summaryrefslogtreecommitdiff
path: root/docs/configexamples
diff options
context:
space:
mode:
Diffstat (limited to 'docs/configexamples')
-rw-r--r--docs/configexamples/md-ansible.md203
-rw-r--r--docs/configexamples/md-bgp-ipv6-unnumbered.md173
-rw-r--r--docs/configexamples/md-dmvpn-dualhub-dualcloud.md523
-rw-r--r--docs/configexamples/md-firewall.md16
-rw-r--r--docs/configexamples/md-fwall-and-bridge.md487
-rw-r--r--docs/configexamples/md-index.md59
-rw-r--r--docs/configexamples/md-lac-lns.md172
-rw-r--r--docs/configexamples/md-nmp.md71
-rw-r--r--docs/configexamples/md-ospf-unnumbered.md117
-rw-r--r--docs/configexamples/md-policy-based-ipsec-and-firewall.md255
-rw-r--r--docs/configexamples/md-segment-routing-isis.md277
-rw-r--r--docs/configexamples/md-site-2-site-cisco.md167
-rw-r--r--docs/configexamples/md-wan-load-balancing.md158
-rw-r--r--docs/configexamples/md-zone-policy.md413
14 files changed, 3091 insertions, 0 deletions
diff --git a/docs/configexamples/md-ansible.md b/docs/configexamples/md-ansible.md
new file mode 100644
index 00000000..3f984812
--- /dev/null
+++ b/docs/configexamples/md-ansible.md
@@ -0,0 +1,203 @@
+---
+lastproofread: '2024-04-09'
+---
+
+(examples-ansible)=
+
+# Ansible example
+
+## Setting up Ansible on a server running the Debian operating system.
+
+In this example, we will set up a simple use of Ansible to configure
+multiple VyOS routers.
+We have four pre-configured routers with this configuration:
+
+Using the general schema for example:
+
+```{image} /_static/images/ansible.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+We have four pre-configured routers with this configuration:
+
+```none
+set interfaces ethernet eth0 address dhcp
+set service ssh
+commit
+save
+```
+
+- vyos7 - 192.0.2.105
+- vyos8 - 192.0.2.106
+- vyos9 - 192.0.2.107
+- vyos10 - 192.0.2.108
+
+## Install Ansible:
+
+```none
+# apt-get install ansible
+Do you want to continue? [Y/n] y
+```
+
+## Install Paramiko:
+
+```none
+#apt-get install -y python3-paramiko
+```
+
+## Check the version:
+
+```none
+# ansible --version
+ansible 2.10.8
+config file = None
+configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
+ansible python module location = /usr/lib/python3/dist-packages/ansible
+executable location = /usr/bin/ansible
+python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]
+```
+
+## Basic configuration of ansible.cfg:
+
+```none
+# nano /root/ansible.cfg
+[defaults]
+host_key_checking = no
+```
+
+## Add all the VyOS hosts:
+
+```none
+# nano /root/hosts
+[vyos_hosts]
+vyos7 ansible_ssh_host=192.0.2.105
+vyos8 ansible_ssh_host=192.0.2.106
+vyos9 ansible_ssh_host=192.0.2.107
+vyos10 ansible_ssh_host=192.0.2.108
+```
+
+## Add general variables:
+
+```none
+# mkdir /root/group_vars/
+# nano /root/group_vars/vyos_hosts
+ansible_python_interpreter: /usr/bin/python3
+ansible_network_os: vyos
+ansible_connection: network_cli
+ansible_user: vyos
+ansible_ssh_pass: vyos
+```
+
+## Add a simple playbook with the tasks for each router:
+
+```none
+# nano /root/main.yml
+
+---
+- hosts: vyos_hosts
+ gather_facts: 'no'
+ tasks:
+ - name: Configure general settings for the vyos hosts group
+ vyos_config:
+ lines:
+ - set system name-server 192.0.2.1
+ - set interfaces ethernet eth0 description '#WAN#'
+ - set interfaces ethernet eth1 description '#LAN#'
+ - set interfaces ethernet eth2 disable
+ - set interfaces ethernet eth3 disable
+ - set system host-name {{ inventory_hostname }}
+ save: true
+```
+
+## Start the playbook:
+
+```none
+ansible-playbook -i hosts main.yml
+PLAY [vyos_hosts] **************************************************************
+
+TASK [Configure general settings for the vyos hosts group] *********************
+ok: [vyos9]
+ok: [vyos10]
+ok: [vyos7]
+ok: [vyos8]
+
+PLAY RECAP *********************************************************************
+vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+```
+
+## Check the result on the vyos10 router:
+
+```none
+vyos@vyos10:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface IP Address S/L Description
+--------- ---------- --- -----------
+eth0 192.0.2.108/24 u/u WAN
+eth1 - u/u LAN
+eth2 - A/D
+eth3 - A/D
+lo 127.0.0.1/8 u/u
+ ::1/128
+
+vyos@vyos10:~$ sh configuration commands | grep 192.0.2.1
+set system name-server '192.0.2.1'
+```
+
+## The simple way without configuration of the hostname (one task for all routers):
+
+```none
+# nano /root/hosts_v2
+[vyos_hosts_group]
+vyos7 ansible_ssh_host=192.0.2.105
+vyos8 ansible_ssh_host=192.0.2.106
+vyos9 ansible_ssh_host=192.0.2.107
+vyos10 ansible_ssh_host=192.0.2.108
+[vyos_hosts_group:vars]
+ansible_python_interpreter=/usr/bin/python3
+ansible_user=vyos
+ansible_ssh_pass=vyos
+ansible_network_os=vyos
+ansible_connection=network_cli
+
+# nano /root/main_v2.yml
+---
+- hosts: vyos_hosts_group
+ connection: network_cli
+ gather_facts: 'no'
+ tasks:
+ - name: Configure remote vyos_hosts_group
+ vyos_config:
+ lines:
+ - set system name-server 192.0.2.1
+ - set interfaces ethernet eth0 description WAN
+ - set interfaces ethernet eth1 description LAN
+ - set interfaces ethernet eth2 disable
+ - set interfaces ethernet eth3 disable
+ save: true
+```
+
+```none
+# ansible-playbook -i hosts_v2 main_v2.yml
+
+PLAY [vyos_hosts_group] ********************************************************
+
+TASK [Configure remote vyos_hosts_group] ***************************************
+ok: [vyos8]
+ok: [vyos7]
+ok: [vyos9]
+ok: [vyos10]
+
+PLAY RECAP *********************************************************************
+vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
+```
+
+In the next chapter of the example, we'll use Ansible with jinja2
+templates and variables.
diff --git a/docs/configexamples/md-bgp-ipv6-unnumbered.md b/docs/configexamples/md-bgp-ipv6-unnumbered.md
new file mode 100644
index 00000000..36d8cf39
--- /dev/null
+++ b/docs/configexamples/md-bgp-ipv6-unnumbered.md
@@ -0,0 +1,173 @@
+---
+lastproofread: '2021-06-28'
+---
+
+(examples-bgp-ipv6-unnumbered)=
+
+# BGP IPv6 unnumbered with extended nexthop
+
+General information can be found in the {ref}`routing-bgp` chapter.
+
+## Configuration
+
+- Router A:
+
+```none
+set protocols bgp system-as 64496
+set protocols bgp address-family ipv4-unicast redistribute connected
+set protocols bgp address-family ipv6-unicast redistribute connected
+set protocols bgp neighbor eth1 interface v6only
+set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
+set protocols bgp neighbor eth2 interface v6only
+set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
+set protocols bgp parameters bestpath as-path multipath-relax
+set protocols bgp parameters bestpath compare-routerid
+set protocols bgp parameters default no-ipv4-unicast
+set protocols bgp parameters router-id '192.168.0.1'
+set protocols bgp peer-group fabric address-family ipv4-unicast
+set protocols bgp peer-group fabric address-family ipv6-unicast
+set protocols bgp peer-group fabric capability extended-nexthop
+set protocols bgp peer-group fabric remote-as 'external'
+```
+
+- Router B:
+
+```none
+set protocols bgp system-as 64499
+set protocols bgp address-family ipv4-unicast redistribute connected
+set protocols bgp address-family ipv6-unicast redistribute connected
+set protocols bgp neighbor eth1 interface v6only
+set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
+set protocols bgp neighbor eth2 interface v6only
+set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
+set protocols bgp parameters bestpath as-path multipath-relax
+set protocols bgp parameters bestpath compare-routerid
+set protocols bgp parameters default no-ipv4-unicast
+set protocols bgp parameters router-id '192.168.0.2'
+set protocols bgp peer-group fabric address-family ipv4-unicast
+set protocols bgp peer-group fabric address-family ipv6-unicast
+set protocols bgp peer-group fabric capability extended-nexthop
+set protocols bgp peer-group fabric remote-as 'external'
+```
+
+## Results
+
+- Router A:
+
+```none
+vyos@vyos:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface IP Address S/L Description
+--------- ---------- --- -----------
+eth0 198.51.100.34/24 u/u
+eth1 - u/u
+eth2 - u/u
+lo 127.0.0.1/8 u/u
+ 192.168.0.1/32
+ ::1/128
+```
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+ O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+ T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+ F - PBR, f - OpenFabric,
+ > - selected route, * - FIB route
+
+S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53
+C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53
+C>* 192.168.0.1/32 is directly connected, lo, 03:21:56
+B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07
+ * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07
+```
+
+```none
+vyos@vyos:~$ ping 192.168.0.2
+PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
+64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms
+64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms
+64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms
+64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms
+64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms
+
+--- 192.168.0.2 ping statistics ---
+5 packets transmitted, 5 received, 0% packet loss, time 4086ms
+rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms
+```
+
+```none
+vyos@vyos:~$ show ip bgp summary
+
+IPv4 Unicast Summary:
+BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0
+BGP table version 4
+RIB entries 5, using 800 bytes of memory
+Peers 2, using 41 KiB of memory
+Peer groups 1, using 64 bytes of memory
+
+Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
+eth1 4 64499 13 13 0 0 0 00:05:33 2
+eth2 4 64499 13 14 0 0 0 00:05:29 2
+
+Total number of neighbors 2
+```
+
+- Router B:
+
+```none
+vyos@vyos:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface IP Address S/L Description
+--------- ---------- --- -----------
+eth0 198.51.100.33/24 u/u
+eth1 - u/u
+eth2 - u/u
+lo 127.0.0.1/8 u/u
+ 192.168.0.2/32
+ ::1/128
+```
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+ O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+ T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+ F - PBR, f - OpenFabric,
+ > - selected route, * - FIB route
+
+S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08
+C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09
+B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18
+ * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18
+C>* 192.168.0.2/32 is directly connected, lo, 00:44:11
+```
+
+```none
+vyos@vyos:~$ ping 192.168.0.1
+PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
+64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms
+64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms
+64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms
+64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms
+
+--- 192.168.0.1 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3051ms
+rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms
+```
+
+```none
+vyos@vyos:~$ show ip bgp summary
+IPv4 Unicast Summary:
+BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0
+BGP table version 4
+RIB entries 5, using 800 bytes of memory
+Peers 2, using 41 KiB of memory
+Peer groups 1, using 64 bytes of memory
+
+Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
+eth1 4 64496 14 14 0 0 0 00:06:40 2
+eth2 4 64496 14 14 0 0 0 00:06:37 2
+
+Total number of neighbors 2
+```
diff --git a/docs/configexamples/md-dmvpn-dualhub-dualcloud.md b/docs/configexamples/md-dmvpn-dualhub-dualcloud.md
new file mode 100644
index 00000000..8f5639b1
--- /dev/null
+++ b/docs/configexamples/md-dmvpn-dualhub-dualcloud.md
@@ -0,0 +1,523 @@
+---
+lastproofread: '2024-02-21'
+---
+
+(examples-dmvpn-dualhub-dualcloud)=
+
+# DMVPN Dual HUB Dual Cloud
+
+This document is to describe a basic setup to build DVMPN network with two Hubs and two clouds using DMVPN Phase3.
+OSPF is used as routing protocol inside DMVPN.
+
+In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1)
+as a Spoke.
+
+## Network Topology
+
+```{image} /_static/images/dual-hub-DMVPN.png
+:align: center
+:alt: DMVPN Network Topology
+:width: 80%
+```
+
+## Configurations
+
+### Underlay configuration
+Networks 192.168.X.0/24 are used as LANs for every spoke.
+
+HUB-1
+
+```none
+set interfaces ethernet eth0 address '10.0.0.2/30'
+set protocols static route 0.0.0.0/0 next-hop 10.0.0.1
+```
+
+HUB-2
+
+```none
+set interfaces ethernet eth0 address '10.0.1.2/30'
+set protocols static route 0.0.0.0/0 next-hop 10.0.1.1
+```
+
+Spoke-1
+
+```none
+interface GigabitEthernet0/0
+ ip address 10.0.11.2 255.255.255.252
+ duplex auto
+ speed auto
+ media-type rj45
+!
+interface GigabitEthernet0/1
+ ip address 192.168.11.1 255.255.255.0
+ ip ospf 1 area 0
+ duplex auto
+ speed auto
+ media-type rj45
+!
+ip route 0.0.0.0 0.0.0.0 10.0.11.1
+```
+
+Spoke-2
+
+```none
+set interfaces ethernet eth0 address '10.0.12.2/30'
+set interfaces ethernet eth1 address '192.168.12.1/24'
+set protocols static route 0.0.0.0/0 next-hop 10.0.12.1
+```
+
+Spoke-3
+
+```none
+set interfaces ethernet eth0 address '10.0.13.2/30'
+set interfaces ethernet eth1 address '192.168.13.1/24'
+set protocols static route 0.0.0.0/0 next-hop 10.0.13.1
+```
+
+### NHRP configuration
+The next step is to configure the NHRP protocol. In a Dual cloud network, every HUB has to be configured with one GRE
+multipoint tunnel interface and every spoke has to be configured with two tunnel interfaces, one tunnel to each hub.
+In this example tunnel networks are 10.100.100.0/24 for the first cloud and 10.100.101.0/24 for the second cloud.
+But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32.
+
+HUB-1
+
+```none
+set interfaces tunnel tun100 address '10.100.100.1/32'
+set interfaces tunnel tun100 enable-multicast
+set interfaces tunnel tun100 encapsulation 'gre'
+set interfaces tunnel tun100 ip adjust-mss '1360'
+set interfaces tunnel tun100 mtu '1436'
+set interfaces tunnel tun100 parameters ip key '42'
+set interfaces tunnel tun100 source-interface 'eth0'
+set protocols nhrp tunnel tun100 authentication 'vyos'
+set protocols nhrp tunnel tun100 holdtime '300'
+set protocols nhrp tunnel tun100 multicast 'dynamic'
+set protocols nhrp tunnel tun100 network-id '1'
+set protocols nhrp tunnel tun100 redirect
+set protocols nhrp tunnel tun100 registration-no-unique
+```
+
+HUB-2
+
+```none
+set interfaces tunnel tun101 address '10.100.101.1/32'
+set interfaces tunnel tun101 enable-multicast
+set interfaces tunnel tun101 encapsulation 'gre'
+set interfaces tunnel tun101 ip adjust-mss '1360'
+set interfaces tunnel tun101 mtu '1436'
+set interfaces tunnel tun101 parameters ip key '43'
+set interfaces tunnel tun101 source-interface 'eth0'
+set protocols nhrp tunnel tun101 authentication 'vyos'
+set protocols nhrp tunnel tun101 holdtime '300'
+set protocols nhrp tunnel tun101 multicast 'dynamic'
+set protocols nhrp tunnel tun101 network-id '2'
+set protocols nhrp tunnel tun101 redirect
+set protocols nhrp tunnel tun101 registration-no-unique
+```
+
+Spoke-1
+
+```none
+interface Tunnel100
+ ip address 10.100.100.11 255.255.255.0
+ no ip redirects
+ ip mtu 1436
+ ip nhrp authentication vyos
+ ip nhrp map multicast 10.0.0.2
+ ip nhrp network-id 1
+ ip nhrp holdtime 300
+ ip nhrp nhs 10.100.100.1 nbma 10.0.0.2
+ ip nhrp shortcut
+ ip tcp adjust-mss 1360
+ tunnel source GigabitEthernet0/0
+ tunnel mode gre multipoint
+ tunnel key 42
+!
+interface Tunnel101
+ ip address 10.100.101.11 255.255.255.0
+ no ip redirects
+ ip mtu 1436
+ ip nhrp authentication vyos
+ ip nhrp map multicast 10.0.1.2
+ ip nhrp network-id 2
+ ip nhrp holdtime 300
+ ip nhrp nhs 10.100.101.1 nbma 10.0.1.2
+ ip nhrp shortcut
+ ip tcp adjust-mss 1360
+ tunnel source GigabitEthernet0/0
+ tunnel mode gre multipoint
+ tunnel key 43
+```
+
+Spoke-2
+
+```none
+set interfaces tunnel tun100 address '10.100.100.12/32'
+set interfaces tunnel tun100 enable-multicast
+set interfaces tunnel tun100 encapsulation 'gre'
+set interfaces tunnel tun100 ip adjust-mss '1360'
+set interfaces tunnel tun100 mtu '1436'
+set interfaces tunnel tun100 parameters ip key '42'
+set interfaces tunnel tun100 source-interface 'eth0'
+set interfaces tunnel tun101 address '10.100.101.12/32'
+set interfaces tunnel tun101 enable-multicast
+set interfaces tunnel tun101 encapsulation 'gre'
+set interfaces tunnel tun101 ip adjust-mss '1360'
+set interfaces tunnel tun101 mtu '1436'
+set interfaces tunnel tun101 parameters ip key '43'
+set interfaces tunnel tun101 source-interface 'eth0'
+set protocols nhrp tunnel tun100 authentication 'vyos'
+set protocols nhrp tunnel tun100 holdtime '300'
+set protocols nhrp tunnel tun100 multicast '10.0.0.2'
+set protocols nhrp tunnel tun100 network-id '1'
+set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2'
+set protocols nhrp tunnel tun100 registration-no-unique
+set protocols nhrp tunnel tun100 shortcut
+set protocols nhrp tunnel tun101 authentication 'vyos'
+set protocols nhrp tunnel tun101 holdtime '300'
+set protocols nhrp tunnel tun101 multicast '10.0.1.2'
+set protocols nhrp tunnel tun101 network-id '2'
+set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2'
+set protocols nhrp tunnel tun101 registration-no-unique
+set protocols nhrp tunnel tun101 shortcut
+```
+
+Spoke-3
+
+```none
+set protocols nhrp tunnel tun100 authentication 'vyos'
+set protocols nhrp tunnel tun100 holdtime '300'
+set protocols nhrp tunnel tun100 multicast '10.0.0.2'
+set protocols nhrp tunnel tun100 network-id '1'
+set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2'
+set protocols nhrp tunnel tun100 registration-no-unique
+set protocols nhrp tunnel tun100 shortcut
+set protocols nhrp tunnel tun101 authentication 'vyos'
+set protocols nhrp tunnel tun101 holdtime '300'
+set protocols nhrp tunnel tun101 multicast '10.0.1.2'
+set protocols nhrp tunnel tun101 network-id '2'
+set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2'
+set protocols nhrp tunnel tun101 registration-no-unique
+set protocols nhrp tunnel tun101 shortcut
+```
+
+### Overlay configuration
+The last step is to configure the routing protocol. In this scenario, OSPF was chosen as the dynamic routing protocol.
+But you can use iBGP or eBGP. To form fast convergence it is possible to use BFD protocol.
+
+HUB-1
+
+```none
+set protocols ospf interface tun100 area '0'
+set protocols ospf interface tun100 network 'point-to-multipoint'
+set protocols ospf interface tun100 passive disable
+set protocols ospf passive-interface 'default'
+```
+
+HUB-2
+
+```none
+set protocols ospf interface tun101 area '0'
+set protocols ospf interface tun101 network 'point-to-multipoint'
+set protocols ospf interface tun101 passive disable
+set protocols ospf passive-interface 'default'
+```
+
+Spoke-1
+
+```none
+interface Tunnel100
+ ip ospf network point-to-multipoint
+ ip ospf dead-interval 40
+ ip ospf hello-interval 10
+ ip ospf 1 area 0
+!
+interface Tunnel101
+ ip ospf network point-to-multipoint
+ ip ospf dead-interval 40
+ ip ospf hello-interval 10
+ ip ospf 1 area 0
+!
+router ospf 1
+ passive-interface default
+ no passive-interface Tunnel100
+ no passive-interface Tunnel101
+```
+
+Spoke-2
+
+```none
+set protocols ospf interface eth1 area '0'
+set protocols ospf interface tun100 area '0'
+set protocols ospf interface tun100 network 'point-to-multipoint'
+set protocols ospf interface tun100 passive disable
+set protocols ospf interface tun101 area '0'
+set protocols ospf interface tun101 network 'point-to-multipoint'
+set protocols ospf interface tun101 passive disable
+set protocols ospf passive-interface 'default'
+```
+
+Spoke-3
+
+```none
+set protocols ospf interface eth1 area '0'
+set protocols ospf interface tun100 area '0'
+set protocols ospf interface tun100 network 'point-to-multipoint'
+set protocols ospf interface tun100 passive disable
+set protocols ospf interface tun101 area '0'
+set protocols ospf interface tun101 network 'point-to-multipoint'
+set protocols ospf interface tun101 passive disable
+set protocols ospf passive-interface 'default'
+```
+
+### Security configuration
+Tunnels can be encrypted by IPSEC for security.
+
+HUB-1
+
+```none
+set vpn ipsec esp-group ESP-HUB lifetime '1800'
+set vpn ipsec esp-group ESP-HUB mode 'transport'
+set vpn ipsec esp-group ESP-HUB pfs 'disable'
+set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+set vpn ipsec ike-group IKE-HUB lifetime '3600'
+set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+set vpn ipsec interface 'eth0'
+set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
+set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
+set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+```
+
+HUB-2
+
+```none
+set vpn ipsec esp-group ESP-HUB lifetime '1800'
+set vpn ipsec esp-group ESP-HUB mode 'transport'
+set vpn ipsec esp-group ESP-HUB pfs 'disable'
+set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+set vpn ipsec ike-group IKE-HUB lifetime '3600'
+set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+set vpn ipsec interface 'eth0'
+set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
+set vpn ipsec profile NHRPVPN bind tunnel 'tun101'
+set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+```
+
+VyOS Spokes have the same configuration
+
+```none
+set vpn ipsec esp-group ESP-HUB lifetime '1800'
+set vpn ipsec esp-group ESP-HUB mode 'transport'
+set vpn ipsec esp-group ESP-HUB pfs 'disable'
+set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+set vpn ipsec ike-group IKE-HUB lifetime '3600'
+set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+set vpn ipsec interface 'eth0'
+set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
+set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
+set vpn ipsec profile NHRPVPN bind tunnel 'tun101'
+set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+```
+
+SPOKE-1
+
+```none
+crypto isakmp policy 1
+ encr aes 256
+ authentication pre-share
+ group 2
+ lifetime 3600
+crypto isakmp key secret address 0.0.0.0
+!
+!
+crypto ipsec transform-set ESP_TRANSFORMSET esp-aes 256 esp-sha-hmac
+ mode transport
+!
+!
+crypto ipsec profile gre_protection
+ set security-association lifetime seconds 1800
+ set transform-set ESP_TRANSFORMSET
+!
+interface Tunnel100
+ tunnel protection ipsec profile gre_protection shared
+!
+interface Tunnel101
+ tunnel protection ipsec profile gre_protection shared
+```
+
+## Monitoring
+All spokes created IPSec tunnels to Hubs, are registered on Hubs using NHRP protocol and formed adjacency in OSPF.
+```none
+vyos@HUB-1:~$ show vpn ipsec sa
+Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal
+-------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------
+dmvpn-NHRPVPN-tun100-child up 6m1s 4K/5K 51/56 10.0.13.2 10.0.13.2 AES_CBC_256/HMAC_SHA1_96
+dmvpn-NHRPVPN-tun100-child up 6m36s 4K/6K 56/65 10.0.12.2 10.0.12.2 AES_CBC_256/HMAC_SHA1_96
+dmvpn-NHRPVPN-tun100-child up 8m49s 6K/6K 73/77 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96
+
+vyos@HUB-1:~$ show ip nhrp cache
+Iface Type Protocol NBMA Claimed NBMA Flags Identity
+tun100 dynamic 10.100.100.12 10.0.12.2 10.0.12.2 T 10.0.12.2
+tun100 dynamic 10.100.100.13 10.0.13.2 10.0.13.2 T 10.0.13.2
+tun100 dynamic 10.100.100.11 10.0.11.2 10.0.11.2 T 10.0.11.2
+tun100 local 10.100.100.1 10.0.0.2 10.0.0.2 -
+
+vyos@HUB-1:~$ show ip ospf neighbor
+
+Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL
+192.168.11.1 1 Full/DROther 17m01s 36.201s 10.100.100.11 tun100:10.100.100.1 0 0 0
+192.168.12.1 1 Full/DROther 9m42s 37.443s 10.100.100.12 tun100:10.100.100.1 0 0 0
+192.168.13.1 1 Full/DROther 9m15s 35.053s 10.100.100.13 tun100:10.100.100.1 0 0 0
+```
+First, we see that LANs are accessible through hubs using OSPF routes.
+```none
+SPOKE-1#show ip route
+Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
+ D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
+ N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
+ E1 - OSPF external type 1, E2 - OSPF external type 2
+ i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
+ ia - IS-IS inter area, * - candidate default, U - per-user static route
+ o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ a - application route
+ + - replicated route, % - next hop override, p - overrides from PfR
+
+Gateway of last resort is 10.0.11.1 to network 0.0.0.0
+.....
+ 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks
+C 192.168.11.0/24 is directly connected, GigabitEthernet0/1
+L 192.168.11.1/32 is directly connected, GigabitEthernet0/1
+O 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101
+ [110/1002] via 10.100.100.1, 00:16:13, Tunnel100
+O 192.168.13.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101
+ [110/1002] via 10.100.100.1, 00:15:45, Tunnel100
+
+
+vyos@SPOKE-2:~$ show ip route
+Codes: K - kernel route, C - connected, L - local, S - static,
+ R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+ T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+ f - OpenFabric, t - Table-Direct,
+ > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+ t - trapped, o - offload failure
+
+......
+
+O>* 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36
+ * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36
+O 192.168.12.0/24 [110/1] is directly connected, eth1, weight 1, 01:24:40
+C>* 192.168.12.0/24 is directly connected, eth1, weight 1, 01:24:43
+L>* 192.168.12.1/32 is directly connected, eth1, weight 1, 01:24:43
+O>* 192.168.13.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36
+ * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36
+```
+After initiating traffic between SPOKES sites, Phase 3 of DMVPN will work.
+For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1
+```none
+PC-SPOKE-2 : 192.168.12.2 255.255.255.0 gateway 192.168.12.1
+
+PC-SPOKE-2> trace 192.168.11.2
+trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop
+ 1 192.168.12.1 0.558 ms 0.378 ms 0.561 ms
+ 2 10.100.101.1 1.768 ms 1.158 ms 1.744 ms
+ 3 10.100.101.11 7.196 ms 4.971 ms 4.793 ms
+ 4 *192.168.11.2 7.747 ms (ICMP type:3, code:3, Destination port unreachable)
+
+PC-SPOKE-2> trace 192.168.11.2
+trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop
+ 1 192.168.12.1 0.562 ms 0.396 ms 0.364 ms
+ 2 10.100.100.11 4.401 ms 4.399 ms 4.174 ms
+ 3 *192.168.11.2 3.241 ms (ICMP type:3, code:3, Destination port unreachable)
+```
+First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2.
+Now routing tables are changed. LAN networks 192.168.12.0/24 and 192.168.11.0/24 available directly via SPOKES.
+```none
+vyos@SPOKE-2:~$ show ip route
+Codes: K - kernel route, C - connected, L - local, S - static,
+ R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+ T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+ f - OpenFabric, t - Table-Direct,
+ > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+ t - trapped, o - offload failure
+
+N>* 192.168.11.0/24 [10/0] via 10.100.100.11, tun100 onlink, weight 1, 00:00:14
+O 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:00:54
+ via 10.100.101.1, tun101 onlink, weight 1, 00:00:54
+
+
+SPOKE-1# show ip route next-hop-override
+Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
+ D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
+ N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
+ E1 - OSPF external type 1, E2 - OSPF external type 2
+ i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
+ ia - IS-IS inter area, * - candidate default, U - per-user static route
+ o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ a - application route
+ + - replicated route, % - next hop override, p - overrides from PfR
+
+Gateway of last resort is 10.0.11.1 to network 0.0.0.0
+
+O % 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:24:09, Tunnel101
+ [110/1002] via 10.100.100.1, 00:25:46, Tunnel100
+ [NHO][110/1] via 10.100.100.12, 00:00:03, Tunnel100
+```
+NHRP shows shortcuts on Spokes
+```none
+vyos@SPOKE-2:~$ show ip nhrp shortcut
+Type Prefix Via Identity
+dynamic 192.168.11.0/24 10.100.100.11 10.0.11.2
+
+SPOKE-1# show ip nhrp shortcut
+10.100.100.12/32 via 10.100.100.12
+ Tunnel100 created 00:09:59, expire 00:02:21
+ Type: dynamic, Flags: router nhop rib nho
+ NBMA address: 10.0.12.2
+192.168.12.0/24 via 10.100.100.12
+ Tunnel100 created 00:02:38, expire 00:02:21
+ Type: dynamic, Flags: router rib nho
+ NBMA address: 10.0.12.2
+```
+A new Spoke to Spoke IPSec tunnel is created
+```none
+SPOKE-1#show crypto isakmp sa
+IPv4 Crypto ISAKMP SA
+dst src state conn-id status
+10.0.0.2 10.0.11.2 QM_IDLE 1002 ACTIVE
+10.0.12.2 10.0.11.2 QM_IDLE 1004 ACTIVE
+10.0.1.2 10.0.11.2 QM_IDLE 1003 ACTIVE
+
+vyos@SPOKE-2:~$ show vpn ipsec sa
+Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal
+-------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------
+dmvpn-NHRPVPN-tun100-child up 7m26s 4K/4K 57/53 10.0.0.2 10.0.0.2 AES_CBC_256/HMAC_SHA1_96
+dmvpn-NHRPVPN-tun100-child up 11m48s 316B/1K 3/15 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96
+dmvpn-NHRPVPN-tun101-child up 5m58s 5K/4K 62/51 10.0.1.2 10.0.1.2 AES_CBC_256/HMAC_SHA1_96
+```
+
+## Summary
+
+If one of the Hubs loses connectivity to the Internet, the other Hub will be available and take the main role.
+This is a simple example where only one internet connection is used. But in the real world, there can be two
+connections to the Internet. In this case, there is a recommendation to build each tunnel via each Internet connection,
+choose the main cloud, and manipulate traffic via a routing protocol. It allows the creation failover on link-level
+connections too.
diff --git a/docs/configexamples/md-firewall.md b/docs/configexamples/md-firewall.md
new file mode 100644
index 00000000..5d170511
--- /dev/null
+++ b/docs/configexamples/md-firewall.md
@@ -0,0 +1,16 @@
+---
+lastproofread: '2024-09-11'
+---
+
+# Firewall Examples
+
+This section contains examples of firewall configurations for various
+deployments.
+
+```{toctree}
+:maxdepth: 2
+
+fwall-and-vrf
+fwall-and-bridge
+zone-policy
+```
diff --git a/docs/configexamples/md-fwall-and-bridge.md b/docs/configexamples/md-fwall-and-bridge.md
new file mode 100644
index 00000000..75fb6b25
--- /dev/null
+++ b/docs/configexamples/md-fwall-and-bridge.md
@@ -0,0 +1,487 @@
+---
+lastproofread: '2024-09-11'
+---
+
+# Bridge and firewall example
+
+## Scenario and requirements
+
+This example shows how to configure a VyOS router with bridge interfaces and
+firewall rules.
+
+Three non VLAN-aware bridges are going to be configured, and each one has its
+own requirements.
+
+- Bridge br0:
+ : - Isolated layer 2 bridge.
+ - Accept only IPv6 communication whithin the bridge.
+- Bridge br1:
+ : - Drop all DHCP discover packets.
+ - Accept all ARP packets.
+ - Within the bridge, accept only new IPv4 connections from host 10.1.1.102
+ - Drop all other IPv4 connections.
+ - Drop all IPv6 connections.
+ - Accept access to router itself.
+ - Allow connections to internet
+ - Drop connections to other LANs.
+- Bridge br2:
+ : - Accept all DHCP discover packets.
+ - Accept only DHCP offers from valid server and|or trusted bridge port.
+ - Accept all ARP packets.
+ - Accept all IPv4 connections.
+ - Drop all IPv6 connections.
+ - Deny access to the router.
+ - Allow connections to internet.
+ - Allow connections to bridge br1.
+
+## Configuration
+
+### Bridges and interfaces configuration
+
+First, we need to configure the interfaces and bridges:
+
+```none
+# Brige br0
+set interfaces bridge br0 description 'Isolated L2 bridge'
+set interfaces bridge br0 member interface eth1
+set interfaces bridge br0 member interface eth2
+set interfaces ethernet eth1 description 'br0'
+set interfaces ethernet eth2 description 'br0'
+
+# Bridge br1:
+set interfaces bridge br1 address '10.1.1.1/24'
+set interfaces bridge br1 description 'L3 bridge br1'
+set interfaces bridge br1 member interface eth3
+set interfaces bridge br1 member interface eth4
+set interfaces ethernet eth3 description 'br1'
+set interfaces ethernet eth4 description 'br1'
+
+# Bridge br2:
+set interfaces bridge br2 address '10.2.2.1/24'
+set interfaces bridge br2 description 'L3 bridge br2'
+set interfaces bridge br2 member interface eth5
+set interfaces bridge br2 member interface eth6
+set interfaces bridge br2 member interface eth7
+set interfaces ethernet eth5 description 'br2 - Host'
+set interfaces ethernet eth6 description 'br2 - Trusted DHCP Server'
+set interfaces ethernet eth7 description 'br2'
+```
+
+### Bridge firewall configuration
+
+In this section, we are going to configure the firewall rules that will be used
+in bridge firewall, and will control the traffic within each bridge.
+
+We are going to use custom firewall rulesets, one for each bridge that will
+be used in `prerouting`, and one for each bridge that will be used in the
+`forward` chain.
+
+Also, we are going to use firewall interface groups in order to simplify the
+firewall configuration.
+
+So first, let's create the required firewall interface groups:
+
+```none
+# Bridge br0 interface-group:
+set firewall group interface-group br0-ifaces interface 'br0'
+set firewall group interface-group br0-ifaces interface 'eth1'
+set firewall group interface-group br0-ifaces interface 'eth2'
+
+# Bridge br1 interface-group:
+set firewall group interface-group br1-ifaces interface 'br1'
+set firewall group interface-group br1-ifaces interface 'eth3'
+set firewall group interface-group br1-ifaces interface 'eth4'
+
+# Bridge br2 interface-group:
+set firewall group interface-group br2-ifaces interface 'br2'
+set firewall group interface-group br2-ifaces interface 'eth5'
+set firewall group interface-group br2-ifaces interface 'eth6'
+set firewall group interface-group br2-ifaces interface 'eth7'
+```
+
+As said before, we are going to create custom firewall rulesets for each
+bridge, that will be used in the `prerouting` chain, in order to drop as much
+unwanted traffic as early as possible. So, custom rulesets used in
+`prerouting` chain are going to be `br0-pre`, `br1-pre`, and `br2-pre`:
+
+```none
+# Prerouting - Catch all traffic for br0
+set firewall bridge prerouting filter rule 10 action 'jump'
+set firewall bridge prerouting filter rule 10 description 'br0 traffic'
+set firewall bridge prerouting filter rule 10 inbound-interface group 'br0-ifaces'
+set firewall bridge prerouting filter rule 10 jump-target 'br0-pre'
+
+# Prerouting - Catch all traffic for br1
+set firewall bridge prerouting filter rule 20 action 'jump'
+set firewall bridge prerouting filter rule 20 description 'br1 traffic'
+set firewall bridge prerouting filter rule 20 inbound-interface group 'br1-ifaces'
+set firewall bridge prerouting filter rule 20 jump-target 'br1-pre'
+
+# Prerouting - Catch all traffic for br2
+set firewall bridge prerouting filter rule 30 action 'jump'
+set firewall bridge prerouting filter rule 30 description 'br2 traffic'
+set firewall bridge prerouting filter rule 30 inbound-interface group 'br2-ifaces'
+set firewall bridge prerouting filter rule 30 jump-target 'br2-pre'
+```
+
+And then create the custom rulesets:
+
+```none
+### br0 - br0-pre
+ # Requirements: accept only IPv6 communication within the bridge
+set firewall bridge name br0-pre rule 10 description 'Accept IPv6 traffic'
+set firewall bridge name br0-pre rule 10 action 'accept'
+set firewall bridge name br0-pre rule 10 ethernet-type 'ipv6'
+ # And drop everything else
+set firewall bridge name br0-pre default-action 'drop'
+
+### br1 - br1-pre
+ # Requirements: drop all DHCP discover packets
+set firewall bridge name br1-pre rule 10 description 'Drop DHCP discover'
+set firewall bridge name br1-pre rule 10 action 'drop'
+set firewall bridge name br1-pre rule 10 protocol 'udp'
+set firewall bridge name br1-pre rule 10 source port '68'
+set firewall bridge name br1-pre rule 10 destination port '67'
+set firewall bridge name br1-pre rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
+set firewall bridge name br1-pre rule 10 log
+ # Requirement: drop all IPv6 connections
+set firewall bridge name br1-pre rule 20 description 'Drop IPv6 traffic'
+set firewall bridge name br1-pre rule 20 action 'drop'
+set firewall bridge name br1-pre rule 20 ethernet-type 'ipv6'
+ # Accept everything else so it can be parsed later
+set firewall bridge name br1-pre default-action 'accept'
+
+### br2 - br2-pre
+ # Requirements: drop all IPv6 connections
+set firewall bridge name br2-pre rule 10 description 'Drop IPv6 traffic'
+set firewall bridge name br2-pre rule 10 action 'drop'
+set firewall bridge name br2-pre rule 10 ethernet-type 'ipv6'
+ # Accept everything else so it can be parsed later
+set firewall bridge name br2-pre default-action 'accept'
+```
+
+Now, in the `forward` chain, we are going to define state policies, and
+custom rulesets for each bridge that would be used in the `forward` chain.
+These rulesets are `br0-fwd`, `br1-fwd`, and `br2-fwd`:
+
+```none
+# Forward - State policies if not defined globally
+set firewall bridge forward filter rule 5 action 'accept'
+set firewall bridge forward filter rule 5 state 'established'
+set firewall bridge forward filter rule 5 state 'related'
+set firewall bridge forward filter rule 10 action 'drop'
+set firewall bridge forward filter rule 10 state 'invalid'
+
+# Forward - Catch all traffic for br0
+set firewall bridge forward filter rule 110 description 'br0 traffic'
+set firewall bridge forward filter rule 110 action 'jump'
+set firewall bridge forward filter rule 110 inbound-interface group 'br0-ifaces'
+set firewall bridge forward filter rule 110 jump-target 'br0-fwd'
+
+# Forward - Catch all traffic for br1
+set firewall bridge forward filter rule 120 description 'br1 traffic'
+set firewall bridge forward filter rule 120 action 'jump'
+set firewall bridge forward filter rule 120 inbound-interface group 'br1-ifaces'
+set firewall bridge forward filter rule 120 jump-target 'br1-fwd'
+
+# Forward - Catch all traffic for br2
+set firewall bridge forward filter rule 130 description 'br2 traffic'
+set firewall bridge forward filter rule 130 action 'jump'
+set firewall bridge forward filter rule 130 inbound-interface group 'br2-ifaces'
+set firewall bridge forward filter rule 130 jump-target 'br2-fwd'
+
+# Forward - Default action drop:
+set firewall bridge forward filter default-action 'drop'
+```
+
+And the content of the custom rulesets:
+
+```none
+### br0 - br0-fwd
+ # Accept everything that wasn't dropped in prerouting
+set firewall bridge name br0-fwd default-action 'accept'
+
+### br1 - br1-fwd
+ # Requirement: Accept all ARP packets
+set firewall bridge name br1-fwd rule 10 description 'Accept ARP'
+set firewall bridge name br1-fwd rule 10 action 'accept'
+set firewall bridge name br1-fwd rule 10 ethernet-type 'arp'
+ # Requirement: Accept only new IPv4 connections from host 10.1.1.102
+set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host'
+set firewall bridge name br1-fwd rule 20 action 'accept'
+set firewall bridge name br1-fwd rule 20 source address '10.1.1.102'
+set firewall bridge name br1-fwd rule 20 state 'new'
+ # Drop everythin else within the bridge:
+set firewall bridge name br1-fwd default-action 'drop'
+
+### br2 - br2-fwd
+ # Requirement: Accept all DHCP discover packets
+set firewall bridge name br2-fwd rule 10 description 'Accept DHCP discover'
+set firewall bridge name br2-fwd rule 10 action 'accept'
+set firewall bridge name br2-fwd rule 10 protocol 'udp'
+set firewall bridge name br2-fwd rule 10 source port '68'
+set firewall bridge name br2-fwd rule 10 destination port '67'
+set firewall bridge name br2-fwd rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
+ # Requirement: Accept only DHCP offers from valid server on port eth6
+set firewall bridge name br2-fwd rule 20 description 'Accept DHCP offers from trusted interface'
+set firewall bridge name br2-fwd rule 20 action 'accept'
+set firewall bridge name br2-fwd rule 20 protocol 'udp'
+set firewall bridge name br2-fwd rule 20 source port '67'
+set firewall bridge name br2-fwd rule 20 destination port '68'
+set firewall bridge name br2-fwd rule 20 inbound-interface name 'eth6'
+set firewall bridge name br2-fwd rule 22 description 'Drop all other DHCP offers'
+set firewall bridge name br2-fwd rule 22 action 'drop'
+set firewall bridge name br2-fwd rule 22 protocol 'udp'
+set firewall bridge name br2-fwd rule 22 source port '67'
+set firewall bridge name br2-fwd rule 22 destination port '68'
+set firewall bridge name br2-fwd rule 22 log
+
+ # Accept all ARP packets
+set firewall bridge name br2-fwd rule 30 description 'Accept ARP'
+set firewall bridge name br2-fwd rule 30 action 'accept'
+set firewall bridge name br2-fwd rule 30 ethernet-type 'arp'
+ # Accept all IPv4 connections
+set firewall bridge name br2-fwd rule 40 description 'Accept ipv4'
+set firewall bridge name br2-fwd rule 40 action 'accept'
+set firewall bridge name br2-fwd rule 40 ethernet-type 'ipv4'
+ # Drop everything else
+set firewall bridge name br2-fwd default-action 'drop'
+```
+
+### IP firewall configuration
+
+Since some of the requirements listed above exceed the capabilities of the
+bridge firewall, we need to use the IP firewall to implement them.
+For bridge br1 and br2, we need to control the traffic that is going to the
+router itself, to other local networks, and to the Internet.
+
+As a reminder, here's a link to the {doc}`firewall documentation
+</configuration/firewall/index>`, where you can find more information about
+the packet flow for traffic that comes from bridge layer and should be analized
+by the IP firewall.
+
+Access to the router itself is controlled by the base chain `input`, and
+rules to accomplish all the requirements are:
+
+```none
+# First of all, if not using global state policies, we need to define them:
+set firewall ipv4 input filter rule 10 state 'established'
+set firewall ipv4 input filter rule 10 state 'related'
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 20 state 'invalid'
+set firewall ipv4 input filter rule 20 action 'drop'
+
+# Input - br1 - Accept access to router itself
+set firewall ipv4 input filter rule 110 description "Accept access from br1"
+set firewall ipv4 input filter rule 110 action 'accept'
+set firewall ipv4 input filter rule 110 inbound-interface group 'br1-ifaces'
+
+# Input - br2 - Deny access to the router
+set firewall ipv4 input filter rule 120 description "Deny access from br2"
+set firewall ipv4 input filter rule 120 action 'drop'
+set firewall ipv4 input filter rule 120 inbound-interface group 'br2-ifaces'
+```
+
+And for traffic that is going to other local networks, and to he Internet, we
+need to use the base chain `forward`. As in the bridge firewall, we are
+going to use custom rulesets for each bridge, that would be used in the
+`forward` chain. Those rulesets are `ip-br1-fwd` and `ip-br2-fwd`:
+
+```none
+# First of all, if not using global state policies, we need to define them:
+set firewall ipv4 forward filter rule 5 action 'accept'
+set firewall ipv4 forward filter rule 5 state 'established'
+set firewall ipv4 forward filter rule 5 state 'related'
+set firewall ipv4 forward filter rule 10 action 'drop'
+set firewall ipv4 forward filter rule 10 state 'invalid'
+
+# Forward - Catch all traffic for br1
+set firewall ipv4 forward filter rule 110 description 'br1 traffic'
+set firewall ipv4 forward filter rule 110 action 'jump'
+set firewall ipv4 forward filter rule 110 inbound-interface group 'br1-ifaces'
+set firewall ipv4 forward filter rule 110 jump-target 'ip-br1-fwd'
+
+# Forward - Catch all traffic for br2
+set firewall ipv4 forward filter rule 120 description 'br2 traffic'
+set firewall ipv4 forward filter rule 120 action 'jump'
+set firewall ipv4 forward filter rule 120 inbound-interface group 'br2-ifaces'
+set firewall ipv4 forward filter rule 120 jump-target 'ip-br2-fwd'
+
+# Forward - Default action drop:
+set firewall ipv4 forward filter default-action 'drop'
+```
+
+And the content of the custom rulesets:
+
+```none
+### br1 - ip-br1-fwd
+ # Requirement: Allow connections to internet
+set firewall ipv4 name ip-br1-fwd rule 10 description 'br1 - allow internet access'
+set firewall ipv4 name ip-br1-fwd rule 10 action 'accept'
+set firewall ipv4 name ip-br1-fwd rule 10 outbound-interface name 'eth0'
+ # Requirement: Drop all other connections
+set firewall ipv4 name ip-br1-fwd default-action 'drop'
+
+### br2 - ip-br2-fwd
+ # Requirement: Allow connections to internet
+set firewall ipv4 name ip-br2-fwd rule 10 description 'br2 - allow internet access'
+set firewall ipv4 name ip-br2-fwd rule 10 action 'accept'
+set firewall ipv4 name ip-br2-fwd rule 10 outbound-interface name 'eth0'
+ # Requirement: Allow connections to br1
+set firewall ipv4 name ip-br2-fwd rule 20 description 'br2 - allow access to br1'
+set firewall ipv4 name ip-br2-fwd rule 20 action 'accept'
+set firewall ipv4 name ip-br2-fwd rule 20 outbound-interface group 'br1-ifaces'
+ # Requirement: Drop all other connections
+set firewall ipv4 name ip-br2-fwd default-action 'drop'
+```
+
+## Validation
+
+While testing the configuration, we can check logs in order to ensure that
+we are accepting and/or blocking the correct traffic.
+
+For example, while a host tries to get an IP address from a DHCP server in
+br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from
+untrusted servers are dropped:
+
+```none
+vyos@bridge:~$ show log firewall bridge
+Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302
+Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
+Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
+```
+
+And with operational mode commands, we can check rules matchers, actions, and
+counters.
+
+Bridge firewall rulset:
+
+```none
+vyos@bri:~$ show firewall bridge
+Rulesets bridge Information
+
+---------------------------------
+bridge Firewall "forward filter"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- -----------------------------------------
+5 accept all 19 1916 ct state { established, related } accept
+10 drop all 0 0 ct state invalid
+110 jump all 2 208 iifname @I_br0-ifaces jump NAME_br0-fwd
+120 jump all 10 670 iifname @I_br1-ifaces jump NAME_br1-fwd
+130 jump all 12 3086 iifname @I_br2-ifaces jump NAME_br2-fwd
+default drop all 0 0
+
+---------------------------------
+bridge Firewall "name br0-fwd"
+
+Rule Action Protocol Packets Bytes
+------- -------- ---------- --------- -------
+default accept all 2 208
+
+---------------------------------
+bridge Firewall "name br0-pre"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- ----------------------
+10 accept all 18 1872 ether type ip6 accept
+default drop all 9 1476
+
+---------------------------------
+bridge Firewall "name br1-fwd"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- ----------------------------------------
+10 accept all 5 250 ether type arp accept
+20 accept all 3 252 ct state new ip saddr 10.1.1.102 accept
+default drop all 2 168
+
+---------------------------------
+bridge Firewall "name br1-pre"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- ----------------------------------------------------------------------------------------
+10 drop udp 3 1176 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 prefix "[bri-NAM-br1-pre-10-D]"
+20 drop all 0 0 ether type ip6
+default accept all 58 4430
+
+---------------------------------
+bridge Firewall "name br2-fwd"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- ---------------------------------------------------------------
+10 accept udp 4 1312 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 accept
+20 accept udp 2 656 udp sport 67 udp dport 68 iifname "eth6" accept
+22 drop udp 1 322 udp sport 67 udp dport 68 prefix "[bri-NAM-br2-fwd-22-D]"
+30 accept all 2 92 ether type arp accept
+40 accept all 3 704 ether type ip accept
+default drop all 0 0
+
+---------------------------------
+bridge Firewall "name br2-pre"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- --------------
+10 drop all 7 728 ether type ip6
+default accept all 77 7548
+
+---------------------------------
+bridge Firewall "prerouting filter"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- ----------------------------------------
+10 jump all 27 3348 iifname @I_br0-ifaces jump NAME_br0-pre
+20 jump all 61 5606 iifname @I_br1-ifaces jump NAME_br1-pre
+30 jump all 84 8276 iifname @I_br2-ifaces jump NAME_br2-pre
+default drop all 0 0
+
+vyos@bridge:~$
+```
+
+IPv4 firewall rulset:
+
+```none
+vyos@bridge:~$ show firewall ipv4
+Rulesets ipv4 Information
+
+---------------------------------
+ipv4 Firewall "forward filter"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- -------------------------------------------
+5 accept all 76 6384 ct state { established, related } accept
+10 drop all 0 0 ct state invalid
+110 jump all 13 1092 iifname @I_br1-ifaces jump NAME_ip-br1-fwd
+120 jump all 3 252 iifname @I_br2-ifaces jump NAME_ip-br2-fwd
+default drop all 0 0
+
+---------------------------------
+ipv4 Firewall "input filter"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- -----------------------------------------
+10 accept all 0 0 ct state { established, related } accept
+20 drop all 0 0 ct state invalid
+110 accept all 10 720 iifname @I_br1-ifaces accept
+120 drop all 26 2672 iifname @I_br2-ifaces
+default accept all 3037 991621
+
+---------------------------------
+ipv4 Firewall "name ip-br1-fwd"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- ----------------------
+10 accept all 5 420 oifname "eth0" accept
+default drop all 8 672
+
+---------------------------------
+ipv4 Firewall "name ip-br2-fwd"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- -----------------------------
+10 accept all 1 84 oifname "eth0" accept
+20 accept all 2 168 oifname @I_br1-ifaces accept
+default drop all 0 0
+
+vyos@bridge:~$
+```
diff --git a/docs/configexamples/md-index.md b/docs/configexamples/md-index.md
new file mode 100644
index 00000000..66b3359e
--- /dev/null
+++ b/docs/configexamples/md-index.md
@@ -0,0 +1,59 @@
+(examples)=
+
+# Configuration Blueprints
+
+This chapter contains various configuration examples:
+
+```{toctree}
+:maxdepth: 2
+
+firewall
+bgp-ipv6-unnumbered
+ospf-unnumbered
+azure-vpn-bgp
+azure-vpn-dual-bgp
+ha
+wan-load-balancing
+pppoe-ipv6-basic
+l3vpn-hub-and-spoke
+lac-lns
+inter-vrf-routing-vrf-lite
+dmvpn-dualhub-dualcloud
+qos
+segment-routing-isis
+nmp
+ansible
+ipsec-cisco-policy-based
+ipsec-cisco-route-based
+ipsec-pa-route-based
+policy-based-ipsec-and-firewall
+site-2-site-cisco
+```
+
+## Configuration Blueprints (autotest)
+
+The next pages contain fully automated configuration examples.
+
+Each lab will build and test from an external script.
+The page content is generated, so changes will not take effect.
+
+A host `vyos-oobm` will be used as an SSH proxy. This host is just
+necessary for the lab tests.
+
+The process will do the following steps:
+1. create the lab on a eve-ng server
+2. configure each host in the lab
+3. do some defined tests
+4. optional do an upgrade to a higher version and do step 3 again.
+5. generate the documentation and include files
+6. shutdown and destroy the lab, if there is no error
+
+```{toctree}
+:maxdepth: 1
+
+autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE
+autotest/tunnelbroker/tunnelbroker
+autotest/L3VPN_EVPN/L3VPN_EVPN
+autotest/Wireguard/Wireguard
+autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP
+```
diff --git a/docs/configexamples/md-lac-lns.md b/docs/configexamples/md-lac-lns.md
new file mode 100644
index 00000000..1b020924
--- /dev/null
+++ b/docs/configexamples/md-lac-lns.md
@@ -0,0 +1,172 @@
+---
+lastproofread: '2024-02-21'
+---
+
+(examples-lac-lns)=
+
+# PPPoE over L2TP
+
+This document is to describe a basic setup using PPPoE over L2TP.
+LAC and LNS are components of the broadband topology.
+LAC - L2TP access concentrator
+LNS - L2TP Network Server
+LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and
+forward them to LNS. LNS is the termination point that comes from PPP packets
+from the remote client.
+
+In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC.
+All users with domain **vyos.io** will be tunneled to LNS via L2TP.
+
+## Network Topology
+
+```{image} /_static/images/lac-lns-diagram.jpg
+:align: center
+:alt: Network Topology Diagram
+:width: 60%
+```
+
+## Configurations
+
+### LAC
+
+```none
+aaa new-model
+!
+aaa authentication ppp default local
+!
+vpdn enable
+vpdn aaa attribute nas-ip-address vpdn-nas
+!
+vpdn-group LAC
+ request-dialin
+ protocol l2tp
+ domain vyos.io
+ initiate-to ip 192.168.139.100
+ source-ip 192.168.139.101
+ local name LAC
+ l2tp tunnel password 0 test123
+!
+bba-group pppoe MAIN-BBA
+ virtual-template 1
+!
+interface GigabitEthernet0/0
+ description To LNS
+ ip address 192.168.139.101 255.255.255.0
+ duplex auto
+ speed auto
+ media-type rj45
+!
+interface GigabitEthernet0/1
+ description To PPPoE clients
+ no ip address
+ duplex auto
+ speed auto
+ media-type rj45
+ pppoe enable group MAIN-BBA
+!
+interface Virtual-Template1
+ description pppoe MAIN-BBA
+ no ip address
+ no peer default ip address
+ ppp mtu adaptive
+ ppp authentication chap
+!
+```
+
+### LNS
+
+```none
+set interfaces ethernet eth0 address '192.168.139.100/24'
+set nat source rule 100 outbound-interface name 'eth0'
+set nat source rule 100 source address '10.0.0.0/24'
+set nat source rule 100 translation address 'masquerade'
+set protocols static route 0.0.0.0/0 next-hop 192.168.139.2
+set vpn l2tp remote-access authentication mode 'radius'
+set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest'
+set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100'
+set vpn l2tp remote-access default-pool 'TEST-POOL'
+set vpn l2tp remote-access gateway-address '10.0.0.1'
+set vpn l2tp remote-access lns host-name 'LAC'
+set vpn l2tp remote-access lns shared-secret 'test123'
+set vpn l2tp remote-access name-server '8.8.8.8'
+set vpn l2tp remote-access ppp-options disable-ccp
+```
+
+:::{note}
+This setup requires the Compression Control Protocol (CCP)
+being disabled, the command `set vpn l2tp remote-access ppp-options disable-ccp`
+accomplishes that.
+:::
+
+### Client
+In this lab we use Windows PPPoE client.
+
+```{image} /_static/images/lac-lns-winclient.jpg
+:align: center
+:alt: Window PPPoE Client Configuration
+:width: 100%
+```
+
+### Monitoring
+Monitoring on LNS side
+
+```none
+vyos@vyos:~$ show l2tp-server sessions
+ ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes
+--------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+----------
+ l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB
+```
+
+Monitoring on LAC side
+
+```none
+Router#show pppoe session
+ 1 session in FORWARDED (FWDED) State
+ 1 session total
+Uniq ID PPPoE RemMAC Port VT VA State
+ SID LocMAC VA-st Type
+ 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED
+ 0c58.88ac.0001
+
+Router#show l2tp
+L2TP Tunnel and Session Information Total tunnels 1 sessions 1
+
+LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/
+ Count VPDN Group
+23238 2640 LAC est 192.168.139.100 1 LAC
+
+LocID RemID TunID Username, Intf/ State Last Chg Uniq ID
+ Vcid, Circuit
+25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1
+```
+
+Monitoring on RADIUS Server side
+
+```none
+root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221
+Wed Feb 21 13:37:17 2024
+ User-Name = "test@vyos.io"
+ NAS-Port = 0
+ NAS-Port-Id = "l2tp0"
+ NAS-Port-Type = Virtual
+ Service-Type = Framed-User
+ Framed-Protocol = PPP
+ Calling-Station-Id = "192.168.139.101"
+ Called-Station-Id = "192.168.139.100"
+ Acct-Status-Type = Start
+ Acct-Authentic = RADIUS
+ Acct-Session-Id = "45c731e169d9a4f1"
+ Acct-Session-Time = 0
+ Acct-Input-Octets = 0
+ Acct-Output-Octets = 0
+ Acct-Input-Packets = 0
+ Acct-Output-Packets = 0
+ Acct-Input-Gigawords = 0
+ Acct-Output-Gigawords = 0
+ Framed-IP-Address = 10.0.0.2
+ NAS-IP-Address = 192.168.139.100
+ Event-Timestamp = "Feb 21 2024 13:37:17 UTC"
+ Tmp-String-9 = "ai:"
+ Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318"
+ Timestamp = 1708522637
+```
diff --git a/docs/configexamples/md-nmp.md b/docs/configexamples/md-nmp.md
new file mode 100644
index 00000000..9c422172
--- /dev/null
+++ b/docs/configexamples/md-nmp.md
@@ -0,0 +1,71 @@
+---
+lastproofread: '2023-03-26'
+---
+
+(examples-nmp)=
+
+# NMP example
+
+Consider how to quickly set up NMP and VyOS for monitoring.
+NMP is multi-vendor network monitoring from 'SolarWinds' built to
+scale and expand with the needs of your network.
+
+## Configuration 'VyOS'
+
+First prepare our VyOS router for connection to NMP. We have to set
+up the SNMP protocol and connectivity between the router and NMP.
+
+```none
+set interfaces ethernet eth0 address 'dhcp'
+set system name-server '8.8.8.8'
+set service snmp community router authorization 'test'
+set service snmp community router network '0.0.0.0/0'
+```
+
+## Configuration 'NMP'
+
+Next, you just should follow the pictures:
+
+```{image} /_static/images/nmp1.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp2.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp3.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp4.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp5.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp6.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+```{image} /_static/images/nmp7.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+In the end, you'll get a powerful instrument for monitoring the VyOS systems.
diff --git a/docs/configexamples/md-ospf-unnumbered.md b/docs/configexamples/md-ospf-unnumbered.md
new file mode 100644
index 00000000..9c4d5399
--- /dev/null
+++ b/docs/configexamples/md-ospf-unnumbered.md
@@ -0,0 +1,117 @@
+---
+lastproofread: '2021-06-29'
+---
+
+(examples-ospf-unnumbered)=
+
+# OSPF unnumbered with ECMP
+
+General information can be found in the {ref}`routing-ospf` chapter.
+
+## Configuration
+
+- Router A:
+
+```none
+set interfaces ethernet eth0 address '10.0.0.1/24'
+set interfaces ethernet eth1 address '192.168.0.1/32'
+set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+set interfaces ethernet eth1 ip ospf network 'point-to-point'
+set interfaces ethernet eth2 address '192.168.0.1/32'
+set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+set interfaces ethernet eth2 ip ospf network 'point-to-point'
+set interfaces loopback lo address '192.168.0.1/32'
+set protocols ospf area 0.0.0.0 authentication 'md5'
+set protocols ospf area 0.0.0.0 network '192.168.0.1/32'
+set protocols ospf parameters router-id '192.168.0.1'
+set protocols ospf redistribute connected
+```
+
+- Router B:
+
+```none
+set interfaces ethernet eth0 address '10.0.0.2/24'
+set interfaces ethernet eth1 address '192.168.0.2/32'
+set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+set interfaces ethernet eth1 ip ospf network 'point-to-point'
+set interfaces ethernet eth2 address '192.168.0.2/32'
+set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
+set interfaces ethernet eth2 ip ospf network 'point-to-point'
+set interfaces loopback lo address '192.168.0.2/32'
+set protocols ospf area 0.0.0.0 authentication 'md5'
+set protocols ospf area 0.0.0.0 network '192.168.0.2/32'
+set protocols ospf parameters router-id '192.168.0.2'
+set protocols ospf redistribute connected
+```
+
+## Results
+
+- Router A:
+
+```none
+vyos@vyos:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface IP Address S/L Description
+--------- ---------- --- -----------
+eth0 10.0.0.1/24 u/u
+eth1 192.168.0.1/32 u/u
+eth2 192.168.0.1/32 u/u
+lo 127.0.0.1/8 u/u
+ 192.168.0.1/32
+ ::1/128
+```
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+ O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+ T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+ F - PBR, f - OpenFabric,
+ > - selected route, * - FIB route, q - queued route, r - rejected route
+
+S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
+O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21
+ via 192.168.0.2, eth2 onlink, 00:13:21
+C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
+O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53
+C * 192.168.0.1/32 is directly connected, eth2, 00:56:31
+C * 192.168.0.1/32 is directly connected, eth1, 00:56:31
+C>* 192.168.0.1/32 is directly connected, lo, 00:57:36
+O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03
+ * via 192.168.0.2, eth2 onlink, 00:29:03
+```
+
+- Router B:
+
+```none
+vyos@vyos:~$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface IP Address S/L Description
+--------- ---------- --- -----------
+eth0 10.0.0.2/24 u/u
+eth1 192.168.0.2/32 u/u
+eth2 192.168.0.2/32 u/u
+lo 127.0.0.1/8 u/u
+ 192.168.0.2/32
+ ::1/128
+```
+
+```none
+vyos@vyos:~$ show ip route
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+ O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+ T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
+ F - PBR, f - OpenFabric,
+ > - selected route, * - FIB route, q - queued route, r - rejected route
+
+S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
+O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21
+ via 192.168.0.1, eth2 onlink, 00:13:21
+C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
+O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53
+C * 192.168.0.2/32 is directly connected, eth2, 00:56:31
+C * 192.168.0.2/32 is directly connected, eth1, 00:56:31
+C>* 192.168.0.2/32 is directly connected, lo, 00:57:36
+O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03
+ * via 192.168.0.1, eth2 onlink, 00:29:03
+```
diff --git a/docs/configexamples/md-policy-based-ipsec-and-firewall.md b/docs/configexamples/md-policy-based-ipsec-and-firewall.md
new file mode 100644
index 00000000..00110117
--- /dev/null
+++ b/docs/configexamples/md-policy-based-ipsec-and-firewall.md
@@ -0,0 +1,255 @@
+(examples-policy-based-ipsec-and-firewall)=
+
+# Policy-Based Site-to-Site VPN and Firewall Configuration
+
+This guide shows an example policy-based IKEv2 site-to-site VPN between two
+VyOS routers, and firewall configuration.
+
+For simplicity, configuration and tests are done only using IPv4, and firewall
+configuration is done only on one router.
+
+## Network Topology and requirements
+
+This configuration example and the requirements consists of:
+
+- Two VyOS routers with public IP address.
+
+- 2 private subnets on each site.
+
+- Local subnets should be able to reach internet using source NAT.
+
+- Communication between private subnets should be done through IPSec tunnel
+ without NAT.
+
+- Configuration of basic firewall in one site, in order to:
+
+ > - Protect the router on 'WAN' interface, allowing only IPSec connections
+ > and SSH access from trusted IPs.
+ > - Allow access to the router only from trusted networks.
+ > - Allow DNS requests only only for local networks.
+ > - Allow ICMP on all interfaces.
+ > - Allow all new connections from local subnets.
+ > - Allow connections from LANs to LANs through the tunnel.
+
+```{image} /_static/images/policy-based-ipsec-and-firewall.png
+```
+
+## Configuration
+Interface and routing configuration:
+```none
+# LEFT router:
+set interfaces ethernet eth0 address '198.51.100.14/30'
+set interfaces ethernet eth1 vif 111 address '10.1.11.1/24'
+set interfaces ethernet eth2 vif 112 address '10.1.12.1/24'
+set protocols static route 0.0.0.0/0 next-hop 198.51.100.13
+
+# RIGHT router:
+set interfaces ethernet eth0 address '192.0.2.130/30'
+set interfaces ethernet eth1 vif 221 address '10.2.21.1/24'
+set interfaces ethernet eth2 vif 222 address '10.2.22.1/24'
+```
+IPSec configuration:
+```none
+# LEFT router:
+set vpn ipsec authentication psk RIGHT id '198.51.100.14'
+set vpn ipsec authentication psk RIGHT id '192.0.2.130'
+set vpn ipsec authentication psk RIGHT secret 'p4ssw0rd'
+set vpn ipsec esp-group ESP-GROUP mode 'tunnel'
+set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
+set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'
+set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
+set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
+set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
+set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
+set vpn ipsec interface 'eth0'
+set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer RIGHT connection-type 'initiate'
+set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14'
+set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130'
+set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24'
+
+# RIGHT router:
+set vpn ipsec authentication psk LEFT id '192.0.2.130'
+set vpn ipsec authentication psk LEFT id '198.51.100.14'
+set vpn ipsec authentication psk LEFT secret 'p4ssw0rd'
+set vpn ipsec esp-group ESP-GROUP mode 'tunnel'
+set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
+set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'
+set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
+set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
+set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
+set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
+set vpn ipsec interface 'eth0'
+set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer LEFT connection-type 'none'
+set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130'
+set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14'
+set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24'
+```
+Firewall Configuration:
+```none
+# Firewall Groups:
+set firewall group network-group LOCAL-NETS network '10.1.11.0/24'
+set firewall group network-group LOCAL-NETS network '10.1.12.0/24'
+set firewall group network-group REMOTE-NETS network '10.2.21.0/24'
+set firewall group network-group REMOTE-NETS network '10.2.22.0/24'
+set firewall group network-group TRUSTED network '198.51.100.125/32'
+set firewall group network-group TRUSTED network '203.0.113.0/24'
+set firewall group network-group TRUSTED network '10.1.11.0/24'
+set firewall group network-group TRUSTED network '192.168.70.0/24'
+
+# Forward traffic: default drop and only allow what is needed
+set firewall ipv4 forward filter default-action 'drop'
+
+# Forward traffic: global state policies
+set firewall ipv4 forward filter rule 1 action 'accept'
+set firewall ipv4 forward filter rule 1 state established 'enable'
+set firewall ipv4 forward filter rule 1 state related 'enable'
+set firewall ipv4 forward filter rule 2 action 'drop'
+set firewall ipv4 forward filter rule 2 state invalid 'enable'
+
+# Forward traffic: Accept all connections from local networks
+set firewall ipv4 forward filter rule 10 action 'accept'
+set firewall ipv4 forward filter rule 10 source group network-group 'LOCAL-NETS'
+
+# Forward traffic: accept connections from remote LANs to local LANs
+set firewall ipv4 forward filter rule 20 action 'accept'
+set firewall ipv4 forward filter rule 20 destination group network-group 'LOCAL-NETS'
+set firewall ipv4 forward filter rule 20 source group network-group 'REMOTE-NETS'
+
+# Input traffic: default drop and only allow what is needed
+set firewall ipv4 input filter default-action 'drop'
+
+# Input traffic: global state policies
+set firewall ipv4 input filter rule 1 action 'accept'
+set firewall ipv4 input filter rule 1 state established 'enable'
+set firewall ipv4 input filter rule 1 state related 'enable'
+set firewall ipv4 input filter rule 2 action 'drop'
+set firewall ipv4 input filter rule 2 state invalid 'enable'
+
+# Input traffic: add rules needed for ipsec connection
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 10 destination port '500,4500'
+set firewall ipv4 input filter rule 10 inbound-interface name 'eth0'
+set firewall ipv4 input filter rule 10 protocol 'udp'
+set firewall ipv4 input filter rule 15 action 'accept'
+set firewall ipv4 input filter rule 15 inbound-interface name 'eth0'
+set firewall ipv4 input filter rule 15 protocol 'esp'
+
+# Input traffic: accept ssh connection from trusted ips
+set firewall ipv4 input filter rule 20 action 'accept'
+set firewall ipv4 input filter rule 20 destination port '22'
+set firewall ipv4 input filter rule 20 protocol 'tcp'
+set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED'
+
+# Input traffic: accepd dns requests only from local networks.
+set firewall ipv4 input filter rule 25 action 'accept'
+set firewall ipv4 input filter rule 25 destination port '53'
+set firewall ipv4 input filter rule 25 protocol 'udp'
+set firewall ipv4 input filter rule 25 source group network-group 'LOCAL-NETS'
+
+# Input traffic: allow icmp
+set firewall ipv4 input filter rule 30 action 'accept'
+set firewall ipv4 input filter rule 30 protocol 'icmp'
+```
+And NAT Configuration:
+```none
+set nat source rule 10 destination group network-group 'REMOTE-NETS'
+set nat source rule 10 exclude
+set nat source rule 10 outbound-interface name 'eth0'
+set nat source rule 10 source group network-group 'LOCAL-NETS'
+set nat source rule 20 outbound-interface name 'eth0'
+set nat source rule 20 source group network-group 'LOCAL-NETS'
+set nat source rule 20 translation address 'masquerade'
+```
+## Checking through op-mode commands
+After some testing, we can check IPSec status, and counter on every tunnel:
+```none
+vyos@LEFT:~$ show vpn ipsec sa
+Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal
+-------------- ------- -------- -------------- ---------------- ---------------- ----------- ---------------------------------------
+RIGHT-tunnel-0 up 36m24s 840B/840B 10/10 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
+RIGHT-tunnel-1 up 36m33s 588B/588B 7/7 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
+RIGHT-tunnel-2 up 35m50s 1K/1K 15/15 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
+RIGHT-tunnel-3 up 36m54s 2K/2K 32/32 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
+vyos@LEFT:~$
+```
+Also, we can check firewall counters:
+```none
+vyos@LEFT:~$ show firewall
+Rulesets Information
+
+---------------------------------
+IPv4 Firewall "forward filter"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- ------------------------------------------------------
+1 accept all 681 96545 ct state { established, related } accept
+2 drop all 0 0 ct state invalid
+10 accept all 360 27205 ip saddr @N_LOCAL-NETS accept
+20 accept all 8 648 ip daddr @N_LOCAL-NETS ip saddr @N_REMOTE-NETS accept
+default drop all
+
+---------------------------------
+IPv4 Firewall "input filter"
+
+Rule Action Protocol Packets Bytes Conditions
+------- -------- ---------- --------- ------- ----------------------------------------------
+1 accept all 901 123709 ct state { established, related } accept
+2 drop all 0 0 ct state invalid
+10 accept udp 0 0 udp dport { 500, 4500 } iifname "eth0" accept
+15 accept esp 0 0 meta l4proto esp iifname "eth0" accept
+20 accept tcp 1 60 tcp dport 22 ip saddr @N_TRUSTED accept
+25 accept udp 0 0 udp dport 53 ip saddr @N_LOCAL-NETS accept
+30 accept icmp 0 0 meta l4proto icmp accept
+default drop all
+
+vyos@LEFT:~$
+vyos@LEFT:~$ show firewall statistics
+Rulesets Statistics
+
+---------------------------------
+IPv4 Firewall "forward filter"
+
+Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface
+------- --------- ------- -------- ----------- ------------- ------------------- --------------------
+1 681 96545 accept any any any any
+2 0 0 drop any any any any
+10 360 27205 accept LOCAL-NETS any any any
+20 8 648 accept REMOTE-NETS LOCAL-NETS any any
+default N/A N/A drop any any any any
+
+---------------------------------
+IPv4 Firewall "input filter"
+
+Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface
+------- --------- ------- -------- ---------- ------------- ------------------- --------------------
+1 905 124213 accept any any any any
+2 0 0 drop any any any any
+10 0 0 accept any any eth0 any
+15 0 0 accept any any eth0 any
+20 1 60 accept TRUSTED any any any
+25 0 0 accept LOCAL-NETS any any any
+30 0 0 accept any any any any
+default N/A N/A drop any any any any
+
+vyos@LEFT:~$
+```
diff --git a/docs/configexamples/md-segment-routing-isis.md b/docs/configexamples/md-segment-routing-isis.md
new file mode 100644
index 00000000..76cb726c
--- /dev/null
+++ b/docs/configexamples/md-segment-routing-isis.md
@@ -0,0 +1,277 @@
+---
+lastproofread: '2023-04-10'
+---
+
+(examples-segment-routing-isis)=
+
+# Segment-routing IS-IS example
+
+When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this
+blue print as an initial setup to get MPLS ISIS-SR working between those two
+devices.The lab was build using {abbr}`EVE-NG (Emulated Virtual
+Environment NG)`.
+
+:::{figure} /_static/images/vyos-sr-isis.png
+:alt: ISIS-SR network
+
+ISIS-SR example network
+:::
+
+The below configuration is used as example where we keep focus on
+VyOS-P1/VyOS-P2/XRv-P3 which we share the settings.
+
+## Configuration
+
+- VyOS-P1:
+
+```none
+set interfaces dummy dum0 address '192.0.2.1/32'
+set interfaces ethernet eth1 address '192.0.2.5/30'
+set interfaces ethernet eth1 mtu '8000'
+set interfaces ethernet eth3 address '192.0.2.21/30'
+set interfaces ethernet eth3 mtu '8000'
+set protocols isis interface dum0 passive
+set protocols isis interface eth1 network point-to-point
+set protocols isis interface eth3 network point-to-point
+set protocols isis level 'level-2'
+set protocols isis log-adjacency-changes
+set protocols isis metric-style 'wide'
+set protocols isis net '49.0000.0000.0000.0001.00'
+set protocols isis segment-routing maximum-label-depth '8'
+set protocols isis segment-routing prefix 192.0.2.1/32 index value '1'
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth3'
+set system host-name 'P1-VyOS'
+```
+
+- XRv-P3:
+
+```none
+hostname P3-VyOS
+interface Loopback0
+ ipv4 address 192.0.2.3 255.255.255.255
+!
+interface GigabitEthernet0/0/0/1
+ mtu 8014
+ ipv4 address 192.0.2.6 255.255.255.252
+!
+interface GigabitEthernet0/0/0/2
+ mtu 8014
+ ipv4 address 192.0.2.18 255.255.255.252
+!
+router isis VyOS
+ is-type level-2-only
+ net 49.0000.0000.0000.0003.00
+ log adjacency changes
+ address-family ipv4 unicast
+ metric-style wide
+ segment-routing mpls
+ !
+ interface Loopback0
+ passive
+ address-family ipv4 unicast
+ prefix-sid index 3
+ !
+ !
+ interface GigabitEthernet0/0/0/1
+ point-to-point
+ address-family ipv4 unicast
+ !
+ !
+ interface GigabitEthernet0/0/0/2
+ point-to-point
+ address-family ipv4 unicast
+ !
+ !
+!
+```
+
+- VyOS-P2:
+
+```none
+set interfaces dummy dum0 address '192.0.2.2/32'
+set interfaces ethernet eth2 address '192.0.2.17/30'
+set interfaces ethernet eth2 mtu '8000'
+set interfaces ethernet eth3 address '192.0.2.26/30'
+set interfaces ethernet eth3 mtu '8000'
+set protocols isis interface dum0 passive
+set protocols isis interface eth2 network point-to-point
+set protocols isis interface eth3 network point-to-point
+set protocols isis level 'level-2'
+set protocols isis log-adjacency-changes
+set protocols isis metric-style 'wide'
+set protocols isis net '49.0000.0000.0000.0002.00'
+set protocols isis segment-routing maximum-label-depth '8'
+set protocols isis segment-routing prefix 192.0.2.2/32 index value '2'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set system host-name 'P2-VyOS'
+```
+
+This gives us MPLS segment routing enabled and labels forwarding :
+
+```none
+vyos@P1-VyOS:~$ show mpls table
+Inbound Label Type Nexthop Outbound Label
+-----------------------------------------------------------------
+15000 SR (IS-IS) 192.0.2.6 implicit-null
+15001 SR (IS-IS) 192.0.2.22 implicit-null
+15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null
+16002 SR (IS-IS) 192.0.2.6 16002
+16003 SR (IS-IS) 192.0.2.6 implicit-null
+16011 SR (IS-IS) 192.0.2.22 implicit-null
+
+vyos@P2-VyOS:~$ show mpls table
+Inbound Label Type Nexthop Outbound Label
+-------------------------------------------------------
+15000 SR (IS-IS) 192.0.2.18 implicit-null
+16001 SR (IS-IS) 192.0.2.18 16001
+16003 SR (IS-IS) 192.0.2.18 implicit-null
+16011 SR (IS-IS) 192.0.2.18 16011
+
+RP/0/0/CPU0:P3-VyOS#show mpls forwarding
+Tue Mar 28 17:47:18.928 UTC
+Local Outgoing Prefix Outgoing Next Hop Bytes
+Label Label or ID Interface Switched
+------ ----------- ------------------ ------------ --------------- ------------
+16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0
+16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0
+16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0
+24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0
+24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0
+24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0
+24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0
+```
+
+VyOS is able to check MSD per devices:
+
+```none
+vyos@P1-VyOS:~$ show isis segment-routing node
+Area VyOS:
+IS-IS L1 SR-Nodes:
+
+IS-IS L2 SR-Nodes:
+
+System ID SRGB SRLB Algorithm MSD
+---------------------------------------------------------------
+0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8
+0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8
+0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10
+0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8
+
+vyos@P2-VyOS:~$ show isis segment-routing node
+Area VyOS:
+ IS-IS L1 SR-Nodes:
+
+ IS-IS L2 SR-Nodes:
+
+ System ID SRGB SRLB Algorithm MSD
+ ---------------------------------------------------------------
+ 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8
+ 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8
+ 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10
+ 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8
+```
+
+Here is the routing tables showing the MPLS segment routing label operations:
+
+```none
+vyos@P1-VyOS:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+ O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+ T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+ f - OpenFabric,
+ > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+ t - trapped, o - offload failure
+
+I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m
+I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m
+I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m
+I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m
+I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m
+I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m
+I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m
+
+
+vyos@P2-VyOS:~$ show ip route isis
+Codes: K - kernel route, C - connected, S - static, R - RIP,
+ O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
+ T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
+ f - OpenFabric,
+ > - selected route, * - FIB route, q - queued, r - rejected, b - backup
+ t - trapped, o - offload failure
+
+I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m
+I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m
+I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m
+I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m
+I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m
+I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m
+
+RP/0/0/CPU0:P3-VyOS#show route isis
+Tue Mar 28 18:19:16.417 UTC
+
+i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1
+i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2
+i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1
+i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1
+i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2
+```
+
+Information about prefix-sid and label-operation from VyOS
+
+```none
+vyos@P1-VyOS:~$ show isis route prefix-sid
+Area VyOS:
+IS-IS L2 IPv4 routing table:
+
+ Prefix Metric Interface Nexthop SID Label Op.
+ ----------------------------------------------------------------------
+ 192.0.2.1/32 0 - - - -
+ 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002)
+ 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003)
+ 192.0.2.4/30 20 eth1 192.0.2.6 - -
+ 192.0.2.16/30 20 eth1 192.0.2.6 - -
+ 192.0.2.20/30 0 - - - -
+ 192.0.2.24/30 30 eth1 192.0.2.6 - -
+
+ vyos@P2-VyOS:~$ show isis route prefix-sid
+ Area VyOS:
+ IS-IS L2 IPv4 routing table:
+
+ Prefix Metric Interface Nexthop SID Label Op.
+ -----------------------------------------------------------------------
+ 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001)
+ 192.0.2.2/32 0 - - - -
+ 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003)
+ 192.0.2.4/30 20 eth2 192.0.2.18 - -
+ 192.0.2.16/30 20 eth2 192.0.2.18 - -
+ 192.0.2.20/30 30 eth2 192.0.2.18 - -
+ 192.0.2.24/30 0 - - - -
+```
+
+Ping between VyOS-P1 / VyOS-P2 to confirm reachability:
+
+```none
+vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1
+PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data.
+64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms
+64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms
+64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms
+64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms
+^C
+--- 192.0.2.2 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3004ms
+rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms
+
+vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2
+PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data.
+64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms
+64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms
+64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms
+64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms
+^C
+--- 192.0.2.1 ping statistics ---
+4 packets transmitted, 4 received, 0% packet loss, time 3005ms
+rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms
+```
diff --git a/docs/configexamples/md-site-2-site-cisco.md b/docs/configexamples/md-site-2-site-cisco.md
new file mode 100644
index 00000000..a3b33d21
--- /dev/null
+++ b/docs/configexamples/md-site-2-site-cisco.md
@@ -0,0 +1,167 @@
+(examples-site-2-site-cisco)=
+
+# Site-to-Site IPSec VPN to Cisco using FlexVPN
+
+This guide shows a sample configuration for FlexVPN site-to-site Internet
+Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel.
+
+FlexVPN is a newer "solution" for deployment of VPNs and it utilizes IKEv2 as
+the key exchange protocol. The result is a flexible and scalable VPN solution
+that can be easily adapted to fit various network needs. It can also support a
+variety of encryption methods, including AES and 3DES.
+
+The lab was built using EVE-NG.
+
+## Configuration
+
+### VyOS
+
+- GRE:
+
+```none
+set interfaces tunnel tun1 encapsulation 'gre'
+set interfaces tunnel tun1 ip adjust-mss '1336'
+set interfaces tunnel tun1 mtu '1376'
+set interfaces tunnel tun1 remote '10.1.1.6'
+set interfaces tunnel tun1 source-address '198.51.100.1'
+```
+
+- IPsec:
+
+```none
+set vpn ipsec authentication psk vyos_cisco_l id 'vyos.net’
+set vpn ipsec authentication psk vyos_cisco_l id 'cisco.hub.net'
+set vpn ipsec authentication psk vyos_cisco_l secret 'secret'
+set vpn ipsec esp-group e1 lifetime '3600'
+set vpn ipsec esp-group e1 mode 'tunnel'
+set vpn ipsec esp-group e1 pfs 'disable'
+set vpn ipsec esp-group e1 proposal 1 encryption 'aes128'
+set vpn ipsec esp-group e1 proposal 1 hash 'sha256'
+set vpn ipsec ike-group i1 key-exchange 'ikev2'
+set vpn ipsec ike-group i1 lifetime '28800'
+set vpn ipsec ike-group i1 proposal 1 dh-group '5'
+set vpn ipsec ike-group i1 proposal 1 encryption 'aes256'
+set vpn ipsec ike-group i1 proposal 1 hash 'sha256'
+set vpn ipsec interface 'eth2'
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec options flexvpn
+set vpn ipsec options interface 'tun1'
+set vpn ipsec options virtual-ip
+set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net'
+set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net'
+set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
+set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
+set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
+set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1'
+set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
+set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'
+```
+
+### Cisco
+
+```none
+aaa new-model
+!
+!
+aaa authorization network default local
+!
+crypto ikev2 name-mangler GET_DOMAIN
+ fqdn all
+ email all
+!
+!
+crypto ikev2 authorization policy vyos
+ pool mypool
+ aaa attribute list mylist
+ route set interface
+ route accept any tag 100 distance 5
+!
+crypto ikev2 keyring mykeys
+ peer peer1
+ identity fqdn vyos.net
+ pre-shared-key local secret
+ pre-shared-key remote secret
+crypto ikev2 profile my_profile
+ match identity remote fqdn vyos.net
+ identity local fqdn cisco.hub.net
+ authentication remote pre-share
+ authentication local pre-share
+ keyring local mykeys
+ dpd 10 3 periodic
+ aaa authorization group psk list local name-mangler GET_DOMAIN
+ aaa authorization user psk cached
+ virtual-template 1
+!
+!
+!
+crypto ipsec transform-set TSET esp-aes esp-sha256-hmac
+ mode tunnel
+!
+!
+crypto ipsec profile my-ipsec-profile
+ set transform-set TSET
+ set ikev2-profile my_profile
+!
+interface Virtual-Template1 type tunnel
+ no ip address
+ ip mtu 1376
+ ip nhrp network-id 1
+ ip nhrp shortcut virtual-template 1
+ ip tcp adjust-mss 1336
+ tunnel path-mtu-discovery
+ tunnel protection ipsec profile my-ipsec-profile
+ !
+ ip local pool my_pool 172.16.122.1 172.16.122.254
+```
+
+Since the tunnel is a point-to-point GRE tunnel, it behaves like any other
+point-to-point interface (for example: serial, dialer), and it is possible to
+run any Interior Gateway Protocol (IGP)/Exterior Gateway Protocol (EGP) over
+the link in order to exchange routing information
+
+## Verification
+
+```none
+vyos@vyos$ show interfaces
+Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
+Interface IP Address S/L Description
+--------- ---------- --- -----------
+eth0 - u/u
+eth1 - u/u
+eth2 198.51.100.1/24 u/u
+eth3 172.16.1.2/24 u/u
+lo 127.0.0.1/8 u/u
+ ::1/128
+tun1 172.16.122.2/32 u/u
+vyos@vyos:~$ show vpn ipsec sa
+Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal
+------------------ ------- -------- -------------- ---------------- ---------------- --------------------- -----------------------------
+cisco_hub-tunnel-1 up 44m17s 35K/31K 382/367 10.1.1.6 cisco.hub.net AES_CBC_128/HMAC_SHA2_256_128
+
+
+Hub#sh crypto ikev2 sa detailed
+ IPv4 Crypto IKEv2 SA
+Tunnel-id Local Remote fvrf/ivrf Status
+5 10.1.1.6/4500 198.51.100.1/4500 none/none READY
+ Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK
+ Life/Active Time: 86400/2694 sec
+ CE id: 0, Session-id: 2
+ Status Description: Negotiation done
+ Local spi: C94EE2DC92A60C47 Remote spi: 9AF0EF151BECF14C
+ Local id: cisco.hub.net
+ Remote id: vyos.net
+ Local req msg id: 269 Remote req msg id: 0
+ Local next msg id: 269 Remote next msg id: 0
+ Local req queued: 269 Remote req queued: 0
+ Local window: 5 Remote window: 1
+ DPD configured for 10 seconds, retry 3
+ Fragmentation not configured.
+ Extended Authentication not configured.
+ NAT-T is not detected
+ Cisco Trust Security SGT is disabled
+ Assigned host addr: 172.16.122.2
+```
diff --git a/docs/configexamples/md-wan-load-balancing.md b/docs/configexamples/md-wan-load-balancing.md
new file mode 100644
index 00000000..21c78f2a
--- /dev/null
+++ b/docs/configexamples/md-wan-load-balancing.md
@@ -0,0 +1,158 @@
+---
+lastproofread: '2021-06-29'
+---
+
+(wan-load-balancing)=
+
+
+# WAN Load Balancer examples
+
+## Example 1: Distributing load evenly
+
+The setup used in this example is shown in the following diagram:
+
+```{image} /_static/images/Wan_load_balancing1.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+### Overview
+> - All traffic coming in through eth2 is balanced between eth0 and eth1
+> on the router.
+> - Pings will be sent to four targets for health testing (33.44.55.66,
+> 44.55.66.77, 55.66.77.88 and 66.77.88.99).
+> - All outgoing packets are assigned the source address of the assigned
+> interface (SNAT).
+> - eth0 is set to be removed from the load balancer's interface pool
+> after 5 ping failures, eth1 will be removed after 4 ping failures.
+
+### Create static routes to ping targets
+Create static routes through the two ISPs towards the ping targets and
+commit the changes:
+
+```none
+set protocols static route 33.44.55.66/32 next-hop 11.22.33.1
+set protocols static route 44.55.66.77/32 next-hop 11.22.33.1
+set protocols static route 55.66.77.88/32 next-hop 22.33.44.1
+set protocols static route 66.77.88.99/32 next-hop 22.33.44.1
+```
+
+### Configure the load balancer
+Configure the WAN load balancer with the parameters described above:
+
+```none
+set load-balancing wan interface-health eth0 failure-count 5
+set load-balancing wan interface-health eth0 nexthop 11.22.33.1
+set load-balancing wan interface-health eth0 test 10 type ping
+set load-balancing wan interface-health eth0 test 10 target 33.44.55.66
+set load-balancing wan interface-health eth0 test 20 type ping
+set load-balancing wan interface-health eth0 test 20 target 44.55.66.77
+set load-balancing wan interface-health eth1 failure-count 4
+set load-balancing wan interface-health eth1 nexthop 22.33.44.1
+set load-balancing wan interface-health eth1 test 10 type ping
+set load-balancing wan interface-health eth1 test 10 target 55.66.77.88
+set load-balancing wan interface-health eth1 test 20 type ping
+set load-balancing wan interface-health eth1 test 20 target 66.77.88.99
+set load-balancing wan rule 10 inbound-interface eth2
+set load-balancing wan rule 10 interface eth0
+set load-balancing wan rule 10 interface eth1
+```
+
+## Example 2: Failover based on interface weights
+This example uses the failover mode.
+(wan-example2-overview)=
+
+### Overview
+In this example, eth0 is the primary interface and eth1 is the secondary
+interface. To provide simple failover functionality. If eth0 fails, eth1
+takes over.
+
+### Create interface weight based configuration
+The configuration steps are the same as in the previous example, except
+rule 10. So we keep the configuration, remove rule 10 and add a new rule
+for the failover mode:
+
+```none
+delete load-balancing wan rule 10
+set load-balancing wan rule 10 failover
+set load-balancing wan rule 10 inbound-interface eth2
+set load-balancing wan rule 10 interface eth0 weight 10
+set load-balancing wan rule 10 interface eth1 weight 1
+```
+
+## Example 3: Failover based on rule order
+The previous example used the failover command to send traffic through
+eth1 if eth0 fails. In this example, failover functionality is provided
+by rule order.
+(wan-example3-overview)=
+
+### Overview
+Two rules will be created, the first rule directs traffic coming in
+from eth2 to eth0 and the second rule directs the traffic to eth1. If
+eth0 fails the first rule is bypassed and the second rule matches,
+directing traffic to eth1.
+
+### Create rule order based configuration
+We keep the configuration from the previous example, delete rule 10
+and create the two new rules as described:
+
+```none
+delete load-balancing wan rule 10
+set load-balancing wan rule 10 inbound-interface eth2
+set load-balancing wan rule 10 interface eth0
+set load-balancing wan rule 20 inbound-interface eth2
+set load-balancing wan rule 20 interface eth1
+```
+
+## Example 4: Failover based on rule order - priority traffic
+A rule order for prioritizing traffic is useful in scenarios where the
+secondary link has a lower speed and should only carry high priority
+traffic. It is assumed for this example that eth1 is connected to a
+slower connection than eth0 and should prioritize VoIP traffic.
+(wan-example4-overview)=
+
+### Overview
+A rule order for prioritizing traffic is useful in scenarios where the
+secondary link has a lower speed and should only carry high priority
+traffic. It is assumed for this example that eth1 is connected to a
+slower connection than eth0 and should prioritize VoIP traffic.
+
+### Create rule order based configuration with low speed secondary link
+We keep the configuration from the previous example, delete rule 20 and
+create a new rule as described:
+
+```none
+delete load-balancing wan rule 20
+set load-balancing wan rule 20 inbound-interface eth2
+set load-balancing wan rule 20 interface eth1
+set load-balancing wan rule 20 destination port sip
+set load-balancing wan rule 20 protocol tcp
+set protocols static route 0.0.0.0/0 next-hop 11.22.33.1
+```
+
+## Example 5: Exclude traffic from load balancing
+In this example two LAN interfaces exist in different subnets instead
+of one like in the previous examples:
+
+```{image} /_static/images/Wan_load_balancing_exclude1.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+### Adding a rule for the second interface
+Based on the previous example, another rule for traffic from the second
+interface eth3 can be added to the load balancer. However, traffic meant
+to flow between the LAN subnets will be sent to eth0 and eth1 as well.
+To prevent this, another rule is required. This rule excludes traffic
+between the local subnets from the load balancer. It also excludes
+locally-sources packets (required for web caching with load balancing).
+eth+ is used as an alias that refers to all ethernet interfaces:
+
+```none
+set load-balancing wan rule 5 exclude
+set load-balancing wan rule 5 inbound-interface eth+
+set load-balancing wan rule 5 destination address 10.0.0.0/8
+```
+
diff --git a/docs/configexamples/md-zone-policy.md b/docs/configexamples/md-zone-policy.md
new file mode 100644
index 00000000..6018e7fe
--- /dev/null
+++ b/docs/configexamples/md-zone-policy.md
@@ -0,0 +1,413 @@
+---
+lastproofread: '2024-06-14'
+---
+
+(examples-zone-policy)=
+
+# Zone-Policy example
+
+:::{note}
+In {vytask}`T2199` the syntax of the zone configuration was changed.
+The zone configuration moved from `zone-policy zone <name>` to `firewall
+zone <name>`.
+:::
+
+## Native IPv4 and IPv6
+
+We have three networks.
+
+```none
+WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64
+LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64
+DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64
+```
+
+**This specific example is for a router on a stick, but is very easily
+adapted for however many NICs you have**:
+
+- Internet - 192.168.200.100 - TCP/80
+- Internet - 192.168.200.100 - TCP/443
+- Internet - 192.168.200.100 - TCP/25
+- Internet - 192.168.200.100 - TCP/53
+- VyOS acts as DHCP, DNS forwarder, NAT, router and firewall.
+- 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web
+ and mail (SMTP/IMAP) server.
+- 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It
+ can SSH to VyOS.
+- LAN and DMZ hosts have basic outbound access: Web, FTP, SSH.
+- LAN can access DMZ resources.
+- DMZ cannot access LAN resources.
+- Inbound WAN connect to DMZ host.
+
+```{image} /_static/images/zone-policy-diagram.png
+:align: center
+:alt: Network Topology Diagram
+:width: 80%
+```
+
+The VyOS interface is assigned the .1/:1 address of their respective
+networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30.
+
+It will look something like this:
+
+```none
+interfaces {
+ ethernet eth0 {
+ duplex auto
+ hw-id 00:53:ed:6e:2a:92
+ smp_affinity auto
+ speed auto
+ vif 10 {
+ address 172.16.10.1/24
+ address 2001:db8:0:9999::1/64
+ }
+ vif 20 {
+ address 192.168.100.1/24
+ address 2001:db8:0:AAAA::1/64
+ }
+ vif 30 {
+ address 192.168.200.1/24
+ address 2001:db8:0:BBBB::1/64
+ }
+ }
+ loopback lo {
+ }
+}
+```
+
+## Zones Basics
+Each interface is assigned to a zone. The interface can be physical or
+virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly
+the same.
+
+Traffic flows from zone A to zone B. That flow is what I refer to as a
+zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations.
+
+Ruleset are created per zone-pair-direction.
+
+I name rule sets to indicate which zone-pair-direction they represent.
+eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN.
+
+In VyOS, you have to have unique Ruleset names. In the event of overlap,
+I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This
+allows for each auto-completion and uniqueness.
+
+In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is
+the firewall itself.
+
+If your computer is on the LAN and you need to SSH into your VyOS box,
+you would need a rule to allow it in the LAN-Local ruleset. If you want
+to access a webpage from your VyOS box, you need a rule to allow it in
+the Local-LAN ruleset.
+
+In rules, it is good to keep them named consistently. As the number of
+rules you have grows, the more consistency you have, the easier your
+life will be.
+
+```none
+Rule 1 - State Established, Related
+Rule 2 - State Invalid
+Rule 100 - ICMP
+Rule 200 - Web
+Rule 300 - FTP
+Rule 400 - NTP
+Rule 500 - SMTP
+Rule 600 - DNS
+Rule 700 - DHCP
+Rule 800 - SSH
+Rule 900 - IMAPS
+```
+
+The first two rules are to deal with the idiosyncrasies of VyOS and
+iptables.
+
+Zones and Rulesets both have a default action statement. When using
+Zone-Policies, the default action is set by the zone-policy statement
+and is represented by rule 10000.
+
+It is good practice to log both accepted and denied traffic. It can save
+you significant headaches when trying to troubleshoot a connectivity
+issue.
+
+To add logging to the default rule, do:
+
+```none
+set firewall name <ruleSet> default-log
+```
+
+By default, iptables does not allow traffic for established sessions to
+return, so you must explicitly allow this. I do this by adding two rules
+to every ruleset. 1 allows established and related state packets through
+and rule 2 drops and logs invalid state packets. We place the
+established/related rule at the top because the vast majority of traffic
+on a network is established and the invalid rule to prevent invalid
+state packets from mistakenly being matched against other rules. Having
+the most matched rule listed first reduces CPU load in high volume
+environments. Note: I have filed a bug to have this added as a default
+action as well.
+
+''It is important to note, that you do not want to add logging to the
+established state rule as you will be logging both the inbound and
+outbound packets for each session instead of just the initiation of the
+session. Your logs will be massive in a very short period of time.''
+
+In VyOS you must have the interfaces created before you can apply it to
+the zone and the rulesets must be created prior to applying it to a
+zone-policy.
+
+I create/configure the interfaces first. Build out the rulesets for each
+zone-pair-direction which includes at least the three state rules. Then
+I setup the zone-policies.
+
+Zones do not allow for a default action of accept; either drop or
+reject. It is important to remember this because if you apply an
+interface to a zone and commit, any active connections will be dropped.
+Specifically, if you are SSH’d into VyOS and add local or the interface
+you are connecting through to a zone and do not have rulesets in place
+to allow SSH and established sessions, you will not be able to connect.
+
+The following are the rules that were created for this example (may not
+be complete), both in IPv4 and IPv6. If there is no IP specified, then
+the source/destination address is not explicit.
+
+```none
+WAN - DMZ:192.168.200.200 - tcp/80
+WAN - DMZ:192.168.200.200 - tcp/443
+WAN - DMZ:192.168.200.200 - tcp/25
+WAN - DMZ:192.168.200.200 - tcp/53
+WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80
+WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443
+WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25
+WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53
+
+DMZ - Local - tcp/53
+DMZ - Local - tcp/123
+DMZ - Local - tcp/67,68
+
+LAN - Local - tcp/53
+LAN - Local - tcp/123
+LAN - Local - tcp/67,68
+LAN:192.168.100.10 - Local - tcp/22
+LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22
+
+LAN - WAN - tcp/80
+LAN - WAN - tcp/443
+LAN - WAN - tcp/22
+LAN - WAN - tcp/20,21
+
+DMZ - WAN - tcp/80
+DMZ - WAN - tcp/443
+DMZ - WAN - tcp/22
+DMZ - WAN - tcp/20,21
+DMZ - WAN - tcp/53
+DMZ - WAN - udp/53
+
+Local - WAN - tcp/80
+Local - WAN - tcp/443
+Local - WAN - tcp/20,21
+
+Local - DMZ - tcp/25
+Local - DMZ - tcp/67,68
+Local - DMZ - tcp/53
+Local - DMZ - udp/53
+
+Local - LAN - tcp/67,68
+
+LAN - DMZ - tcp/80
+LAN - DMZ - tcp/443
+LAN - DMZ - tcp/993
+LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22
+LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22
+```
+
+Since we have 4 zones, we need to setup the following rulesets.
+
+```none
+Lan-wan
+Lan-local
+Lan-dmz
+Wan-lan
+Wan-local
+Wan-dmz
+Local-lan
+Local-wan
+Local-dmz
+Dmz-lan
+Dmz-wan
+Dmz-local
+```
+
+Even if the two zones will never communicate, it is a good idea to
+create the zone-pair-direction rulesets and set default-log. This
+will allow you to log attempts to access the networks. Without it, you
+will never see the connection attempts.
+
+This is an example of the three base rules.
+
+```none
+name wan-lan {
+ default-action drop
+ default-log
+ rule 1 {
+ action accept
+ state {
+ established enable
+ related enable
+ }
+ }
+ rule 2 {
+ action drop
+ log enable
+ state {
+ invalid enable
+ }
+ }
+}
+```
+
+Here is an example of an IPv6 DMZ-WAN ruleset.
+
+```none
+ipv6-name dmz-wan-6 {
+ default-action drop
+ default-log
+ rule 1 {
+ action accept
+ state {
+ established enable
+ related enable
+ }
+ }
+ rule 2 {
+ action drop
+ log enable
+ state {
+ invalid enable
+ }
+ rule 100 {
+ action accept
+ log enable
+ protocol ipv6-icmp
+ }
+ rule 200 {
+ action accept
+ destination {
+ port 80,443
+ }
+ log enable
+ protocol tcp
+ }
+ rule 300 {
+ action accept
+ destination {
+ port 20,21
+ }
+ log enable
+ protocol tcp
+ }
+ rule 500 {
+ action accept
+ destination {
+ port 25
+ }
+ log enable
+ protocol tcp
+ source {
+ address 2001:db8:0:BBBB::200
+ }
+ }
+ rule 600 {
+ action accept
+ destination {
+ port 53
+ }
+ log enable
+ protocol tcp_udp
+ source {
+ address 2001:db8:0:BBBB::200
+ }
+ }
+ rule 800 {
+ action accept
+ destination {
+ port 22
+ }
+ log enable
+ protocol tcp
+ }
+}
+```
+
+Once you have all of your rulesets built, then you need to create your
+zone-policy.
+
+Start by setting the interface and default action for each zone.
+
+```none
+set firewall zone dmz default-action drop
+set firewall zone dmz interface eth0.30
+```
+
+In this case, we are setting the v6 ruleset that represents traffic
+sourced from the LAN, destined for the DMZ. Because the zone-policy
+firewall syntax is a little awkward, I keep it straight by thinking of
+it backwards.
+
+```none
+set firewall zone dmz from lan firewall ipv6-name lan-dmz-6
+```
+
+DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out
+a bunch at one time.
+
+In the end, you will end up with something like this config. I took out
+everything but the Firewall, Interfaces, and zone-policy sections. It is
+long enough as is.
+
+## IPv6 Tunnel
+If you are using a IPv6 tunnel from HE.net or someone else, the basis is
+the same except you have two WAN interfaces. One for v4 and one for v6.
+
+You would have 5 zones instead of just 4 and you would configure your v6
+ruleset between your tunnel interface and your LAN/DMZ zones instead of
+to the WAN.
+
+LAN, WAN, DMZ, local and TUN (tunnel)
+
+v6 pairs would be:
+
+```none
+lan-tun
+lan-local
+lan-dmz
+tun-lan
+tun-local
+tun-dmz
+local-lan
+local-tun
+local-dmz
+dmz-lan
+dmz-tun
+dmz-local
+```
+
+Notice, none go to WAN since WAN wouldn't have a v6 address on it.
+
+You would have to add a couple of rules on your wan-local ruleset to
+allow protocol 41 in.
+
+Something like:
+
+```none
+rule 400 {
+ action accept
+ destination {
+ address 172.16.10.1
+ }
+ log enable
+ protocol 41
+ source {
+ address ip.of.tunnel.broker
+ }
+}
+```
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-14 14:32:51 +0000