firewall/groups: document include option and remote-group interval (#2241)

* firewall/groups: document include option and remote-group interval

These CLI nodes existed in the XML definitions but were missing from
the docs entirely, per docs.vyos.io/en/1.5/coverage.html:

- include: lets one group nest another group of the same type
  (address-group, ipv6-address-group, network-group,
  ipv6-network-group, mac-group, port-group, interface-group)
- remote-group interval: overrides the global resolver-interval on a
  per-group basis

* firewall/groups: clarify remote-group interval range applies post-conversion

CodeRabbit review on #2241 noted the range (60-2419200s) wasn't clearly
tied to suffixed values. Confirmed in vyos-1x conf_mode/firewall.py:
human_to_seconds() converts the value first, then the range check
runs on the converted seconds -- so e.g. "30s" is rejected same as "30".

1 files changed, 53 insertions, 0 deletions

diff --git a/docs/configuration/firewall/groups.md b/docs/configuration/firewall/groups.md
index d364d2d7..8c733075 100644
--- a/docs/configuration/firewall/groups.md
+++ b/docs/configuration/firewall/groups.md
@@ -39,6 +39,18 @@ set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1
 Provide an IPv4 or IPv6 address group description.
 ```
 
+```{cfgcmd} set firewall group address-group \<name\> include \<name\>
+
+Include another address-group as a member of this group. The
+referenced group must already exist and be of the same type.
+```
+
+```{cfgcmd} set firewall group ipv6-address-group \<name\> include \<name\>
+
+Include another ipv6-address-group as a member of this group. The
+referenced group must already exist and be of the same type.
+```
+
 ### Remote Groups
 
 A **remote-group** uses a URL that hosts a newline-delimited list of IPv4
@@ -86,6 +98,17 @@ combined (e.g. `1h30m`). If not set, the group follows the global
 Set a description for a remote group.
 ```
 
+```{cfgcmd} set firewall group remote-group \<name\> interval \<interval\>
+
+Override the global **resolver-interval** for this remote group.
+Accepts a plain number of seconds or a number with a time-unit
+suffix: ``s``, ``m``, ``h``, ``d``, ``w`` (e.g. ``4h``). The value is
+converted to seconds and must be between 60 and 2419200 (4 weeks)
+after conversion, so a suffixed value like ``30s`` is rejected the
+same as the plain number ``30``. If not set, the remote group falls
+back to **firewall global-options resolver-interval**.
+```
+
 The remote list format is flexible. VyOS attempts to parse the first word of
 each line as an entry and skips lines it cannot match. Lines that begin with
 an alphanumeric character but do not match valid IPv4 or IPv6 addresses,
@@ -129,6 +152,18 @@ set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64
 Provide an IPv4 or IPv6 network group description.
 ```
 
+```{cfgcmd} set firewall group network-group \<name\> include \<name\>
+
+Include another network-group as a member of this group. The
+referenced group must already exist and be of the same type.
+```
+
+```{cfgcmd} set firewall group ipv6-network-group \<name\> include \<name\>
+
+Include another ipv6-network-group as a member of this group. The
+referenced group must already exist and be of the same type.
+```
+
 ### Interface Groups
 
 An **interface group** represents a collection of interfaces.
@@ -150,6 +185,12 @@ set firewall group interface-group LAN interface eth3*
 Provide an interface group description.
 ```
 
+```{cfgcmd} set firewall group interface-group \<name\> include \<name\>
+
+Include another interface-group as a member of this group. The
+referenced group must already exist and be of the same type.
+```
+
 ### Port Groups
 
 A **port group** represents only port numbers, not the protocol. You can
@@ -174,6 +215,12 @@ set firewall group port-group PORT-TCP-SERVER1 port 5000-5010
 Provide a port group description.
 ```
 
+```{cfgcmd} set firewall group port-group \<name\> include \<name\>
+
+Include another port-group as a member of this group. The referenced
+group must already exist and be of the same type.
+```
+
 ### MAC Groups
 
 A **mac group** represents a collection of mac addresses.
@@ -193,6 +240,12 @@ set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81
 Provide a MAC group description.
 ```
 
+```{cfgcmd} set firewall group mac-group \<name\> include \<name\>
+
+Include another mac-group as a member of this group. The referenced
+group must already exist and be of the same type.
+```
+
 ### Domain Groups
 
 A **domain group** represents a collection of domains.