merge: resolve CLAUDE.md conflict, keep current branch version

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

6 files changed, 89 insertions, 22 deletions

diff --git a/docs/configuration/vpn/index.rst b/docs/configuration/vpn/index.rst
index d0121abd..6d38e5b5 100644
--- a/docs/configuration/vpn/index.rst
+++ b/docs/configuration/vpn/index.rst
@@ -13,12 +13,4 @@ VPN
    pptp
    rsa-keys
    sstp
-
-
-pages to sort
-
-.. toctree::
-   :maxdepth: 1
-   :includehidden:
-
    dmvpn
diff --git a/docs/configuration/vpn/ipsec/index.rst b/docs/configuration/vpn/ipsec/index.rst
index e454e2f6..973c76de 100644
--- a/docs/configuration/vpn/ipsec/index.rst
+++ b/docs/configuration/vpn/ipsec/index.rst
@@ -12,10 +12,4 @@ IPsec
    remoteaccess_ipsec
    troubleshooting_ipsec
 
-pages to sort
-
-.. toctree::
-   :maxdepth: 1
-   :includehidden:
-
 
diff --git a/docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst b/docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst
index 1a41d987..50499160 100644
--- a/docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst
+++ b/docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst
@@ -1,7 +1,11 @@
 .. _remoteaccess_ipsec:
 
+############################
 IPSec IKEv2 Remote Access VPN
-=============================
+############################
+
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
 
 Internet Key Exchange version 2 (IKEv2) is a tunneling protocol, based on IPsec,
 that establishes a secure VPN communication between VPN devices, and defines
diff --git a/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst b/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst
index fdeb347d..f0f2e208 100644
--- a/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst
+++ b/docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst
@@ -4,6 +4,9 @@
 Troubleshooting Site-to-Site VPN IPsec
 ######################################
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 ************
 Introduction
 ************
@@ -26,6 +29,8 @@ Checking IKE SA Status
 
 The next command shows IKE SAs' statuses.
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
  vyos@vyos:~$ show vpn ike sa
@@ -317,6 +322,8 @@ The reason of this problem is showed on the responder side.
  Jun 23 14:13:19 charon[2440]: 01[ENC] <PEER|7> generating IKE_AUTH response 1 [ IDr AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ]
  Jun 23 14:13:19 charon-systemd[2440]: generating IKE_AUTH response 1 [ IDr AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(TS_UNACCEPT) ]
 
+.. start_vyoslinter
+
 Traffic selectors **10.0.2.0/24 === 10.0.0.0/24** are unacceptable on the
 responder side.
 
diff --git a/docs/configuration/vpn/openconnect.rst b/docs/configuration/vpn/openconnect.rst
index 11824e50..0262b3f2 100644
--- a/docs/configuration/vpn/openconnect.rst
+++ b/docs/configuration/vpn/openconnect.rst
@@ -4,6 +4,9 @@
 OpenConnect
 ###########
 
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 OpenConnect-compatible server feature has been available since Equuleus (1.3).
 Openconnect VPN supports SSL connection and offers full network access. SSL VPN
 network extension connects the end-user system to the corporate network with
@@ -37,10 +40,14 @@ client that fetches a certificate from Let's Encrypt an open certificate
 authority launched by the EFF, Mozilla, and others and deploys it to a web 
 server.
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   sudo certbot certonly --standalone --preferred-challenges http -d <domain name>
 
+.. start_vyoslinter
+
 Server Configuration
 ====================
 
@@ -63,6 +70,8 @@ authentication + OTP key can be used. Alternatively, OTP authentication only,
 without a password, can be used.
 To do this, an OTP configuration must be added to the configuration above:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   set vpn openconnect authentication mode local <password-otp|otp>
@@ -71,6 +80,8 @@ To do this, an OTP configuration must be added to the configuration above:
   set vpn openconnect authentication local-users username <user> otp-length <otp-length (optional)>
   set vpn openconnect authentication local-users username <user> token-type <token-type (optional)>
 
+.. start_vyoslinter
+
 For generating an OTP key in VyOS, you can use the CLI command 
 (operational mode):
 
@@ -81,9 +92,21 @@ For generating an OTP key in VyOS, you can use the CLI command
 User Certificate Authentication
 ===============================
 
-You can configure users to be authenticated by certificate by setting the authentication mode to certificate, and defining what field (by OID) in the certificate will be used to identify the username. Two pre-defined shortcuts for Common Name (OID 2.5.4.3) and User ID (OID 0.9.2342.19200300.100.1.1) have been provide as cn or uid. Otherwise a specific OID value must be provided.
+You can configure users to be authenticated by certificate by setting
+the authentication mode to certificate, and defining what field (by OID)
+in the certificate will be used to identify the username. Two pre-defined
+
+.. stop_vyoslinter
+
+shortcuts for Common Name (OID 2.5.4.3) and User ID
+(OID 0.9.2342.19200300.100.1.1) have been provided as cn or uid.
 
-The user's certificate must be signed by the certificate authority defined in the configuration for it to be validated for authentication.
+.. start_vyoslinter
+
+Otherwise a specific OID value must be provided.
+
+The user's certificate must be signed by the certificate authority
+defined in the configuration for it to be validated for authentication.
 
 .. code-block:: none
 
@@ -95,14 +118,17 @@ The user's certificate must be signed by the certificate authority defined in th
 Verification
 ************
 
-.. code-block:: none
+.. stop_vyoslinter
 
+.. code-block:: none
 
   vyos@vyos:~$ sh openconnect-server sessions
   interface    username    ip             remote IP    RX       TX         state      uptime
   -----------  ----------  -------------  -----------  -------  ---------  ---------  --------
   sslvpn0      tst         172.20.20.198  192.168.6.1  0 bytes  152 bytes  connected  3s
 
+.. start_vyoslinter
+
 .. note:: It is compatible with Cisco (R) AnyConnect (R) clients.
 
 *******
@@ -114,6 +140,8 @@ SSL Certificates generation
 
 Follow the instructions to generate CA cert (in configuration mode):
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   vyos@vyos# run generate pki ca install ca-ocserv
@@ -151,6 +179,8 @@ Follow the instructions to generate server cert (in configuration mode):
   2 value(s) installed. Use "compare" to see the pending changes, and "commit" to apply.
   [edit]
 
+.. start_vyoslinter
+
 Each of the install command should be applied to the configuration and commited
 before using under the openconnect configuration:
 
@@ -168,6 +198,8 @@ Openconnect Configuration
 
 Simple setup with one user added and password authentication:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   set vpn openconnect authentication local-users username tst password 'OC_bad_Secret'
@@ -178,6 +210,8 @@ Simple setup with one user added and password authentication:
   set vpn openconnect ssl ca-certificate 'ca-ocserv'
   set vpn openconnect ssl certificate 'srv-ocserv'
 
+.. start_vyoslinter
+
 To enable the HTTP security headers in the configuration file, use the command:
 
 .. code-block:: none
@@ -191,6 +225,8 @@ Adding a 2FA with an OTP-key
 First the OTP keys must be generated and sent to the user and to the 
 configuration:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   vyos@vyos:~$ generate openconnect username tst otp-key hotp-time
@@ -222,13 +258,19 @@ configuration:
   # To add this OTP key to configuration, run the following commands:
   set vpn openconnect authentication local-users username tst otp key 'ebc1c91b13848ce0bb67d9212934546e41803cfa'
 
+.. start_vyoslinter
+
 Next it is necessary to configure 2FA for OpenConnect:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   set vpn openconnect authentication mode local password-otp
   set vpn openconnect authentication local-users username tst otp key 'ebc1c91b13848ce0bb67d9212934546e41803cfa'
 
+.. start_vyoslinter
+
 Now when connecting the user will first be asked for the password 
 and then the OTP key.
 
@@ -254,6 +296,8 @@ outlines the set of configuration options that are allowed. This can be
 leveraged to apply different sets of configs to different users or groups of
 users.
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   sudo mkdir -p /config/auth/ocserv/config-per-user
@@ -263,6 +307,8 @@ users.
   set vpn openconnect authentication identity-based-config directory /config/auth/ocserv/config-per-user
   set vpn openconnect authentication identity-based-config default-config /config/auth/ocserv/default-user.conf
 
+.. start_vyoslinter
+
 .. warning:: The above directory and default-config must be a child directory
   of /config/auth, since files outside this directory are not persisted after an
   image upgrade.
@@ -297,6 +343,8 @@ connect/disconnect, data transferred, and so on.
 
 Configure an accounting server and enable accounting with:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   set vpn openconnect accounting mode radius
@@ -304,12 +352,16 @@ Configure an accounting server and enable accounting with:
   set vpn openconnect accounting radius server 172.20.20.10 port 1813
   set vpn openconnect accounting radius server 172.20.20.10 key your_radius_secret
 
+.. start_vyoslinter
+
 .. warning:: The RADIUS accounting feature must be used with the OpenConnect
   authentication mode RADIUS. It cannot be used with local authentication.
   You must configure the OpenConnect authentication mode to "radius".
 
 An example of the data captured by a FREERADIUS server with sql accounting:
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   mysql> SELECT username, nasipaddress, acctstarttime, acctstoptime, acctinputoctets, acctoutputoctets, callingstationid, framedipaddress, connectinfo_start FROM radacct;
@@ -318,3 +370,5 @@ An example of the data captured by a FREERADIUS server with sql accounting:
   +----------+---------------+---------------------+---------------------+-----------------+------------------+-------------------+-----------------+-----------------------------------+
   | test     | 198.51.100.15 | 2023-01-13 00:59:15 | 2023-01-13 00:59:21 |           10606 |              152 | 192.168.6.1       | 172.20.20.198   | Open AnyConnect VPN Agent v8.05-1 |
   +----------+---------------+---------------------+---------------------+-----------------+------------------+-------------------+-----------------+-----------------------------------+
+
+.. start_vyoslinter
diff --git a/docs/configuration/vpn/rsa-keys.rst b/docs/configuration/vpn/rsa-keys.rst
index 0508522f..e7584563 100644
--- a/docs/configuration/vpn/rsa-keys.rst
+++ b/docs/configuration/vpn/rsa-keys.rst
@@ -2,6 +2,10 @@
 ########
 RSA-Keys
 ########
+
+.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd
+   directives for command coverage tracking.
+
 RSA can be used for services such as key exchanges and for encryption purposes.
 To make IPSec work with dynamic address on one/both sides, we will have to use
 RSA keys for authentication. They are very fast and easy to setup.
@@ -9,6 +13,8 @@ RSA keys for authentication. They are very fast and easy to setup.
 First, on both routers run the operational command "generate pki key-pair 
 install <key-pair nam>>". You may choose different length than 2048 of course.
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   vyos@left# run generate pki key-pair install ipsec-LEFT
@@ -23,6 +29,8 @@ install <key-pair nam>>". You may choose different length than 2048 of course.
   set pki key-pair ipsec-LEFT private key 'MIIEvgIBADAN...'
   [edit]
 
+.. start_vyoslinter
+
 Configuration commands will display.
 Note the command with the public key 
 (set pki key-pair ipsec-LEFT public key 'MIIBIjANBgkqh...'). 
@@ -51,13 +59,19 @@ On the RIGHT:
 
 Now you are ready to setup IPsec. The key points:
 
-1. Since both routers do not know their effective public addresses, we set the local-address of the peer to "any".
-2. On the initiator, we set the peer address to its public address, but on the responder we only set the id.
-3. On the initiator, we need to set the remote-id option so that it can identify IKE traffic from the responder correctly.
-4. On the responder, we need to set the local id so that initiator can know who's talking to it for the point #3 to work.
+1. Since both routers do not know their effective public addresses,
+   we set the local-address of the peer to "any".
+2. On the initiator, we set the peer address to its public address,
+   but on the responder we only set the id.
+3. On the initiator, we need to set the remote-id option so that it
+   can identify IKE traffic from the responder correctly.
+4. On the responder, we need to set the local id so that initiator
+   can know who's talking to it for the point #3 to work.
 
 On the LEFT (static address):
 
+.. stop_vyoslinter
+
 .. code-block:: none
 
   set vpn ipsec interface eth0
@@ -105,3 +119,5 @@ On the RIGHT (dynamic address):
   set vpn ipsec site-to-site peer 192.0.2.10 local-address any
   set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 local prefix 192.168.99.2/32  # Additional loopback address on the local
   set vpn ipsec site-to-site peer 192.0.2.10 tunnel 1 remote prefix 192.168.99.1/32 # Additional loopback address on the remote
+
+.. start_vyoslinter