summaryrefslogtreecommitdiff
path: root/docs/configexamples
diff options
context:
space:
mode:
Diffstat (limited to 'docs/configexamples')
-rw-r--r--docs/configexamples/md-ansible.md203
-rw-r--r--docs/configexamples/md-bgp-ipv6-unnumbered.md173
-rw-r--r--docs/configexamples/md-dmvpn-dualhub-dualcloud.md523
-rw-r--r--docs/configexamples/md-firewall.md16
-rw-r--r--docs/configexamples/md-fwall-and-bridge.md487
-rw-r--r--docs/configexamples/md-index.md59
-rw-r--r--docs/configexamples/md-lac-lns.md172
-rw-r--r--docs/configexamples/md-nmp.md71
-rw-r--r--docs/configexamples/md-ospf-unnumbered.md117
-rw-r--r--docs/configexamples/md-policy-based-ipsec-and-firewall.md255
-rw-r--r--docs/configexamples/md-segment-routing-isis.md277
-rw-r--r--docs/configexamples/md-site-2-site-cisco.md167
-rw-r--r--docs/configexamples/md-wan-load-balancing.md158
-rw-r--r--docs/configexamples/md-zone-policy.md413
14 files changed, 0 insertions, 3091 deletions
diff --git a/docs/configexamples/md-ansible.md b/docs/configexamples/md-ansible.md
deleted file mode 100644
index 3f984812..00000000
--- a/docs/configexamples/md-ansible.md
+++ /dev/null
@@ -1,203 +0,0 @@
----
-lastproofread: '2024-04-09'
----
-
-(examples-ansible)=
-
-# Ansible example
-
-## Setting up Ansible on a server running the Debian operating system.
-
-In this example, we will set up a simple use of Ansible to configure
-multiple VyOS routers.
-We have four pre-configured routers with this configuration:
-
-Using the general schema for example:
-
-```{image} /_static/images/ansible.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-We have four pre-configured routers with this configuration:
-
-```none
-set interfaces ethernet eth0 address dhcp
-set service ssh
-commit
-save
-```
-
-- vyos7 - 192.0.2.105
-- vyos8 - 192.0.2.106
-- vyos9 - 192.0.2.107
-- vyos10 - 192.0.2.108
-
-## Install Ansible:
-
-```none
-# apt-get install ansible
-Do you want to continue? [Y/n] y
-```
-
-## Install Paramiko:
-
-```none
-#apt-get install -y python3-paramiko
-```
-
-## Check the version:
-
-```none
-# ansible --version
-ansible 2.10.8
-config file = None
-configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
-ansible python module location = /usr/lib/python3/dist-packages/ansible
-executable location = /usr/bin/ansible
-python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110]
-```
-
-## Basic configuration of ansible.cfg:
-
-```none
-# nano /root/ansible.cfg
-[defaults]
-host_key_checking = no
-```
-
-## Add all the VyOS hosts:
-
-```none
-# nano /root/hosts
-[vyos_hosts]
-vyos7 ansible_ssh_host=192.0.2.105
-vyos8 ansible_ssh_host=192.0.2.106
-vyos9 ansible_ssh_host=192.0.2.107
-vyos10 ansible_ssh_host=192.0.2.108
-```
-
-## Add general variables:
-
-```none
-# mkdir /root/group_vars/
-# nano /root/group_vars/vyos_hosts
-ansible_python_interpreter: /usr/bin/python3
-ansible_network_os: vyos
-ansible_connection: network_cli
-ansible_user: vyos
-ansible_ssh_pass: vyos
-```
-
-## Add a simple playbook with the tasks for each router:
-
-```none
-# nano /root/main.yml
-
----
-- hosts: vyos_hosts
- gather_facts: 'no'
- tasks:
- - name: Configure general settings for the vyos hosts group
- vyos_config:
- lines:
- - set system name-server 192.0.2.1
- - set interfaces ethernet eth0 description '#WAN#'
- - set interfaces ethernet eth1 description '#LAN#'
- - set interfaces ethernet eth2 disable
- - set interfaces ethernet eth3 disable
- - set system host-name {{ inventory_hostname }}
- save: true
-```
-
-## Start the playbook:
-
-```none
-ansible-playbook -i hosts main.yml
-PLAY [vyos_hosts] **************************************************************
-
-TASK [Configure general settings for the vyos hosts group] *********************
-ok: [vyos9]
-ok: [vyos10]
-ok: [vyos7]
-ok: [vyos8]
-
-PLAY RECAP *********************************************************************
-vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
-vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
-vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
-vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
-```
-
-## Check the result on the vyos10 router:
-
-```none
-vyos@vyos10:~$ show interfaces
-Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-Interface IP Address S/L Description
---------- ---------- --- -----------
-eth0 192.0.2.108/24 u/u WAN
-eth1 - u/u LAN
-eth2 - A/D
-eth3 - A/D
-lo 127.0.0.1/8 u/u
- ::1/128
-
-vyos@vyos10:~$ sh configuration commands | grep 192.0.2.1
-set system name-server '192.0.2.1'
-```
-
-## The simple way without configuration of the hostname (one task for all routers):
-
-```none
-# nano /root/hosts_v2
-[vyos_hosts_group]
-vyos7 ansible_ssh_host=192.0.2.105
-vyos8 ansible_ssh_host=192.0.2.106
-vyos9 ansible_ssh_host=192.0.2.107
-vyos10 ansible_ssh_host=192.0.2.108
-[vyos_hosts_group:vars]
-ansible_python_interpreter=/usr/bin/python3
-ansible_user=vyos
-ansible_ssh_pass=vyos
-ansible_network_os=vyos
-ansible_connection=network_cli
-
-# nano /root/main_v2.yml
----
-- hosts: vyos_hosts_group
- connection: network_cli
- gather_facts: 'no'
- tasks:
- - name: Configure remote vyos_hosts_group
- vyos_config:
- lines:
- - set system name-server 192.0.2.1
- - set interfaces ethernet eth0 description WAN
- - set interfaces ethernet eth1 description LAN
- - set interfaces ethernet eth2 disable
- - set interfaces ethernet eth3 disable
- save: true
-```
-
-```none
-# ansible-playbook -i hosts_v2 main_v2.yml
-
-PLAY [vyos_hosts_group] ********************************************************
-
-TASK [Configure remote vyos_hosts_group] ***************************************
-ok: [vyos8]
-ok: [vyos7]
-ok: [vyos9]
-ok: [vyos10]
-
-PLAY RECAP *********************************************************************
-vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
-vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
-vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
-vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
-```
-
-In the next chapter of the example, we'll use Ansible with jinja2
-templates and variables.
diff --git a/docs/configexamples/md-bgp-ipv6-unnumbered.md b/docs/configexamples/md-bgp-ipv6-unnumbered.md
deleted file mode 100644
index 36d8cf39..00000000
--- a/docs/configexamples/md-bgp-ipv6-unnumbered.md
+++ /dev/null
@@ -1,173 +0,0 @@
----
-lastproofread: '2021-06-28'
----
-
-(examples-bgp-ipv6-unnumbered)=
-
-# BGP IPv6 unnumbered with extended nexthop
-
-General information can be found in the {ref}`routing-bgp` chapter.
-
-## Configuration
-
-- Router A:
-
-```none
-set protocols bgp system-as 64496
-set protocols bgp address-family ipv4-unicast redistribute connected
-set protocols bgp address-family ipv6-unicast redistribute connected
-set protocols bgp neighbor eth1 interface v6only
-set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
-set protocols bgp neighbor eth2 interface v6only
-set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
-set protocols bgp parameters bestpath as-path multipath-relax
-set protocols bgp parameters bestpath compare-routerid
-set protocols bgp parameters default no-ipv4-unicast
-set protocols bgp parameters router-id '192.168.0.1'
-set protocols bgp peer-group fabric address-family ipv4-unicast
-set protocols bgp peer-group fabric address-family ipv6-unicast
-set protocols bgp peer-group fabric capability extended-nexthop
-set protocols bgp peer-group fabric remote-as 'external'
-```
-
-- Router B:
-
-```none
-set protocols bgp system-as 64499
-set protocols bgp address-family ipv4-unicast redistribute connected
-set protocols bgp address-family ipv6-unicast redistribute connected
-set protocols bgp neighbor eth1 interface v6only
-set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
-set protocols bgp neighbor eth2 interface v6only
-set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
-set protocols bgp parameters bestpath as-path multipath-relax
-set protocols bgp parameters bestpath compare-routerid
-set protocols bgp parameters default no-ipv4-unicast
-set protocols bgp parameters router-id '192.168.0.2'
-set protocols bgp peer-group fabric address-family ipv4-unicast
-set protocols bgp peer-group fabric address-family ipv6-unicast
-set protocols bgp peer-group fabric capability extended-nexthop
-set protocols bgp peer-group fabric remote-as 'external'
-```
-
-## Results
-
-- Router A:
-
-```none
-vyos@vyos:~$ show interfaces
-Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-Interface IP Address S/L Description
---------- ---------- --- -----------
-eth0 198.51.100.34/24 u/u
-eth1 - u/u
-eth2 - u/u
-lo 127.0.0.1/8 u/u
- 192.168.0.1/32
- ::1/128
-```
-
-```none
-vyos@vyos:~$ show ip route
-Codes: K - kernel route, C - connected, S - static, R - RIP,
- O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
- T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
- F - PBR, f - OpenFabric,
- > - selected route, * - FIB route
-
-S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53
-C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53
-C>* 192.168.0.1/32 is directly connected, lo, 03:21:56
-B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07
- * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07
-```
-
-```none
-vyos@vyos:~$ ping 192.168.0.2
-PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.
-64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms
-64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms
-64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms
-64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms
-64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms
-
---- 192.168.0.2 ping statistics ---
-5 packets transmitted, 5 received, 0% packet loss, time 4086ms
-rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms
-```
-
-```none
-vyos@vyos:~$ show ip bgp summary
-
-IPv4 Unicast Summary:
-BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0
-BGP table version 4
-RIB entries 5, using 800 bytes of memory
-Peers 2, using 41 KiB of memory
-Peer groups 1, using 64 bytes of memory
-
-Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
-eth1 4 64499 13 13 0 0 0 00:05:33 2
-eth2 4 64499 13 14 0 0 0 00:05:29 2
-
-Total number of neighbors 2
-```
-
-- Router B:
-
-```none
-vyos@vyos:~$ show interfaces
-Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-Interface IP Address S/L Description
---------- ---------- --- -----------
-eth0 198.51.100.33/24 u/u
-eth1 - u/u
-eth2 - u/u
-lo 127.0.0.1/8 u/u
- 192.168.0.2/32
- ::1/128
-```
-
-```none
-vyos@vyos:~$ show ip route
-Codes: K - kernel route, C - connected, S - static, R - RIP,
- O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
- T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
- F - PBR, f - OpenFabric,
- > - selected route, * - FIB route
-
-S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08
-C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09
-B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18
- * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18
-C>* 192.168.0.2/32 is directly connected, lo, 00:44:11
-```
-
-```none
-vyos@vyos:~$ ping 192.168.0.1
-PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
-64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms
-64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms
-64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms
-64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms
-
---- 192.168.0.1 ping statistics ---
-4 packets transmitted, 4 received, 0% packet loss, time 3051ms
-rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms
-```
-
-```none
-vyos@vyos:~$ show ip bgp summary
-IPv4 Unicast Summary:
-BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0
-BGP table version 4
-RIB entries 5, using 800 bytes of memory
-Peers 2, using 41 KiB of memory
-Peer groups 1, using 64 bytes of memory
-
-Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
-eth1 4 64496 14 14 0 0 0 00:06:40 2
-eth2 4 64496 14 14 0 0 0 00:06:37 2
-
-Total number of neighbors 2
-```
diff --git a/docs/configexamples/md-dmvpn-dualhub-dualcloud.md b/docs/configexamples/md-dmvpn-dualhub-dualcloud.md
deleted file mode 100644
index 8f5639b1..00000000
--- a/docs/configexamples/md-dmvpn-dualhub-dualcloud.md
+++ /dev/null
@@ -1,523 +0,0 @@
----
-lastproofread: '2024-02-21'
----
-
-(examples-dmvpn-dualhub-dualcloud)=
-
-# DMVPN Dual HUB Dual Cloud
-
-This document is to describe a basic setup to build DVMPN network with two Hubs and two clouds using DMVPN Phase3.
-OSPF is used as routing protocol inside DMVPN.
-
-In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1)
-as a Spoke.
-
-## Network Topology
-
-```{image} /_static/images/dual-hub-DMVPN.png
-:align: center
-:alt: DMVPN Network Topology
-:width: 80%
-```
-
-## Configurations
-
-### Underlay configuration
-Networks 192.168.X.0/24 are used as LANs for every spoke.
-
-HUB-1
-
-```none
-set interfaces ethernet eth0 address '10.0.0.2/30'
-set protocols static route 0.0.0.0/0 next-hop 10.0.0.1
-```
-
-HUB-2
-
-```none
-set interfaces ethernet eth0 address '10.0.1.2/30'
-set protocols static route 0.0.0.0/0 next-hop 10.0.1.1
-```
-
-Spoke-1
-
-```none
-interface GigabitEthernet0/0
- ip address 10.0.11.2 255.255.255.252
- duplex auto
- speed auto
- media-type rj45
-!
-interface GigabitEthernet0/1
- ip address 192.168.11.1 255.255.255.0
- ip ospf 1 area 0
- duplex auto
- speed auto
- media-type rj45
-!
-ip route 0.0.0.0 0.0.0.0 10.0.11.1
-```
-
-Spoke-2
-
-```none
-set interfaces ethernet eth0 address '10.0.12.2/30'
-set interfaces ethernet eth1 address '192.168.12.1/24'
-set protocols static route 0.0.0.0/0 next-hop 10.0.12.1
-```
-
-Spoke-3
-
-```none
-set interfaces ethernet eth0 address '10.0.13.2/30'
-set interfaces ethernet eth1 address '192.168.13.1/24'
-set protocols static route 0.0.0.0/0 next-hop 10.0.13.1
-```
-
-### NHRP configuration
-The next step is to configure the NHRP protocol. In a Dual cloud network, every HUB has to be configured with one GRE
-multipoint tunnel interface and every spoke has to be configured with two tunnel interfaces, one tunnel to each hub.
-In this example tunnel networks are 10.100.100.0/24 for the first cloud and 10.100.101.0/24 for the second cloud.
-But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32.
-
-HUB-1
-
-```none
-set interfaces tunnel tun100 address '10.100.100.1/32'
-set interfaces tunnel tun100 enable-multicast
-set interfaces tunnel tun100 encapsulation 'gre'
-set interfaces tunnel tun100 ip adjust-mss '1360'
-set interfaces tunnel tun100 mtu '1436'
-set interfaces tunnel tun100 parameters ip key '42'
-set interfaces tunnel tun100 source-interface 'eth0'
-set protocols nhrp tunnel tun100 authentication 'vyos'
-set protocols nhrp tunnel tun100 holdtime '300'
-set protocols nhrp tunnel tun100 multicast 'dynamic'
-set protocols nhrp tunnel tun100 network-id '1'
-set protocols nhrp tunnel tun100 redirect
-set protocols nhrp tunnel tun100 registration-no-unique
-```
-
-HUB-2
-
-```none
-set interfaces tunnel tun101 address '10.100.101.1/32'
-set interfaces tunnel tun101 enable-multicast
-set interfaces tunnel tun101 encapsulation 'gre'
-set interfaces tunnel tun101 ip adjust-mss '1360'
-set interfaces tunnel tun101 mtu '1436'
-set interfaces tunnel tun101 parameters ip key '43'
-set interfaces tunnel tun101 source-interface 'eth0'
-set protocols nhrp tunnel tun101 authentication 'vyos'
-set protocols nhrp tunnel tun101 holdtime '300'
-set protocols nhrp tunnel tun101 multicast 'dynamic'
-set protocols nhrp tunnel tun101 network-id '2'
-set protocols nhrp tunnel tun101 redirect
-set protocols nhrp tunnel tun101 registration-no-unique
-```
-
-Spoke-1
-
-```none
-interface Tunnel100
- ip address 10.100.100.11 255.255.255.0
- no ip redirects
- ip mtu 1436
- ip nhrp authentication vyos
- ip nhrp map multicast 10.0.0.2
- ip nhrp network-id 1
- ip nhrp holdtime 300
- ip nhrp nhs 10.100.100.1 nbma 10.0.0.2
- ip nhrp shortcut
- ip tcp adjust-mss 1360
- tunnel source GigabitEthernet0/0
- tunnel mode gre multipoint
- tunnel key 42
-!
-interface Tunnel101
- ip address 10.100.101.11 255.255.255.0
- no ip redirects
- ip mtu 1436
- ip nhrp authentication vyos
- ip nhrp map multicast 10.0.1.2
- ip nhrp network-id 2
- ip nhrp holdtime 300
- ip nhrp nhs 10.100.101.1 nbma 10.0.1.2
- ip nhrp shortcut
- ip tcp adjust-mss 1360
- tunnel source GigabitEthernet0/0
- tunnel mode gre multipoint
- tunnel key 43
-```
-
-Spoke-2
-
-```none
-set interfaces tunnel tun100 address '10.100.100.12/32'
-set interfaces tunnel tun100 enable-multicast
-set interfaces tunnel tun100 encapsulation 'gre'
-set interfaces tunnel tun100 ip adjust-mss '1360'
-set interfaces tunnel tun100 mtu '1436'
-set interfaces tunnel tun100 parameters ip key '42'
-set interfaces tunnel tun100 source-interface 'eth0'
-set interfaces tunnel tun101 address '10.100.101.12/32'
-set interfaces tunnel tun101 enable-multicast
-set interfaces tunnel tun101 encapsulation 'gre'
-set interfaces tunnel tun101 ip adjust-mss '1360'
-set interfaces tunnel tun101 mtu '1436'
-set interfaces tunnel tun101 parameters ip key '43'
-set interfaces tunnel tun101 source-interface 'eth0'
-set protocols nhrp tunnel tun100 authentication 'vyos'
-set protocols nhrp tunnel tun100 holdtime '300'
-set protocols nhrp tunnel tun100 multicast '10.0.0.2'
-set protocols nhrp tunnel tun100 network-id '1'
-set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2'
-set protocols nhrp tunnel tun100 registration-no-unique
-set protocols nhrp tunnel tun100 shortcut
-set protocols nhrp tunnel tun101 authentication 'vyos'
-set protocols nhrp tunnel tun101 holdtime '300'
-set protocols nhrp tunnel tun101 multicast '10.0.1.2'
-set protocols nhrp tunnel tun101 network-id '2'
-set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2'
-set protocols nhrp tunnel tun101 registration-no-unique
-set protocols nhrp tunnel tun101 shortcut
-```
-
-Spoke-3
-
-```none
-set protocols nhrp tunnel tun100 authentication 'vyos'
-set protocols nhrp tunnel tun100 holdtime '300'
-set protocols nhrp tunnel tun100 multicast '10.0.0.2'
-set protocols nhrp tunnel tun100 network-id '1'
-set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2'
-set protocols nhrp tunnel tun100 registration-no-unique
-set protocols nhrp tunnel tun100 shortcut
-set protocols nhrp tunnel tun101 authentication 'vyos'
-set protocols nhrp tunnel tun101 holdtime '300'
-set protocols nhrp tunnel tun101 multicast '10.0.1.2'
-set protocols nhrp tunnel tun101 network-id '2'
-set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2'
-set protocols nhrp tunnel tun101 registration-no-unique
-set protocols nhrp tunnel tun101 shortcut
-```
-
-### Overlay configuration
-The last step is to configure the routing protocol. In this scenario, OSPF was chosen as the dynamic routing protocol.
-But you can use iBGP or eBGP. To form fast convergence it is possible to use BFD protocol.
-
-HUB-1
-
-```none
-set protocols ospf interface tun100 area '0'
-set protocols ospf interface tun100 network 'point-to-multipoint'
-set protocols ospf interface tun100 passive disable
-set protocols ospf passive-interface 'default'
-```
-
-HUB-2
-
-```none
-set protocols ospf interface tun101 area '0'
-set protocols ospf interface tun101 network 'point-to-multipoint'
-set protocols ospf interface tun101 passive disable
-set protocols ospf passive-interface 'default'
-```
-
-Spoke-1
-
-```none
-interface Tunnel100
- ip ospf network point-to-multipoint
- ip ospf dead-interval 40
- ip ospf hello-interval 10
- ip ospf 1 area 0
-!
-interface Tunnel101
- ip ospf network point-to-multipoint
- ip ospf dead-interval 40
- ip ospf hello-interval 10
- ip ospf 1 area 0
-!
-router ospf 1
- passive-interface default
- no passive-interface Tunnel100
- no passive-interface Tunnel101
-```
-
-Spoke-2
-
-```none
-set protocols ospf interface eth1 area '0'
-set protocols ospf interface tun100 area '0'
-set protocols ospf interface tun100 network 'point-to-multipoint'
-set protocols ospf interface tun100 passive disable
-set protocols ospf interface tun101 area '0'
-set protocols ospf interface tun101 network 'point-to-multipoint'
-set protocols ospf interface tun101 passive disable
-set protocols ospf passive-interface 'default'
-```
-
-Spoke-3
-
-```none
-set protocols ospf interface eth1 area '0'
-set protocols ospf interface tun100 area '0'
-set protocols ospf interface tun100 network 'point-to-multipoint'
-set protocols ospf interface tun100 passive disable
-set protocols ospf interface tun101 area '0'
-set protocols ospf interface tun101 network 'point-to-multipoint'
-set protocols ospf interface tun101 passive disable
-set protocols ospf passive-interface 'default'
-```
-
-### Security configuration
-Tunnels can be encrypted by IPSEC for security.
-
-HUB-1
-
-```none
-set vpn ipsec esp-group ESP-HUB lifetime '1800'
-set vpn ipsec esp-group ESP-HUB mode 'transport'
-set vpn ipsec esp-group ESP-HUB pfs 'disable'
-set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
-set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
-set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
-set vpn ipsec ike-group IKE-HUB lifetime '3600'
-set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
-set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
-set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
-set vpn ipsec interface 'eth0'
-set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
-set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
-set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
-set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
-set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
-```
-
-HUB-2
-
-```none
-set vpn ipsec esp-group ESP-HUB lifetime '1800'
-set vpn ipsec esp-group ESP-HUB mode 'transport'
-set vpn ipsec esp-group ESP-HUB pfs 'disable'
-set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
-set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
-set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
-set vpn ipsec ike-group IKE-HUB lifetime '3600'
-set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
-set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
-set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
-set vpn ipsec interface 'eth0'
-set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
-set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
-set vpn ipsec profile NHRPVPN bind tunnel 'tun101'
-set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
-set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
-```
-
-VyOS Spokes have the same configuration
-
-```none
-set vpn ipsec esp-group ESP-HUB lifetime '1800'
-set vpn ipsec esp-group ESP-HUB mode 'transport'
-set vpn ipsec esp-group ESP-HUB pfs 'disable'
-set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
-set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
-set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
-set vpn ipsec ike-group IKE-HUB lifetime '3600'
-set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
-set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
-set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
-set vpn ipsec interface 'eth0'
-set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
-set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret'
-set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
-set vpn ipsec profile NHRPVPN bind tunnel 'tun101'
-set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
-set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
-```
-
-SPOKE-1
-
-```none
-crypto isakmp policy 1
- encr aes 256
- authentication pre-share
- group 2
- lifetime 3600
-crypto isakmp key secret address 0.0.0.0
-!
-!
-crypto ipsec transform-set ESP_TRANSFORMSET esp-aes 256 esp-sha-hmac
- mode transport
-!
-!
-crypto ipsec profile gre_protection
- set security-association lifetime seconds 1800
- set transform-set ESP_TRANSFORMSET
-!
-interface Tunnel100
- tunnel protection ipsec profile gre_protection shared
-!
-interface Tunnel101
- tunnel protection ipsec profile gre_protection shared
-```
-
-## Monitoring
-All spokes created IPSec tunnels to Hubs, are registered on Hubs using NHRP protocol and formed adjacency in OSPF.
-```none
-vyos@HUB-1:~$ show vpn ipsec sa
-Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal
--------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------
-dmvpn-NHRPVPN-tun100-child up 6m1s 4K/5K 51/56 10.0.13.2 10.0.13.2 AES_CBC_256/HMAC_SHA1_96
-dmvpn-NHRPVPN-tun100-child up 6m36s 4K/6K 56/65 10.0.12.2 10.0.12.2 AES_CBC_256/HMAC_SHA1_96
-dmvpn-NHRPVPN-tun100-child up 8m49s 6K/6K 73/77 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96
-
-vyos@HUB-1:~$ show ip nhrp cache
-Iface Type Protocol NBMA Claimed NBMA Flags Identity
-tun100 dynamic 10.100.100.12 10.0.12.2 10.0.12.2 T 10.0.12.2
-tun100 dynamic 10.100.100.13 10.0.13.2 10.0.13.2 T 10.0.13.2
-tun100 dynamic 10.100.100.11 10.0.11.2 10.0.11.2 T 10.0.11.2
-tun100 local 10.100.100.1 10.0.0.2 10.0.0.2 -
-
-vyos@HUB-1:~$ show ip ospf neighbor
-
-Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL
-192.168.11.1 1 Full/DROther 17m01s 36.201s 10.100.100.11 tun100:10.100.100.1 0 0 0
-192.168.12.1 1 Full/DROther 9m42s 37.443s 10.100.100.12 tun100:10.100.100.1 0 0 0
-192.168.13.1 1 Full/DROther 9m15s 35.053s 10.100.100.13 tun100:10.100.100.1 0 0 0
-```
-First, we see that LANs are accessible through hubs using OSPF routes.
-```none
-SPOKE-1#show ip route
-Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2
- i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
- ia - IS-IS inter area, * - candidate default, U - per-user static route
- o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
- a - application route
- + - replicated route, % - next hop override, p - overrides from PfR
-
-Gateway of last resort is 10.0.11.1 to network 0.0.0.0
-.....
- 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks
-C 192.168.11.0/24 is directly connected, GigabitEthernet0/1
-L 192.168.11.1/32 is directly connected, GigabitEthernet0/1
-O 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101
- [110/1002] via 10.100.100.1, 00:16:13, Tunnel100
-O 192.168.13.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101
- [110/1002] via 10.100.100.1, 00:15:45, Tunnel100
-
-
-vyos@SPOKE-2:~$ show ip route
-Codes: K - kernel route, C - connected, L - local, S - static,
- R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
- T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
- f - OpenFabric, t - Table-Direct,
- > - selected route, * - FIB route, q - queued, r - rejected, b - backup
- t - trapped, o - offload failure
-
-......
-
-O>* 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36
- * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36
-O 192.168.12.0/24 [110/1] is directly connected, eth1, weight 1, 01:24:40
-C>* 192.168.12.0/24 is directly connected, eth1, weight 1, 01:24:43
-L>* 192.168.12.1/32 is directly connected, eth1, weight 1, 01:24:43
-O>* 192.168.13.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36
- * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36
-```
-After initiating traffic between SPOKES sites, Phase 3 of DMVPN will work.
-For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1
-```none
-PC-SPOKE-2 : 192.168.12.2 255.255.255.0 gateway 192.168.12.1
-
-PC-SPOKE-2> trace 192.168.11.2
-trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop
- 1 192.168.12.1 0.558 ms 0.378 ms 0.561 ms
- 2 10.100.101.1 1.768 ms 1.158 ms 1.744 ms
- 3 10.100.101.11 7.196 ms 4.971 ms 4.793 ms
- 4 *192.168.11.2 7.747 ms (ICMP type:3, code:3, Destination port unreachable)
-
-PC-SPOKE-2> trace 192.168.11.2
-trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop
- 1 192.168.12.1 0.562 ms 0.396 ms 0.364 ms
- 2 10.100.100.11 4.401 ms 4.399 ms 4.174 ms
- 3 *192.168.11.2 3.241 ms (ICMP type:3, code:3, Destination port unreachable)
-```
-First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2.
-Now routing tables are changed. LAN networks 192.168.12.0/24 and 192.168.11.0/24 available directly via SPOKES.
-```none
-vyos@SPOKE-2:~$ show ip route
-Codes: K - kernel route, C - connected, L - local, S - static,
- R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
- T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
- f - OpenFabric, t - Table-Direct,
- > - selected route, * - FIB route, q - queued, r - rejected, b - backup
- t - trapped, o - offload failure
-
-N>* 192.168.11.0/24 [10/0] via 10.100.100.11, tun100 onlink, weight 1, 00:00:14
-O 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:00:54
- via 10.100.101.1, tun101 onlink, weight 1, 00:00:54
-
-
-SPOKE-1# show ip route next-hop-override
-Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
- D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
- N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
- E1 - OSPF external type 1, E2 - OSPF external type 2
- i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
- ia - IS-IS inter area, * - candidate default, U - per-user static route
- o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
- a - application route
- + - replicated route, % - next hop override, p - overrides from PfR
-
-Gateway of last resort is 10.0.11.1 to network 0.0.0.0
-
-O % 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:24:09, Tunnel101
- [110/1002] via 10.100.100.1, 00:25:46, Tunnel100
- [NHO][110/1] via 10.100.100.12, 00:00:03, Tunnel100
-```
-NHRP shows shortcuts on Spokes
-```none
-vyos@SPOKE-2:~$ show ip nhrp shortcut
-Type Prefix Via Identity
-dynamic 192.168.11.0/24 10.100.100.11 10.0.11.2
-
-SPOKE-1# show ip nhrp shortcut
-10.100.100.12/32 via 10.100.100.12
- Tunnel100 created 00:09:59, expire 00:02:21
- Type: dynamic, Flags: router nhop rib nho
- NBMA address: 10.0.12.2
-192.168.12.0/24 via 10.100.100.12
- Tunnel100 created 00:02:38, expire 00:02:21
- Type: dynamic, Flags: router rib nho
- NBMA address: 10.0.12.2
-```
-A new Spoke to Spoke IPSec tunnel is created
-```none
-SPOKE-1#show crypto isakmp sa
-IPv4 Crypto ISAKMP SA
-dst src state conn-id status
-10.0.0.2 10.0.11.2 QM_IDLE 1002 ACTIVE
-10.0.12.2 10.0.11.2 QM_IDLE 1004 ACTIVE
-10.0.1.2 10.0.11.2 QM_IDLE 1003 ACTIVE
-
-vyos@SPOKE-2:~$ show vpn ipsec sa
-Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal
--------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------
-dmvpn-NHRPVPN-tun100-child up 7m26s 4K/4K 57/53 10.0.0.2 10.0.0.2 AES_CBC_256/HMAC_SHA1_96
-dmvpn-NHRPVPN-tun100-child up 11m48s 316B/1K 3/15 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96
-dmvpn-NHRPVPN-tun101-child up 5m58s 5K/4K 62/51 10.0.1.2 10.0.1.2 AES_CBC_256/HMAC_SHA1_96
-```
-
-## Summary
-
-If one of the Hubs loses connectivity to the Internet, the other Hub will be available and take the main role.
-This is a simple example where only one internet connection is used. But in the real world, there can be two
-connections to the Internet. In this case, there is a recommendation to build each tunnel via each Internet connection,
-choose the main cloud, and manipulate traffic via a routing protocol. It allows the creation failover on link-level
-connections too.
diff --git a/docs/configexamples/md-firewall.md b/docs/configexamples/md-firewall.md
deleted file mode 100644
index 5d170511..00000000
--- a/docs/configexamples/md-firewall.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-lastproofread: '2024-09-11'
----
-
-# Firewall Examples
-
-This section contains examples of firewall configurations for various
-deployments.
-
-```{toctree}
-:maxdepth: 2
-
-fwall-and-vrf
-fwall-and-bridge
-zone-policy
-```
diff --git a/docs/configexamples/md-fwall-and-bridge.md b/docs/configexamples/md-fwall-and-bridge.md
deleted file mode 100644
index 75fb6b25..00000000
--- a/docs/configexamples/md-fwall-and-bridge.md
+++ /dev/null
@@ -1,487 +0,0 @@
----
-lastproofread: '2024-09-11'
----
-
-# Bridge and firewall example
-
-## Scenario and requirements
-
-This example shows how to configure a VyOS router with bridge interfaces and
-firewall rules.
-
-Three non VLAN-aware bridges are going to be configured, and each one has its
-own requirements.
-
-- Bridge br0:
- : - Isolated layer 2 bridge.
- - Accept only IPv6 communication whithin the bridge.
-- Bridge br1:
- : - Drop all DHCP discover packets.
- - Accept all ARP packets.
- - Within the bridge, accept only new IPv4 connections from host 10.1.1.102
- - Drop all other IPv4 connections.
- - Drop all IPv6 connections.
- - Accept access to router itself.
- - Allow connections to internet
- - Drop connections to other LANs.
-- Bridge br2:
- : - Accept all DHCP discover packets.
- - Accept only DHCP offers from valid server and|or trusted bridge port.
- - Accept all ARP packets.
- - Accept all IPv4 connections.
- - Drop all IPv6 connections.
- - Deny access to the router.
- - Allow connections to internet.
- - Allow connections to bridge br1.
-
-## Configuration
-
-### Bridges and interfaces configuration
-
-First, we need to configure the interfaces and bridges:
-
-```none
-# Brige br0
-set interfaces bridge br0 description 'Isolated L2 bridge'
-set interfaces bridge br0 member interface eth1
-set interfaces bridge br0 member interface eth2
-set interfaces ethernet eth1 description 'br0'
-set interfaces ethernet eth2 description 'br0'
-
-# Bridge br1:
-set interfaces bridge br1 address '10.1.1.1/24'
-set interfaces bridge br1 description 'L3 bridge br1'
-set interfaces bridge br1 member interface eth3
-set interfaces bridge br1 member interface eth4
-set interfaces ethernet eth3 description 'br1'
-set interfaces ethernet eth4 description 'br1'
-
-# Bridge br2:
-set interfaces bridge br2 address '10.2.2.1/24'
-set interfaces bridge br2 description 'L3 bridge br2'
-set interfaces bridge br2 member interface eth5
-set interfaces bridge br2 member interface eth6
-set interfaces bridge br2 member interface eth7
-set interfaces ethernet eth5 description 'br2 - Host'
-set interfaces ethernet eth6 description 'br2 - Trusted DHCP Server'
-set interfaces ethernet eth7 description 'br2'
-```
-
-### Bridge firewall configuration
-
-In this section, we are going to configure the firewall rules that will be used
-in bridge firewall, and will control the traffic within each bridge.
-
-We are going to use custom firewall rulesets, one for each bridge that will
-be used in `prerouting`, and one for each bridge that will be used in the
-`forward` chain.
-
-Also, we are going to use firewall interface groups in order to simplify the
-firewall configuration.
-
-So first, let's create the required firewall interface groups:
-
-```none
-# Bridge br0 interface-group:
-set firewall group interface-group br0-ifaces interface 'br0'
-set firewall group interface-group br0-ifaces interface 'eth1'
-set firewall group interface-group br0-ifaces interface 'eth2'
-
-# Bridge br1 interface-group:
-set firewall group interface-group br1-ifaces interface 'br1'
-set firewall group interface-group br1-ifaces interface 'eth3'
-set firewall group interface-group br1-ifaces interface 'eth4'
-
-# Bridge br2 interface-group:
-set firewall group interface-group br2-ifaces interface 'br2'
-set firewall group interface-group br2-ifaces interface 'eth5'
-set firewall group interface-group br2-ifaces interface 'eth6'
-set firewall group interface-group br2-ifaces interface 'eth7'
-```
-
-As said before, we are going to create custom firewall rulesets for each
-bridge, that will be used in the `prerouting` chain, in order to drop as much
-unwanted traffic as early as possible. So, custom rulesets used in
-`prerouting` chain are going to be `br0-pre`, `br1-pre`, and `br2-pre`:
-
-```none
-# Prerouting - Catch all traffic for br0
-set firewall bridge prerouting filter rule 10 action 'jump'
-set firewall bridge prerouting filter rule 10 description 'br0 traffic'
-set firewall bridge prerouting filter rule 10 inbound-interface group 'br0-ifaces'
-set firewall bridge prerouting filter rule 10 jump-target 'br0-pre'
-
-# Prerouting - Catch all traffic for br1
-set firewall bridge prerouting filter rule 20 action 'jump'
-set firewall bridge prerouting filter rule 20 description 'br1 traffic'
-set firewall bridge prerouting filter rule 20 inbound-interface group 'br1-ifaces'
-set firewall bridge prerouting filter rule 20 jump-target 'br1-pre'
-
-# Prerouting - Catch all traffic for br2
-set firewall bridge prerouting filter rule 30 action 'jump'
-set firewall bridge prerouting filter rule 30 description 'br2 traffic'
-set firewall bridge prerouting filter rule 30 inbound-interface group 'br2-ifaces'
-set firewall bridge prerouting filter rule 30 jump-target 'br2-pre'
-```
-
-And then create the custom rulesets:
-
-```none
-### br0 - br0-pre
- # Requirements: accept only IPv6 communication within the bridge
-set firewall bridge name br0-pre rule 10 description 'Accept IPv6 traffic'
-set firewall bridge name br0-pre rule 10 action 'accept'
-set firewall bridge name br0-pre rule 10 ethernet-type 'ipv6'
- # And drop everything else
-set firewall bridge name br0-pre default-action 'drop'
-
-### br1 - br1-pre
- # Requirements: drop all DHCP discover packets
-set firewall bridge name br1-pre rule 10 description 'Drop DHCP discover'
-set firewall bridge name br1-pre rule 10 action 'drop'
-set firewall bridge name br1-pre rule 10 protocol 'udp'
-set firewall bridge name br1-pre rule 10 source port '68'
-set firewall bridge name br1-pre rule 10 destination port '67'
-set firewall bridge name br1-pre rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
-set firewall bridge name br1-pre rule 10 log
- # Requirement: drop all IPv6 connections
-set firewall bridge name br1-pre rule 20 description 'Drop IPv6 traffic'
-set firewall bridge name br1-pre rule 20 action 'drop'
-set firewall bridge name br1-pre rule 20 ethernet-type 'ipv6'
- # Accept everything else so it can be parsed later
-set firewall bridge name br1-pre default-action 'accept'
-
-### br2 - br2-pre
- # Requirements: drop all IPv6 connections
-set firewall bridge name br2-pre rule 10 description 'Drop IPv6 traffic'
-set firewall bridge name br2-pre rule 10 action 'drop'
-set firewall bridge name br2-pre rule 10 ethernet-type 'ipv6'
- # Accept everything else so it can be parsed later
-set firewall bridge name br2-pre default-action 'accept'
-```
-
-Now, in the `forward` chain, we are going to define state policies, and
-custom rulesets for each bridge that would be used in the `forward` chain.
-These rulesets are `br0-fwd`, `br1-fwd`, and `br2-fwd`:
-
-```none
-# Forward - State policies if not defined globally
-set firewall bridge forward filter rule 5 action 'accept'
-set firewall bridge forward filter rule 5 state 'established'
-set firewall bridge forward filter rule 5 state 'related'
-set firewall bridge forward filter rule 10 action 'drop'
-set firewall bridge forward filter rule 10 state 'invalid'
-
-# Forward - Catch all traffic for br0
-set firewall bridge forward filter rule 110 description 'br0 traffic'
-set firewall bridge forward filter rule 110 action 'jump'
-set firewall bridge forward filter rule 110 inbound-interface group 'br0-ifaces'
-set firewall bridge forward filter rule 110 jump-target 'br0-fwd'
-
-# Forward - Catch all traffic for br1
-set firewall bridge forward filter rule 120 description 'br1 traffic'
-set firewall bridge forward filter rule 120 action 'jump'
-set firewall bridge forward filter rule 120 inbound-interface group 'br1-ifaces'
-set firewall bridge forward filter rule 120 jump-target 'br1-fwd'
-
-# Forward - Catch all traffic for br2
-set firewall bridge forward filter rule 130 description 'br2 traffic'
-set firewall bridge forward filter rule 130 action 'jump'
-set firewall bridge forward filter rule 130 inbound-interface group 'br2-ifaces'
-set firewall bridge forward filter rule 130 jump-target 'br2-fwd'
-
-# Forward - Default action drop:
-set firewall bridge forward filter default-action 'drop'
-```
-
-And the content of the custom rulesets:
-
-```none
-### br0 - br0-fwd
- # Accept everything that wasn't dropped in prerouting
-set firewall bridge name br0-fwd default-action 'accept'
-
-### br1 - br1-fwd
- # Requirement: Accept all ARP packets
-set firewall bridge name br1-fwd rule 10 description 'Accept ARP'
-set firewall bridge name br1-fwd rule 10 action 'accept'
-set firewall bridge name br1-fwd rule 10 ethernet-type 'arp'
- # Requirement: Accept only new IPv4 connections from host 10.1.1.102
-set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host'
-set firewall bridge name br1-fwd rule 20 action 'accept'
-set firewall bridge name br1-fwd rule 20 source address '10.1.1.102'
-set firewall bridge name br1-fwd rule 20 state 'new'
- # Drop everythin else within the bridge:
-set firewall bridge name br1-fwd default-action 'drop'
-
-### br2 - br2-fwd
- # Requirement: Accept all DHCP discover packets
-set firewall bridge name br2-fwd rule 10 description 'Accept DHCP discover'
-set firewall bridge name br2-fwd rule 10 action 'accept'
-set firewall bridge name br2-fwd rule 10 protocol 'udp'
-set firewall bridge name br2-fwd rule 10 source port '68'
-set firewall bridge name br2-fwd rule 10 destination port '67'
-set firewall bridge name br2-fwd rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
- # Requirement: Accept only DHCP offers from valid server on port eth6
-set firewall bridge name br2-fwd rule 20 description 'Accept DHCP offers from trusted interface'
-set firewall bridge name br2-fwd rule 20 action 'accept'
-set firewall bridge name br2-fwd rule 20 protocol 'udp'
-set firewall bridge name br2-fwd rule 20 source port '67'
-set firewall bridge name br2-fwd rule 20 destination port '68'
-set firewall bridge name br2-fwd rule 20 inbound-interface name 'eth6'
-set firewall bridge name br2-fwd rule 22 description 'Drop all other DHCP offers'
-set firewall bridge name br2-fwd rule 22 action 'drop'
-set firewall bridge name br2-fwd rule 22 protocol 'udp'
-set firewall bridge name br2-fwd rule 22 source port '67'
-set firewall bridge name br2-fwd rule 22 destination port '68'
-set firewall bridge name br2-fwd rule 22 log
-
- # Accept all ARP packets
-set firewall bridge name br2-fwd rule 30 description 'Accept ARP'
-set firewall bridge name br2-fwd rule 30 action 'accept'
-set firewall bridge name br2-fwd rule 30 ethernet-type 'arp'
- # Accept all IPv4 connections
-set firewall bridge name br2-fwd rule 40 description 'Accept ipv4'
-set firewall bridge name br2-fwd rule 40 action 'accept'
-set firewall bridge name br2-fwd rule 40 ethernet-type 'ipv4'
- # Drop everything else
-set firewall bridge name br2-fwd default-action 'drop'
-```
-
-### IP firewall configuration
-
-Since some of the requirements listed above exceed the capabilities of the
-bridge firewall, we need to use the IP firewall to implement them.
-For bridge br1 and br2, we need to control the traffic that is going to the
-router itself, to other local networks, and to the Internet.
-
-As a reminder, here's a link to the {doc}`firewall documentation
-</configuration/firewall/index>`, where you can find more information about
-the packet flow for traffic that comes from bridge layer and should be analized
-by the IP firewall.
-
-Access to the router itself is controlled by the base chain `input`, and
-rules to accomplish all the requirements are:
-
-```none
-# First of all, if not using global state policies, we need to define them:
-set firewall ipv4 input filter rule 10 state 'established'
-set firewall ipv4 input filter rule 10 state 'related'
-set firewall ipv4 input filter rule 10 action 'accept'
-set firewall ipv4 input filter rule 20 state 'invalid'
-set firewall ipv4 input filter rule 20 action 'drop'
-
-# Input - br1 - Accept access to router itself
-set firewall ipv4 input filter rule 110 description "Accept access from br1"
-set firewall ipv4 input filter rule 110 action 'accept'
-set firewall ipv4 input filter rule 110 inbound-interface group 'br1-ifaces'
-
-# Input - br2 - Deny access to the router
-set firewall ipv4 input filter rule 120 description "Deny access from br2"
-set firewall ipv4 input filter rule 120 action 'drop'
-set firewall ipv4 input filter rule 120 inbound-interface group 'br2-ifaces'
-```
-
-And for traffic that is going to other local networks, and to he Internet, we
-need to use the base chain `forward`. As in the bridge firewall, we are
-going to use custom rulesets for each bridge, that would be used in the
-`forward` chain. Those rulesets are `ip-br1-fwd` and `ip-br2-fwd`:
-
-```none
-# First of all, if not using global state policies, we need to define them:
-set firewall ipv4 forward filter rule 5 action 'accept'
-set firewall ipv4 forward filter rule 5 state 'established'
-set firewall ipv4 forward filter rule 5 state 'related'
-set firewall ipv4 forward filter rule 10 action 'drop'
-set firewall ipv4 forward filter rule 10 state 'invalid'
-
-# Forward - Catch all traffic for br1
-set firewall ipv4 forward filter rule 110 description 'br1 traffic'
-set firewall ipv4 forward filter rule 110 action 'jump'
-set firewall ipv4 forward filter rule 110 inbound-interface group 'br1-ifaces'
-set firewall ipv4 forward filter rule 110 jump-target 'ip-br1-fwd'
-
-# Forward - Catch all traffic for br2
-set firewall ipv4 forward filter rule 120 description 'br2 traffic'
-set firewall ipv4 forward filter rule 120 action 'jump'
-set firewall ipv4 forward filter rule 120 inbound-interface group 'br2-ifaces'
-set firewall ipv4 forward filter rule 120 jump-target 'ip-br2-fwd'
-
-# Forward - Default action drop:
-set firewall ipv4 forward filter default-action 'drop'
-```
-
-And the content of the custom rulesets:
-
-```none
-### br1 - ip-br1-fwd
- # Requirement: Allow connections to internet
-set firewall ipv4 name ip-br1-fwd rule 10 description 'br1 - allow internet access'
-set firewall ipv4 name ip-br1-fwd rule 10 action 'accept'
-set firewall ipv4 name ip-br1-fwd rule 10 outbound-interface name 'eth0'
- # Requirement: Drop all other connections
-set firewall ipv4 name ip-br1-fwd default-action 'drop'
-
-### br2 - ip-br2-fwd
- # Requirement: Allow connections to internet
-set firewall ipv4 name ip-br2-fwd rule 10 description 'br2 - allow internet access'
-set firewall ipv4 name ip-br2-fwd rule 10 action 'accept'
-set firewall ipv4 name ip-br2-fwd rule 10 outbound-interface name 'eth0'
- # Requirement: Allow connections to br1
-set firewall ipv4 name ip-br2-fwd rule 20 description 'br2 - allow access to br1'
-set firewall ipv4 name ip-br2-fwd rule 20 action 'accept'
-set firewall ipv4 name ip-br2-fwd rule 20 outbound-interface group 'br1-ifaces'
- # Requirement: Drop all other connections
-set firewall ipv4 name ip-br2-fwd default-action 'drop'
-```
-
-## Validation
-
-While testing the configuration, we can check logs in order to ensure that
-we are accepting and/or blocking the correct traffic.
-
-For example, while a host tries to get an IP address from a DHCP server in
-br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from
-untrusted servers are dropped:
-
-```none
-vyos@bridge:~$ show log firewall bridge
-Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302
-Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
-Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372
-```
-
-And with operational mode commands, we can check rules matchers, actions, and
-counters.
-
-Bridge firewall rulset:
-
-```none
-vyos@bri:~$ show firewall bridge
-Rulesets bridge Information
-
----------------------------------
-bridge Firewall "forward filter"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- -----------------------------------------
-5 accept all 19 1916 ct state { established, related } accept
-10 drop all 0 0 ct state invalid
-110 jump all 2 208 iifname @I_br0-ifaces jump NAME_br0-fwd
-120 jump all 10 670 iifname @I_br1-ifaces jump NAME_br1-fwd
-130 jump all 12 3086 iifname @I_br2-ifaces jump NAME_br2-fwd
-default drop all 0 0
-
----------------------------------
-bridge Firewall "name br0-fwd"
-
-Rule Action Protocol Packets Bytes
-------- -------- ---------- --------- -------
-default accept all 2 208
-
----------------------------------
-bridge Firewall "name br0-pre"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- ----------------------
-10 accept all 18 1872 ether type ip6 accept
-default drop all 9 1476
-
----------------------------------
-bridge Firewall "name br1-fwd"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- ----------------------------------------
-10 accept all 5 250 ether type arp accept
-20 accept all 3 252 ct state new ip saddr 10.1.1.102 accept
-default drop all 2 168
-
----------------------------------
-bridge Firewall "name br1-pre"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- ----------------------------------------------------------------------------------------
-10 drop udp 3 1176 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 prefix "[bri-NAM-br1-pre-10-D]"
-20 drop all 0 0 ether type ip6
-default accept all 58 4430
-
----------------------------------
-bridge Firewall "name br2-fwd"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- ---------------------------------------------------------------
-10 accept udp 4 1312 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 accept
-20 accept udp 2 656 udp sport 67 udp dport 68 iifname "eth6" accept
-22 drop udp 1 322 udp sport 67 udp dport 68 prefix "[bri-NAM-br2-fwd-22-D]"
-30 accept all 2 92 ether type arp accept
-40 accept all 3 704 ether type ip accept
-default drop all 0 0
-
----------------------------------
-bridge Firewall "name br2-pre"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- --------------
-10 drop all 7 728 ether type ip6
-default accept all 77 7548
-
----------------------------------
-bridge Firewall "prerouting filter"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- ----------------------------------------
-10 jump all 27 3348 iifname @I_br0-ifaces jump NAME_br0-pre
-20 jump all 61 5606 iifname @I_br1-ifaces jump NAME_br1-pre
-30 jump all 84 8276 iifname @I_br2-ifaces jump NAME_br2-pre
-default drop all 0 0
-
-vyos@bridge:~$
-```
-
-IPv4 firewall rulset:
-
-```none
-vyos@bridge:~$ show firewall ipv4
-Rulesets ipv4 Information
-
----------------------------------
-ipv4 Firewall "forward filter"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- -------------------------------------------
-5 accept all 76 6384 ct state { established, related } accept
-10 drop all 0 0 ct state invalid
-110 jump all 13 1092 iifname @I_br1-ifaces jump NAME_ip-br1-fwd
-120 jump all 3 252 iifname @I_br2-ifaces jump NAME_ip-br2-fwd
-default drop all 0 0
-
----------------------------------
-ipv4 Firewall "input filter"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- -----------------------------------------
-10 accept all 0 0 ct state { established, related } accept
-20 drop all 0 0 ct state invalid
-110 accept all 10 720 iifname @I_br1-ifaces accept
-120 drop all 26 2672 iifname @I_br2-ifaces
-default accept all 3037 991621
-
----------------------------------
-ipv4 Firewall "name ip-br1-fwd"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- ----------------------
-10 accept all 5 420 oifname "eth0" accept
-default drop all 8 672
-
----------------------------------
-ipv4 Firewall "name ip-br2-fwd"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- -----------------------------
-10 accept all 1 84 oifname "eth0" accept
-20 accept all 2 168 oifname @I_br1-ifaces accept
-default drop all 0 0
-
-vyos@bridge:~$
-```
diff --git a/docs/configexamples/md-index.md b/docs/configexamples/md-index.md
deleted file mode 100644
index 66b3359e..00000000
--- a/docs/configexamples/md-index.md
+++ /dev/null
@@ -1,59 +0,0 @@
-(examples)=
-
-# Configuration Blueprints
-
-This chapter contains various configuration examples:
-
-```{toctree}
-:maxdepth: 2
-
-firewall
-bgp-ipv6-unnumbered
-ospf-unnumbered
-azure-vpn-bgp
-azure-vpn-dual-bgp
-ha
-wan-load-balancing
-pppoe-ipv6-basic
-l3vpn-hub-and-spoke
-lac-lns
-inter-vrf-routing-vrf-lite
-dmvpn-dualhub-dualcloud
-qos
-segment-routing-isis
-nmp
-ansible
-ipsec-cisco-policy-based
-ipsec-cisco-route-based
-ipsec-pa-route-based
-policy-based-ipsec-and-firewall
-site-2-site-cisco
-```
-
-## Configuration Blueprints (autotest)
-
-The next pages contain fully automated configuration examples.
-
-Each lab will build and test from an external script.
-The page content is generated, so changes will not take effect.
-
-A host `vyos-oobm` will be used as an SSH proxy. This host is just
-necessary for the lab tests.
-
-The process will do the following steps:
-1. create the lab on a eve-ng server
-2. configure each host in the lab
-3. do some defined tests
-4. optional do an upgrade to a higher version and do step 3 again.
-5. generate the documentation and include files
-6. shutdown and destroy the lab, if there is no error
-
-```{toctree}
-:maxdepth: 1
-
-autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE
-autotest/tunnelbroker/tunnelbroker
-autotest/L3VPN_EVPN/L3VPN_EVPN
-autotest/Wireguard/Wireguard
-autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP
-```
diff --git a/docs/configexamples/md-lac-lns.md b/docs/configexamples/md-lac-lns.md
deleted file mode 100644
index 1b020924..00000000
--- a/docs/configexamples/md-lac-lns.md
+++ /dev/null
@@ -1,172 +0,0 @@
----
-lastproofread: '2024-02-21'
----
-
-(examples-lac-lns)=
-
-# PPPoE over L2TP
-
-This document is to describe a basic setup using PPPoE over L2TP.
-LAC and LNS are components of the broadband topology.
-LAC - L2TP access concentrator
-LNS - L2TP Network Server
-LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and
-forward them to LNS. LNS is the termination point that comes from PPP packets
-from the remote client.
-
-In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC.
-All users with domain **vyos.io** will be tunneled to LNS via L2TP.
-
-## Network Topology
-
-```{image} /_static/images/lac-lns-diagram.jpg
-:align: center
-:alt: Network Topology Diagram
-:width: 60%
-```
-
-## Configurations
-
-### LAC
-
-```none
-aaa new-model
-!
-aaa authentication ppp default local
-!
-vpdn enable
-vpdn aaa attribute nas-ip-address vpdn-nas
-!
-vpdn-group LAC
- request-dialin
- protocol l2tp
- domain vyos.io
- initiate-to ip 192.168.139.100
- source-ip 192.168.139.101
- local name LAC
- l2tp tunnel password 0 test123
-!
-bba-group pppoe MAIN-BBA
- virtual-template 1
-!
-interface GigabitEthernet0/0
- description To LNS
- ip address 192.168.139.101 255.255.255.0
- duplex auto
- speed auto
- media-type rj45
-!
-interface GigabitEthernet0/1
- description To PPPoE clients
- no ip address
- duplex auto
- speed auto
- media-type rj45
- pppoe enable group MAIN-BBA
-!
-interface Virtual-Template1
- description pppoe MAIN-BBA
- no ip address
- no peer default ip address
- ppp mtu adaptive
- ppp authentication chap
-!
-```
-
-### LNS
-
-```none
-set interfaces ethernet eth0 address '192.168.139.100/24'
-set nat source rule 100 outbound-interface name 'eth0'
-set nat source rule 100 source address '10.0.0.0/24'
-set nat source rule 100 translation address 'masquerade'
-set protocols static route 0.0.0.0/0 next-hop 192.168.139.2
-set vpn l2tp remote-access authentication mode 'radius'
-set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest'
-set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100'
-set vpn l2tp remote-access default-pool 'TEST-POOL'
-set vpn l2tp remote-access gateway-address '10.0.0.1'
-set vpn l2tp remote-access lns host-name 'LAC'
-set vpn l2tp remote-access lns shared-secret 'test123'
-set vpn l2tp remote-access name-server '8.8.8.8'
-set vpn l2tp remote-access ppp-options disable-ccp
-```
-
-:::{note}
-This setup requires the Compression Control Protocol (CCP)
-being disabled, the command `set vpn l2tp remote-access ppp-options disable-ccp`
-accomplishes that.
-:::
-
-### Client
-In this lab we use Windows PPPoE client.
-
-```{image} /_static/images/lac-lns-winclient.jpg
-:align: center
-:alt: Window PPPoE Client Configuration
-:width: 100%
-```
-
-### Monitoring
-Monitoring on LNS side
-
-```none
-vyos@vyos:~$ show l2tp-server sessions
- ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes
---------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+----------
- l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB
-```
-
-Monitoring on LAC side
-
-```none
-Router#show pppoe session
- 1 session in FORWARDED (FWDED) State
- 1 session total
-Uniq ID PPPoE RemMAC Port VT VA State
- SID LocMAC VA-st Type
- 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED
- 0c58.88ac.0001
-
-Router#show l2tp
-L2TP Tunnel and Session Information Total tunnels 1 sessions 1
-
-LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/
- Count VPDN Group
-23238 2640 LAC est 192.168.139.100 1 LAC
-
-LocID RemID TunID Username, Intf/ State Last Chg Uniq ID
- Vcid, Circuit
-25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1
-```
-
-Monitoring on RADIUS Server side
-
-```none
-root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221
-Wed Feb 21 13:37:17 2024
- User-Name = "test@vyos.io"
- NAS-Port = 0
- NAS-Port-Id = "l2tp0"
- NAS-Port-Type = Virtual
- Service-Type = Framed-User
- Framed-Protocol = PPP
- Calling-Station-Id = "192.168.139.101"
- Called-Station-Id = "192.168.139.100"
- Acct-Status-Type = Start
- Acct-Authentic = RADIUS
- Acct-Session-Id = "45c731e169d9a4f1"
- Acct-Session-Time = 0
- Acct-Input-Octets = 0
- Acct-Output-Octets = 0
- Acct-Input-Packets = 0
- Acct-Output-Packets = 0
- Acct-Input-Gigawords = 0
- Acct-Output-Gigawords = 0
- Framed-IP-Address = 10.0.0.2
- NAS-IP-Address = 192.168.139.100
- Event-Timestamp = "Feb 21 2024 13:37:17 UTC"
- Tmp-String-9 = "ai:"
- Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318"
- Timestamp = 1708522637
-```
diff --git a/docs/configexamples/md-nmp.md b/docs/configexamples/md-nmp.md
deleted file mode 100644
index 9c422172..00000000
--- a/docs/configexamples/md-nmp.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-lastproofread: '2023-03-26'
----
-
-(examples-nmp)=
-
-# NMP example
-
-Consider how to quickly set up NMP and VyOS for monitoring.
-NMP is multi-vendor network monitoring from 'SolarWinds' built to
-scale and expand with the needs of your network.
-
-## Configuration 'VyOS'
-
-First prepare our VyOS router for connection to NMP. We have to set
-up the SNMP protocol and connectivity between the router and NMP.
-
-```none
-set interfaces ethernet eth0 address 'dhcp'
-set system name-server '8.8.8.8'
-set service snmp community router authorization 'test'
-set service snmp community router network '0.0.0.0/0'
-```
-
-## Configuration 'NMP'
-
-Next, you just should follow the pictures:
-
-```{image} /_static/images/nmp1.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-```{image} /_static/images/nmp2.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-```{image} /_static/images/nmp3.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-```{image} /_static/images/nmp4.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-```{image} /_static/images/nmp5.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-```{image} /_static/images/nmp6.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-```{image} /_static/images/nmp7.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-In the end, you'll get a powerful instrument for monitoring the VyOS systems.
diff --git a/docs/configexamples/md-ospf-unnumbered.md b/docs/configexamples/md-ospf-unnumbered.md
deleted file mode 100644
index 9c4d5399..00000000
--- a/docs/configexamples/md-ospf-unnumbered.md
+++ /dev/null
@@ -1,117 +0,0 @@
----
-lastproofread: '2021-06-29'
----
-
-(examples-ospf-unnumbered)=
-
-# OSPF unnumbered with ECMP
-
-General information can be found in the {ref}`routing-ospf` chapter.
-
-## Configuration
-
-- Router A:
-
-```none
-set interfaces ethernet eth0 address '10.0.0.1/24'
-set interfaces ethernet eth1 address '192.168.0.1/32'
-set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-set interfaces ethernet eth1 ip ospf network 'point-to-point'
-set interfaces ethernet eth2 address '192.168.0.1/32'
-set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-set interfaces ethernet eth2 ip ospf network 'point-to-point'
-set interfaces loopback lo address '192.168.0.1/32'
-set protocols ospf area 0.0.0.0 authentication 'md5'
-set protocols ospf area 0.0.0.0 network '192.168.0.1/32'
-set protocols ospf parameters router-id '192.168.0.1'
-set protocols ospf redistribute connected
-```
-
-- Router B:
-
-```none
-set interfaces ethernet eth0 address '10.0.0.2/24'
-set interfaces ethernet eth1 address '192.168.0.2/32'
-set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-set interfaces ethernet eth1 ip ospf network 'point-to-point'
-set interfaces ethernet eth2 address '192.168.0.2/32'
-set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword'
-set interfaces ethernet eth2 ip ospf network 'point-to-point'
-set interfaces loopback lo address '192.168.0.2/32'
-set protocols ospf area 0.0.0.0 authentication 'md5'
-set protocols ospf area 0.0.0.0 network '192.168.0.2/32'
-set protocols ospf parameters router-id '192.168.0.2'
-set protocols ospf redistribute connected
-```
-
-## Results
-
-- Router A:
-
-```none
-vyos@vyos:~$ show interfaces
-Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-Interface IP Address S/L Description
---------- ---------- --- -----------
-eth0 10.0.0.1/24 u/u
-eth1 192.168.0.1/32 u/u
-eth2 192.168.0.1/32 u/u
-lo 127.0.0.1/8 u/u
- 192.168.0.1/32
- ::1/128
-```
-
-```none
-vyos@vyos:~$ show ip route
-Codes: K - kernel route, C - connected, S - static, R - RIP,
- O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
- T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
- F - PBR, f - OpenFabric,
- > - selected route, * - FIB route, q - queued route, r - rejected route
-
-S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
-O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21
- via 192.168.0.2, eth2 onlink, 00:13:21
-C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
-O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53
-C * 192.168.0.1/32 is directly connected, eth2, 00:56:31
-C * 192.168.0.1/32 is directly connected, eth1, 00:56:31
-C>* 192.168.0.1/32 is directly connected, lo, 00:57:36
-O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03
- * via 192.168.0.2, eth2 onlink, 00:29:03
-```
-
-- Router B:
-
-```none
-vyos@vyos:~$ show interfaces
-Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-Interface IP Address S/L Description
---------- ---------- --- -----------
-eth0 10.0.0.2/24 u/u
-eth1 192.168.0.2/32 u/u
-eth2 192.168.0.2/32 u/u
-lo 127.0.0.1/8 u/u
- 192.168.0.2/32
- ::1/128
-```
-
-```none
-vyos@vyos:~$ show ip route
-Codes: K - kernel route, C - connected, S - static, R - RIP,
- O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
- T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
- F - PBR, f - OpenFabric,
- > - selected route, * - FIB route, q - queued route, r - rejected route
-
-S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34
-O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21
- via 192.168.0.1, eth2 onlink, 00:13:21
-C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35
-O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53
-C * 192.168.0.2/32 is directly connected, eth2, 00:56:31
-C * 192.168.0.2/32 is directly connected, eth1, 00:56:31
-C>* 192.168.0.2/32 is directly connected, lo, 00:57:36
-O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03
- * via 192.168.0.1, eth2 onlink, 00:29:03
-```
diff --git a/docs/configexamples/md-policy-based-ipsec-and-firewall.md b/docs/configexamples/md-policy-based-ipsec-and-firewall.md
deleted file mode 100644
index 00110117..00000000
--- a/docs/configexamples/md-policy-based-ipsec-and-firewall.md
+++ /dev/null
@@ -1,255 +0,0 @@
-(examples-policy-based-ipsec-and-firewall)=
-
-# Policy-Based Site-to-Site VPN and Firewall Configuration
-
-This guide shows an example policy-based IKEv2 site-to-site VPN between two
-VyOS routers, and firewall configuration.
-
-For simplicity, configuration and tests are done only using IPv4, and firewall
-configuration is done only on one router.
-
-## Network Topology and requirements
-
-This configuration example and the requirements consists of:
-
-- Two VyOS routers with public IP address.
-
-- 2 private subnets on each site.
-
-- Local subnets should be able to reach internet using source NAT.
-
-- Communication between private subnets should be done through IPSec tunnel
- without NAT.
-
-- Configuration of basic firewall in one site, in order to:
-
- > - Protect the router on 'WAN' interface, allowing only IPSec connections
- > and SSH access from trusted IPs.
- > - Allow access to the router only from trusted networks.
- > - Allow DNS requests only only for local networks.
- > - Allow ICMP on all interfaces.
- > - Allow all new connections from local subnets.
- > - Allow connections from LANs to LANs through the tunnel.
-
-```{image} /_static/images/policy-based-ipsec-and-firewall.png
-```
-
-## Configuration
-Interface and routing configuration:
-```none
-# LEFT router:
-set interfaces ethernet eth0 address '198.51.100.14/30'
-set interfaces ethernet eth1 vif 111 address '10.1.11.1/24'
-set interfaces ethernet eth2 vif 112 address '10.1.12.1/24'
-set protocols static route 0.0.0.0/0 next-hop 198.51.100.13
-
-# RIGHT router:
-set interfaces ethernet eth0 address '192.0.2.130/30'
-set interfaces ethernet eth1 vif 221 address '10.2.21.1/24'
-set interfaces ethernet eth2 vif 222 address '10.2.22.1/24'
-```
-IPSec configuration:
-```none
-# LEFT router:
-set vpn ipsec authentication psk RIGHT id '198.51.100.14'
-set vpn ipsec authentication psk RIGHT id '192.0.2.130'
-set vpn ipsec authentication psk RIGHT secret 'p4ssw0rd'
-set vpn ipsec esp-group ESP-GROUP mode 'tunnel'
-set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
-set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'
-set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
-set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
-set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
-set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
-set vpn ipsec interface 'eth0'
-set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret'
-set vpn ipsec site-to-site peer RIGHT connection-type 'initiate'
-set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP'
-set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP'
-set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14'
-set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130'
-set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24'
-set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24'
-set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24'
-set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24'
-set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24'
-set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24'
-set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24'
-set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24'
-
-# RIGHT router:
-set vpn ipsec authentication psk LEFT id '192.0.2.130'
-set vpn ipsec authentication psk LEFT id '198.51.100.14'
-set vpn ipsec authentication psk LEFT secret 'p4ssw0rd'
-set vpn ipsec esp-group ESP-GROUP mode 'tunnel'
-set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256'
-set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256'
-set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2'
-set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14'
-set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256'
-set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
-set vpn ipsec interface 'eth0'
-set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret'
-set vpn ipsec site-to-site peer LEFT connection-type 'none'
-set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP'
-set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP'
-set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130'
-set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14'
-set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24'
-set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24'
-set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24'
-set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24'
-set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24'
-set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24'
-set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24'
-set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24'
-```
-Firewall Configuration:
-```none
-# Firewall Groups:
-set firewall group network-group LOCAL-NETS network '10.1.11.0/24'
-set firewall group network-group LOCAL-NETS network '10.1.12.0/24'
-set firewall group network-group REMOTE-NETS network '10.2.21.0/24'
-set firewall group network-group REMOTE-NETS network '10.2.22.0/24'
-set firewall group network-group TRUSTED network '198.51.100.125/32'
-set firewall group network-group TRUSTED network '203.0.113.0/24'
-set firewall group network-group TRUSTED network '10.1.11.0/24'
-set firewall group network-group TRUSTED network '192.168.70.0/24'
-
-# Forward traffic: default drop and only allow what is needed
-set firewall ipv4 forward filter default-action 'drop'
-
-# Forward traffic: global state policies
-set firewall ipv4 forward filter rule 1 action 'accept'
-set firewall ipv4 forward filter rule 1 state established 'enable'
-set firewall ipv4 forward filter rule 1 state related 'enable'
-set firewall ipv4 forward filter rule 2 action 'drop'
-set firewall ipv4 forward filter rule 2 state invalid 'enable'
-
-# Forward traffic: Accept all connections from local networks
-set firewall ipv4 forward filter rule 10 action 'accept'
-set firewall ipv4 forward filter rule 10 source group network-group 'LOCAL-NETS'
-
-# Forward traffic: accept connections from remote LANs to local LANs
-set firewall ipv4 forward filter rule 20 action 'accept'
-set firewall ipv4 forward filter rule 20 destination group network-group 'LOCAL-NETS'
-set firewall ipv4 forward filter rule 20 source group network-group 'REMOTE-NETS'
-
-# Input traffic: default drop and only allow what is needed
-set firewall ipv4 input filter default-action 'drop'
-
-# Input traffic: global state policies
-set firewall ipv4 input filter rule 1 action 'accept'
-set firewall ipv4 input filter rule 1 state established 'enable'
-set firewall ipv4 input filter rule 1 state related 'enable'
-set firewall ipv4 input filter rule 2 action 'drop'
-set firewall ipv4 input filter rule 2 state invalid 'enable'
-
-# Input traffic: add rules needed for ipsec connection
-set firewall ipv4 input filter rule 10 action 'accept'
-set firewall ipv4 input filter rule 10 destination port '500,4500'
-set firewall ipv4 input filter rule 10 inbound-interface name 'eth0'
-set firewall ipv4 input filter rule 10 protocol 'udp'
-set firewall ipv4 input filter rule 15 action 'accept'
-set firewall ipv4 input filter rule 15 inbound-interface name 'eth0'
-set firewall ipv4 input filter rule 15 protocol 'esp'
-
-# Input traffic: accept ssh connection from trusted ips
-set firewall ipv4 input filter rule 20 action 'accept'
-set firewall ipv4 input filter rule 20 destination port '22'
-set firewall ipv4 input filter rule 20 protocol 'tcp'
-set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED'
-
-# Input traffic: accepd dns requests only from local networks.
-set firewall ipv4 input filter rule 25 action 'accept'
-set firewall ipv4 input filter rule 25 destination port '53'
-set firewall ipv4 input filter rule 25 protocol 'udp'
-set firewall ipv4 input filter rule 25 source group network-group 'LOCAL-NETS'
-
-# Input traffic: allow icmp
-set firewall ipv4 input filter rule 30 action 'accept'
-set firewall ipv4 input filter rule 30 protocol 'icmp'
-```
-And NAT Configuration:
-```none
-set nat source rule 10 destination group network-group 'REMOTE-NETS'
-set nat source rule 10 exclude
-set nat source rule 10 outbound-interface name 'eth0'
-set nat source rule 10 source group network-group 'LOCAL-NETS'
-set nat source rule 20 outbound-interface name 'eth0'
-set nat source rule 20 source group network-group 'LOCAL-NETS'
-set nat source rule 20 translation address 'masquerade'
-```
-## Checking through op-mode commands
-After some testing, we can check IPSec status, and counter on every tunnel:
-```none
-vyos@LEFT:~$ show vpn ipsec sa
-Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal
--------------- ------- -------- -------------- ---------------- ---------------- ----------- ---------------------------------------
-RIGHT-tunnel-0 up 36m24s 840B/840B 10/10 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
-RIGHT-tunnel-1 up 36m33s 588B/588B 7/7 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
-RIGHT-tunnel-2 up 35m50s 1K/1K 15/15 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
-RIGHT-tunnel-3 up 36m54s 2K/2K 32/32 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048
-vyos@LEFT:~$
-```
-Also, we can check firewall counters:
-```none
-vyos@LEFT:~$ show firewall
-Rulesets Information
-
----------------------------------
-IPv4 Firewall "forward filter"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- ------------------------------------------------------
-1 accept all 681 96545 ct state { established, related } accept
-2 drop all 0 0 ct state invalid
-10 accept all 360 27205 ip saddr @N_LOCAL-NETS accept
-20 accept all 8 648 ip daddr @N_LOCAL-NETS ip saddr @N_REMOTE-NETS accept
-default drop all
-
----------------------------------
-IPv4 Firewall "input filter"
-
-Rule Action Protocol Packets Bytes Conditions
-------- -------- ---------- --------- ------- ----------------------------------------------
-1 accept all 901 123709 ct state { established, related } accept
-2 drop all 0 0 ct state invalid
-10 accept udp 0 0 udp dport { 500, 4500 } iifname "eth0" accept
-15 accept esp 0 0 meta l4proto esp iifname "eth0" accept
-20 accept tcp 1 60 tcp dport 22 ip saddr @N_TRUSTED accept
-25 accept udp 0 0 udp dport 53 ip saddr @N_LOCAL-NETS accept
-30 accept icmp 0 0 meta l4proto icmp accept
-default drop all
-
-vyos@LEFT:~$
-vyos@LEFT:~$ show firewall statistics
-Rulesets Statistics
-
----------------------------------
-IPv4 Firewall "forward filter"
-
-Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface
-------- --------- ------- -------- ----------- ------------- ------------------- --------------------
-1 681 96545 accept any any any any
-2 0 0 drop any any any any
-10 360 27205 accept LOCAL-NETS any any any
-20 8 648 accept REMOTE-NETS LOCAL-NETS any any
-default N/A N/A drop any any any any
-
----------------------------------
-IPv4 Firewall "input filter"
-
-Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface
-------- --------- ------- -------- ---------- ------------- ------------------- --------------------
-1 905 124213 accept any any any any
-2 0 0 drop any any any any
-10 0 0 accept any any eth0 any
-15 0 0 accept any any eth0 any
-20 1 60 accept TRUSTED any any any
-25 0 0 accept LOCAL-NETS any any any
-30 0 0 accept any any any any
-default N/A N/A drop any any any any
-
-vyos@LEFT:~$
-```
diff --git a/docs/configexamples/md-segment-routing-isis.md b/docs/configexamples/md-segment-routing-isis.md
deleted file mode 100644
index 76cb726c..00000000
--- a/docs/configexamples/md-segment-routing-isis.md
+++ /dev/null
@@ -1,277 +0,0 @@
----
-lastproofread: '2023-04-10'
----
-
-(examples-segment-routing-isis)=
-
-# Segment-routing IS-IS example
-
-When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this
-blue print as an initial setup to get MPLS ISIS-SR working between those two
-devices.The lab was build using {abbr}`EVE-NG (Emulated Virtual
-Environment NG)`.
-
-:::{figure} /_static/images/vyos-sr-isis.png
-:alt: ISIS-SR network
-
-ISIS-SR example network
-:::
-
-The below configuration is used as example where we keep focus on
-VyOS-P1/VyOS-P2/XRv-P3 which we share the settings.
-
-## Configuration
-
-- VyOS-P1:
-
-```none
-set interfaces dummy dum0 address '192.0.2.1/32'
-set interfaces ethernet eth1 address '192.0.2.5/30'
-set interfaces ethernet eth1 mtu '8000'
-set interfaces ethernet eth3 address '192.0.2.21/30'
-set interfaces ethernet eth3 mtu '8000'
-set protocols isis interface dum0 passive
-set protocols isis interface eth1 network point-to-point
-set protocols isis interface eth3 network point-to-point
-set protocols isis level 'level-2'
-set protocols isis log-adjacency-changes
-set protocols isis metric-style 'wide'
-set protocols isis net '49.0000.0000.0000.0001.00'
-set protocols isis segment-routing maximum-label-depth '8'
-set protocols isis segment-routing prefix 192.0.2.1/32 index value '1'
-set protocols mpls interface 'eth1'
-set protocols mpls interface 'eth3'
-set system host-name 'P1-VyOS'
-```
-
-- XRv-P3:
-
-```none
-hostname P3-VyOS
-interface Loopback0
- ipv4 address 192.0.2.3 255.255.255.255
-!
-interface GigabitEthernet0/0/0/1
- mtu 8014
- ipv4 address 192.0.2.6 255.255.255.252
-!
-interface GigabitEthernet0/0/0/2
- mtu 8014
- ipv4 address 192.0.2.18 255.255.255.252
-!
-router isis VyOS
- is-type level-2-only
- net 49.0000.0000.0000.0003.00
- log adjacency changes
- address-family ipv4 unicast
- metric-style wide
- segment-routing mpls
- !
- interface Loopback0
- passive
- address-family ipv4 unicast
- prefix-sid index 3
- !
- !
- interface GigabitEthernet0/0/0/1
- point-to-point
- address-family ipv4 unicast
- !
- !
- interface GigabitEthernet0/0/0/2
- point-to-point
- address-family ipv4 unicast
- !
- !
-!
-```
-
-- VyOS-P2:
-
-```none
-set interfaces dummy dum0 address '192.0.2.2/32'
-set interfaces ethernet eth2 address '192.0.2.17/30'
-set interfaces ethernet eth2 mtu '8000'
-set interfaces ethernet eth3 address '192.0.2.26/30'
-set interfaces ethernet eth3 mtu '8000'
-set protocols isis interface dum0 passive
-set protocols isis interface eth2 network point-to-point
-set protocols isis interface eth3 network point-to-point
-set protocols isis level 'level-2'
-set protocols isis log-adjacency-changes
-set protocols isis metric-style 'wide'
-set protocols isis net '49.0000.0000.0000.0002.00'
-set protocols isis segment-routing maximum-label-depth '8'
-set protocols isis segment-routing prefix 192.0.2.2/32 index value '2'
-set protocols mpls interface 'eth2'
-set protocols mpls interface 'eth3'
-set system host-name 'P2-VyOS'
-```
-
-This gives us MPLS segment routing enabled and labels forwarding :
-
-```none
-vyos@P1-VyOS:~$ show mpls table
-Inbound Label Type Nexthop Outbound Label
------------------------------------------------------------------
-15000 SR (IS-IS) 192.0.2.6 implicit-null
-15001 SR (IS-IS) 192.0.2.22 implicit-null
-15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null
-16002 SR (IS-IS) 192.0.2.6 16002
-16003 SR (IS-IS) 192.0.2.6 implicit-null
-16011 SR (IS-IS) 192.0.2.22 implicit-null
-
-vyos@P2-VyOS:~$ show mpls table
-Inbound Label Type Nexthop Outbound Label
--------------------------------------------------------
-15000 SR (IS-IS) 192.0.2.18 implicit-null
-16001 SR (IS-IS) 192.0.2.18 16001
-16003 SR (IS-IS) 192.0.2.18 implicit-null
-16011 SR (IS-IS) 192.0.2.18 16011
-
-RP/0/0/CPU0:P3-VyOS#show mpls forwarding
-Tue Mar 28 17:47:18.928 UTC
-Local Outgoing Prefix Outgoing Next Hop Bytes
-Label Label or ID Interface Switched
------- ----------- ------------------ ------------ --------------- ------------
-16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0
-16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0
-16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0
-24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0
-24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0
-24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0
-24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0
-```
-
-VyOS is able to check MSD per devices:
-
-```none
-vyos@P1-VyOS:~$ show isis segment-routing node
-Area VyOS:
-IS-IS L1 SR-Nodes:
-
-IS-IS L2 SR-Nodes:
-
-System ID SRGB SRLB Algorithm MSD
----------------------------------------------------------------
-0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8
-0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8
-0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10
-0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8
-
-vyos@P2-VyOS:~$ show isis segment-routing node
-Area VyOS:
- IS-IS L1 SR-Nodes:
-
- IS-IS L2 SR-Nodes:
-
- System ID SRGB SRLB Algorithm MSD
- ---------------------------------------------------------------
- 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8
- 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8
- 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10
- 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8
-```
-
-Here is the routing tables showing the MPLS segment routing label operations:
-
-```none
-vyos@P1-VyOS:~$ show ip route isis
-Codes: K - kernel route, C - connected, S - static, R - RIP,
- O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
- T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
- f - OpenFabric,
- > - selected route, * - FIB route, q - queued, r - rejected, b - backup
- t - trapped, o - offload failure
-
-I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m
-I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m
-I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m
-I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m
-I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m
-I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m
-I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m
-
-
-vyos@P2-VyOS:~$ show ip route isis
-Codes: K - kernel route, C - connected, S - static, R - RIP,
- O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
- T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
- f - OpenFabric,
- > - selected route, * - FIB route, q - queued, r - rejected, b - backup
- t - trapped, o - offload failure
-
-I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m
-I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m
-I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m
-I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m
-I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m
-I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m
-
-RP/0/0/CPU0:P3-VyOS#show route isis
-Tue Mar 28 18:19:16.417 UTC
-
-i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1
-i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2
-i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1
-i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1
-i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2
-```
-
-Information about prefix-sid and label-operation from VyOS
-
-```none
-vyos@P1-VyOS:~$ show isis route prefix-sid
-Area VyOS:
-IS-IS L2 IPv4 routing table:
-
- Prefix Metric Interface Nexthop SID Label Op.
- ----------------------------------------------------------------------
- 192.0.2.1/32 0 - - - -
- 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002)
- 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003)
- 192.0.2.4/30 20 eth1 192.0.2.6 - -
- 192.0.2.16/30 20 eth1 192.0.2.6 - -
- 192.0.2.20/30 0 - - - -
- 192.0.2.24/30 30 eth1 192.0.2.6 - -
-
- vyos@P2-VyOS:~$ show isis route prefix-sid
- Area VyOS:
- IS-IS L2 IPv4 routing table:
-
- Prefix Metric Interface Nexthop SID Label Op.
- -----------------------------------------------------------------------
- 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001)
- 192.0.2.2/32 0 - - - -
- 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003)
- 192.0.2.4/30 20 eth2 192.0.2.18 - -
- 192.0.2.16/30 20 eth2 192.0.2.18 - -
- 192.0.2.20/30 30 eth2 192.0.2.18 - -
- 192.0.2.24/30 0 - - - -
-```
-
-Ping between VyOS-P1 / VyOS-P2 to confirm reachability:
-
-```none
-vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1
-PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data.
-64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms
-64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms
-64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms
-64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms
-^C
---- 192.0.2.2 ping statistics ---
-4 packets transmitted, 4 received, 0% packet loss, time 3004ms
-rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms
-
-vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2
-PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data.
-64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms
-64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms
-64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms
-64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms
-^C
---- 192.0.2.1 ping statistics ---
-4 packets transmitted, 4 received, 0% packet loss, time 3005ms
-rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms
-```
diff --git a/docs/configexamples/md-site-2-site-cisco.md b/docs/configexamples/md-site-2-site-cisco.md
deleted file mode 100644
index a3b33d21..00000000
--- a/docs/configexamples/md-site-2-site-cisco.md
+++ /dev/null
@@ -1,167 +0,0 @@
-(examples-site-2-site-cisco)=
-
-# Site-to-Site IPSec VPN to Cisco using FlexVPN
-
-This guide shows a sample configuration for FlexVPN site-to-site Internet
-Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel.
-
-FlexVPN is a newer "solution" for deployment of VPNs and it utilizes IKEv2 as
-the key exchange protocol. The result is a flexible and scalable VPN solution
-that can be easily adapted to fit various network needs. It can also support a
-variety of encryption methods, including AES and 3DES.
-
-The lab was built using EVE-NG.
-
-## Configuration
-
-### VyOS
-
-- GRE:
-
-```none
-set interfaces tunnel tun1 encapsulation 'gre'
-set interfaces tunnel tun1 ip adjust-mss '1336'
-set interfaces tunnel tun1 mtu '1376'
-set interfaces tunnel tun1 remote '10.1.1.6'
-set interfaces tunnel tun1 source-address '198.51.100.1'
-```
-
-- IPsec:
-
-```none
-set vpn ipsec authentication psk vyos_cisco_l id 'vyos.net’
-set vpn ipsec authentication psk vyos_cisco_l id 'cisco.hub.net'
-set vpn ipsec authentication psk vyos_cisco_l secret 'secret'
-set vpn ipsec esp-group e1 lifetime '3600'
-set vpn ipsec esp-group e1 mode 'tunnel'
-set vpn ipsec esp-group e1 pfs 'disable'
-set vpn ipsec esp-group e1 proposal 1 encryption 'aes128'
-set vpn ipsec esp-group e1 proposal 1 hash 'sha256'
-set vpn ipsec ike-group i1 key-exchange 'ikev2'
-set vpn ipsec ike-group i1 lifetime '28800'
-set vpn ipsec ike-group i1 proposal 1 dh-group '5'
-set vpn ipsec ike-group i1 proposal 1 encryption 'aes256'
-set vpn ipsec ike-group i1 proposal 1 hash 'sha256'
-set vpn ipsec interface 'eth2'
-set vpn ipsec options disable-route-autoinstall
-set vpn ipsec options flexvpn
-set vpn ipsec options interface 'tun1'
-set vpn ipsec options virtual-ip
-set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net'
-set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret'
-set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net'
-set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
-set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
-set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
-set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1'
-set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
-set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32'
-set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
-set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
-set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'
-```
-
-### Cisco
-
-```none
-aaa new-model
-!
-!
-aaa authorization network default local
-!
-crypto ikev2 name-mangler GET_DOMAIN
- fqdn all
- email all
-!
-!
-crypto ikev2 authorization policy vyos
- pool mypool
- aaa attribute list mylist
- route set interface
- route accept any tag 100 distance 5
-!
-crypto ikev2 keyring mykeys
- peer peer1
- identity fqdn vyos.net
- pre-shared-key local secret
- pre-shared-key remote secret
-crypto ikev2 profile my_profile
- match identity remote fqdn vyos.net
- identity local fqdn cisco.hub.net
- authentication remote pre-share
- authentication local pre-share
- keyring local mykeys
- dpd 10 3 periodic
- aaa authorization group psk list local name-mangler GET_DOMAIN
- aaa authorization user psk cached
- virtual-template 1
-!
-!
-!
-crypto ipsec transform-set TSET esp-aes esp-sha256-hmac
- mode tunnel
-!
-!
-crypto ipsec profile my-ipsec-profile
- set transform-set TSET
- set ikev2-profile my_profile
-!
-interface Virtual-Template1 type tunnel
- no ip address
- ip mtu 1376
- ip nhrp network-id 1
- ip nhrp shortcut virtual-template 1
- ip tcp adjust-mss 1336
- tunnel path-mtu-discovery
- tunnel protection ipsec profile my-ipsec-profile
- !
- ip local pool my_pool 172.16.122.1 172.16.122.254
-```
-
-Since the tunnel is a point-to-point GRE tunnel, it behaves like any other
-point-to-point interface (for example: serial, dialer), and it is possible to
-run any Interior Gateway Protocol (IGP)/Exterior Gateway Protocol (EGP) over
-the link in order to exchange routing information
-
-## Verification
-
-```none
-vyos@vyos$ show interfaces
-Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
-Interface IP Address S/L Description
---------- ---------- --- -----------
-eth0 - u/u
-eth1 - u/u
-eth2 198.51.100.1/24 u/u
-eth3 172.16.1.2/24 u/u
-lo 127.0.0.1/8 u/u
- ::1/128
-tun1 172.16.122.2/32 u/u
-vyos@vyos:~$ show vpn ipsec sa
-Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal
------------------- ------- -------- -------------- ---------------- ---------------- --------------------- -----------------------------
-cisco_hub-tunnel-1 up 44m17s 35K/31K 382/367 10.1.1.6 cisco.hub.net AES_CBC_128/HMAC_SHA2_256_128
-
-
-Hub#sh crypto ikev2 sa detailed
- IPv4 Crypto IKEv2 SA
-Tunnel-id Local Remote fvrf/ivrf Status
-5 10.1.1.6/4500 198.51.100.1/4500 none/none READY
- Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK
- Life/Active Time: 86400/2694 sec
- CE id: 0, Session-id: 2
- Status Description: Negotiation done
- Local spi: C94EE2DC92A60C47 Remote spi: 9AF0EF151BECF14C
- Local id: cisco.hub.net
- Remote id: vyos.net
- Local req msg id: 269 Remote req msg id: 0
- Local next msg id: 269 Remote next msg id: 0
- Local req queued: 269 Remote req queued: 0
- Local window: 5 Remote window: 1
- DPD configured for 10 seconds, retry 3
- Fragmentation not configured.
- Extended Authentication not configured.
- NAT-T is not detected
- Cisco Trust Security SGT is disabled
- Assigned host addr: 172.16.122.2
-```
diff --git a/docs/configexamples/md-wan-load-balancing.md b/docs/configexamples/md-wan-load-balancing.md
deleted file mode 100644
index 21c78f2a..00000000
--- a/docs/configexamples/md-wan-load-balancing.md
+++ /dev/null
@@ -1,158 +0,0 @@
----
-lastproofread: '2021-06-29'
----
-
-(wan-load-balancing)=
-
-
-# WAN Load Balancer examples
-
-## Example 1: Distributing load evenly
-
-The setup used in this example is shown in the following diagram:
-
-```{image} /_static/images/Wan_load_balancing1.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-### Overview
-> - All traffic coming in through eth2 is balanced between eth0 and eth1
-> on the router.
-> - Pings will be sent to four targets for health testing (33.44.55.66,
-> 44.55.66.77, 55.66.77.88 and 66.77.88.99).
-> - All outgoing packets are assigned the source address of the assigned
-> interface (SNAT).
-> - eth0 is set to be removed from the load balancer's interface pool
-> after 5 ping failures, eth1 will be removed after 4 ping failures.
-
-### Create static routes to ping targets
-Create static routes through the two ISPs towards the ping targets and
-commit the changes:
-
-```none
-set protocols static route 33.44.55.66/32 next-hop 11.22.33.1
-set protocols static route 44.55.66.77/32 next-hop 11.22.33.1
-set protocols static route 55.66.77.88/32 next-hop 22.33.44.1
-set protocols static route 66.77.88.99/32 next-hop 22.33.44.1
-```
-
-### Configure the load balancer
-Configure the WAN load balancer with the parameters described above:
-
-```none
-set load-balancing wan interface-health eth0 failure-count 5
-set load-balancing wan interface-health eth0 nexthop 11.22.33.1
-set load-balancing wan interface-health eth0 test 10 type ping
-set load-balancing wan interface-health eth0 test 10 target 33.44.55.66
-set load-balancing wan interface-health eth0 test 20 type ping
-set load-balancing wan interface-health eth0 test 20 target 44.55.66.77
-set load-balancing wan interface-health eth1 failure-count 4
-set load-balancing wan interface-health eth1 nexthop 22.33.44.1
-set load-balancing wan interface-health eth1 test 10 type ping
-set load-balancing wan interface-health eth1 test 10 target 55.66.77.88
-set load-balancing wan interface-health eth1 test 20 type ping
-set load-balancing wan interface-health eth1 test 20 target 66.77.88.99
-set load-balancing wan rule 10 inbound-interface eth2
-set load-balancing wan rule 10 interface eth0
-set load-balancing wan rule 10 interface eth1
-```
-
-## Example 2: Failover based on interface weights
-This example uses the failover mode.
-(wan-example2-overview)=
-
-### Overview
-In this example, eth0 is the primary interface and eth1 is the secondary
-interface. To provide simple failover functionality. If eth0 fails, eth1
-takes over.
-
-### Create interface weight based configuration
-The configuration steps are the same as in the previous example, except
-rule 10. So we keep the configuration, remove rule 10 and add a new rule
-for the failover mode:
-
-```none
-delete load-balancing wan rule 10
-set load-balancing wan rule 10 failover
-set load-balancing wan rule 10 inbound-interface eth2
-set load-balancing wan rule 10 interface eth0 weight 10
-set load-balancing wan rule 10 interface eth1 weight 1
-```
-
-## Example 3: Failover based on rule order
-The previous example used the failover command to send traffic through
-eth1 if eth0 fails. In this example, failover functionality is provided
-by rule order.
-(wan-example3-overview)=
-
-### Overview
-Two rules will be created, the first rule directs traffic coming in
-from eth2 to eth0 and the second rule directs the traffic to eth1. If
-eth0 fails the first rule is bypassed and the second rule matches,
-directing traffic to eth1.
-
-### Create rule order based configuration
-We keep the configuration from the previous example, delete rule 10
-and create the two new rules as described:
-
-```none
-delete load-balancing wan rule 10
-set load-balancing wan rule 10 inbound-interface eth2
-set load-balancing wan rule 10 interface eth0
-set load-balancing wan rule 20 inbound-interface eth2
-set load-balancing wan rule 20 interface eth1
-```
-
-## Example 4: Failover based on rule order - priority traffic
-A rule order for prioritizing traffic is useful in scenarios where the
-secondary link has a lower speed and should only carry high priority
-traffic. It is assumed for this example that eth1 is connected to a
-slower connection than eth0 and should prioritize VoIP traffic.
-(wan-example4-overview)=
-
-### Overview
-A rule order for prioritizing traffic is useful in scenarios where the
-secondary link has a lower speed and should only carry high priority
-traffic. It is assumed for this example that eth1 is connected to a
-slower connection than eth0 and should prioritize VoIP traffic.
-
-### Create rule order based configuration with low speed secondary link
-We keep the configuration from the previous example, delete rule 20 and
-create a new rule as described:
-
-```none
-delete load-balancing wan rule 20
-set load-balancing wan rule 20 inbound-interface eth2
-set load-balancing wan rule 20 interface eth1
-set load-balancing wan rule 20 destination port sip
-set load-balancing wan rule 20 protocol tcp
-set protocols static route 0.0.0.0/0 next-hop 11.22.33.1
-```
-
-## Example 5: Exclude traffic from load balancing
-In this example two LAN interfaces exist in different subnets instead
-of one like in the previous examples:
-
-```{image} /_static/images/Wan_load_balancing_exclude1.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-### Adding a rule for the second interface
-Based on the previous example, another rule for traffic from the second
-interface eth3 can be added to the load balancer. However, traffic meant
-to flow between the LAN subnets will be sent to eth0 and eth1 as well.
-To prevent this, another rule is required. This rule excludes traffic
-between the local subnets from the load balancer. It also excludes
-locally-sources packets (required for web caching with load balancing).
-eth+ is used as an alias that refers to all ethernet interfaces:
-
-```none
-set load-balancing wan rule 5 exclude
-set load-balancing wan rule 5 inbound-interface eth+
-set load-balancing wan rule 5 destination address 10.0.0.0/8
-```
-
diff --git a/docs/configexamples/md-zone-policy.md b/docs/configexamples/md-zone-policy.md
deleted file mode 100644
index 6018e7fe..00000000
--- a/docs/configexamples/md-zone-policy.md
+++ /dev/null
@@ -1,413 +0,0 @@
----
-lastproofread: '2024-06-14'
----
-
-(examples-zone-policy)=
-
-# Zone-Policy example
-
-:::{note}
-In {vytask}`T2199` the syntax of the zone configuration was changed.
-The zone configuration moved from `zone-policy zone <name>` to `firewall
-zone <name>`.
-:::
-
-## Native IPv4 and IPv6
-
-We have three networks.
-
-```none
-WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64
-LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64
-DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64
-```
-
-**This specific example is for a router on a stick, but is very easily
-adapted for however many NICs you have**:
-
-- Internet - 192.168.200.100 - TCP/80
-- Internet - 192.168.200.100 - TCP/443
-- Internet - 192.168.200.100 - TCP/25
-- Internet - 192.168.200.100 - TCP/53
-- VyOS acts as DHCP, DNS forwarder, NAT, router and firewall.
-- 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web
- and mail (SMTP/IMAP) server.
-- 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It
- can SSH to VyOS.
-- LAN and DMZ hosts have basic outbound access: Web, FTP, SSH.
-- LAN can access DMZ resources.
-- DMZ cannot access LAN resources.
-- Inbound WAN connect to DMZ host.
-
-```{image} /_static/images/zone-policy-diagram.png
-:align: center
-:alt: Network Topology Diagram
-:width: 80%
-```
-
-The VyOS interface is assigned the .1/:1 address of their respective
-networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30.
-
-It will look something like this:
-
-```none
-interfaces {
- ethernet eth0 {
- duplex auto
- hw-id 00:53:ed:6e:2a:92
- smp_affinity auto
- speed auto
- vif 10 {
- address 172.16.10.1/24
- address 2001:db8:0:9999::1/64
- }
- vif 20 {
- address 192.168.100.1/24
- address 2001:db8:0:AAAA::1/64
- }
- vif 30 {
- address 192.168.200.1/24
- address 2001:db8:0:BBBB::1/64
- }
- }
- loopback lo {
- }
-}
-```
-
-## Zones Basics
-Each interface is assigned to a zone. The interface can be physical or
-virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly
-the same.
-
-Traffic flows from zone A to zone B. That flow is what I refer to as a
-zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations.
-
-Ruleset are created per zone-pair-direction.
-
-I name rule sets to indicate which zone-pair-direction they represent.
-eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN.
-
-In VyOS, you have to have unique Ruleset names. In the event of overlap,
-I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This
-allows for each auto-completion and uniqueness.
-
-In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is
-the firewall itself.
-
-If your computer is on the LAN and you need to SSH into your VyOS box,
-you would need a rule to allow it in the LAN-Local ruleset. If you want
-to access a webpage from your VyOS box, you need a rule to allow it in
-the Local-LAN ruleset.
-
-In rules, it is good to keep them named consistently. As the number of
-rules you have grows, the more consistency you have, the easier your
-life will be.
-
-```none
-Rule 1 - State Established, Related
-Rule 2 - State Invalid
-Rule 100 - ICMP
-Rule 200 - Web
-Rule 300 - FTP
-Rule 400 - NTP
-Rule 500 - SMTP
-Rule 600 - DNS
-Rule 700 - DHCP
-Rule 800 - SSH
-Rule 900 - IMAPS
-```
-
-The first two rules are to deal with the idiosyncrasies of VyOS and
-iptables.
-
-Zones and Rulesets both have a default action statement. When using
-Zone-Policies, the default action is set by the zone-policy statement
-and is represented by rule 10000.
-
-It is good practice to log both accepted and denied traffic. It can save
-you significant headaches when trying to troubleshoot a connectivity
-issue.
-
-To add logging to the default rule, do:
-
-```none
-set firewall name <ruleSet> default-log
-```
-
-By default, iptables does not allow traffic for established sessions to
-return, so you must explicitly allow this. I do this by adding two rules
-to every ruleset. 1 allows established and related state packets through
-and rule 2 drops and logs invalid state packets. We place the
-established/related rule at the top because the vast majority of traffic
-on a network is established and the invalid rule to prevent invalid
-state packets from mistakenly being matched against other rules. Having
-the most matched rule listed first reduces CPU load in high volume
-environments. Note: I have filed a bug to have this added as a default
-action as well.
-
-''It is important to note, that you do not want to add logging to the
-established state rule as you will be logging both the inbound and
-outbound packets for each session instead of just the initiation of the
-session. Your logs will be massive in a very short period of time.''
-
-In VyOS you must have the interfaces created before you can apply it to
-the zone and the rulesets must be created prior to applying it to a
-zone-policy.
-
-I create/configure the interfaces first. Build out the rulesets for each
-zone-pair-direction which includes at least the three state rules. Then
-I setup the zone-policies.
-
-Zones do not allow for a default action of accept; either drop or
-reject. It is important to remember this because if you apply an
-interface to a zone and commit, any active connections will be dropped.
-Specifically, if you are SSH’d into VyOS and add local or the interface
-you are connecting through to a zone and do not have rulesets in place
-to allow SSH and established sessions, you will not be able to connect.
-
-The following are the rules that were created for this example (may not
-be complete), both in IPv4 and IPv6. If there is no IP specified, then
-the source/destination address is not explicit.
-
-```none
-WAN - DMZ:192.168.200.200 - tcp/80
-WAN - DMZ:192.168.200.200 - tcp/443
-WAN - DMZ:192.168.200.200 - tcp/25
-WAN - DMZ:192.168.200.200 - tcp/53
-WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80
-WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443
-WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25
-WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53
-
-DMZ - Local - tcp/53
-DMZ - Local - tcp/123
-DMZ - Local - tcp/67,68
-
-LAN - Local - tcp/53
-LAN - Local - tcp/123
-LAN - Local - tcp/67,68
-LAN:192.168.100.10 - Local - tcp/22
-LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22
-
-LAN - WAN - tcp/80
-LAN - WAN - tcp/443
-LAN - WAN - tcp/22
-LAN - WAN - tcp/20,21
-
-DMZ - WAN - tcp/80
-DMZ - WAN - tcp/443
-DMZ - WAN - tcp/22
-DMZ - WAN - tcp/20,21
-DMZ - WAN - tcp/53
-DMZ - WAN - udp/53
-
-Local - WAN - tcp/80
-Local - WAN - tcp/443
-Local - WAN - tcp/20,21
-
-Local - DMZ - tcp/25
-Local - DMZ - tcp/67,68
-Local - DMZ - tcp/53
-Local - DMZ - udp/53
-
-Local - LAN - tcp/67,68
-
-LAN - DMZ - tcp/80
-LAN - DMZ - tcp/443
-LAN - DMZ - tcp/993
-LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22
-LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22
-```
-
-Since we have 4 zones, we need to setup the following rulesets.
-
-```none
-Lan-wan
-Lan-local
-Lan-dmz
-Wan-lan
-Wan-local
-Wan-dmz
-Local-lan
-Local-wan
-Local-dmz
-Dmz-lan
-Dmz-wan
-Dmz-local
-```
-
-Even if the two zones will never communicate, it is a good idea to
-create the zone-pair-direction rulesets and set default-log. This
-will allow you to log attempts to access the networks. Without it, you
-will never see the connection attempts.
-
-This is an example of the three base rules.
-
-```none
-name wan-lan {
- default-action drop
- default-log
- rule 1 {
- action accept
- state {
- established enable
- related enable
- }
- }
- rule 2 {
- action drop
- log enable
- state {
- invalid enable
- }
- }
-}
-```
-
-Here is an example of an IPv6 DMZ-WAN ruleset.
-
-```none
-ipv6-name dmz-wan-6 {
- default-action drop
- default-log
- rule 1 {
- action accept
- state {
- established enable
- related enable
- }
- }
- rule 2 {
- action drop
- log enable
- state {
- invalid enable
- }
- rule 100 {
- action accept
- log enable
- protocol ipv6-icmp
- }
- rule 200 {
- action accept
- destination {
- port 80,443
- }
- log enable
- protocol tcp
- }
- rule 300 {
- action accept
- destination {
- port 20,21
- }
- log enable
- protocol tcp
- }
- rule 500 {
- action accept
- destination {
- port 25
- }
- log enable
- protocol tcp
- source {
- address 2001:db8:0:BBBB::200
- }
- }
- rule 600 {
- action accept
- destination {
- port 53
- }
- log enable
- protocol tcp_udp
- source {
- address 2001:db8:0:BBBB::200
- }
- }
- rule 800 {
- action accept
- destination {
- port 22
- }
- log enable
- protocol tcp
- }
-}
-```
-
-Once you have all of your rulesets built, then you need to create your
-zone-policy.
-
-Start by setting the interface and default action for each zone.
-
-```none
-set firewall zone dmz default-action drop
-set firewall zone dmz interface eth0.30
-```
-
-In this case, we are setting the v6 ruleset that represents traffic
-sourced from the LAN, destined for the DMZ. Because the zone-policy
-firewall syntax is a little awkward, I keep it straight by thinking of
-it backwards.
-
-```none
-set firewall zone dmz from lan firewall ipv6-name lan-dmz-6
-```
-
-DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out
-a bunch at one time.
-
-In the end, you will end up with something like this config. I took out
-everything but the Firewall, Interfaces, and zone-policy sections. It is
-long enough as is.
-
-## IPv6 Tunnel
-If you are using a IPv6 tunnel from HE.net or someone else, the basis is
-the same except you have two WAN interfaces. One for v4 and one for v6.
-
-You would have 5 zones instead of just 4 and you would configure your v6
-ruleset between your tunnel interface and your LAN/DMZ zones instead of
-to the WAN.
-
-LAN, WAN, DMZ, local and TUN (tunnel)
-
-v6 pairs would be:
-
-```none
-lan-tun
-lan-local
-lan-dmz
-tun-lan
-tun-local
-tun-dmz
-local-lan
-local-tun
-local-dmz
-dmz-lan
-dmz-tun
-dmz-local
-```
-
-Notice, none go to WAN since WAN wouldn't have a v6 address on it.
-
-You would have to add a couple of rules on your wan-local ruleset to
-allow protocol 41 in.
-
-Something like:
-
-```none
-rule 400 {
- action accept
- destination {
- address 172.16.10.1
- }
- log enable
- protocol 41
- source {
- address ip.of.tunnel.broker
- }
-}
-```
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-14 14:36:01 +0000