docs: T8887: backfill Phase 1 commands from recent vyos-1x additions (#2134)rolling

* docs: T8887: backfill Phase 1 commands from recent vyos-1x additions

Documents six CLI features added to vyos-1x between Nov 2025 and May 2026
that were missing from the docs (gap-audit T8886, Phase 1 / T8887):

- policy route-map match source-peer (vyos-1x#5149, T8588)
- high-availability vrrp snmp trap (vyos-1x#5108, T8448)
- protocols segment-routing traffic-engineering subtree (vyos-1x#4994, T6750)
- protocols bgp bmp target monitor pre-policy/post-policy/local-rib
  (vyos-1x#4922, T8133)
- firewall global-options geoip provider/maxmind-* (vyos-1x#4949, T7926/T8049)
- vpn ipsec childless IKE SA option (vyos-1x#4930, T8136)

system frr watchfrr-timeout and service router-advert prefix
base-interface are now documented on rolling via the page rewrites in
vyos-documentation#2251 and vyos-documentation#2132. protocols bgp
parameters as-notation is deferred: rolling carries it commented out;
to be handled in a follow-up.

🤖 Generated by [robots](https://vyos.io)

* docs: T8887: wrap pre-existing overlong lines in touched files

- route-map, ipsec_general: wrap five pre-existing overlong lines so the
  doc linter (which scans whole modified files) passes on touched files

🤖 Generated by [robots](https://vyos.io)

* docs: T8887: document BMP prerequisites and mandatory target address

- state that set system frr bmp needs a commit plus a router reboot (or
  FRR restart) before BMP targets can be committed (protocols_bgp.py
  verify)
- add target address (mandatory) and port (default 5000) commands and
  include the address in the example

🤖 Generated by [robots](https://vyos.io)

* docs: T8887: state SR-TE segment-list commit requirements

Per protocols_segment-routing.py verify(): a segment list needs at least
one index; each index needs an MPLS label or a NAI; an adjacency NAI
needs both source- and destination-identifier; a prefix identifier
needs an algorithm; IS-IS/OSPF import, adjacency/prefix, IPv4/IPv6 and
spf/strict-spf are mutually exclusive. Add a complete example.

🤖 Generated by [robots](https://vyos.io)

* docs: T8887: escape placeholders in GeoIP and childless cfgcmd headers

🤖 Generated by [robots](https://vyos.io)

* Apply suggestions from Liydmyla

Co-authored-by: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com>

---------

Co-authored-by: Daniil Baturin <daniil@vyos.io>
Co-authored-by: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com>

6 files changed, 225 insertions, 6 deletions

diff --git a/docs/configuration/firewall/global-options.md b/docs/configuration/firewall/global-options.md
index 0f6d91ac..d8e9999d 100644
--- a/docs/configuration/firewall/global-options.md
+++ b/docs/configuration/firewall/global-options.md
@@ -119,6 +119,49 @@ The following sysctl parameter will be changed:
 * ``net.ipv4.tcp_rfc1337``
 ```
 
+## GeoIP
+
+```{cfgcmd} set firewall global-options geoip provider \<db-ip | maxmind\>
+
+**Configure the GeoIP database provider that supplies the IP address ranges used for firewall GeoIP country-code and {abbr}`ASN (Autonomous System Number)` matching.**
+
+- `db-ip`: Uses the DB-IP Lite databases and requires no credentials.
+- `maxmind`: Uses the MaxMind databases and requires both `maxmind-account-id` and `maxmind-license-key`. Otherwise, the commit fails.
+
+The default is `db-ip`.
+```
+
+```{cfgcmd} set firewall global-options geoip maxmind-account-id \<id\>
+
+**Configure the MaxMind account ID the router uses to authenticate when
+downloading the MaxMind databases.**
+
+Required when `provider` is `maxmind`. You must configure both
+`maxmind-account-id` and `maxmind-license-key`. Otherwise, the commit
+fails.
+```
+
+```{cfgcmd} set firewall global-options geoip maxmind-license-key \<key\>
+
+**Configure the MaxMind license key used to authenticate when
+downloading the MaxMind databases.**
+
+Required when `provider` is `maxmind`. You must configure both
+`maxmind-account-id` and `maxmind-license-key`. Otherwise, the commit
+fails.
+```
+
+```{cfgcmd} set firewall global-options geoip maxmind-lite
+
+**Select the MaxMind GeoLite2 databases instead of the GeoIP2 databases
+as the GeoIP data source.**
+
+By default, the router downloads the GeoIP2 databases.
+
+The command applies only when `provider` is `maxmind`. GeoLite2 still
+requires `maxmind-account-id` and `maxmind-license-key`.
+```
+
 ```{cfgcmd} set firewall global-options state-policy established action [accept | drop | reject]
 ```
 
diff --git a/docs/configuration/highavailability/index.md b/docs/configuration/highavailability/index.md
index 1e4f2aed..4f462506 100644
--- a/docs/configuration/highavailability/index.md
+++ b/docs/configuration/highavailability/index.md
@@ -317,6 +317,9 @@ need to configure it. But if necessary, Gratuitous ARP can be configured in
    will always use version 3.
 ```
 
+## SNMP traps
+
+
 ## Scripting
 
 VRRP functionality can be extended with scripts. VyOS supports two kinds of
diff --git a/docs/configuration/policy/route-map.md b/docs/configuration/policy/route-map.md
index cf419a48..602b59a6 100644
--- a/docs/configuration/policy/route-map.md
+++ b/docs/configuration/policy/route-map.md
@@ -219,6 +219,19 @@ Match RPKI validation result.
 ```
 
 
+```{cfgcmd} set policy route-map \<text\> rule \<1-65535\> match source-peer \<value\>
+
+**Match BGP routes by the peer they were received from.**
+
+The rule then applies only to routes received from the specified peer.
+
+The value is the peer's IPv4 or IPv6 address, the name of the interface
+on which the peer is configured, or the name of a BGP peer-group. A
+peer-group name matches a route received from any peer in that
+peer-group.
+```
+
+
 ```{cfgcmd} set policy route-map \<text\> rule \<1-65535\> match source-vrf \<text\>
 
 Source VRF to match.
@@ -426,14 +439,18 @@ Set BGP weight attribute
 > - `local-as` - Well-known communities value NO_EXPORT_SUBCONFED 0xFFFFFF03
 > - `no-advertise` - Well-known communities value NO_ADVERTISE 0xFFFFFF02
 > - `no-export` - Well-known communities value NO_EXPORT 0xFFFFFF01
-> - `graceful-shutdown` - Well-known communities value GRACEFUL_SHUTDOWN 0xFFFF0000
+> - `graceful-shutdown` - Well-known communities value GRACEFUL_SHUTDOWN
+>   0xFFFF0000
 > - `accept-own` - Well-known communities value ACCEPT_OWN 0xFFFF0001
-> - `route-filter-translated-v4` - Well-known communities value ROUTE_FILTER_TRANSLATED_v4 0xFFFF0002
+> - `route-filter-translated-v4` - Well-known communities value
+>   ROUTE_FILTER_TRANSLATED_v4 0xFFFF0002
 > - `route-filter-v4` - Well-known communities value ROUTE_FILTER_v4 0xFFFF0003
-> - `route-filter-translated-v6` - Well-known communities value ROUTE_FILTER_TRANSLATED_v6 0xFFFF0004
+> - `route-filter-translated-v6` - Well-known communities value
+>   ROUTE_FILTER_TRANSLATED_v6 0xFFFF0004
 > - `route-filter-v6` - Well-known communities value ROUTE_FILTER_v6 0xFFFF0005
 > - `llgr-stale` - Well-known communities value LLGR_STALE 0xFFFF0006
 > - `no-llgr` - Well-known communities value NO_LLGR 0xFFFF0007
-> - `accept-own-nexthop` - Well-known communities value accept-own-nexthop 0xFFFF0008
+> - `accept-own-nexthop` - Well-known communities value accept-own-nexthop
+>   0xFFFF0008
 > - `blackhole` - Well-known communities value BLACKHOLE 0xFFFF029A
 > - `no-peer` - Well-known communities value NOPEER 0xFFFFFF04
diff --git a/docs/configuration/protocols/bgp.md b/docs/configuration/protocols/bgp.md
index 68902bfb..c12b2fd1 100644
--- a/docs/configuration/protocols/bgp.md
+++ b/docs/configuration/protocols/bgp.md
@@ -2568,6 +2568,66 @@ set protocols bgp parameters confederation peers 65002
 set protocols bgp parameters confederation peers 65003
 ```
 
+### BGP Monitoring Protocol (BMP) configuration
+
+{abbr}`BMP (BGP Monitoring Protocol)` lets the router send BGP route
+information to a monitoring station.
+
+Before configuring any BMP target under `protocols bgp bmp`, first
+enable BMP with `set system frr bmp` and commit, then reboot the router
+(preferred) or restart its FRR service. BGP then restarts with BMP
+support. Otherwise, committing configuration under `protocols bgp bmp`
+fails with the error `"bmp" flag is not found in bgpd`.
+
+```{cfgcmd} set protocols bgp bmp target \<name\> address \<x.x.x.x | h:h:h:h:h:h:h:h\>
+
+**Configure the IPv4 or IPv6 address of the BMP monitoring station.**
+
+The address is mandatory for every BMP target. Otherwise, the commit
+fails.
+```
+
+Example:
+
+```none
+set protocols bgp bmp target collector address 192.0.2.10
+```
+
+```{cfgcmd} set protocols bgp bmp target \<name\> port \<1-65535\>
+
+**Configure the TCP port of the BMP monitoring station.**
+
+The default is 5000.
+```
+
+Example:
+
+```none
+set protocols bgp bmp target collector port 5000
+```
+
+```{cfgcmd} set protocols bgp bmp target \<name\> monitor \<ipv4-unicast | ipv6-unicast\> \<pre-policy | post-policy | local-rib\>
+
+**Configure which route views are sent to the BMP target for the
+specified address family.**
+
+- `pre-policy`: Sends routes as received from the peer, before inbound
+  policy and filters are applied (the pre-policy Adj-RIB-In).
+- `post-policy`: Sends routes after inbound policy and filters are
+  applied (the post-policy Adj-RIB-In).
+- `local-rib`: Sends the routes the router installed in its local RIB
+  (Loc-RIB).
+
+Each view is configured separately. Repeat the command for each view you
+want to send.
+```
+
+Example:
+
+```none
+set protocols bgp bmp target collector monitor ipv4-unicast post-policy
+```
+
 ## Operation
 
 ### Show
diff --git a/docs/configuration/protocols/segment-routing.md b/docs/configuration/protocols/segment-routing.md
index b0896f73..29b74f75 100644
--- a/docs/configuration/protocols/segment-routing.md
+++ b/docs/configuration/protocols/segment-routing.md
@@ -356,6 +356,79 @@ set protocols ospf segment-routing prefix 192.0.2.1/32 index no-php-flag
 For more information, see {ref}`ospf`.
 ```
 
+## SR-TE configuration
+
+{abbr}`SR-TE (Segment Routing Traffic Engineering)` steers traffic along
+an explicit segment-routed path instead of the IGP shortest path. The
+current SR-TE implementation in VyOS only lets you:
+
+- Choose which IGP, IS-IS or OSPFv2, the router loads TE data from into
+  the {abbr}`TED (Traffic Engineering Database)`. The TED is used to
+  translate segments given as a
+  {abbr}`NAI (Node or Adjacency Identifier)` to MPLS labels.
+- Define named segment lists that describe such a path. Each list orders
+  its segments using a numbered index. Each segment is an MPLS label, a
+  NAI, or both.
+
+VyOS does not provide the SR policy that binds a segment list to traffic,
+so these definitions alone do not steer traffic.
+
+```{cfgcmd} set protocols segment-routing traffic-engineering database-import-protocol \<isis | ospf\>
+
+**Select the IGP, IS-IS or OSPFv2, whose originated Traffic Engineering
+(TE) database the router imports into the TED.**
+
+IS-IS and OSPF are mutually exclusive.
+
+```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\>
+
+**Configure a named segment list, an ordered set of segments that
+describes an explicit path.**
+
+The name may contain letters, digits, hyphens, and underscores.
+
+Add segments under `index`, where each index orders one segment given as
+an MPLS label, a NAI, or both.
+
+A segment list must contain at least one `index`. Otherwise, the commit
+fails.
+```
+
+
+```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\> index \<index\> nai adjacency \<ipv4 | ipv6\> source-identifier \<address\>
+
+**Configure the adjacency source address identifier (IPv4 or IPv6) for
+the given segment list index.**
+
+An adjacency NAI requires both `source-identifier` and
+`destination-identifier`. A NAI is either an adjacency or a prefix, not
+both, and uses either IPv4 or IPv6, not both. Otherwise, the commit
+fails.
+```
+
+```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\> index \<index\> nai adjacency \<ipv4 | ipv6\> destination-identifier \<address\>
+
+**Configure the adjacency destination address identifier (IPv4 or IPv6)
+for the given segment list index.**
+
+An adjacency NAI requires both `source-identifier` and
+`destination-identifier`. A NAI is either an adjacency or a prefix, not
+both, and uses either IPv4 or IPv6, not both. Otherwise, the commit
+fails.
+```
+
+```{cfgcmd} set protocols segment-routing traffic-engineering segment-list \<name\> index \<index\> nai prefix \<ipv4 | ipv6\> prefix-identifier \<prefix\>
+
+**Configure the IGP prefix (IPv4 or IPv6) of a prefix NAI at the given
+segment list index.**
+
+A prefix NAI requires an `algorithm` (`spf` or `strict-spf`). A NAI is
+either an adjacency or a prefix, not both, and uses either IPv4 or IPv6,
+not both. Otherwise, the commit fails.
+```
+
+
+
 ## Examples
 
 ### Enable SR on IS-IS (experimental)
@@ -531,4 +604,3 @@ Codes: K - kernel route, C - connected, S - static, R - RIP,
 O>* 198.51.100.1/32 [110/1] via 192.0.2.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36
 O   198.51.100.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51
 O   192.0.2.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51
-```
diff --git a/docs/configuration/vpn/ipsec/ipsec_general.md b/docs/configuration/vpn/ipsec/ipsec_general.md
index 62fcec8a..13673836 100644
--- a/docs/configuration/vpn/ipsec/ipsec_general.md
+++ b/docs/configuration/vpn/ipsec/ipsec_general.md
@@ -149,6 +149,29 @@ Possible values of the `configured` field are `none` if not
 configured, `opt` if configured but optional, and `req` is
 configured and required. The in use will show yes
 
+## Childless IKE SA
+
+```{cfgcmd} set vpn ipsec site-to-site peer \<name\> childless \<allow | prefer | force | never\>
+
+**Control childless IKEv2 SA initiation ({rfc}`6023` — an IKE SA established
+without a Child SA).**
+
+- `allow`: accept childless IKE SA in responder mode; create a regular IKE SA
+  in initiator mode.
+- `prefer`: accept and create childless IKE SA in both responder and
+  initiator modes.
+- `force`: require the use of childless IKE SA in both responder and
+  initiator modes.
+- `never`: disable support for childless IKE SA when acting as a responder.
+
+Childless IKE SAs require the connection's `ike-group` to use
+`key-exchange ikev2`. Otherwise, the commit fails.
+
+```{cfgcmd} set vpn ipsec remote-access connection \<name\> childless \<allow | prefer | force | never\>
+
+The same option for IKEv2 remote-access connections.
+```
+
 ## Configuration IKE
 
 ```{eval-rst}
@@ -362,7 +385,8 @@ Options
 
 ### IKEv2 Retransmission
 
-If the peer does not respond on DPD packet, the router starts retransmission procedure.
+If the peer does not respond on DPD packet, the router starts retransmission
+procedure.
 
 The following formula is used to calculate the timeout: