Apply suggestions from Liydmyladocs/t8887-phase1-batch1

Co-authored-by: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com>

6 files changed, 95 insertions, 78 deletions

diff --git a/docs/configuration/firewall/global-options.md b/docs/configuration/firewall/global-options.md
index ce18c059..d8e9999d 100644
--- a/docs/configuration/firewall/global-options.md
+++ b/docs/configuration/firewall/global-options.md
@@ -123,26 +123,43 @@ The following sysctl parameter will be changed:
 
 ```{cfgcmd} set firewall global-options geoip provider \<db-ip | maxmind\>
 
-Select the GeoIP database provider used to resolve country codes
-for firewall GeoIP matching. `db-ip` uses the DB-IP.com database and requires
-no credentials; `maxmind` uses the MaxMind database and requires a MaxMind
-account ID and license key. The default is `db-ip`.
+**Configure the GeoIP database provider that supplies the IP address ranges used for firewall GeoIP country-code and {abbr}`ASN (Autonomous System Number)` matching.**
+
+- `db-ip`: Uses the DB-IP Lite databases and requires no credentials.
+- `maxmind`: Uses the MaxMind databases and requires both `maxmind-account-id` and `maxmind-license-key`. Otherwise, the commit fails.
+
+The default is `db-ip`.
 ```
 
 ```{cfgcmd} set firewall global-options geoip maxmind-account-id \<id\>
 
-Account ID for the MaxMind GeoIP database.
+**Configure the MaxMind account ID the router uses to authenticate when
+downloading the MaxMind databases.**
+
+Required when `provider` is `maxmind`. You must configure both
+`maxmind-account-id` and `maxmind-license-key`. Otherwise, the commit
+fails.
 ```
 
 ```{cfgcmd} set firewall global-options geoip maxmind-license-key \<key\>
 
-License key for the MaxMind GeoIP database.
+**Configure the MaxMind license key used to authenticate when
+downloading the MaxMind databases.**
+
+Required when `provider` is `maxmind`. You must configure both
+`maxmind-account-id` and `maxmind-license-key`. Otherwise, the commit
+fails.
 ```
 
 ```{cfgcmd} set firewall global-options geoip maxmind-lite
 
-Use the free MaxMind GeoLite2 database instead of the paid
-GeoIP2 database.
+**Select the MaxMind GeoLite2 databases instead of the GeoIP2 databases
+as the GeoIP data source.**
+
+By default, the router downloads the GeoIP2 databases.
+
+The command applies only when `provider` is `maxmind`. GeoLite2 still
+requires `maxmind-account-id` and `maxmind-license-key`.
 ```
 
 ```{cfgcmd} set firewall global-options state-policy established action [accept | drop | reject]
diff --git a/docs/configuration/highavailability/index.md b/docs/configuration/highavailability/index.md
index 4c017b76..4f462506 100644
--- a/docs/configuration/highavailability/index.md
+++ b/docs/configuration/highavailability/index.md
@@ -319,11 +319,6 @@ need to configure it. But if necessary, Gratuitous ARP can be configured in
 
 ## SNMP traps
 
-```{eval-rst}
-.. cfgcmd:: set high-availability vrrp snmp trap
-
-   Enable sending SNMP traps from keepalived on VRRP state changes.
-```
 
 ## Scripting
 
diff --git a/docs/configuration/policy/route-map.md b/docs/configuration/policy/route-map.md
index 524e7ec0..602b59a6 100644
--- a/docs/configuration/policy/route-map.md
+++ b/docs/configuration/policy/route-map.md
@@ -221,8 +221,14 @@ Match RPKI validation result.
 
 ```{cfgcmd} set policy route-map \<text\> rule \<1-65535\> match source-peer \<value\>
 
-BGP source peer to match. The value can be a peer IPv4 address, a peer IPv6
-address, an interface name of a peer, or a BGP peer-group name.
+**Match BGP routes by the peer they were received from.**
+
+The rule then applies only to routes received from the specified peer.
+
+The value is the peer's IPv4 or IPv6 address, the name of the interface
+on which the peer is configured, or the name of a BGP peer-group. A
+peer-group name matches a route received from any peer in that
+peer-group.
 ```
 
 
diff --git a/docs/configuration/protocols/bgp.md b/docs/configuration/protocols/bgp.md
index 29618d27..25e04453 100644
--- a/docs/configuration/protocols/bgp.md
+++ b/docs/configuration/protocols/bgp.md
@@ -2560,15 +2560,14 @@ set protocols bgp parameters confederation peers 65003
 
 ### BGP Monitoring Protocol (BMP) configuration
 
-{abbr}`BMP (BGP Monitoring Protocol)` sends BGP route information to a
-monitoring station.
+{abbr}`BMP (BGP Monitoring Protocol)` lets the router send BGP route
+information to a monitoring station.
 
-BMP support must be loaded into the BGP daemon before any BMP target can
-be committed. Enable it with `set system frr bmp`, commit, and then
-reboot the router (preferred) or restart FRR so the BGP daemon starts
-with the BMP module. Until then, committing configuration under
-`protocols bgp bmp` fails with an error that the `bmp` flag is not found
-in bgpd.
+Before configuring any BMP target under `protocols bgp bmp`, first
+enable BMP with `set system frr bmp` and commit, then reboot the router
+(preferred) or restart its FRR service. BGP then restarts with BMP
+support. Otherwise, committing configuration under `protocols bgp bmp`
+fails with the error `"bmp" flag is not found in bgpd`.
 
 ```{cfgcmd} set protocols bgp bmp target \<name\> address \<x.x.x.x | h:h:h:h:h:h:h:h\>
 
@@ -2602,18 +2601,20 @@ set protocols bgp bmp target collector port 5000
 **Configure which route views are sent to the BMP target for the
 specified address family.**
 
-- `pre-policy`: Send state before policy and filter processing.
-- `post-policy`: Send state with policy and filters applied.
-- `local-rib`: Send routes from the local RIB.
+- `pre-policy`: Sends routes as received from the peer, before inbound
+  policy and filters are applied (the pre-policy Adj-RIB-In).
+- `post-policy`: Sends routes after inbound policy and filters are
+  applied (the post-policy Adj-RIB-In).
+- `local-rib`: Sends the routes the router installed in its local RIB
+  (Loc-RIB).
 
-Each view is configured separately. Issue the command once per view to
-send more than one.
+Each view is configured separately. Repeat the command for each view you
+want to send.
 ```
 
 Example:
 
 ```none
-set protocols bgp bmp target collector address 192.0.2.10
 set protocols bgp bmp target collector monitor ipv4-unicast post-policy
 ```
 
diff --git a/docs/configuration/protocols/segment-routing.md b/docs/configuration/protocols/segment-routing.md
index c1bbe240..29b74f75 100644
--- a/docs/configuration/protocols/segment-routing.md
+++ b/docs/configuration/protocols/segment-routing.md
@@ -358,79 +358,76 @@ For more information, see {ref}`ospf`.
 
 ## SR-TE configuration
 
-{abbr}`SR-TE (Segment Routing Traffic Engineering)` steers traffic along an
-explicit segment-routed path instead of the IGP shortest path. The initial
-SR-TE implementation in VyOS lets you select the IGP that feeds the
-{abbr}`TED (Traffic Engineering Database)` and define named segment lists —
-ordered label or {abbr}`NAI (Node or Adjacency Identifier)` stacks describing
-the path.
+{abbr}`SR-TE (Segment Routing Traffic Engineering)` steers traffic along
+an explicit segment-routed path instead of the IGP shortest path. The
+current SR-TE implementation in VyOS only lets you:
+
+- Choose which IGP, IS-IS or OSPFv2, the router loads TE data from into
+  the {abbr}`TED (Traffic Engineering Database)`. The TED is used to
+  translate segments given as a
+  {abbr}`NAI (Node or Adjacency Identifier)` to MPLS labels.
+- Define named segment lists that describe such a path. Each list orders
+  its segments using a numbered index. Each segment is an MPLS label, a
+  NAI, or both.
+
+VyOS does not provide the SR policy that binds a segment list to traffic,
+so these definitions alone do not steer traffic.
 
 ```{cfgcmd} set protocols segment-routing traffic-engineering database-import-protocol \<isis | ospf\>
 
-Select the IGP whose originated Traffic Engineering (TE) database is imported
-into the TED. IS-IS and OSPF are mutually exclusive.
-```
+**Select the IGP, IS-IS or OSPFv2, whose originated Traffic Engineering
+(TE) database the router imports into the TED.**
+
+IS-IS and OSPF are mutually exclusive.
 
 ```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\>
 
-Define a named segment list. Each entry of the list is addressed by an index
-and describes one segment of the path.
+**Configure a named segment list, an ordered set of segments that
+describes an explicit path.**
 
-A segment list requires at least one index, and each index requires either
-an MPLS label or a NAI. Otherwise, the commit fails.
-```
+The name may contain letters, digits, hyphens, and underscores.
 
-```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\> index \<index\> mpls label \<16-1048575\>
+Add segments under `index`, where each index orders one segment given as
+an MPLS label, a NAI, or both.
 
-Set an MPLS label value for the given segment list index.
+A segment list must contain at least one `index`. Otherwise, the commit
+fails.
 ```
 
+
 ```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\> index \<index\> nai adjacency \<ipv4 | ipv6\> source-identifier \<address\>
 
-Set the adjacency source address identifier (IPv4 or IPv6) for the given
-segment list index.
+**Configure the adjacency source address identifier (IPv4 or IPv6) for
+the given segment list index.**
 
 An adjacency NAI requires both `source-identifier` and
 `destination-identifier`. A NAI is either an adjacency or a prefix, not
-both, and uses either IPv4 or IPv6, not both.
+both, and uses either IPv4 or IPv6, not both. Otherwise, the commit
+fails.
 ```
 
 ```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\> index \<index\> nai adjacency \<ipv4 | ipv6\> destination-identifier \<address\>
 
-Set the adjacency destination address identifier (IPv4 or IPv6) for the given
-segment list index.
-```
-
-```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\> index \<index\> nai prefix \<ipv4 | ipv6\> prefix-identifier \<prefix\>
+**Configure the adjacency destination address identifier (IPv4 or IPv6)
+for the given segment list index.**
 
-Set an IGP prefix identifier (IPv4 or IPv6 prefix) for the given segment list
-index.
-
-A prefix identifier requires an `algorithm` (see the next command).
-Otherwise, the commit fails.
+An adjacency NAI requires both `source-identifier` and
+`destination-identifier`. A NAI is either an adjacency or a prefix, not
+both, and uses either IPv4 or IPv6, not both. Otherwise, the commit
+fails.
 ```
 
-```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\> index \<index\> nai prefix \<ipv4 | ipv6\> prefix-identifier \<prefix\> algorithm \<spf | strict-spf\>
-
-Select the IGP prefix algorithm style for the prefix identifier:
+```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\> index \<index\> nai prefix \<ipv4 | ipv6\> prefix-identifier \<prefix\>
 
-- `spf`: Shortest Path First (SPF).
-- `strict-spf`: Strict SPF - ignore any possible local policy overriding the
-  SPF along the path.
+**Configure the IGP prefix (IPv4 or IPv6) of a prefix NAI at the given
+segment list index.**
 
-`spf` and `strict-spf` are mutually exclusive.
+A prefix NAI requires an `algorithm` (`spf` or `strict-spf`). A NAI is
+either an adjacency or a prefix, not both, and uses either IPv4 or IPv6,
+not both. Otherwise, the commit fails.
 ```
 
-Example of a segment list with one MPLS label, one adjacency, and one
-prefix segment:
 
-```none
-set protocols segment-routing traffic-engineering database-import-protocol isis
-set protocols segment-routing traffic-engineering segment-list SL1 index 10 mpls label 16001
-set protocols segment-routing traffic-engineering segment-list SL1 index 20 nai adjacency ipv4 source-identifier 192.0.2.1
-set protocols segment-routing traffic-engineering segment-list SL1 index 20 nai adjacency ipv4 destination-identifier 192.0.2.2
-set protocols segment-routing traffic-engineering segment-list SL1 index 30 nai prefix ipv4 prefix-identifier 198.51.100.1/32 algorithm spf
-```
 
 ## Examples
 
@@ -607,4 +604,3 @@ Codes: K - kernel route, C - connected, S - static, R - RIP,
 O>* 198.51.100.1/32 [110/1] via 192.0.2.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36
 O   198.51.100.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51
 O   192.0.2.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51
-```
diff --git a/docs/configuration/vpn/ipsec/ipsec_general.md b/docs/configuration/vpn/ipsec/ipsec_general.md
index 551718ca..13673836 100644
--- a/docs/configuration/vpn/ipsec/ipsec_general.md
+++ b/docs/configuration/vpn/ipsec/ipsec_general.md
@@ -153,8 +153,8 @@ configured and required. The in use will show yes
 
 ```{cfgcmd} set vpn ipsec site-to-site peer \<name\> childless \<allow | prefer | force | never\>
 
-Control childless IKEv2 SA initiation ({rfc}`6023` — an IKE SA established
-without a Child SA). This option applies to IKEv2 only:
+**Control childless IKEv2 SA initiation ({rfc}`6023` — an IKE SA established
+without a Child SA).**
 
 - `allow`: accept childless IKE SA in responder mode; create a regular IKE SA
   in initiator mode.
@@ -163,7 +163,9 @@ without a Child SA). This option applies to IKEv2 only:
 - `force`: require the use of childless IKE SA in both responder and
   initiator modes.
 - `never`: disable support for childless IKE SA when acting as a responder.
-```
+
+Childless IKE SAs require the connection's `ike-group` to use
+`key-exchange ikev2`. Otherwise, the commit fails.
 
 ```{cfgcmd} set vpn ipsec remote-access connection \<name\> childless \<allow | prefer | force | never\>