docs: fix typos and a few grammar issues (ported from #1852 RST → MyST)

Ports the typo/grammar sweep originally captured in PR #1852 from .rst
files to their .md equivalents, plus the eventhandler grammar fix that
Copilot flagged in #1852's review (which the RST PR explicitly skipped
as scope-stretch).

Sources:
- 73 typo/grammar substitutions from PR #1852 (rebased from #1801)
- "Using environments is more preferable" → "Using environment variables
  is preferable" (Copilot review comment on #1852)

#1852 itself is being discarded since it targets RST and we are phasing
out the RST tree in favor of MyST.

The 4 RST-linter line-wrap comments and 1 RST section-underline comment
from Copilot's #1852 review are RST-specific and do not apply to .md.

🤖 Generated by [robots](https://vyos.io)

28 files changed, 64 insertions, 65 deletions

diff --git a/docs/configuration/firewall/md-ipv4.md b/docs/configuration/firewall/md-ipv4.md
index 2107065d..e5c0a986 100644
--- a/docs/configuration/firewall/md-ipv4.md
+++ b/docs/configuration/firewall/md-ipv4.md
@@ -1377,7 +1377,7 @@ WAN_IN-122
 SUPPORT                  address_group       VyOS_MANAGEMENT-20       192.168.1.2
 WAN_IN-20
 PHONE_VPN_SERVERS        address_group       WAN_IN-160               10.6.32.2
-PINGABLE_ADRESSES        address_group       WAN_IN-170               192.168.5.2
+PINGABLE_ADDRESSES        address_group       WAN_IN-170               192.168.5.2
 WAN_IN-171
 PBX                      ipv6_address_group  IPV6-WAN_IN-100          2001:db8::1
 SERVERS                  ipv6_address_group  IPV6-WAN_IN-110          2001:db8::2
diff --git a/docs/configuration/firewall/md-ipv6.md b/docs/configuration/firewall/md-ipv6.md
index 770cb146..e9011b4c 100644
--- a/docs/configuration/firewall/md-ipv6.md
+++ b/docs/configuration/firewall/md-ipv6.md
@@ -1425,7 +1425,7 @@ WAN_IN-122
 SUPPORT                  address_group       VyOS_MANAGEMENT-20       192.168.1.2
 WAN_IN-20
 PHONE_VPN_SERVERS        address_group       WAN_IN-160               10.6.32.2
-PINGABLE_ADRESSES        address_group       WAN_IN-170               192.168.5.2
+PINGABLE_ADDRESSES        address_group       WAN_IN-170               192.168.5.2
 WAN_IN-171
 PBX                      ipv6_address_group  IPV6-WAN_IN-100          2001:db8::1
 SERVERS                  ipv6_address_group  IPV6-WAN_IN-110          2001:db8::2
diff --git a/docs/configuration/nat/md-nat44.md b/docs/configuration/nat/md-nat44.md
index 4f5bd580..8b02477e 100644
--- a/docs/configuration/nat/md-nat44.md
+++ b/docs/configuration/nat/md-nat44.md
@@ -630,7 +630,7 @@ network to a source address provided by the ASP.
 
 Here we provide two examples on how to apply NAT Load Balance.
 
-First scenario: apply destination NAT for all HTTP traffic comming through
+First scenario: apply destination NAT for all HTTP traffic coming through
 interface eth0, and user 4 backends. First backend should received 30% of
 the request, second backend should get 20%, third 15% and the fourth 35%
 We will use source and destination address for hash generation.
diff --git a/docs/configuration/policy/md-examples.md b/docs/configuration/policy/md-examples.md
index 2b5d54d2..4dc3f3b0 100644
--- a/docs/configuration/policy/md-examples.md
+++ b/docs/configuration/policy/md-examples.md
@@ -152,8 +152,8 @@ ISP's and VyOS router will respond from the same interface that the packet was
 received. Also, it used, if we want that one VPN tunnel to be through one
 provider, and the second through another.
 
-- `203.0.113.254` IP addreess on VyOS eth1 from ISP1
-- `192.168.2.254` IP addreess on VyOS eth2 from ISP2
+- `203.0.113.254` IP address on VyOS eth1 from ISP1
+- `192.168.2.254` IP address on VyOS eth2 from ISP2
 - `table 10` Routing table used for ISP1
 - `table 11` Routing table used for ISP2
 
diff --git a/docs/configuration/policy/md-route-map.md b/docs/configuration/policy/md-route-map.md
index 624b542c..cf419a48 100644
--- a/docs/configuration/policy/md-route-map.md
+++ b/docs/configuration/policy/md-route-map.md
@@ -1,6 +1,6 @@
 # Route Map Policy
 
-Route map is a powerfull command, that gives network administrators a very
+Route map is a powerful command, that gives network administrators a very
 useful and flexible tool for traffic manipulation.
 
 ## Configuration
diff --git a/docs/configuration/policy/md-route.md b/docs/configuration/policy/md-route.md
index 828bd0f1..b3ef6540 100644
--- a/docs/configuration/policy/md-route.md
+++ b/docs/configuration/policy/md-route.md
@@ -211,7 +211,7 @@ Set IPSec inbound match criterias, where:
 
 ```{cfgcmd} set policy route6 \<name\> rule \<n\> limit burst \<0-4294967295\>
 
-Set maximum number of packets to alow in excess of rate.
+Set maximum number of packets to allow in excess of rate.
 ```
 
 ```{cfgcmd} set policy route \<name\> rule \<n\> limit rate \<text\>
@@ -351,8 +351,8 @@ Match hop-limit parameter, where 'eq' stands for 'equal'; 'gt' stands for
 
 ### Actions
 
-When mathcing all patterns defined in a rule, then different actions can
-be made. This includes droping the packet, modifying certain data, or
+When matching all patterns defined in a rule, then different actions can
+be made. This includes dropping the packet, modifying certain data, or
 setting a different routing table.
 
 ```{cfgcmd} set policy route \<name\> rule \<n\> action drop
diff --git a/docs/configuration/protocols/md-bfd.md b/docs/configuration/protocols/md-bfd.md
index 59541abc..13623e03 100644
--- a/docs/configuration/protocols/md-bfd.md
+++ b/docs/configuration/protocols/md-bfd.md
@@ -165,7 +165,7 @@ and use the gateway address as BFD peer destination address.
 ```{cfgcmd} set protocols static route \<subnet\> next-hop \<address\> bfd multi-hop source \<address\> profile \<profile\>
 
 Configure a static route for \<subnet\> using gateway \<address\>,
-use source address to indentify the peer when is multi-hop session
+use source address to identify the peer when is multi-hop session
 and the gateway address as BFD peer destination address.
 ```
 
@@ -178,7 +178,7 @@ and use the gateway address as BFD peer destination address.
 ```{cfgcmd} set protocols static route6 \<subnet\> next-hop \<address\> bfd multi-hop source \<address\> profile \<profile\>
 
 Configure a static route for \<subnet\> using gateway \<address\>,
-use source address to indentify the peer when is multi-hop session
+use source address to identify the peer when is multi-hop session
 and the gateway address as BFD peer destination address.
 ```
 
diff --git a/docs/configuration/protocols/md-bgp.md b/docs/configuration/protocols/md-bgp.md
index 0af79f6e..702a2b1f 100644
--- a/docs/configuration/protocols/md-bgp.md
+++ b/docs/configuration/protocols/md-bgp.md
@@ -375,7 +375,7 @@ used when you want to use the same AS number in your sites,
 but you can’t connect them directly.
 
    The number parameter (1-10) configures the amount of accepted
-   occurences of the system AS number in AS path.
+   occurrences of the system AS number in AS path.
 
    This command is only allowed for eBGP peers. It is not applicable
    for peer groups.
diff --git a/docs/configuration/protocols/md-segment-routing.md b/docs/configuration/protocols/md-segment-routing.md
index 45c89a41..af47d343 100644
--- a/docs/configuration/protocols/md-segment-routing.md
+++ b/docs/configuration/protocols/md-segment-routing.md
@@ -91,7 +91,7 @@ the MPLS dataplane.
 
 A segment ID that contains an IP address prefix calculated by an IGP in the
 service provider core network. Prefix SIDs are globally unique, this value
-indentify it
+identify it
 ```
 
 
@@ -174,7 +174,7 @@ the MPLS dataplane.
 
 A segment ID that contains an IP address prefix calculated by an IGP in the
 service provider core network. Prefix SIDs are globally unique, this value
-indentify it
+identify it
 ```
 
 ```{cfgcmd} set protocols ospf segment-routing prefix \<address\> index \<no-php-flag | explicit-null| n-flag-clear\>
diff --git a/docs/configuration/service/md-conntrack-sync.md b/docs/configuration/service/md-conntrack-sync.md
index 47a0ae2f..4aad6283 100644
--- a/docs/configuration/service/md-conntrack-sync.md
+++ b/docs/configuration/service/md-conntrack-sync.md
@@ -27,7 +27,7 @@ will be mandatorily defragmented.
 
 It is possible to use either Multicast or Unicast to sync conntrack traffic.
 Most examples below show Multicast, but unicast can be specified by using the
-"peer" keywork after the specified interface, as in the following example:
+"peer" keyword after the specified interface, as in the following example:
 
 {cfgcmd}`set service conntrack-sync interface eth0 peer 192.168.0.250`
 
@@ -100,8 +100,8 @@ Defaults to 225.0.0.50.
 
 ```{cfgcmd} set service conntrack-sync interface \<name\> peer \<address\>
 
-Peer to send unicast UDP conntrack sync entires to, if not using Multicast
-configuration from above above.
+Peer to send unicast UDP conntrack sync entries to, if not using Multicast
+configuration from above.
 ```
 
 
@@ -113,7 +113,7 @@ Queue size for syncing conntrack entries in MB.
 
 ```{cfgcmd} set service conntrack-sync disable-external-cache
 
-This diable the external cache and directly injects the flow-states into the
+This disables the external cache and directly injects the flow-states into the
 in-kernel Connection Tracking System of the backup firewall.
 ```
 
diff --git a/docs/configuration/service/md-console-server.md b/docs/configuration/service/md-console-server.md
index 9402e935..f0556652 100644
--- a/docs/configuration/service/md-console-server.md
+++ b/docs/configuration/service/md-console-server.md
@@ -75,7 +75,7 @@ port.
 ```{cfgcmd} set service console-server device \<device\> ssh port \<port\>
 
 Accept SSH connections for the given `<device>` on TCP port `<port>`.
-After successfull authentication the user will be directly dropped to
+After successful authentication the user will be directly dropped to
 the connected serial device.
 
 :::{hint}
diff --git a/docs/configuration/service/md-dhcp-server.md b/docs/configuration/service/md-dhcp-server.md
index 96c375da..721d6d4a 100644
--- a/docs/configuration/service/md-dhcp-server.md
+++ b/docs/configuration/service/md-dhcp-server.md
@@ -209,7 +209,7 @@ level, i.e. for individual shared networks or subnets. See examples below.
 
 If set to ``enable`` on global level, updates for all scopes will be enabled,
 except if explicitly set to ``disable`` on the scope level. If set to ``disable``,
-updates will only be sent for scopes, where ``send-updates`` is explicity
+updates will only be sent for scopes, where ``send-updates`` is explicitly
 set to ``enable``.
 
 This model is followed for a few behavioral settings below: if the option is
@@ -579,7 +579,7 @@ NB: Kea (the DHCP server used by VyOS) is programmed to offer as many
 alternatives as it can to repeated DHCP Discover requests. Some operating
 systems (Notably Microsoft Windows) make multiple DHCP Discover requests before
 settling on an address. This particularly seems to happen when the DHCP server
-isn't set to authorative. This may explain why the address you espect isn't
+isn't set to authoritative. This may explain why the address you expect isn't
 being chosen. Wireshark is helpful in these situations.
 
 
@@ -1010,14 +1010,14 @@ A SNTP server address can be specified for DHCPv6 clients.
 To hand out individual prefixes to your clients the following configuration is
 used:
 
-```{cfgcmd} set service dhcpv6-server shared-network-name \<name\> subnet \<prefix\> prefix-delegation prefix \<pd-prefix\> prefix-length \<lenght\>
+```{cfgcmd} set service dhcpv6-server shared-network-name \<name\> subnet \<prefix\> prefix-delegation prefix \<pd-prefix\> prefix-length \<length\>
 
 Delegate prefixes from `<pd-prefix>` to clients in subnet `<prefix>`. Range
-is defined by `<lenght>` in bits, 32 to 64.
+is defined by `<length>` in bits, 32 to 64.
 ```
 
 
-```{cfgcmd} set service dhcpv6-server shared-network-name \<name\> subnet \<prefix\> prefix-delegation prefix \<pd-prefix\> delegated-length \<lenght\>
+```{cfgcmd} set service dhcpv6-server shared-network-name \<name\> subnet \<prefix\> prefix-delegation prefix \<pd-prefix\> delegated-length \<length\>
 
 Hand out prefixes of size `<length>` in bits from `<pd-prefix>` to clients
 in subnet `<prefix>` when the request for prefix delegation.
@@ -1030,7 +1030,7 @@ Exclude `<exclude-prefix>` from `<pd-prefix>`.
 ```
 ```{cfgcmd} set service dhcpv6-server shared-network-name \<name\> subnet \<prefix\> prefix-delegation prefix \<pd-prefix\> excluded-prefix-length \<length\>
 
-Define lenght of exclude prefix in `<pd-prefix>`.
+Define length of exclude prefix in `<pd-prefix>`.
 ```
 
 **Example:**
diff --git a/docs/configuration/service/md-eventhandler.md b/docs/configuration/service/md-eventhandler.md
index 48031909..6413c24d 100644
--- a/docs/configuration/service/md-eventhandler.md
+++ b/docs/configuration/service/md-eventhandler.md
@@ -76,8 +76,7 @@ This is an optional command. Adds arguments to the script.
 Arguments must be separated by spaces.
 
 :::{note}
-We don't recommend to use arguments. Using environments
-is more preferable.
+We don't recommend using arguments. Using environment variables is preferable.
 :::
 ```
 
diff --git a/docs/configuration/service/md-ipoe-server.md b/docs/configuration/service/md-ipoe-server.md
index 88ec4f51..f1ef2a63 100644
--- a/docs/configuration/service/md-ipoe-server.md
+++ b/docs/configuration/service/md-ipoe-server.md
@@ -162,7 +162,7 @@ to a single source IP e.g. the loopback interface.
 
 ```{cfgcmd} set service ipoe-server authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 :::{note}
@@ -244,7 +244,7 @@ in DM/CoA requests. Also DM/CoA server will bind to that address.
 
 ```{cfgcmd} set service ipoe-server authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 
@@ -292,7 +292,7 @@ will be allocated from a predefined IPv6 pool ``prefix`` whose name equals the a
 
 
 If the RADIUS server sends the attribute ``Delegated-IPv6-Prefix-Pool``, IPv6
-delegation pefix will be allocated from a predefined IPv6 pool ``delegate``
+delegation prefix will be allocated from a predefined IPv6 pool ``delegate``
 whose name equals the attribute value.
 
 
@@ -311,7 +311,7 @@ Define it in your RADIUS server.
 
 ```{cfgcmd} set service ipoe-server client-ipv6-pool \<IPv6-POOL-NAME\> prefix \<address\>  mask \<number-of-bits\>
 
-Use this comand to set the IPv6 address pool from which an IPoE client
+Use this command to set the IPv6 address pool from which an IPoE client
 will get an IPv6 prefix of your defined length (mask) to terminate the
 IPoE endpoint at their side. The mask length can be set from 48 to 128
 bit long, the default value is 64.
@@ -492,7 +492,7 @@ ipoe:
   delayed: 0
 ```
 
-## Toubleshooting
+## Troubleshooting
 
 ```none
 vyos@vyos:~$ show log ipoe-server
diff --git a/docs/configuration/service/md-monitoring.md b/docs/configuration/service/md-monitoring.md
index a6bf2605..93bd40e6 100644
--- a/docs/configuration/service/md-monitoring.md
+++ b/docs/configuration/service/md-monitoring.md
@@ -98,7 +98,7 @@ Local IP addresses to listen on
 
 ```{cfgcmd} set service monitoring telegraf prometheus-client metric-version \<1 | 2\>
 
-Metris version, the default is ``2``
+Metrics version, the default is ``2``
 ```
 
 
diff --git a/docs/configuration/service/md-pppoe-server.md b/docs/configuration/service/md-pppoe-server.md
index 32881845..805740e4 100644
--- a/docs/configuration/service/md-pppoe-server.md
+++ b/docs/configuration/service/md-pppoe-server.md
@@ -123,7 +123,7 @@ to a single source IP e.g. the loopback interface.
 
 ```{cfgcmd} set service pppoe-server authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 :::{note}
@@ -205,7 +205,7 @@ in DM/CoA requests. Also DM/CoA server will bind to that address.
 
 ```{cfgcmd} set service pppoe-server authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 
@@ -254,7 +254,7 @@ whose name equals the attribute value.
 
 
 If the RADIUS server sends the attribute `Delegated-IPv6-Prefix-Pool`,
-IPv6 delegation pefix will be allocated from a predefined IPv6 pool `delegate`
+IPv6 delegation prefix will be allocated from a predefined IPv6 pool `delegate`
 whose name equals the attribute value.
 
 
@@ -407,7 +407,7 @@ Specifies IPv6 negotiation preference.
 
 ```{cfgcmd} set service pppoe-server client-ipv6-pool \<IPv6-POOL-NAME\> prefix \<address\> mask \<number-of-bits\>
 
-Use this comand to set the IPv6 address pool from which an PPPoE client
+Use this command to set the IPv6 address pool from which a PPPoE client
 will get an IPv6 prefix of your defined length (mask) to terminate the
 PPPoE endpoint at their side. The mask length can be set from 48 to 128
 bit long, the default value is 64.
diff --git a/docs/configuration/service/md-salt-minion.md b/docs/configuration/service/md-salt-minion.md
index e6f99752..e430f4fc 100644
--- a/docs/configuration/service/md-salt-minion.md
+++ b/docs/configuration/service/md-salt-minion.md
@@ -45,7 +45,7 @@ The hostname or IP address of the master
 URL with signature of master for auth reply verification
 ```
 
-Please take a look in the Automation section to find some usefull
+Please take a look in the Automation section to find some useful
 Examples.
 
 [saltstack]: https://saltproject.io/
diff --git a/docs/configuration/system/md-conntrack.md b/docs/configuration/system/md-conntrack.md
index f83f0684..3c292132 100644
--- a/docs/configuration/system/md-conntrack.md
+++ b/docs/configuration/system/md-conntrack.md
@@ -40,9 +40,9 @@ searching the connection tracking table faster. The hash table uses
 .. cfgcmd:: set system conntrack modules tftp
 
     Configure the connection tracking protocol helper modules.
-    All modules are enable by default.
+    All modules are enabled by default.
 
-    | Use `delete system conntrack modules` to deactive all modules.
+    | Use `delete system conntrack modules` to deactivate all modules.
     | Or, for example ftp, `delete system conntrack modules ftp`.
 ```
 
@@ -52,7 +52,7 @@ searching the connection tracking table faster. The hash table uses
 Set the maximum number of TCP half-open connections.
 ```
 
-```{cfgcmd} set system conntrack tcp loose \<enable | disable\>
+```{cfgcmd} set system conntrack tcp loose \<enabled | disable\>
 :defaultvalue:
 
 Policy to track previously established connections.
diff --git a/docs/configuration/system/md-frr.md b/docs/configuration/system/md-frr.md
index 1741e286..40305ad7 100644
--- a/docs/configuration/system/md-frr.md
+++ b/docs/configuration/system/md-frr.md
@@ -11,7 +11,7 @@ but requires either a restart of the routing daemon, or a reboot of the system.
 Enable {abbr}`BMP (BGP Monitoring Protocol)` support.
 ```
 
-```{cfgcmd} set system frr descriptors \<numer\>
+```{cfgcmd} set system frr descriptors \<number\>
 
 This allows the operator to control the number of open file descriptors
 each daemon is allowed to start with. If the operator plans to run bgp with
diff --git a/docs/configuration/system/md-option.md b/docs/configuration/system/md-option.md
index c7a6ccf2..ed1c3461 100644
--- a/docs/configuration/system/md-option.md
+++ b/docs/configuration/system/md-option.md
@@ -154,7 +154,7 @@ layout here corresponds to your access system.
 
 ## Performance
 
-As more and more routers run on Hypervisors, expecially with a {abbr}`NOS
+As more and more routers run on Hypervisors, especially with a {abbr}`NOS
 (Network Operating System)` as VyOS, it makes fewer and fewer sense to use
 static resource bindings like `smp-affinity` as present in VyOS 1.2 and
 earlier to pin certain interrupt handlers to specific CPUs.
diff --git a/docs/configuration/system/md-proxy.md b/docs/configuration/system/md-proxy.md
index 286e835f..3b12634b 100644
--- a/docs/configuration/system/md-proxy.md
+++ b/docs/configuration/system/md-proxy.md
@@ -17,11 +17,11 @@ Configure proxy port if it does not listen to the default port 80.
 ```
 ```{cfgcmd} set system proxy username \<username\>
 
-Some proxys require/support the "basic" HTTP authentication scheme as per
+Some proxies require/support the "basic" HTTP authentication scheme as per
 {rfc}`7617`, thus a username can be configured.
 ```
 ```{cfgcmd} set system proxy password \<password\>
 
-Some proxys require/support the "basic" HTTP authentication scheme as per
+Some proxies require/support the "basic" HTTP authentication scheme as per
 {rfc}`7617`, thus a password can be configured.
 ```
\ No newline at end of file
diff --git a/docs/configuration/trafficpolicy/md-index.md b/docs/configuration/trafficpolicy/md-index.md
index 01a820a9..f1dccc92 100644
--- a/docs/configuration/trafficpolicy/md-index.md
+++ b/docs/configuration/trafficpolicy/md-index.md
@@ -1061,7 +1061,7 @@ class.
 ```{cfgcmd} set qos policy shaper \<policy-name\> class \<class-ID\> burst \<bytes\>
 
 Use this command to configure a Shaper policy, set its name, define
-a class and set the size of the tocken bucket in bytes, which will
+a class and set the size of the token bucket in bytes, which will
 be available to be sent at ceiling speed (default: 15Kb).
 ```
 
@@ -1296,4 +1296,4 @@ which can be solved with `sudo ip link delete ifb0`.
 [intermediate functional block]: https://www.linuxfoundation.org/collaborate/workgroups/networking/ifb
 [tc]: <https://en.wikipedia.org/wiki/Tc_(Linux)>
 [that can give you a great deal of flexibility]: https://blog.vyos.io/using-the-policy-route-and-packet-marking-for-custom-qos-matches
-[tocken bucket]: <https://en.wikipedia.org/wiki/Token_bucket>
+[token bucket]: <https://en.wikipedia.org/wiki/Token_bucket>
diff --git a/docs/configuration/vpn/ipsec/md-ipsec_general.md b/docs/configuration/vpn/ipsec/md-ipsec_general.md
index 6fc47386..62fcec8a 100644
--- a/docs/configuration/vpn/ipsec/md-ipsec_general.md
+++ b/docs/configuration/vpn/ipsec/md-ipsec_general.md
@@ -112,7 +112,7 @@ available. The use of PPKs in IKEv2 is described in {rfc}`8784`.
 .. cfgmod:: edit vpn authentication ppk <name>
 ```
 
-PPKs can be configued within VyOS under the `vpn ipsec authentication ppk`
+PPKs can be configured within VyOS under the `vpn ipsec authentication ppk`
 config.
 
 ```{eval-rst}
@@ -143,10 +143,10 @@ Optionally, you can require the use of PPK to have a successful connection.
 
 You can view the PPK column for information on if PPK is configured, and
 if it is in use. The output is in the format of `<configured> / <in use>`.
-The options for configured are none if not conifugred, opt if configured
+The options for configured are none if not configured, opt if configured
 but optional, and req is configured and required. The in use will show yes
 Possible values of the `configured` field are `none` if not
-conifgured, `opt` if configured but optional, and `req` is
+configured, `opt` if configured but optional, and `req` is
 configured and required. The in use will show yes
 
 ## Configuration IKE
diff --git a/docs/configuration/vpn/md-l2tp.md b/docs/configuration/vpn/md-l2tp.md
index d932d095..3b131b98 100644
--- a/docs/configuration/vpn/md-l2tp.md
+++ b/docs/configuration/vpn/md-l2tp.md
@@ -159,7 +159,7 @@ e.g. the loopback interface.
 
 ```{cfgcmd} set vpn l2tp remote-access authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 :::{note}
@@ -229,7 +229,7 @@ in DM/CoA requests. Also DM/CoA server will bind to that address.
 
 ```{cfgcmd} set vpn l2tp remote-access authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 ```{cfgcmd} set vpn l2tp remote-access authentication radius rate-limit attribute \<attribute\>
@@ -324,7 +324,7 @@ Specifies IPv6 negotiation preference.
 
 ```{cfgcmd} set vpn l2tp remote-access client-ipv6-pool \<IPv6-POOL-NAME\> prefix \<address\> mask \<number-of-bits\>
 
-Use this comand to set the IPv6 address pool from which an l2tp client will
+Use this command to set the IPv6 address pool from which an l2tp client will
 get an IPv6 prefix of your defined length (mask) to terminate the l2tp
 endpoint at their side. The mask length can be set between 48 and 128 bits
 long, the default value is 64.
diff --git a/docs/configuration/vpn/md-openconnect.md b/docs/configuration/vpn/md-openconnect.md
index 0bf804ff..af5dcf7b 100644
--- a/docs/configuration/vpn/md-openconnect.md
+++ b/docs/configuration/vpn/md-openconnect.md
@@ -156,7 +156,7 @@ Do you want to encrypt the private key with a passphrase? [y/N] N
 [edit]
 ```
 
-Each of the install command should be applied to the configuration and commited
+Each of the install commands should be applied to the configuration and committed
 before using under the openconnect configuration:
 
 ```none
diff --git a/docs/configuration/vpn/md-pptp.md b/docs/configuration/vpn/md-pptp.md
index 5df63755..34f883cc 100644
--- a/docs/configuration/vpn/md-pptp.md
+++ b/docs/configuration/vpn/md-pptp.md
@@ -93,7 +93,7 @@ to a single source IP e.g. the loopback interface.
 
 ```{cfgcmd} set vpn pptp remote-access authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 :::{note}
@@ -163,7 +163,7 @@ in DM/CoA requests. Also DM/CoA server will bind to that address.
 
 ```{cfgcmd} set vpn pptp remote-access authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 ```{cfgcmd} set vpn pptp remote-access authentication radius rate-limit attribute \<attribute\>
@@ -204,7 +204,7 @@ If the RADIUS server sends the attribute `Stateful-IPv6-Address-Pool`, IPv6 addr
 will be allocated from a predefined IPv6 pool `prefix` whose name equals the attribute value.
 
 If the RADIUS server sends the attribute `Delegated-IPv6-Prefix-Pool`, IPv6
-delegation pefix will be allocated from a predefined IPv6 pool `delegate`
+delegation prefix will be allocated from a predefined IPv6 pool `delegate`
 whose name equals the attribute value.
 
 :::{note}
@@ -239,7 +239,7 @@ Specifies IPv6 negotiation preference.
 
 ```{cfgcmd} set vpn pptp remote-access client-ipv6-pool \<IPv6-POOL-NAME\> prefix \<address\> mask \<number-of-bits\>
 
-Use this comand to set the IPv6 address pool from which an PPTP client
+Use this command to set the IPv6 address pool from which a PPTP client
 will get an IPv6 prefix of your defined length (mask) to terminate the
 PPTP endpoint at their side. The mask length can be set from 48 to 128
 bit long, the default value is 64.
diff --git a/docs/configuration/vpn/md-sstp.md b/docs/configuration/vpn/md-sstp.md
index 54383cc6..38596153 100644
--- a/docs/configuration/vpn/md-sstp.md
+++ b/docs/configuration/vpn/md-sstp.md
@@ -129,7 +129,7 @@ e.g. the loopback interface.
 
 ```{cfgcmd} set vpn sstp authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 :::{note}
@@ -199,7 +199,7 @@ in DM/CoA requests. Also DM/CoA server will bind to that address.
 
 ```{cfgcmd} set vpn sstp authentication radius source-address \<address\>
 
-Source IPv4 address used in all RADIUS server queires.
+Source IPv4 address used in all RADIUS server queries.
 ```
 
 ```{cfgcmd} set vpn sstp authentication radius rate-limit attribute \<attribute\>
@@ -278,7 +278,7 @@ Specifies IPv6 negotiation preference.
 
 ```{cfgcmd} set vpn sstp client-ipv6-pool \<IPv6-POOL-NAME\> prefix \<address\> mask \<number-of-bits\>
 
-Use this comand to set the IPv6 address pool from which an SSTP client will
+Use this command to set the IPv6 address pool from which an SSTP client will
 get an IPv6 prefix of your defined length (mask) to terminate the SSTP
 endpoint at their side. The mask length can be set between 48 and 128 bits
 long, the default value is 64.
@@ -555,7 +555,7 @@ nodeflate
 debug
 ```
 
-You can now "dial" the peer with the follwoing command: `sstpc --log-level 4
+You can now "dial" the peer with the following command: `sstpc --log-level 4
 --log-stderr --user vyos --password vyos vpn.example.com -- call vyos`.
 
 A connection attempt will be shown as:
diff --git a/docs/configuration/vrf/md-index.md b/docs/configuration/vrf/md-index.md
index d679d1c9..c9b2cfd8 100644
--- a/docs/configuration/vrf/md-index.md
+++ b/docs/configuration/vrf/md-index.md
@@ -495,9 +495,9 @@ BGP routes may be leaked (i.e. copied) between a unicast VRF RIB and the VPN
 SAFI RIB of the default VRF for use in MPLS-based L3VPNs. Unicast routes may
 also be leaked between any VRFs (including the unicast RIB of the default BGP
 instance). A shortcut syntax is also available for specifying leaking from
-one VRF to another VRF using the default instance’s VPN RIB as the intemediary
-. A common application of the VRF-VRF feature is to connect a customer’s
-private routing domain to a provider’s VPN service. Leaking is configured from
+one VRF to another VRF using the default instance’s VPN RIB as the intermediary.
+A common application of the VRF-VRF feature is to connect a customer’s private
+routing domain to a provider’s VPN service. Leaking is configured from
 the point of view of an individual VRF: import refers to routes leaked from VPN
 to a unicast VRF, whereas export refers to routes leaked from a unicast VRF to
 VPN.