs in MaxAge list.
+
+</div>
+
+#### Examples
+
+##### Enable OSPF
+
+**Node 1**
+
+``` none
+set interfaces loopback lo address 10.1.1.1/32
+set interfaces ethernet eth0 address 192.168.0.1/24
+set protocols ospf area 0 network 192.168.0.0/24
+set protocols ospf area 0 network 10.1.1.1/32
+set protocols ospf parameters router-id 10.1.1.1
+```
+
+**Node 2**
+
+``` none
+set interfaces loopback lo address 10.1.1.2/32
+set interfaces ethernet eth0 address 192.168.0.2/24
+set protocols ospf area 0 network 192.168.0.0/24
+set protocols ospf area 0 network 10.1.1.2/32
+set protocols ospf parameters router-id 10.1.1.2
+```
+
+Here's the neighbors up:
+
+``` none
+Node-1@vyos:~$ show ip ospf neighbor
+
+Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXmtL RqstL DBsmL
+10.1.1.2          1 Full/DR         3m43s             36.094s 192.168.0.2     eth0:192.168.0.1                     0     0     0
+
+
+
+Node-2@vyos:~$ show ip ospf neighbor
+
+Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXmtL RqstL DBsmL
+10.1.1.1          1 Full/Backup     3m47s             31.736s 192.168.0.1     eth0:192.168.0.2                     0     0     0
+```
+
+Here's the routes:
+
+``` none
+Node-1@vyos:~$ show ip route ospf
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+O   10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:00:14
+O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, weight 1, 00:00:07
+O   192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:32
+
+Node-2@vyos:~$ show ip route ospf
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, weight 1, 00:00:11
+O   10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:00:04
+O   192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:18
+```
+
+##### Enable OSPF with route redistribution of the loopback and default originate:
+
+**Node 1**
+
+``` none
+set interfaces loopback lo address 10.1.1.1/32
+set protocols ospf area 0 network 192.168.0.0/24
+set protocols ospf default-information originate always
+set protocols ospf default-information originate metric 10
+set protocols ospf default-information originate metric-type 2
+set protocols ospf log-adjacency-changes
+set protocols ospf parameters router-id 10.1.1.1
+set protocols ospf redistribute connected metric-type 2
+set protocols ospf redistribute connected route-map CONNECT
+
+set policy route-map CONNECT rule 10 action permit
+set policy route-map CONNECT rule 10 match interface lo
+```
+
+**Node 2**
+
+``` none
+set interfaces loopback lo address 10.2.2.2/32
+set protocols ospf area 0 network 192.168.0.0/24
+set protocols ospf log-adjacency-changes
+set protocols ospf parameters router-id 10.2.2.2
+set protocols ospf redistribute connected metric-type 2
+set protocols ospf redistribute connected route-map CONNECT
+
+set policy route-map CONNECT rule 10 action permit
+set policy route-map CONNECT rule 10 match interface lo
+```
+
+##### Enable OSPF and IGP-LDP synchronization:
+
+**Node 1:**
+
+``` none
+set interfaces loopback lo address 10.1.1.1/32
+set interfaces ethernet eth0 address 192.168.0.1/24
+
+set protocols ospf area 0 network '192.168.0.0/24'
+set protocols ospf area 0 network '10.1.1.1/32'
+set protocols ospf parameters router-id '10.1.1.1'
+set protocols ospf ldp-sync
+
+set protocols mpls interface eth0
+set protocols mpls ldp discovery transport-ipv4-address 10.1.1.1
+set protocols mpls ldp interface lo
+set protocols mpls ldp interface eth0
+set protocols mpls ldp parameters transport-prefer-ipv4
+set protocols mpls ldp router-id 10.1.1.1
+```
+
+This gives us IGP-LDP synchronization for all non-loopback interfaces with
+a holddown timer of zero seconds:
+
+``` none
+Node-1@vyos:~$ show ip ospf mpls ldp-sync
+  eth0
+  LDP-IGP Synchronization enabled: yes
+  Holddown timer in seconds: 0
+  State: Sync achieved
+```
+
+##### Enable OSPF with Segment Routing (Experimental):
+
+**Node 1**
+
+``` none
+set interfaces loopback lo address 10.1.1.1/32
+set interfaces ethernet eth0 address 192.168.0.1/24
+
+set protocols ospf area 0 network '192.168.0.0/24'
+set protocols ospf area 0 network '10.1.1.1/32'
+set protocols ospf parameters opaque-lsa
+set protocols ospf parameters router-id '10.1.1.1'
+set protocols ospf segment-routing global-block high-label-value '1100'
+set protocols ospf segment-routing global-block low-label-value '1000'
+set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null
+set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1'
+```
+
+**Node 2**
+
+``` none
+set interfaces loopback lo address 10.1.1.2/32
+set interfaces ethernet eth0 address 192.168.0.2/24
+
+set protocols ospf area 0 network '192.168.0.0/24'
+set protocols ospf area 0 network '10.1.1.2/32'
+set protocols ospf parameters opaque-lsa
+set protocols ospf parameters router-id '10.1.1.2'
+set protocols ospf segment-routing global-block high-label-value '1100'
+set protocols ospf segment-routing global-block low-label-value '1000'
+set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null
+set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2'
+```
+
+This gives us MPLS segment routing enabled and labels for far end loopbacks:
+
+``` none
+Node-1@vyos:~$ show mpls table
+ Inbound Label  Type       Nexthop      Outbound Label
+ -----------------------------------------------------------
+ 1002           SR (OSPF)  192.168.0.2  IPv4 Explicit Null  <-- Node-2 loopback learned on Node-1
+ 15000          SR (OSPF)  192.168.0.2  implicit-null
+ 15001          SR (OSPF)  192.168.0.2  implicit-null
+
+Node-2@vyos:~$ show mpls table
+ Inbound Label  Type       Nexthop      Outbound Label
+ -----------------------------------------------------------
+ 1001           SR (OSPF)  192.168.0.1  IPv4 Explicit Null  <-- Node-1 loopback learned on Node-2
+ 15000          SR (OSPF)  192.168.0.1  implicit-null
+ 15001          SR (OSPF)  192.168.0.1  implicit-null
+```
+
+Here is the routing tables showing the MPLS segment routing label operations:
+
+``` none
+Node-1@vyos:~$ show ip route ospf
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+O   10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43
+O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32
+O   192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43
+
+Node-2@vyos:~$ show ip route ospf
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36
+O   10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51
+O   192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51
+```
+
+## OSPFv3 (IPv6)
+
+### Configuration
+
+#### General
+
+VyOS does not have a special command to start the OSPFv3 process. The OSPFv3
+process starts when the first ospf enabled interface is configured.
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> area \<number\>
+
+This command specifies the OSPFv3 enabled interface. This command is also
+used to enable the OSPF process. The area number can be specified in
+decimal notation in the range from 0 to 4294967295. Or it can be specified
+in dotted decimal notation similar to ip address.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 parameters router-id \<rid\>
+
+This command sets the router-ID of the OSPFv3 process. The router-ID may be
+an IP address of the router, but need not be – it can be any arbitrary
+32bit number. However it MUST be unique within the entire OSPFv3 domain to
+the OSPFv3 speaker – bad things will happen if multiple OSPFv3 speakers are
+configured with the same router-ID!
+
+</div>
+
+#### Optional
+
+<div class="cfgcmd">
+
+set protocols ospfv3 distance global \<distance\>
+
+This command change distance value of OSPFv3 globally.
+The distance range is 1 to 255.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 distance ospfv3
+\<external[|inter-area|](##SUBST##|inter-area|)intra-area\> \<distance\>
+
+This command change distance value of OSPFv3. The arguments are the
+distance values for external routes, inter-area routes and intra-area
+routes respectively. The distance range is 1 to 255.
+
+</div>
+
+#### Area Configuration
+
+<div class="cfgcmd">
+
+set protocols ospfv3 area \<number\> range \<prefix\>
+
+This command summarizes intra area paths from specified area into one
+Type-3 Inter-Area Prefix LSA announced to other areas. This command can be
+used only in ABR.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 area \<number\> range \<prefix\> not-advertise
+
+This command instead of summarizing intra area paths filter them - i.e.
+intra area paths from this range are not advertised into other areas. This
+command makes sense in ABR only.
+
+</div>
+
+#### Interface Configuration
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> ipv6 cost \<number\>
+
+This command sets link cost for the specified interface. The cost value is
+set to router-LSA’s metric field and used for SPF calculation. The cost
+range is 1 to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> dead-interval \<number\>
+
+Set number of seconds for router Dead Interval timer value used for Wait
+Timer and Inactivity Timer. This value must be the same for all routers
+attached to a common network. The default value is 40 seconds. The
+interval range is 1 to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> hello-interval
+\<number\>
+
+Set number of seconds for Hello Interval timer value. Setting this value,
+Hello packet will be sent every timer value seconds on the specified
+interface. This value must be the same for all routers attached to a
+common network. The default value is 10 seconds. The interval range is 1
+to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> mtu-ignore
+
+This command disables check of the MTU value in the OSPF DBD packets.
+Thus, use of this command allows the OSPF adjacency to reach the FULL
+state even though there is an interface MTU mismatch between two OSPF
+routers.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> network \<type\>
+
+This command allows to specify the distribution type for the network
+connected to this interface:
+
+**broadcast** – broadcast IP addresses distribution.
+**point-to-point** – address distribution in point-to-point networks.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> priority \<number\>
+
+This command sets Router Priority integer value. The router with the
+highest priority will be more eligible to become Designated Router.
+Setting the value to 0, makes the router ineligible to become Designated
+Router. The default value is 1. The interval range is 0 to 255.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> passive
+
+This command specifies interface as passive. Passive interface advertises
+its address, but does not run the OSPF protocol (adjacencies are not formed
+and hello packets are not generated).
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> retransmit-interval
+\<number\>
+
+This command sets number of seconds for RxmtInterval timer value. This
+value is used when retransmitting Database Description and Link State
+Request packets if acknowledge was not received. The default value is 5
+seconds. The interval range is 3 to 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 interface \<interface\> transmit-delay
+\<number\>
+
+This command sets number of seconds for InfTransDelay value. It allows to
+set and adjust for each interface the delay interval before starting the
+synchronizing process of the router's database with all neighbors. The
+default value is 1 seconds. The interval range is 3 to 65535.
+
+</div>
+
+#### Graceful Restart
+
+<div class="cfgcmd">
+
+set protocols ospfv3 graceful-restart \[grace-period (1-1800)\]
+
+Configure Graceful Restart `3623` restarting support. When enabled,
+the default grace period is 120 seconds.
+
+To perform a graceful shutdown, the FRR `graceful-restart prepare ip ospf` EXEC-level command needs to be issued before restarting the
+ospfd daemon.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 graceful-restart helper enable \[router-id A.B.C.D\]
+
+Configure Graceful Restart `3623` helper support. By default, helper support
+is disabled for all neighbours. This config enables/disables helper support
+on this router for all neighbours.
+
+To enable/disable helper support for a specific neighbour, the router-id
+(A.B.C.D) has to be specified.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 graceful-restart helper lsa-check-disable
+
+By default <span class="title-ref">strict-lsa-checking</span> is configured then the helper will abort
+the Graceful Restart when a LSA change occurs which affects the restarting
+router.
+
+This command disables it.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 graceful-restart helper supported-grace-time
+
+Supports as HELPER for configured grace period.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospfv3 graceful-restart helper planned-only
+
+It helps to support as HELPER only for planned restarts.
+
+By default, it supports both planned and unplanned outages.
+
+</div>
+
+#### Redistribution Configuration
+
+<div class="cfgcmd">
+
+set protocols ospfv3 redistribute \<route source\>
+
+This command redistributes routing information from the given route source
+to the OSPFv3 process. There are five modes available for route source:
+bgp, connected, kernel, ripng, static.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf redistribute \<route source\> route-map \<name\>
+
+This command allows to use route map to filter redistributed routes from
+given route source. There are five modes available for route source: bgp,
+connected, kernel, ripng, static.
+
+</div>
+
+#### Operational Mode Commands
+
+<div class="opcmd">
+
+show ipv6 ospfv3 neighbor
+
+This command displays the neighbors status.
+
+</div>
+
+<div class="opcmd">
+
+show ipv6 ospfv3 neighbor detail
+
+This command displays the neighbors information in a detailed form, not
+just a summary table.
+
+</div>
+
+<div class="opcmd">
+
+show ipv6 ospfv3 neighbor drchoice
+
+This command displays the neighbor DR choice information.
+
+</div>
+
+<div class="opcmd">
+
+show ipv6 ospfv3 interface \[prefix\]|\[\<interface\> \[prefix\]\]
+
+This command displays state and configuration of OSPF the specified
+interface, or all interfaces if no interface is given. Whith the argument
+`prefix` this command shows connected prefixes to advertise.
+
+</div>
+
+<div class="opcmd">
+
+show ipv6 ospfv3 route
+
+This command displays the OSPF routing table, as determined by the most
+recent SPF calculation.
+
+</div>
+
+<div class="opcmd">
+
+show ipv6 ospfv3 border-routers
+
+This command displays a table of paths to area boundary and autonomous
+system boundary routers.
+
+</div>
+
+<div class="opcmd">
+
+show ipv6 ospfv3 database
+
+This command displays a summary table with a database contents (LSA).
+
+</div>
+
+<div class="opcmd">
+
+show ipv6 ospfv3 database \<type\> \[A.B.C.D\]
+\[adv-router \<A.B.C.D\>|self-originate\]
+
+This command displays a database contents for a specific link
+advertisement type.
+
+</div>
+
+<div class="opcmd">
+
+show ipv6 ospfv3 redistribute
+
+This command displays external information redistributed into OSPFv3
+
+</div>
+
+#### Configuration Example
+
+A typical configuration using 2 nodes.
+
+**Node 1:**
+
+``` none
+set protocols ospfv3 interface eth1 area 0.0.0.0
+set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64
+set protocols ospfv3 parameters router-id 192.168.1.1
+set protocols ospfv3 redistribute connected
+```
+
+**Node 2:**
+
+``` none
+set protocols ospfv3 interface eth1 area 0.0.0.0
+set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64
+set protocols ospfv3 parameters router-id 192.168.2.1
+set protocols ospfv3 redistribute connected
+```
+
+**To see the redistributed routes:**
+
+``` none
+show ipv6 ospfv3 redistribute
+```
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+You cannot easily redistribute IPv6 routes via OSPFv3 on a
+WireGuard interface link. This requires you to configure link-local
+addresses manually on the WireGuard interfaces, see `T1483`.
+
+</div>
+
+Example configuration for WireGuard interfaces:
+
+**Node 1**
+
+``` none
+set interfaces wireguard wg01 address 'fe80::216:3eff:fe51:fd8c/64'
+set interfaces wireguard wg01 address '192.168.0.1/24'
+set interfaces wireguard wg01 peer ospf02 allowed-ips '::/0'
+set interfaces wireguard wg01 peer ospf02 allowed-ips '0.0.0.0/0'
+set interfaces wireguard wg01 peer ospf02 endpoint '10.1.1.101:12345'
+set interfaces wireguard wg01 peer ospf02 pubkey 'ie3...='
+set interfaces wireguard wg01 port '12345'
+set protocols ospfv3 parameters router-id 192.168.1.1
+set protocols ospfv3 interface 'wg01' area 0.0.0.0
+set protocols ospfv3 interface 'lo' area 0.0.0.0
+```
+
+**Node 2**
+
+``` none
+set interfaces wireguard wg01 address 'fe80::216:3eff:fe0a:7ada/64'
+set interfaces wireguard wg01 address '192.168.0.2/24'
+set interfaces wireguard wg01 peer ospf01 allowed-ips '::/0'
+set interfaces wireguard wg01 peer ospf01 allowed-ips '0.0.0.0/0'
+set interfaces wireguard wg01 peer ospf01 endpoint '10.1.1.100:12345'
+set interfaces wireguard wg01 peer ospf01 pubkey 'NHI...='
+set interfaces wireguard wg01 port '12345'
+set protocols ospfv3 parameters router-id 192.168.1.2
+set protocols ospfv3 interface 'wg01' area 0.0.0.0
+set protocols ospfv3 interface 'lo' area 0.0.0.0
+```
+
+**Status**
+
+``` none
+vyos@ospf01:~$ sh ipv6 ospfv3 neighbor
+Neighbor ID     Pri    DeadTime    State/IfState         Duration I/F[State]
+192.168.0.2       1    00:00:37     Full/PointToPoint    00:18:03 wg01[PointToPoint]
+
+vyos@ospf02# run sh ipv6 ospfv3 neighbor
+Neighbor ID     Pri    DeadTime    State/IfState         Duration I/F[State]
+192.168.0.1       1    00:00:39     Full/PointToPoint    00:19:44 wg01[PointToPoint]
+```
diff --git a/docs/configuration/protocols/md-pim.md b/docs/configuration/protocols/md-pim.md
new file mode 100644
index 00000000..2f31de95
--- /dev/null
+++ b/docs/configuration/protocols/md-pim.md
@@ -0,0 +1,345 @@
+lastproofread  
+2023-11-13
+
+# PIM – Protocol Independent Multicast
+
+VyOS supports `PIM-SM (PIM Sparse Mode)` as well as
+`IGMP (Internet Group Management Protocol)` v2 and v3
+
+`PIM (Protocol Independent Multicast)` must be configured in every
+interface of every participating router. Every router must also have the
+location of the Rendevouz Point manually configured. Then, unidirectional
+shared trees rooted at the Rendevouz Point will automatically be built
+for multicast distribution.
+
+Traffic from multicast sources will go to the Rendezvous Point, and
+receivers will pull it from a shared tree using `IGMP (Internet
+Group Management Protocol)`.
+
+Multicast receivers will talk IGMP to their local router, so, besides
+having PIM configured in every router, IGMP must also be configured in
+any router where there could be a multicast receiver locally connected.
+
+VyOS supports both IGMP version 2 and version 3 (which allows
+source-specific multicast).
+
+## PIM-SM - PIM Sparse Mode
+
+<div class="cfgcmd">
+
+set protocols pim ecmp
+
+If PIM has the a choice of ECMP nexthops for a particular
+`RPF (Reverse Path Forwarding)`, PIM will cause S,G flows to be
+spread out amongst the nexthops. If this command is not specified then
+the first nexthop found will be used.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim ecmp rebalance
+
+If PIM is using ECMP and an interface goes down, cause PIM to rebalance all
+S,G flows across the remaining nexthops. If this command is not configured
+PIM only modifies those S,G flows that were using the interface that went
+down.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim join-prune-interval \<n\>
+
+Modify the join/prune interval that PIM uses to the new value. Time is
+specified in seconds.
+
+The default time is 60 seconds.
+
+If you enter a value smaller than 60 seconds be aware that this can and
+will affect convergence at scale.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim keep-alive-timer \<n\>
+
+Modify the time out value for a S,G flow from 1-65535 seconds. If choosing
+a value below 31 seconds be aware that some hardware platforms cannot see
+data flowing in better than 30 second chunks.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim packets \<n\>
+
+When processing packets from a neighbor process the number of packets
+incoming at one time before moving on to the next task.
+
+The default value is 3 packets.
+
+This command is only useful at scale when you can possibly have a large
+number of PIM control packets flowing.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim register-accept-list \<prefix-list\>
+
+When PIM receives a register packet the source of the packet will be compared
+to the prefix-list specified, and if a permit is received normal processing
+continues. If a deny is returned for the source address of the register packet
+a register stop message is sent to the source.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim register-suppress-time \<n\>
+
+Modify the time that pim will register suppress a FHR will send register
+notifications to the kernel.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim rp \<address\> group \<group\>
+
+In order to use PIM, it is necessary to configure a `RP (Rendezvous Point)`
+for join messages to be sent to. Currently the only methodology to do this is
+via static rendezvous point commands.
+
+All routers in the PIM network must agree on these values.
+
+The first ip address is the RP's address and the second value is the matching
+prefix of group ranges covered.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim rp keep-alive-timer \<n\>
+
+Modify the time out value for a S,G flow from 1-65535 seconds at
+`RP (Rendezvous Point)`. The normal keepalive period for the KAT(S,G)
+defaults to 210 seconds. However, at the `RP (Rendezvous Point)`, the
+keepalive period must be at least the Register_Suppression_Time, or the RP
+may time out the (S,G) state before the next Null-Register arrives.
+Thus, the KAT(S,G) is set to max(Keepalive_Period, RP_Keepalive_Period)
+when a Register-Stop is sent.
+
+If choosing a value below 31 seconds be aware that some hardware platforms
+cannot see data flowing in better than 30 second chunks.
+
+See `7761#section-4.1` for details.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim no-v6-secondary
+
+When sending PIM hello packets tell PIM to not send any v6 secondary
+addresses on the interface. This information is used to allow PIM to use v6
+nexthops in it's decision for `RPF (Reverse Path Forwarding)` lookup
+if this option is not set (default).
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim spt-switchover infinity-and-beyond \[prefix-list \<list\>\]
+
+On the last hop router if it is desired to not switch over to the SPT tree
+configure this command.
+
+Optional parameter prefix-list can be use to control which groups to switch or
+not switch. If a group is PERMIT as per the prefix-list, then the SPT switchover
+does not happen for it and if it is DENY, then the SPT switchover happens.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim ssm prefix-list \<list\>
+
+Specify a range of group addresses via a prefix-list that forces PIM to never
+do `SSM (Source-Specific Multicast)` over.
+
+</div>
+
+### Interface specific commands
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> bfd \[profile \<name\>\]
+
+Automatically create BFD session for each RIP peer discovered in this
+interface. When the BFD session monitor signalize that the link is down
+the RIP peer is removed and all the learned routes associated with that
+peer are removed.
+
+If optional profile parameter is used, select a BFD profile for the BFD
+sessions created via this interface.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> dr-priority \<n\>
+
+Set the `DR (Designated Router)` Priority for the interface.
+This command is useful to allow the user to influence what node becomes
+the DR for a LAN segment.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> hello \<n\>
+
+Set the PIM hello and hold interval for a interface.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> no-bsm
+
+Tell PIM that we would not like to use this interface to process
+bootstrap messages.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> no-unicast-bsm
+
+Tell PIM that we would not like to use this interface to process
+unicast bootstrap messages.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> passive
+
+Disable sending and receiving PIM control packets on the interface.
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> source-address \<ip-address\>
+
+</div>
+
+If you have multiple addresses configured on a particular interface and would
+like PIM to use a specific source address associated with that interface.
+
+</div>
+
+## IGMP - Internet Group Management Protocol)
+
+<div class="cfgcmd">
+
+set protocols pim igmp watermark-warning \<n\>
+
+Configure watermark warning generation for an IGMP group limit. Generates
+warning once the configured group limit is reached while adding new groups.
+
+</div>
+
+### Interface specific commands
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> igmp
+join \<multicast-address\> source-address \<IP-address\>
+
+Use this command to allow the selected interface to join a multicast
+group defining the multicast address you want to join and the source
+IP address too.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> igmp
+query-interval \<seconds\>
+
+Use this command to configure in the selected interface the IGMP
+host query interval (1-1800) in seconds that PIM will use.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> igmp
+query-max-response-time \<n\>
+
+Use this command to configure in the selected interface the IGMP
+query response timeout value (10-250) in deciseconds. If a report is
+not returned in the specified time, it will be assumed the (S,G) or
+(\*,G) state `7761#section-4.1` has timed out.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim interface \<interface\> igmp version \<version-number\>
+
+Use this command to define in the selected interface whether you
+choose IGMP version 2 or 3.
+
+The default value is 3.
+
+</div>
+
+#### Example
+
+In the following example we can see a basic multicast setup:
+
+<img src="/_static/images/multicast-basic.webp" class="align-center" style="width:90.0%" alt="Network Topology Diagram" />
+
+**Router 1**
+
+``` none
+set interfaces ethernet eth2 address '172.16.0.2/24'
+set interfaces ethernet eth1 address '100.64.0.1/24'
+set protocols ospf area 0 network '172.16.0.0/24'
+set protocols ospf area 0 network '100.64.0.0/24'
+set protocols igmp interface eth1
+set protocols pim interface eth1
+set protocols pim interface eth2
+set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'
+```
+
+**Router 3**
+
+``` none
+set interfaces dummy dum0 address '172.16.255.1/24'
+set interfaces ethernet eth0 address '172.16.0.1/24'
+set interfaces ethernet eth1 address '172.16.1.1/24'
+set protocols ospf area 0 network '172.16.0.0/24'
+set protocols ospf area 0 network '172.16.255.0/24'
+set protocols ospf area 0 network '172.16.1.0/24'
+set protocols pim interface dum0
+set protocols pim interface eth0
+set protocols pim interface eth1
+set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'
+```
+
+**Router 2**
+
+``` none
+set interfaces ethernet eth1 address '10.0.0.1/24'
+set interfaces ethernet eth2 address '172.16.1.2/24'
+set protocols ospf area 0 network '10.0.0.0/24'
+set protocols ospf area 0 network '172.16.1.0/24'
+set protocols pim interface eth1
+set protocols pim interface eth2
+set protocols pim rp address 172.16.255.1 group '224.0.0.0/4'
+```
diff --git a/docs/configuration/protocols/md-pim6.md b/docs/configuration/protocols/md-pim6.md
new file mode 100644
index 00000000..6b3c00fc
--- /dev/null
+++ b/docs/configuration/protocols/md-pim6.md
@@ -0,0 +1,122 @@
+# PIM6 - Protocol Independent Multicast for IPv6
+
+VyOS facilitates IPv6 Multicast by supporting **PIMv6** and **MLD**.
+
+PIMv6 (Protocol Independent Multicast for IPv6) must be configured in every
+interface of every participating router. Every router must also have the
+location of the Rendevouz Point manually configured.
+Then, unidirectional shared trees rooted at the Rendevouz Point will
+automatically be built for multicast distribution.
+
+Traffic from multicast sources will go to the Rendezvous Point, and receivers
+will pull it from a shared tree using MLD (Multicast Listener Discovery).
+
+Multicast receivers will talk MLD to their local router, so, besides having
+PIMv6 configured in every router, MLD must also be configured in any router
+where there could be a multicast receiver locally connected.
+
+VyOS supports both MLD version 1 and version 2
+(which allows source-specific multicast).
+
+## Basic commands
+
+These are the commands for a basic setup.
+
+<div class="cfgcmd">
+
+set protocols pim6 interface \<interface-name\>
+
+Use this command to enable PIMv6 in the selected interface so that it
+can communicate with PIMv6 neighbors. This command also enables MLD reports
+and query on the interface unless `mld disable` is configured.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim6 interface \<interface-name\> mld disable
+
+Disable MLD reports and query on the interface.
+
+</div>
+
+## Tuning commands
+
+You can also tune multicast with the following commands.
+
+<div class="cfgcmd">
+
+set protocols pim6 interface \<interface-name\> mld interval \<seconds\>
+
+Use this command to configure in the selected interface the MLD
+host query interval (1-65535) in seconds that PIM will use.
+The default value is 125 seconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim6 interface \<interface-name\> mld join \<multicast-address\>
+
+Use this command to allow the selected interface to join a multicast group.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim6 interface \<interface-name\> mld join \<multicast-address\> source \<source-address\>
+
+Use this command to allow the selected interface to join a source-specific multicast
+group.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim6 interface \<interface-name\> mld last-member-query-count \<count\>
+
+Set the MLD last member query count. The default value is 2.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim6 interface \<interface-name\> mld last-member-query-interval \<milliseconds\>
+
+Set the MLD last member query interval in milliseconds (100-6553500). The default value is 1000 milliseconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim6 interface \<interface-name\> mld max-response-time \<milliseconds\>
+
+Set the MLD query response timeout in milliseconds (100-6553500). The default value is 10000 milliseconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols pim6 interface \<interface-name\> mld version \<version-number\>
+
+Set the MLD version used on this interface. The default value is 2.
+
+</div>
+
+### Configuration Example
+
+To enable MLD reports and query on interfaces <span class="title-ref">eth0</span> and \`eth1\`:
+
+``` none
+set protocols pim6 interface eth0
+set protocols pim6 interface eth1
+```
+
+The following configuration explicitly joins multicast group <span class="title-ref">ff15::1234</span> on interface <span class="title-ref">eth1</span>
+and source-specific multicast group <span class="title-ref">ff15::5678</span> with source address <span class="title-ref">2001:db8::1</span> on interface
+\`eth1\`:
+
+``` none
+set protocols pim6 interface eth0 mld join ff15::1234
+set protocols pim6 interface eth1 mld join ff15::5678 source 2001:db8::1
+```
diff --git a/docs/configuration/protocols/md-rip.md b/docs/configuration/protocols/md-rip.md
new file mode 100644
index 00000000..1bd580ab
--- /dev/null
+++ b/docs/configuration/protocols/md-rip.md
@@ -0,0 +1,361 @@
+lastproofread  
+2021-10-04
+
+# RIP
+
+`RIP (Routing Information Protocol)` is a widely deployed interior gateway
+protocol. RIP was developed in the 1970s at Xerox Labs as part of the XNS
+routing protocol. RIP is a distance-vector protocol and is based on the
+Bellman-Ford algorithms. As a distance-vector protocol, RIP router send updates
+to its neighbors periodically, thus allowing the convergence to a known
+topology. In each update, the distance to any given network will be broadcast
+to its neighboring router.
+
+Supported versions of RIP are:
+
+> - RIPv1 as described in `1058`
+> - RIPv2 as described in `2453`
+
+## General Configuration
+
+<div class="cfgcmd">
+
+set protocols rip network \<A.B.C.D/M\>
+
+This command enables RIP and sets the RIP enable interface by NETWORK.
+The interfaces which have addresses matching with NETWORK are enabled.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip interface \<interface\>
+
+This command specifies a RIP enabled interface by interface name. Both
+the sending and receiving of RIP packets will be enabled on the port
+specified in this command.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip neighbor \<A.B.C.D\>
+
+This command specifies a RIP neighbor. When a neighbor doesn’t understand
+multicast, this command is used to specify neighbors. In some cases, not
+all routers will be able to understand multicasting, where packets are
+sent to a network or a group of addresses. In a situation where a neighbor
+cannot process multicast packets, it is necessary to establish a direct
+link between routers.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip passive-interface interface \<interface\>
+
+This command sets the specified interface to passive mode. On passive mode
+interface, all receiving packets are processed as normal and VyOS does not
+send either multicast or unicast RIP packets except to RIP neighbors
+specified with neighbor command.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip passive-interface interface default
+
+This command specifies all interfaces to passive mode.
+
+</div>
+
+## Optional Configuration
+
+<div class="cfgcmd">
+
+set protocols rip default-distance \<distance\>
+
+This command change the distance value of RIP. The distance range is 1 to 255.
+
+> <div class="note">
+>
+> <div class="title">
+>
+> Note
+>
+> </div>
+>
+> Routes with a distance of 255 are effectively disabled and not
+> installed into the kernel.
+>
+> </div>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip network-distance \<A.B.C.D/M\> distance \<distance\>
+
+This command sets default RIP distance to a specified value when the routes
+source IP address matches the specified prefix.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip network-distance \<A.B.C.D/M\> access-list \<name\>
+
+This command can be used with previous command to sets default RIP distance
+to specified value when the route source IP address matches the specified
+prefix and the specified access-list.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip default-information originate
+
+This command generate a default route into the RIP.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip distribute-list access-list \<in|out\> \<number\>
+
+This command can be used to filter the RIP path using access lists.
+`in` and `out` this is the direction in which the access
+lists are applied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip distribute-list interface \<interface\> access-list \<in|out\> \<number\>
+
+This command allows you apply access lists to a chosen interface to
+filter the RIP path.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip distribute-list prefix-list \<in|out\> \<name\>
+
+This command can be used to filter the RIP path using prefix lists.
+`in` and `out` this is the direction in which the prefix
+lists are applied.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip distribute-list interface \<interface\> prefix-list \<in|out\> \<name\>
+
+This command allows you apply prefix lists to a chosen interface to
+filter the RIP path.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip route \<A.B.C.D/M\>
+
+This command is specific to FRR and VyOS. The route command makes a static
+route only inside RIP. This command should be used only by advanced users
+who are particularly knowledgeable about the RIP protocol. In most cases,
+we recommend creating a static route in VyOS and redistributing it in RIP
+using `redistribute static`.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip timers update \<seconds\>
+
+This command specifies the update timer. Every update timer seconds, the
+RIP process is awakened to send an unsolicited response message containing
+the complete routing table to all neighboring RIP routers. The time range
+is 5 to 2147483647. The default value is 30 seconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip timers timeout \<seconds\>
+
+This command specifies the timeout timer. Upon expiration of the timeout,
+the route is no longer valid; however, it is retained in the routing table
+for a short time so that neighbors can be notified that the route has been
+dropped. The time range is 5 to 2147483647. The default value is 180
+seconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip timers garbage-collection \<seconds\>
+
+This command specifies the garbage-collection timer. Upon expiration of
+the garbage-collection timer, the route is finally removed from the
+routing table. The time range is 5 to 2147483647. The default value is 120
+seconds.
+
+</div>
+
+## Redistribution Configuration
+
+<div class="cfgcmd">
+
+set protocols rip redistribute \<route source\>
+
+This command redistributes routing information from the given route source
+into the RIP tables. There are five modes available for route source: bgp,
+connected, kernel, ospf, static.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip redistribute \<route source\> metric \<metric\>
+
+This command specifies metric for redistributed routes from the given route
+source. There are five modes available for route source: bgp, connected,
+kernel, ospf, static. The metric range is 1 to 16.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip redistribute \<route source\> route-map \<name\>
+
+This command allows to use route map to filter redistributed routes from
+the given route source. There are five modes available for route source:
+bgp, connected, kernel, ospf, static.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rip default-metric \<metric\>
+
+This command modifies the default metric (hop count) value for redistributed
+routes. The metric range is 1 to 16. The default value is 1. This command
+does not affect connected route even if it is redistributed by
+`redistribute connected`. To modify connected routes metric
+value, please use `redistribute connected metric`.
+
+</div>
+
+## Interfaces Configuration
+
+<div class="cfgcmd">
+
+set interfaces \<inttype\> \<intname\> ip rip authentication plaintext-password \<text\>
+
+This command sets the interface with RIP simple password authentication.
+This command also sets authentication string. The string must be shorter
+than 16 characters.
+
+</div>
+
+<div class="cfgcmd">
+
+set interfaces \<inttype\> \<intname\> ip rip authentication md5 \<id\> password \<text\>
+
+This command sets the interface with RIP MD5 authentication. This command
+also sets MD5 Key. The key must be shorter than 16 characters.
+
+</div>
+
+<div class="cfgcmd">
+
+set interfaces \<inttype\> \<intname\> ip rip split-horizon disable
+
+This command disables split-horizon on the interface. By default, VyOS does
+not advertise RIP routes out the interface over which they were learned
+(split horizon).3
+
+</div>
+
+<div class="cfgcmd">
+
+set interfaces \<inttype\> \<intname\> ip rip split-horizon poison-reverse
+
+This command enables poison-reverse on the interface. If both poison reverse
+and split horizon are enabled, then VyOS advertises the learned routes
+as unreachable over the interface on which the route was learned.
+
+</div>
+
+## Operational Mode Commands
+
+<div class="opcmd">
+
+show ip rip
+
+This command displays RIP routes.
+
+</div>
+
+``` none
+Codes: R - RIP, C - connected, S - Static, O - OSPF, B - BGP
+Sub-codes:
+      (n) - normal, (s) - static, (d) - default, (r) - redistribute,
+      (i) - interface
+
+     Network            Next Hop         Metric From            Tag Time
+C(i) 10.0.12.0/24       0.0.0.0               1 self              0
+C(i) 10.0.13.0/24       0.0.0.0               1 self              0
+R(n) 10.0.23.0/24       10.0.12.2             2 10.0.12.2         0 02:53
+```
+
+<div class="opcmd">
+
+show ip rip status
+
+The command displays current RIP status. It includes RIP timer, filtering,
+version, RIP enabled interface and RIP peer information.
+
+</div>
+
+``` none
+Routing Protocol is "rip"
+  Sending updates every 30 seconds with +/-50%, next due in 11 seconds
+  Timeout after 180 seconds, garbage collect after 120 seconds
+  Outgoing update filter list for all interface is not set
+  Incoming update filter list for all interface is not set
+  Default redistribution metric is 1
+  Redistributing:
+  Default version control: send version 2, receive any version
+    Interface        Send  Recv   Key-chain
+    eth0             2     1 2
+    eth2             2     1 2
+  Routing for Networks:
+    10.0.12.0/24
+    eth0
+  Routing Information Sources:
+    Gateway          BadPackets BadRoutes  Distance Last Update
+    10.0.12.2                0         0       120   00:00:11
+  Distance: (default is 120)
+```
+
+## Configuration Example
+
+Simple RIP configuration using 2 nodes and redistributing connected interfaces.
+
+**Node 1:**
+
+``` none
+set interfaces loopback address 10.1.1.1/32
+set protocols rip network 192.168.0.0/24
+set protocols rip redistribute connected
+```
+
+**Node 2:**
+
+``` none
+set interfaces loopback address 10.2.2.2/32
+set protocols rip network 192.168.0.0/24
+set protocols rip redistribute connected
+```
diff --git a/docs/configuration/protocols/md-rpki.md b/docs/configuration/protocols/md-rpki.md
new file mode 100644
index 00000000..f41e4d59
--- /dev/null
+++ b/docs/configuration/protocols/md-rpki.md
@@ -0,0 +1,238 @@
+# RPKI
+
+> There are two types of Network Admins who deal with BGP, those who have
+> created an international incident and/or outage, and those who are lying
+>
+> -- [tweet by EvilMog](https://twitter.com/Evil_Mog/status/1230924170508169216), 2020-02-21
+
+`RPKI (Resource Public Key Infrastructure)` is a framework designed to
+secure the Internet routing infrastructure. It associates BGP route
+announcements with the correct originating `ASN (Autonomus System
+Number)` which BGP routers can then use to check each route against the
+corresponding `ROA (Route Origin Authorisation)` for validity. RPKI is
+described in `6480`.
+
+A BGP-speaking router like VyOS can retrieve ROA information from RPKI
+"Relying Party software" (often just called an "RPKI server" or "RPKI
+validator") by using `RTR (RPKI to Router)` protocol. There are several
+open source implementations to choose from, such as NLNetLabs' [Routinator](https://www.nlnetlabs.nl/projects/rpki/routinator/)
+(written in Rust), OpenBSD's [rpki-client](https://www.rpki-client.org/) (written in C), and [StayRTR](https://github.com/bgp/stayrtr/) (written
+in Go). The RTR protocol is described in `8210`.
+
+<div class="tip">
+
+<div class="title">
+
+Tip
+
+</div>
+
+If you are new to these routing security technologies then there is an
+[excellent guide to RPKI](https://rpki.readthedocs.io/) by NLnet Labs which will get you up to speed
+very quickly. Their documentation explains everything from what RPKI is to
+deploying it in production. It also has some
+[help and operational guidance](https://rpki.readthedocs.io/en/latest/about/help.html) including "What can I do about my route
+having an Invalid state?"
+
+</div>
+
+## Getting started
+
+First you will need to deploy an RPKI validator for your routers to use. NLnet
+Labs provides a collection of [software](https://rpki.readthedocs.io/en/latest/ops/tools.html#relying-party-software) you can compare and settle on one.
+Once your server is running you can start validating announcements.
+
+Imported prefixes during the validation may have values:
+
+> valid  
+> The prefix and ASN that originated it match a signed ROA. These are
+> probably trustworthy route announcements.
+>
+> invalid  
+> The prefix or prefix length and ASN that originated it doesn't
+> match any existing ROA. This could be the result of a prefix hijack, or
+> merely a misconfiguration, but should probably be treated as
+> untrustworthy route announcements.
+>
+> notfound  
+> No ROA exists which covers that prefix. Unfortunately this is the case for
+> about 40%-50% of the prefixes which were announced to the `DFZ
+> (default-free zone)` at the start of 2024.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+If you are responsible for the global addresses assigned to your
+network, please make sure that your prefixes have ROAs associated with them
+to avoid being <span class="title-ref">notfound</span> by RPKI. For most ASNs this will involve
+publishing ROAs via your `RIR (Regional Internet Registry)` (RIPE
+NCC, APNIC, ARIN, LACNIC, or AFRINIC), and is something you are encouraged
+to do whenever you plan to announce addresses into the DFZ.
+
+Particularly large networks may wish to run their own RPKI certificate
+authority and publication server instead of publishing ROAs via their RIR.
+This is a subject far beyond the scope of VyOS' documentation. Consider
+reading about [Krill](https://www.nlnetlabs.nl/projects/rpki/krill/) if this is a rabbit hole you need or especially want
+to dive down.
+
+</div>
+
+### Features of the Current Implementation
+
+In a nutshell, the current implementation provides the following features:
+
+- The BGP router can connect to one or more RPKI cache servers to receive
+  validated prefix to origin AS mappings. Advanced failover can be implemented
+  by server sockets with different preference values.
+- If no connection to an RPKI cache server can be established after a
+  pre-defined timeout, the router will process routes without prefix origin
+  validation. It still will try to establish a connection to an RPKI cache
+  server in the background.
+- By default, enabling RPKI does not change best path selection. In particular,
+  invalid prefixes will still be considered during best path selection. However,
+  the router can be configured to ignore all invalid prefixes.
+- Route maps can be configured to match a specific RPKI validation state. This
+  allows the creation of local policies, which handle BGP routes based on the
+  outcome of the Prefix Origin Validation.
+- Updates from the RPKI cache servers are directly applied and path selection is
+  updated accordingly. (Soft reconfiguration must be enabled for this to work).
+
+## Configuration
+
+<div class="cfgcmd">
+
+set protocols rpki polling-period \<1-86400\>
+
+Define the time interval to update the local cache
+
+The default value is 300 seconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rpki expire-interval \<600-172800\>
+
+Set the number of seconds the router waits until the router
+expires the cache.
+
+The default value is 7200 seconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rpki retry-interval \<1-7200\>
+
+Set the number of seconds the router waits until retrying to connect
+to the cache server.
+
+The default value is 600 seconds.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rpki cache \<address\> port \<port\>
+
+Defined the IPv4, IPv6 or FQDN and port number of the caching RPKI caching
+instance which is used.
+
+This is a mandatory setting.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rpki cache \<address\> preference \<preference\>
+
+Multiple RPKI caching instances can be supplied and they need a preference in
+which their result sets are used.
+
+This is a mandatory setting.
+
+</div>
+
+### SSH
+
+Connections to the RPKI caching server can not only be established by TCP using
+the RTR protocol but you can also rely on a secure SSH session to the server.
+This provides transport integrity and confidentiality and it is a good idea if
+your validation software supports it. To enable SSH, first you need to create
+an SSH client keypair using `generate ssh client-key /config/auth/id_rsa_rpki`. Once your key is created you can setup the
+connection.
+
+<div class="cfgcmd">
+
+set protocols rpki cache \<address\> ssh username \<user\>
+
+SSH username to establish an SSH connection to the cache server.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rpki cache \<address\> ssh private-key-file \<filepath\>
+
+Local path that includes the private key file of the router.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols rpki cache \<address\> ssh public-key-file \<filepath\>
+
+Local path that includes the public key file of the router.
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+When using SSH, private-key-file and public-key-file
+are mandatory options.
+
+</div>
+
+## Example
+
+We can build route-maps for import based on these states. Here is a simple
+RPKI configuration, where <span class="title-ref">routinator</span> is the RPKI-validating "cache"
+server with ip \`192.0.2.1\`:
+
+``` none
+set protocols rpki cache 192.0.2.1 port '3323'
+set protocols rpki cache 192.0.2.1 preference '1'
+```
+
+Here is an example route-map to apply to routes learned at import. In this
+filter we reject prefixes with the state <span class="title-ref">invalid</span>, and set a higher
+<span class="title-ref">local-preference</span> if the prefix is RPKI <span class="title-ref">valid</span> rather than merely
+<span class="title-ref">notfound</span>.
+
+``` none
+set policy route-map ROUTES-IN rule 10 action 'permit'
+set policy route-map ROUTES-IN rule 10 match rpki 'valid'
+set policy route-map ROUTES-IN rule 10 set local-preference '300'
+set policy route-map ROUTES-IN rule 20 action 'permit'
+set policy route-map ROUTES-IN rule 20 match rpki 'notfound'
+set policy route-map ROUTES-IN rule 20 set local-preference '125'
+set policy route-map ROUTES-IN rule 30 action 'deny'
+set policy route-map ROUTES-IN rule 30 match rpki 'invalid'
+```
+
+Once your routers are configured to reject RPKI-invalid prefixes, you can
+test whether the configuration is working correctly using Cloudflare's [test](https://isbgpsafeyet.com/)
+website. Keep in mind that in order for this to work, you need to have no
+default routes or anything else that would still send traffic to RPKI-invalid
+destinations.
diff --git a/docs/configuration/protocols/md-segment-routing.md b/docs/configuration/protocols/md-segment-routing.md
new file mode 100644
index 00000000..24516103
--- /dev/null
+++ b/docs/configuration/protocols/md-segment-routing.md
@@ -0,0 +1,442 @@
+# Segment Routing
+
+Segment Routing (SR) is a network architecture that is similar to source-routing
+. In this architecture, the ingress router adds a list of segments, known as
+SIDs, to the packet as it enters the network. These segments represent different
+portions of the network path that the packet will take.
+
+The SR segments are portions of the network path taken by the packet, and are
+called SIDs. At each node, the first SID of the list is read, executed as a
+forwarding function, and may be popped to let the next node read the next SID of
+the list. The SID list completely determines the path where the packet is
+forwarded.
+
+Segment Routing can be applied to an existing MPLS-based data plane and defines
+a control plane network architecture. In MPLS networks, segments are encoded as
+MPLS labels and are added at the ingress router. These MPLS labels are then
+exchanged and populated by Interior Gateway Protocols (IGPs) like IS-IS or OSPF
+which are running on most ISPs.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+Segment routing defines a control plane network architecture and
+can be applied to an existing MPLS based dataplane. In the MPLS networks,
+segments are encoded as MPLS labels and are imposed at the ingress router.
+MPLS labels are exchanged and populated by IGPs like IS-IS.Segment Routing
+as per RFC8667 for MPLS dataplane. It supports IPv4, IPv6 and ECMP and has
+been tested against Cisco & Juniper routers.however,this deployment is still
+EXPERIMENTAL for FRR.
+
+</div>
+
+## IS-IS SR Configuration
+
+Segment routing (SR) is used by the IGP protocols to interconnect network
+devices, below configuration shows how to enable SR on IS-IS:
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+`Known limitations:`
+
+No support for level redistribution (L1 to L2 or L2 to L1)
+
+No support for binding SID
+
+No support for SRLB
+
+Only one SRGB and default SPF Algorithm is supported
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis segment-routing global-block high-label-value
+\<label-value\>
+
+Set the Segment Routing Global Block i.e. the label range used by MPLS to
+store label in the MPLS FIB for Prefix SID. Note that the block size may
+not exceed 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis segment-routing global-block low-label-value
+\<label-value\>
+
+Set the Segment Routing Global Block i.e. the low label range used by MPLS to
+store label in the MPLS FIB for Prefix SID. Note that the block size may
+not exceed 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis segment-routing local-block high-label-value
+\<label-value\>
+
+Set the Segment Routing Local Block i.e. the label range used by MPLS to
+store label in the MPLS FIB for Prefix SID. Note that the block size may
+not exceed 65535.Segment Routing Local Block, The negative command always
+unsets both.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis segment-routing local-block \<low-label-value
+\<label-value\>
+
+Set the Segment Routing Local Block i.e. the low label range used by MPLS to
+store label in the MPLS FIB for Prefix SID. Note that the block size may
+not exceed 65535.Segment Routing Local Block, The negative command always
+unsets both.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis segment-routing maximum-label-depth \<1-16\>
+
+Set the Maximum Stack Depth supported by the router. The value depend of
+the MPLS dataplane.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis segment-routing prefix \<address\> index value
+\<0-65535\>
+
+A segment ID that contains an IP address prefix calculated by an IGP in the
+service provider core network. Prefix SIDs are globally unique, this value
+indentify it
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols isis segment-routing prefix \<address\> index
+\<no-php-flag | explicit-null| n-flag-clear\>
+
+this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO
+Penultimate Hop Popping that allows SR node to request to its neighbor to
+not pop the label. The ‘explicit-null’ flag allows SR node to request to its
+neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’
+option can be used to explicitly clear the Node flag that is set by default
+for Prefix-SIDs associated to loopback addresses. This option is necessary
+to configure Anycast-SIDs.
+
+</div>
+
+<div class="opcmd">
+
+show isis segment-routing node
+
+Show detailed information about all learned Segment Routing Nodes
+
+</div>
+
+<div class="opcmd">
+
+show isis route prefix-sid
+
+Show detailed information about prefix-sid and label learned
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+more information related IGP - `routing-isis`
+
+</div>
+
+## OSPF SR Configuration
+
+Segment routing (SR) is used by the IGP protocols to interconnect network
+devices, below configuration shows how to enable SR on OSPF:
+
+<div class="cfgcmd">
+
+set protocols ospf parameters opaque-lsa
+
+Enable the Opaque-LSA capability (rfc2370), necessary to transport label
+on IGP
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf segment-routing global-block high-label-value
+\<label-value\>
+
+Set the Segment Routing Global Block i.e. the label range used by MPLS to
+store label in the MPLS FIB for Prefix SID. Note that the block size may
+not exceed 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf segment-routing global-block low-label-value
+\<label-value\>
+
+Set the Segment Routing Global Block i.e. the low label range used by MPLS to
+store label in the MPLS FIB for Prefix SID. Note that the block size may
+not exceed 65535.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf segment-routing local-block high-label-value
+\<label-value\>
+
+Set the Segment Routing Local Block i.e. the label range used by MPLS to
+store label in the MPLS FIB for Prefix SID. Note that the block size may
+not exceed 65535.Segment Routing Local Block, The negative command always
+unsets both.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf segment-routing local-block \<low-label-value
+\<label-value\>
+
+Set the Segment Routing Local Block i.e. the low label range used by MPLS to
+store label in the MPLS FIB for Prefix SID. Note that the block size may
+not exceed 65535.Segment Routing Local Block, The negative command always
+unsets both.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf segment-routing maximum-label-depth \<1-16\>
+
+Set the Maximum Stack Depth supported by the router. The value depend of
+the MPLS dataplane.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf segment-routing prefix \<address\> index value
+\<0-65535\>
+
+A segment ID that contains an IP address prefix calculated by an IGP in the
+service provider core network. Prefix SIDs are globally unique, this value
+indentify it
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols ospf segment-routing prefix \<address\> index
+\<no-php-flag | explicit-null| n-flag-clear\>
+
+this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO
+Penultimate Hop Popping that allows SR node to request to its neighbor to
+not pop the label. The ‘explicit-null’ flag allows SR node to request to its
+neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’
+option can be used to explicitly clear the Node flag that is set by default
+for Prefix-SIDs associated to loopback addresses. This option is necessary
+to configure Anycast-SIDs.
+
+</div>
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+more information related IGP - `routing-ospf`
+
+</div>
+
+## Configuration Example
+
+we described the configuration SR ISIS / SR OSPF using 2 connected with them to
+share label information.
+
+### Enable IS-IS with Segment Routing (Experimental)
+
+**Node 1:**
+
+``` none
+set interfaces loopback lo address '192.168.255.255/32'
+set interfaces ethernet eth1 address '192.0.2.1/24'
+
+set protocols isis interface eth1
+set protocols isis interface lo
+set protocols isis net '49.0001.1921.6825.5255.00'
+set protocols isis segment-routing global-block high-label-value '599'
+set protocols isis segment-routing global-block low-label-value '550'
+set protocols isis segment-routing prefix 192.168.255.255/32 index value '1'
+set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null
+set protocols mpls interface 'eth1'
+```
+
+**Node 2:**
+
+``` none
+set interfaces loopback lo address '192.168.255.254/32'
+set interfaces ethernet eth1 address '192.0.2.2/24'
+
+set protocols isis interface eth1
+set protocols isis interface lo
+set protocols isis net '49.0001.1921.6825.5254.00'
+set protocols isis segment-routing global-block high-label-value '599'
+set protocols isis segment-routing global-block low-label-value '550'
+set protocols isis segment-routing prefix 192.168.255.254/32 index value '2'
+set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null
+set protocols mpls interface 'eth1'
+```
+
+This gives us MPLS segment routing enabled and labels for far end loopbacks:
+
+``` none
+Node-1@vyos:~$ show mpls table
+ Inbound Label  Type        Nexthop                Outbound Label
+ ----------------------------------------------------------------------
+ 552            SR (IS-IS)  192.0.2.2              IPv4 Explicit Null <-- Node-2 loopback learned on Node-1
+ 15000          SR (IS-IS)  192.0.2.2              implicit-null
+ 15001          SR (IS-IS)  fe80::e87:6cff:fe09:1  implicit-null
+ 15002          SR (IS-IS)  192.0.2.2              implicit-null
+ 15003          SR (IS-IS)  fe80::e87:6cff:fe09:1  implicit-null
+
+Node-2@vyos:~$ show mpls table
+ Inbound Label  Type        Nexthop               Outbound Label
+ ---------------------------------------------------------------------
+ 551            SR (IS-IS)  192.0.2.1             IPv4 Explicit Null <-- Node-1 loopback learned on Node-2
+ 15000          SR (IS-IS)  192.0.2.1             implicit-null
+ 15001          SR (IS-IS)  fe80::e33:2ff:fe80:1  implicit-null
+ 15002          SR (IS-IS)  192.0.2.1             implicit-null
+ 15003          SR (IS-IS)  fe80::e33:2ff:fe80:1  implicit-null
+```
+
+Here is the routing tables showing the MPLS segment routing label operations:
+
+``` none
+Node-1@vyos:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+I   192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48
+I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39
+
+Node-2@vyos:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+I   192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46
+I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43
+```
+
+### Enable OSPF with Segment Routing (Experimental):
+
+**Node 1**
+
+``` none
+set interfaces loopback lo address 10.1.1.1/32
+set interfaces ethernet eth0 address 192.168.0.1/24
+set protocols ospf area 0 network '192.168.0.0/24'
+set protocols ospf area 0 network '10.1.1.1/32'
+set protocols ospf parameters opaque-lsa
+set protocols ospf parameters router-id '10.1.1.1'
+set protocols ospf segment-routing global-block high-label-value '1100'
+set protocols ospf segment-routing global-block low-label-value '1000'
+set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null
+set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1'
+```
+
+**Node 2**
+
+``` none
+set interfaces loopback lo address 10.1.1.2/32
+set interfaces ethernet eth0 address 192.168.0.2/24
+set protocols ospf area 0 network '192.168.0.0/24'
+set protocols ospf area 0 network '10.1.1.2/32'
+set protocols ospf parameters opaque-lsa
+set protocols ospf parameters router-id '10.1.1.2'
+set protocols ospf segment-routing global-block high-label-value '1100'
+set protocols ospf segment-routing global-block low-label-value '1000'
+set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null
+set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2'
+```
+
+This gives us MPLS segment routing enabled and labels for far end loopbacks:
+
+``` none
+Node-1@vyos:~$ show mpls table
+ Inbound Label  Type       Nexthop      Outbound Label
+ -----------------------------------------------------------
+ 1002           SR (OSPF)  192.168.0.2  IPv4 Explicit Null  <-- Node-2 loopback learned on Node-1
+ 15000          SR (OSPF)  192.168.0.2  implicit-null
+ 15001          SR (OSPF)  192.168.0.2  implicit-null
+
+Node-2@vyos:~$ show mpls table
+ Inbound Label  Type       Nexthop      Outbound Label
+ -----------------------------------------------------------
+ 1001           SR (OSPF)  192.168.0.1  IPv4 Explicit Null  <-- Node-1 loopback learned on Node-2
+ 15000          SR (OSPF)  192.168.0.1  implicit-null
+ 15001          SR (OSPF)  192.168.0.1  implicit-null
+```
+
+Here is the routing tables showing the MPLS segment routing label operations:
+
+``` none
+Node-1@vyos:~$ show ip route ospf
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+O   10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43
+O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32
+O   192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43
+
+Node-2@vyos:~$ show ip route ospf
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+       f - OpenFabric,
+       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+       t - trapped, o - offload failure
+
+O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36
+O   10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51
+O   192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51
+```
diff --git a/docs/configuration/protocols/md-static.md b/docs/configuration/protocols/md-static.md
new file mode 100644
index 00000000..dca76d53
--- /dev/null
+++ b/docs/configuration/protocols/md-static.md
@@ -0,0 +1,322 @@
+# Static
+
+Static routes are manually configured routes, which, in general, cannot be
+updated dynamically from information VyOS learns about the network topology from
+other routing protocols. However, if a link fails, the router will remove
+routes, including static routes, from the `RIPB (Routing Information
+Base)` that used this interface to reach the next hop. In general, static
+routes should only be used for very simple network topologies, or to override
+the behavior of a dynamic routing protocol for a small number of routes. The
+collection of all routes the router has learned from its configuration or from
+its dynamic routing protocols is stored in the RIB. Unicast routes are directly
+used to determine the forwarding table used for unicast packet forwarding.
+
+## Static Routes
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> next-hop \<address\>
+
+Configure next-hop <span class="title-ref">\<address\></span> for an IPv4 static route. Multiple static
+routes can be created.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> next-hop \<address\> disable
+
+Disable this IPv4 static route entry.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> next-hop \<address\>
+distance \<distance\>
+
+Defines next-hop distance for this route, routes with smaller administrative
+distance are elected prior to those with a higher distance.
+
+Range is 1 to 255, default is 1.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+Routes with a distance of 255 are effectively disabled and not
+installed into the kernel.
+
+</div>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> next-hop \<address\>
+
+Configure next-hop <span class="title-ref">\<address\></span> for an IPv6 static route. Multiple static
+routes can be created.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> next-hop \<address\> disable
+
+Disable this IPv6 static route entry.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> next-hop \<address\>
+distance \<distance\>
+
+Defines next-hop distance for this route, routes with smaller administrative
+distance are elected prior to those with a higher distance.
+
+Range is 1 to 255, default is 1.
+
+<div class="note">
+
+<div class="title">
+
+Note
+
+</div>
+
+Routes with a distance of 255 are effectively disabled and not
+installed into the kernel.
+
+</div>
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> next-hop \<address\> segments \<segments\>
+
+It is possible to specify a static route for ipv6 prefixes using an SRv6 segments
+instruction. The <span class="title-ref">/</span> separator can be used to specify multiple segment instructions.
+
+Example:
+
+``` none
+set protocols static route6 2001:db8:1000::/36 next-hop 2001:db8:201::ffff segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2'
+```
+
+``` none
+vyos@vyos:~$ show ipv6 route
+Codes: K - kernel route, C - connected, S - static, R - RIPng,
+      O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table,
+      v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+      f - OpenFabric,
+      > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+      t - trapped, o - offload failure
+C>* 2001:db8:201::/64 is directly connected, eth0.201, 00:00:46
+S>* 2001:db8:1000::/36 [1/0] via 2001:db8:201::ffff, eth0.201, seg6 2001:db8:aaaa::7,2002::4,2002::3,2002::2, weight 1, 00:00:08
+```
+
+</div>
+
+### Interface Routes
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> interface
+\<interface\>
+
+Allows you to configure the next-hop interface for an interface-based IPv4
+static route. <span class="title-ref">\<interface\></span> will be the next-hop interface where traffic is
+routed for the given <span class="title-ref">\<subnet\></span>.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> interface
+\<interface\> disable
+
+Disables interface-based IPv4 static route.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> interface
+\<interface\> distance \<distance\>
+
+Defines next-hop distance for this route, routes with smaller administrative
+distance are elected prior to those with a higher distance.
+
+Range is 1 to 255, default is 1.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> interface
+\<interface\>
+
+Allows you to configure the next-hop interface for an interface-based IPv6
+static route. <span class="title-ref">\<interface\></span> will be the next-hop interface where traffic is
+routed for the given <span class="title-ref">\<subnet\></span>.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> interface
+\<interface\> disable
+
+Disables interface-based IPv6 static route.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> interface
+\<interface\> distance \<distance\>
+
+Defines next-hop distance for this route, routes with smaller administrative
+distance are elected prior to those with a higher distance.
+
+Range is 1 to 255, default is 1.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> interface
+\<interface\> segments \<segments\>
+
+It is possible to specify a static route for ipv6 prefixes using an SRv6 segments
+instruction. The <span class="title-ref">/</span> separator can be used to specify multiple segment instructions.
+
+Example:
+
+``` none
+set protocols static route6 2001:db8:1000::/36 interface eth0 segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2'
+```
+
+</div>
+
+### Blackhole
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> blackhole
+
+Use this command to configure a "black-hole" route on the router. A
+black-hole route is a route for which the system silently discard packets
+that are matched. This prevents networks leaking out public interfaces, but
+it does not prevent them from being used as a more specific route inside your
+network.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route \<subnet\> blackhole distance \<distance\>
+
+Defines blackhole distance for this route, routes with smaller administrative
+distance are elected prior to those with a higher distance.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> blackhole
+
+Use this command to configure a "black-hole" route on the router. A
+black-hole route is a route for which the system silently discard packets
+that are matched. This prevents networks leaking out public interfaces, but
+it does not prevent them from being used as a more specific route inside your
+network.
+
+</div>
+
+<div class="cfgcmd">
+
+set protocols static route6 \<subnet\> blackhole distance \<distance\>
+
+Defines blackhole distance for this route, routes with smaller administrative
+distance are elected prior to those with a higher distance.
+
+</div>
+
+### Alternate Routing Tables
+
+TBD
+
+Alternate routing tables are used with policy based routing by utilizing
+`vrf`.
+
+# ARP
+
+`ARP (Address Resolution Protocol)` is a communication protocol used for
+discovering the link layer address, such as a MAC address, associated with a
+given internet layer address, typically an IPv4 address. This mapping is a
+critical function in the Internet protocol suite. ARP was defined in 1982 by
+`826` which is Internet Standard STD 37.
+
+In Internet Protocol Version 6 (IPv6) networks, the functionality of ARP is
+provided by the Neighbor Discovery Protocol (NDP).
+
+To manipulate or display [ARP](https://en.wikipedia.org/wiki/Address_Resolution_Protocol) table entries, the following commands are
+implemented.
+
+## Configure
+
+<div class="cfgcmd">
+
+set protocols static arp interface \<interface\> address \<host\>
+mac \<mac\>
+
+This will configure a static ARP entry always resolving <span class="title-ref">\<address\></span> to
+<span class="title-ref">\<mac\></span> for interface <span class="title-ref">\<interface\></span>.
+
+Example:
+
+``` none
+set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01
+```
+
+</div>
+
+## Operation
+
+<div class="opcmd">
+
+show protocols static arp
+
+Display all known ARP table entries spanning across all interfaces
+
+</div>
+
+``` none
+vyos@vyos:~$ show protocols static arp
+Address                  HWtype  HWaddress           Flags Mask     Iface
+10.1.1.1                 ether   00:53:00:de:23:2e   C              eth1
+10.1.1.100               ether   00:53:00:de:23:aa   CM             eth1
+```
+
+<div class="opcmd">
+
+show protocols static arp interface eth1
+
+Display all known ARP table entries on a given interface only (<span class="title-ref">eth1</span>):
+
+</div>
+
+``` none
+vyos@vyos:~$ show protocols static arp interface eth1
+Address                  HWtype  HWaddress           Flags Mask     Iface
+10.1.1.1                 ether   00:53:00:de:23:2e   C              eth1
+10.1.1.100               ether   00:53:00:de:23:aa   CM             eth1
+```