T6732: added same as vyos 1x

116 files changed, 22469 insertions, 0 deletions

diff --git a/src/conf_mode/container.py b/src/conf_mode/container.py
new file mode 100644
index 0000000..14387cb
--- /dev/null
+++ b/src/conf_mode/container.py
@@ -0,0 +1,525 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from decimal import Decimal
+from hashlib import sha256
+from ipaddress import ip_address
+from ipaddress import ip_network
+from json import dumps as json_write
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import Interface
+from vyos.utils.cpu import get_core_count
+from vyos.utils.file import write_file
+from vyos.utils.process import call
+from vyos.utils.process import cmd
+from vyos.utils.process import run
+from vyos.utils.network import interface_exists
+from vyos.template import bracketize_ipv6
+from vyos.template import inc_ip
+from vyos.template import is_ipv4
+from vyos.template import is_ipv6
+from vyos.template import render
+from vyos.xml_ref import default_value
+from vyos import ConfigError
+from vyos import airbag
+
+airbag.enable()
+
+config_containers = '/etc/containers/containers.conf'
+config_registry = '/etc/containers/registries.conf'
+config_storage = '/etc/containers/storage.conf'
+systemd_unit_path = '/run/systemd/system'
+
+
+def _cmd(command):
+    if os.path.exists('/tmp/vyos.container.debug'):
+        print(command)
+    return cmd(command)
+
+
+def network_exists(name):
+    # Check explicit name for network, returns True if network exists
+    c = _cmd(f'podman network ls --quiet --filter name=^{name}$')
+    return bool(c)
+
+
+# Common functions
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['container']
+    container = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                     no_tag_node_value_mangle=True,
+                                     get_first_key=True,
+                                     with_recursive_defaults=True)
+
+    for name in container.get('name', []):
+        # T5047: Any container related configuration changed? We only
+        # wan't to restart the required containers and not all of them ...
+        tmp = is_node_changed(conf, base + ['name', name])
+        if tmp:
+            if 'container_restart' not in container:
+                container['container_restart'] = [name]
+            else:
+                container['container_restart'].append(name)
+
+    # registry is a tagNode with default values - merge the list from
+    # default_values['registry'] into the tagNode variables
+    if 'registry' not in container:
+        container.update({'registry': {}})
+        default_values = default_value(base + ['registry'])
+        for registry in default_values:
+            tmp = {registry: {}}
+            container['registry'] = dict_merge(tmp, container['registry'])
+
+    # Delete container network, delete containers
+    tmp = node_changed(conf, base + ['network'])
+    if tmp: container.update({'network_remove': tmp})
+
+    tmp = node_changed(conf, base + ['name'])
+    if tmp: container.update({'container_remove': tmp})
+
+    return container
+
+
+def verify(container):
+    # bail out early - looks like removal from running config
+    if not container:
+        return None
+
+    # Add new container
+    if 'name' in container:
+        for name, container_config in container['name'].items():
+            # Container image is a mandatory option
+            if 'image' not in container_config:
+                raise ConfigError(f'Container image for "{name}" is mandatory!')
+
+            # Check if requested container image exists locally. If it does not
+            # exist locally - inform the user. This is required as there is a
+            # shared container image storage accross all VyOS images. A user can
+            # delete a container image from the system, boot into another version
+            # of VyOS and then it would fail to boot. This is to prevent any
+            # configuration error when container images are deleted from the
+            # global storage. A per image local storage would be a super waste
+            # of diskspace as there will be a full copy (up tu several GB/image)
+            # on upgrade. This is the "cheapest" and fastest solution in terms
+            # of image upgrade and deletion.
+            image = container_config['image']
+            if run(f'podman image exists {image}') != 0:
+                Warning(f'Image "{image}" used in container "{name}" does not exist ' \
+                        f'locally. Please use "add container image {image}" to add it ' \
+                        f'to the system! Container "{name}" will not be started!')
+
+            if 'cpu_quota' in container_config:
+                cores = get_core_count()
+                if Decimal(container_config['cpu_quota']) > cores:
+                    raise ConfigError(f'Cannot set limit to more cores than available "{name}"!')
+
+            if 'network' in container_config:
+                if len(container_config['network']) > 1:
+                    raise ConfigError(f'Only one network can be specified for container "{name}"!')
+
+                # Check if the specified container network exists
+                network_name = list(container_config['network'])[0]
+                if network_name not in container.get('network', {}):
+                    raise ConfigError(f'Container network "{network_name}" does not exist!')
+
+                if 'address' in container_config['network'][network_name]:
+                    cnt_ipv4 = 0
+                    cnt_ipv6 = 0
+                    for address in container_config['network'][network_name]['address']:
+                        network = None
+                        if is_ipv4(address):
+                            try:
+                                network = [x for x in container['network'][network_name]['prefix'] if is_ipv4(x)][0]
+                                cnt_ipv4 += 1
+                            except:
+                                raise ConfigError(f'Network "{network_name}" does not contain an IPv4 prefix!')
+                        elif is_ipv6(address):
+                            try:
+                                network = [x for x in container['network'][network_name]['prefix'] if is_ipv6(x)][0]
+                                cnt_ipv6 += 1
+                            except:
+                                raise ConfigError(f'Network "{network_name}" does not contain an IPv6 prefix!')
+
+                        # Specified container IP address must belong to network prefix
+                        if ip_address(address) not in ip_network(network):
+                            raise ConfigError(f'Used container address "{address}" not in network "{network}"!')
+
+                        # We can not use the first IP address of a network prefix as this is used by podman
+                        if ip_address(address) == ip_network(network)[1]:
+                            raise ConfigError(f'IP address "{address}" can not be used for a container, ' \
+                                              'reserved for the container engine!')
+
+                    if cnt_ipv4 > 1 or cnt_ipv6 > 1:
+                        raise ConfigError(f'Only one IP address per address family can be used for ' \
+                                          f'container "{name}". {cnt_ipv4} IPv4 and {cnt_ipv6} IPv6 address(es)!')
+
+            if 'device' in container_config:
+                for dev, dev_config in container_config['device'].items():
+                    if 'source' not in dev_config:
+                        raise ConfigError(f'Device "{dev}" has no source path configured!')
+
+                    if 'destination' not in dev_config:
+                        raise ConfigError(f'Device "{dev}" has no destination path configured!')
+
+                    source = dev_config['source']
+                    if not os.path.exists(source):
+                        raise ConfigError(f'Device "{dev}" source path "{source}" does not exist!')
+
+            if 'sysctl' in container_config and 'parameter' in container_config['sysctl']:
+                for var, cfg in container_config['sysctl']['parameter'].items():
+                    if 'value' not in cfg:
+                        raise ConfigError(f'sysctl parameter {var} has no value assigned!')
+                    if var.startswith('net.') and 'allow_host_networks' in container_config:
+                        raise ConfigError(f'sysctl parameter {var} cannot be set when using host networking!')
+
+            if 'environment' in container_config:
+                for var, cfg in container_config['environment'].items():
+                    if 'value' not in cfg:
+                        raise ConfigError(f'Environment variable {var} has no value assigned!')
+
+            if 'label' in container_config:
+                for var, cfg in container_config['label'].items():
+                    if 'value' not in cfg:
+                        raise ConfigError(f'Label variable {var} has no value assigned!')
+
+            if 'volume' in container_config:
+                for volume, volume_config in container_config['volume'].items():
+                    if 'source' not in volume_config:
+                        raise ConfigError(f'Volume "{volume}" has no source path configured!')
+
+                    if 'destination' not in volume_config:
+                        raise ConfigError(f'Volume "{volume}" has no destination path configured!')
+
+                    source = volume_config['source']
+                    if not os.path.exists(source):
+                        raise ConfigError(f'Volume "{volume}" source path "{source}" does not exist!')
+
+            if 'port' in container_config:
+                for tmp in container_config['port']:
+                    if not {'source', 'destination'} <= set(container_config['port'][tmp]):
+                        raise ConfigError(f'Both "source" and "destination" must be specified for a port mapping!')
+
+            # If 'allow-host-networks' or 'network' not set.
+            if 'allow_host_networks' not in container_config and 'network' not in container_config:
+                raise ConfigError(f'Must either set "network" or "allow-host-networks" for container "{name}"!')
+
+            # Can not set both allow-host-networks and network at the same time
+            if {'allow_host_networks', 'network'} <= set(container_config):
+                raise ConfigError(
+                    f'"allow-host-networks" and "network" for "{name}" cannot be both configured at the same time!')
+
+            # gid cannot be set without uid
+            if 'gid' in container_config and 'uid' not in container_config:
+                raise ConfigError(f'Cannot set "gid" without "uid" for container')
+
+    # Add new network
+    if 'network' in container:
+        for network, network_config in container['network'].items():
+            v4_prefix = 0
+            v6_prefix = 0
+            # If ipv4-prefix not defined for user-defined network
+            if 'prefix' not in network_config:
+                raise ConfigError(f'prefix for network "{network}" must be defined!')
+
+            for prefix in network_config['prefix']:
+                if is_ipv4(prefix):
+                    v4_prefix += 1
+                elif is_ipv6(prefix):
+                    v6_prefix += 1
+
+            if v4_prefix > 1:
+                raise ConfigError(f'Only one IPv4 prefix can be defined for network "{network}"!')
+            if v6_prefix > 1:
+                raise ConfigError(f'Only one IPv6 prefix can be defined for network "{network}"!')
+
+            # Verify VRF exists
+            verify_vrf(network_config)
+
+    # A network attached to a container can not be deleted
+    if {'network_remove', 'name'} <= set(container):
+        for network in container['network_remove']:
+            for c, c_config in container['name'].items():
+                if 'network' in c_config and network in c_config['network']:
+                    raise ConfigError(f'Can not remove network "{network}", used by container "{c}"!')
+
+    if 'registry' in container:
+        for registry, registry_config in container['registry'].items():
+            if 'authentication' not in registry_config:
+                continue
+            if not {'username', 'password'} <= set(registry_config['authentication']):
+                raise ConfigError('Container registry requires both username and password to be set!')
+
+    return None
+
+
+def generate_run_arguments(name, container_config):
+    image = container_config['image']
+    cpu_quota = container_config['cpu_quota']
+    memory = container_config['memory']
+    shared_memory = container_config['shared_memory']
+    restart = container_config['restart']
+
+    # Add sysctl options
+    sysctl_opt = ''
+    if 'sysctl' in container_config and 'parameter' in container_config['sysctl']:
+        for k, v in container_config['sysctl']['parameter'].items():
+            sysctl_opt += f" --sysctl {k}={v['value']}"
+
+    # Add capability options. Should be in uppercase
+    capabilities = ''
+    if 'capability' in container_config:
+        for cap in container_config['capability']:
+            cap = cap.upper().replace('-', '_')
+            capabilities += f' --cap-add={cap}'
+
+    # Add a host device to the container /dev/x:/dev/x
+    device = ''
+    if 'device' in container_config:
+        for dev, dev_config in container_config['device'].items():
+            source_dev = dev_config['source']
+            dest_dev = dev_config['destination']
+            device += f' --device={source_dev}:{dest_dev}'
+
+    # Check/set environment options "-e foo=bar"
+    env_opt = ''
+    if 'environment' in container_config:
+        for k, v in container_config['environment'].items():
+            env_opt += f" --env \"{k}={v['value']}\""
+
+    # Check/set label options "--label foo=bar"
+    label = ''
+    if 'label' in container_config:
+        for k, v in container_config['label'].items():
+            label += f" --label \"{k}={v['value']}\""
+
+    hostname = ''
+    if 'host_name' in container_config:
+        hostname = container_config['host_name']
+        hostname = f'--hostname {hostname}'
+
+    # Publish ports
+    port = ''
+    if 'port' in container_config:
+        protocol = ''
+        for portmap in container_config['port']:
+            protocol = container_config['port'][portmap]['protocol']
+            sport = container_config['port'][portmap]['source']
+            dport = container_config['port'][portmap]['destination']
+            listen_addresses = container_config['port'][portmap].get('listen_address', [])
+
+            # If listen_addresses is not empty, include them in the publish command
+            if listen_addresses:
+                for listen_address in listen_addresses:
+                    port += f' --publish {bracketize_ipv6(listen_address)}:{sport}:{dport}/{protocol}'
+            else:
+                # If listen_addresses is empty, just include the standard publish command
+                port += f' --publish {sport}:{dport}/{protocol}'
+
+    # Set uid and gid
+    uid = ''
+    if 'uid' in container_config:
+        uid = container_config['uid']
+        if 'gid' in container_config:
+            uid += ':' + container_config['gid']
+        uid = f'--user {uid}'
+
+    # Bind volume
+    volume = ''
+    if 'volume' in container_config:
+        for vol, vol_config in container_config['volume'].items():
+            svol = vol_config['source']
+            dvol = vol_config['destination']
+            mode = vol_config['mode']
+            prop = vol_config['propagation']
+            volume += f' --volume {svol}:{dvol}:{mode},{prop}'
+
+    host_pid = ''
+    if 'allow_host_pid' in container_config:
+      host_pid = '--pid host'
+
+    container_base_cmd = f'--detach --interactive --tty --replace {capabilities} --cpus {cpu_quota} {sysctl_opt} ' \
+                         f'--memory {memory}m --shm-size {shared_memory}m --memory-swap 0 --restart {restart} ' \
+                         f'--name {name} {hostname} {device} {port} {volume} {env_opt} {label} {uid} {host_pid}'
+
+    entrypoint = ''
+    if 'entrypoint' in container_config:
+        # it needs to be json-formatted with single quote on the outside
+        entrypoint = json_write(container_config['entrypoint'].split()).replace('"', "&quot;")
+        entrypoint = f'--entrypoint &apos;{entrypoint}&apos;'
+
+    command = ''
+    if 'command' in container_config:
+        command = container_config['command'].strip()
+
+    command_arguments = ''
+    if 'arguments' in container_config:
+        command_arguments = container_config['arguments'].strip()
+
+    if 'allow_host_networks' in container_config:
+        return f'{container_base_cmd} --net host {entrypoint} {image} {command} {command_arguments}'.strip()
+
+    ip_param = ''
+    networks = ",".join(container_config['network'])
+    for network in container_config['network']:
+        if 'address' not in container_config['network'][network]:
+            continue
+        for address in container_config['network'][network]['address']:
+            if is_ipv6(address):
+                ip_param += f' --ip6 {address}'
+            else:
+                ip_param += f' --ip {address}'
+
+    return f'{container_base_cmd} --no-healthcheck --net {networks} {ip_param} {entrypoint} {image} {command} {command_arguments}'.strip()
+
+
+def generate(container):
+    # bail out early - looks like removal from running config
+    if not container:
+        for file in [config_containers, config_registry, config_storage]:
+            if os.path.exists(file):
+                os.unlink(file)
+        return None
+
+    if 'network' in container:
+        for network, network_config in container['network'].items():
+            tmp = {
+                'name': network,
+                'id': sha256(f'{network}'.encode()).hexdigest(),
+                'driver': 'bridge',
+                'network_interface': f'pod-{network}',
+                'subnets': [],
+                'ipv6_enabled': False,
+                'internal': False,
+                'dns_enabled': True,
+                'ipam_options': {
+                    'driver': 'host-local'
+                }
+            }
+
+            if 'no_name_server' in network_config:
+                tmp['dns_enabled'] = False
+
+            for prefix in network_config['prefix']:
+                net = {'subnet': prefix, 'gateway': inc_ip(prefix, 1)}
+                tmp['subnets'].append(net)
+
+                if is_ipv6(prefix):
+                    tmp['ipv6_enabled'] = True
+
+            write_file(f'/etc/containers/networks/{network}.json', json_write(tmp, indent=2))
+
+    render(config_containers, 'container/containers.conf.j2', container)
+    render(config_registry, 'container/registries.conf.j2', container)
+    render(config_storage, 'container/storage.conf.j2', container)
+
+    if 'name' in container:
+        for name, container_config in container['name'].items():
+            if 'disable' in container_config:
+                continue
+
+            file_path = os.path.join(systemd_unit_path, f'vyos-container-{name}.service')
+            run_args = generate_run_arguments(name, container_config)
+            render(file_path, 'container/systemd-unit.j2', {'name': name, 'run_args': run_args, },
+                   formater=lambda _: _.replace("&quot;", '"').replace("&apos;", "'"))
+
+    return None
+
+
+def apply(container):
+    # Delete old containers if needed. We can't delete running container
+    # Option "--force" allows to delete containers with any status
+    if 'container_remove' in container:
+        for name in container['container_remove']:
+            file_path = os.path.join(systemd_unit_path, f'vyos-container-{name}.service')
+            call(f'systemctl stop vyos-container-{name}.service')
+            if os.path.exists(file_path):
+                os.unlink(file_path)
+
+    call('systemctl daemon-reload')
+
+    # Delete old networks if needed
+    if 'network_remove' in container:
+        for network in container['network_remove']:
+            call(f'podman network rm {network} >/dev/null 2>&1')
+
+    # Add container
+    disabled_new = False
+    if 'name' in container:
+        for name, container_config in container['name'].items():
+            image = container_config['image']
+
+            if run(f'podman image exists {image}') != 0:
+                # container image does not exist locally - user already got
+                # informed by a WARNING in verfiy() - bail out early
+                continue
+
+            if 'disable' in container_config:
+                # check if there is a container by that name running
+                tmp = _cmd('podman ps -a --format "{{.Names}}"')
+                if name in tmp:
+                    file_path = os.path.join(systemd_unit_path, f'vyos-container-{name}.service')
+                    call(f'systemctl stop vyos-container-{name}.service')
+                    if os.path.exists(file_path):
+                        disabled_new = True
+                        os.unlink(file_path)
+                continue
+
+            if 'container_restart' in container and name in container['container_restart']:
+                cmd(f'systemctl restart vyos-container-{name}.service')
+
+    if disabled_new:
+        call('systemctl daemon-reload')
+
+    # Start network and assign it to given VRF if requested. this can only be done
+    # after the containers got started as the podman network interface will
+    # only be enabled by the first container and yet I do not know how to enable
+    # the network interface in advance
+    if 'network' in container:
+        for network, network_config in container['network'].items():
+            network_name = f'pod-{network}'
+            # T5147: Networks are started only as soon as there is a consumer.
+            # If only a network is created in the first place, no need to assign
+            # it to a VRF as there's no consumer, yet.
+            if interface_exists(network_name):
+                tmp = Interface(network_name)
+                tmp.set_vrf(network_config.get('vrf', ''))
+                tmp.add_ipv6_eui64_address('fe80::/64')
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
new file mode 100644
index 0000000..5638a96
--- /dev/null
+++ b/src/conf_mode/firewall.py
@@ -0,0 +1,597 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import re
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import is_node_changed
+from vyos.configdiff import get_config_diff, Diff
+from vyos.configdep import set_dependents, call_dependents
+from vyos.configverify import verify_interface_exists
+from vyos.ethtool import Ethtool
+from vyos.firewall import fqdn_config_parse
+from vyos.firewall import geoip_update
+from vyos.template import render
+from vyos.utils.dict import dict_search_args
+from vyos.utils.dict import dict_search_recursive
+from vyos.utils.process import call
+from vyos.utils.process import cmd
+from vyos.utils.process import rc_cmd
+from vyos import ConfigError
+from vyos import airbag
+from subprocess import run as subp_run
+
+airbag.enable()
+
+nftables_conf = '/run/nftables.conf'
+sysctl_file = r'/run/sysctl/10-vyos-firewall.conf'
+
+valid_groups = [
+    'address_group',
+    'domain_group',
+    'network_group',
+    'port_group',
+    'interface_group',
+    ## Added for group ussage in bridge firewall
+    'ipv4_address_group',
+    'ipv6_address_group',
+    'ipv4_network_group',
+    'ipv6_network_group'
+]
+
+nested_group_types = [
+    'address_group', 'network_group', 'mac_group',
+    'port_group', 'ipv6_address_group', 'ipv6_network_group'
+]
+
+snmp_change_type = {
+    'unknown': 0,
+    'add': 1,
+    'delete': 2,
+    'change': 3
+}
+snmp_event_source = 1
+snmp_trap_mib = 'VYATTA-TRAP-MIB'
+snmp_trap_name = 'mgmtEventTrap'
+
+def geoip_updated(conf, firewall):
+    diff = get_config_diff(conf)
+    node_diff = diff.get_child_nodes_diff(['firewall'], expand_nodes=Diff.DELETE, recursive=True)
+
+    out = {
+        'name': [],
+        'ipv6_name': [],
+        'deleted_name': [],
+        'deleted_ipv6_name': []
+    }
+    updated = False
+
+    for key, path in dict_search_recursive(firewall, 'geoip'):
+        set_name = f'GEOIP_CC_{path[1]}_{path[2]}_{path[4]}'
+        if (path[0] == 'ipv4'):
+            out['name'].append(set_name)
+        elif (path[0] == 'ipv6'):
+            set_name = f'GEOIP_CC6_{path[1]}_{path[2]}_{path[4]}'
+            out['ipv6_name'].append(set_name)
+
+        updated = True
+
+    if 'delete' in node_diff:
+        for key, path in dict_search_recursive(node_diff['delete'], 'geoip'):
+            set_name = f'GEOIP_CC_{path[1]}_{path[2]}_{path[4]}'
+            if (path[0] == 'ipv4'):
+                out['deleted_name'].append(set_name)
+            elif (path[0] == 'ipv6'):
+                set_name = f'GEOIP_CC_{path[1]}_{path[2]}_{path[4]}'
+                out['deleted_ipv6_name'].append(set_name)
+            updated = True
+
+    if updated:
+        return out
+
+    return False
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['firewall']
+
+    firewall = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                    no_tag_node_value_mangle=True,
+                                    get_first_key=True,
+                                    with_recursive_defaults=True)
+
+
+    firewall['group_resync'] = bool('group' in firewall or is_node_changed(conf, base + ['group']))
+    if firewall['group_resync']:
+        # Update nat and policy-route as firewall groups were updated
+        set_dependents('group_resync', conf)
+
+    firewall['geoip_updated'] = geoip_updated(conf, firewall)
+
+    fqdn_config_parse(firewall)
+
+    set_dependents('conntrack', conf)
+
+    return firewall
+
+def verify_jump_target(firewall, hook, jump_target, family, recursive=False):
+    targets_seen = []
+    targets_pending = [jump_target]
+
+    while targets_pending:
+        target = targets_pending.pop()
+
+        if 'name' not in firewall[family]:
+            raise ConfigError(f'Invalid jump-target. Firewall {family} name {target} does not exist on the system')
+        elif target not in dict_search_args(firewall, family, 'name'):
+            raise ConfigError(f'Invalid jump-target. Firewall {family} name {target} does not exist on the system')
+
+        target_rules = dict_search_args(firewall, family, 'name', target, 'rule')
+        no_ipsec_in = hook in ('output', )
+
+        if target_rules:
+            for target_rule_conf in target_rules.values():
+                # Output hook types will not tolerate 'meta ipsec exists' matches even in jump targets:
+                if no_ipsec_in and (dict_search_args(target_rule_conf, 'ipsec', 'match_ipsec_in') is not None \
+                                    or dict_search_args(target_rule_conf, 'ipsec', 'match_none_in') is not None):
+                    raise ConfigError(f'Invalid jump-target for {hook}. Firewall {family} name {target} rules contain incompatible ipsec inbound matches')
+                # Make sure we're not looping back on ourselves somewhere:
+                if recursive and 'jump_target' in target_rule_conf:
+                    child_target = target_rule_conf['jump_target']
+                    if child_target in targets_seen:
+                        raise ConfigError(f'Loop detected in jump-targets, firewall {family} name {target} refers to previously traversed {family} name {child_target}')
+                    targets_pending.append(child_target)
+                    if len(targets_seen) == 7:
+                        path_txt = ' -> '.join(targets_seen)
+                        Warning(f'Deep nesting of jump targets has reached 8 levels deep, following the path {path_txt} -> {child_target}!')
+
+        targets_seen.append(target)
+
+def verify_rule(firewall, family, hook, priority, rule_id, rule_conf):
+    if 'action' not in rule_conf:
+        raise ConfigError('Rule action must be defined')
+
+    if 'jump' in rule_conf['action'] and 'jump_target' not in rule_conf:
+        raise ConfigError('Action set to jump, but no jump-target specified')
+
+    if 'jump_target' in rule_conf:
+        if 'jump' not in rule_conf['action']:
+            raise ConfigError('jump-target defined, but action jump needed and it is not defined')
+        target = rule_conf['jump_target']
+        if hook != 'name': # This is a bit clumsy, but consolidates a chunk of code. 
+            verify_jump_target(firewall, hook, target, family, recursive=True)
+        else:
+            verify_jump_target(firewall, hook, target, family, recursive=False)
+
+    if rule_conf['action'] == 'offload':
+        if 'offload_target' not in rule_conf:
+            raise ConfigError('Action set to offload, but no offload-target specified')
+
+        offload_target = rule_conf['offload_target']
+
+        if not dict_search_args(firewall, 'flowtable', offload_target):
+            raise ConfigError(f'Invalid offload-target. Flowtable "{offload_target}" does not exist on the system')
+
+    if rule_conf['action'] != 'synproxy' and 'synproxy' in rule_conf:
+        raise ConfigError('"synproxy" option allowed only for action synproxy')
+    if rule_conf['action'] == 'synproxy':
+        if 'state' in rule_conf:
+            raise ConfigError('For action "synproxy" state cannot be defined')
+        if not rule_conf.get('synproxy', {}).get('tcp'):
+            raise ConfigError('synproxy TCP MSS is not defined')
+        if rule_conf.get('protocol', {}) != 'tcp':
+            raise ConfigError('For action "synproxy" the protocol must be set to TCP')
+
+    if 'queue_options' in rule_conf:
+        if 'queue' not in rule_conf['action']:
+            raise ConfigError('queue-options defined, but action queue needed and it is not defined')
+        if 'fanout' in rule_conf['queue_options'] and ('queue' not in rule_conf or '-' not in rule_conf['queue']):
+            raise ConfigError('queue-options fanout defined, then queue needs to be defined as a range')
+
+    if 'queue' in rule_conf and 'queue' not in rule_conf['action']:
+        raise ConfigError('queue defined, but action queue needed and it is not defined')
+
+    if 'fragment' in rule_conf:
+        if {'match_frag', 'match_non_frag'} <= set(rule_conf['fragment']):
+            raise ConfigError('Cannot specify both "match-frag" and "match-non-frag"')
+
+    if 'limit' in rule_conf:
+        if 'rate' in rule_conf['limit']:
+            rate_int = re.sub(r'\D', '', rule_conf['limit']['rate'])
+            if int(rate_int) < 1:
+                raise ConfigError('Limit rate integer cannot be less than 1')
+
+    if 'ipsec' in rule_conf:
+        if {'match_ipsec_in', 'match_none_in'} <= set(rule_conf['ipsec']):
+            raise ConfigError('Cannot specify both "match-ipsec" and "match-none"')
+        if {'match_ipsec_out', 'match_none_out'} <= set(rule_conf['ipsec']):
+            raise ConfigError('Cannot specify both "match-ipsec" and "match-none"')
+
+    if 'recent' in rule_conf:
+        if not {'count', 'time'} <= set(rule_conf['recent']):
+            raise ConfigError('Recent "count" and "time" values must be defined')
+
+    if 'gre' in rule_conf:
+        if dict_search_args(rule_conf, 'protocol') != 'gre':
+            raise ConfigError('Protocol must be gre when matching GRE flags and fields')
+
+        if dict_search_args(rule_conf, 'gre', 'key'):
+            if dict_search_args(rule_conf, 'gre', 'version') == 'pptp':
+                raise ConfigError('GRE tunnel keys are not present in PPTP')
+
+            if dict_search_args(rule_conf, 'gre', 'flags', 'checksum') is None:
+                # There is no builtin match in nftables for the GRE key, so we need to do a raw lookup.
+                # The offset of the key within the packet shifts depending on the C-flag. 
+                # 99% of the time, nobody will have checksums enabled - it's usually a manual config option. 
+                # We can either assume it is unset unless otherwise directed 
+                # (confusing, requires doco to explain why it doesn't work sometimes)
+                # or, demand an explicit selection to be made for this specific match rule. 
+                # This check enforces the latter. The user is free to create rules for both cases. 
+                raise ConfigError('Matching GRE tunnel key requires an explicit checksum flag match. For most cases, use "gre flags checksum unset"')
+
+            if dict_search_args(rule_conf, 'gre', 'flags', 'key', 'unset') is not None:
+                raise ConfigError('Matching GRE tunnel key implies "flags key", cannot specify "flags key unset"')
+
+        gre_inner_proto = dict_search_args(rule_conf, 'gre', 'inner_proto')
+        if gre_inner_proto is not None:
+            try:
+                gre_inner_value = int(gre_inner_proto, 0)
+                if gre_inner_value < 0 or gre_inner_value > 65535:
+                    raise ConfigError('inner-proto outside valid ethertype range 0-65535')
+            except ValueError:
+                pass # Symbolic constant, pre-validated before reaching here. 
+
+    tcp_flags = dict_search_args(rule_conf, 'tcp', 'flags')
+    if tcp_flags:
+        if dict_search_args(rule_conf, 'protocol') != 'tcp':
+            raise ConfigError('Protocol must be tcp when specifying tcp flags')
+
+        not_flags = dict_search_args(rule_conf, 'tcp', 'flags', 'not')
+        if not_flags:
+            duplicates = [flag for flag in tcp_flags if flag in not_flags]
+            if duplicates:
+                raise ConfigError(f'Cannot match a tcp flag as set and not set')
+
+    if 'protocol' in rule_conf:
+        if rule_conf['protocol'] == 'icmp' and family == 'ipv6':
+            raise ConfigError(f'Cannot match IPv4 ICMP protocol on IPv6, use ipv6-icmp')
+        if rule_conf['protocol'] == 'ipv6-icmp' and family == 'ipv4':
+            raise ConfigError(f'Cannot match IPv6 ICMP protocol on IPv4, use icmp')
+
+    for side in ['destination', 'source']:
+        if side in rule_conf:
+            side_conf = rule_conf[side]
+
+            if len({'address', 'fqdn', 'geoip'} & set(side_conf)) > 1:
+                raise ConfigError('Only one of address, fqdn or geoip can be specified')
+
+            if 'group' in side_conf:
+                if len({'address_group', 'network_group', 'domain_group'} & set(side_conf['group'])) > 1:
+                    raise ConfigError('Only one address-group, network-group or domain-group can be specified')
+
+                for group in valid_groups:
+                    if group in side_conf['group']:
+                        group_name = side_conf['group'][group]
+
+                        if family == 'ipv6' and group in ['address_group', 'network_group']:
+                            fw_group = f'ipv6_{group}'
+                        elif family == 'bridge':
+                            if group =='ipv4_address_group':
+                                fw_group = 'address_group'
+                            elif group == 'ipv4_network_group':
+                                fw_group = 'network_group'
+                            else:
+                                fw_group = group
+                        else:
+                            fw_group = group
+
+                        error_group = fw_group.replace("_", "-")
+
+                        if group in ['address_group', 'network_group', 'domain_group']:
+                            types = [t for t in ['address', 'fqdn', 'geoip'] if t in side_conf]
+                            if types:
+                                raise ConfigError(f'{error_group} and {types[0]} cannot both be defined')
+
+                        if group_name and group_name[0] == '!':
+                            group_name = group_name[1:]
+
+                        group_obj = dict_search_args(firewall, 'group', fw_group, group_name)
+
+                        if group_obj is None:
+                            raise ConfigError(f'Invalid {error_group} "{group_name}" on firewall rule')
+
+                        if not group_obj:
+                            Warning(f'{error_group} "{group_name}" has no members!')
+
+            if 'port' in side_conf or dict_search_args(side_conf, 'group', 'port_group'):
+                if 'protocol' not in rule_conf:
+                    raise ConfigError('Protocol must be defined if specifying a port or port-group')
+
+                if rule_conf['protocol'] not in ['tcp', 'udp', 'tcp_udp']:
+                    raise ConfigError('Protocol must be tcp, udp, or tcp_udp when specifying a port or port-group')
+
+            if 'port' in side_conf and dict_search_args(side_conf, 'group', 'port_group'):
+                raise ConfigError(f'{side} port-group and port cannot both be defined')
+
+    if 'add_address_to_group' in rule_conf:
+        for type in ['destination_address', 'source_address']:
+            if type in rule_conf['add_address_to_group']:
+                if 'address_group' not in rule_conf['add_address_to_group'][type]:
+                    raise ConfigError(f'Dynamic address group must be defined.')
+                else:
+                    target = rule_conf['add_address_to_group'][type]['address_group']
+                    fwall_group = 'ipv6_address_group' if family == 'ipv6' else 'address_group'
+                    group_obj = dict_search_args(firewall, 'group', 'dynamic_group', fwall_group, target)
+                    if group_obj is None:
+                            raise ConfigError(f'Invalid dynamic address group on firewall rule')
+
+    if 'log_options' in rule_conf:
+        if 'log' not in rule_conf:
+            raise ConfigError('log-options defined, but log is not enable')
+
+        if 'snapshot_length' in rule_conf['log_options'] and 'group' not in rule_conf['log_options']:
+            raise ConfigError('log-options snapshot-length defined, but log group is not define')
+
+        if 'queue_threshold' in rule_conf['log_options'] and 'group' not in rule_conf['log_options']:
+            raise ConfigError('log-options queue-threshold defined, but log group is not define')
+
+    for direction in ['inbound_interface','outbound_interface']:
+        if direction in rule_conf:
+            if 'name' in rule_conf[direction] and 'group' in rule_conf[direction]:
+                raise ConfigError(f'Cannot specify both interface group and interface name for {direction}')
+            if 'group' in rule_conf[direction]:
+                group_name = rule_conf[direction]['group']
+                if group_name[0] == '!':
+                    group_name = group_name[1:]
+                group_obj = dict_search_args(firewall, 'group', 'interface_group', group_name)
+                if group_obj is None:
+                    raise ConfigError(f'Invalid interface group "{group_name}" on firewall rule')
+                if not group_obj:
+                    Warning(f'interface-group "{group_name}" has no members!')
+
+def verify_nested_group(group_name, group, groups, seen):
+    if 'include' not in group:
+        return
+
+    seen.append(group_name)
+
+    for g in group['include']:
+        if g not in groups:
+            raise ConfigError(f'Nested group "{g}" does not exist')
+
+        if g in seen:
+            raise ConfigError(f'Group "{group_name}" has a circular reference')
+
+        if 'include' in groups[g]:
+            verify_nested_group(g, groups[g], groups, seen)
+
+def verify_hardware_offload(ifname):
+    ethtool = Ethtool(ifname)
+    enabled, fixed = ethtool.get_hw_tc_offload()
+
+    if not enabled and fixed:
+        raise ConfigError(f'Interface "{ifname}" does not support hardware offload')
+
+    if not enabled:
+        raise ConfigError(f'Interface "{ifname}" requires "offload hw-tc-offload"')
+
+def verify(firewall):
+    if 'flowtable' in firewall:
+        for flowtable, flowtable_conf in firewall['flowtable'].items():
+            if 'interface' not in flowtable_conf:
+                raise ConfigError(f'Flowtable "{flowtable}" requires at least one interface')
+
+            for ifname in flowtable_conf['interface']:
+                verify_interface_exists(firewall, ifname)
+
+            if dict_search_args(flowtable_conf, 'offload') == 'hardware':
+                interfaces = flowtable_conf['interface']
+
+                for ifname in interfaces:
+                    verify_hardware_offload(ifname)
+
+    if 'group' in firewall:
+        for group_type in nested_group_types:
+            if group_type in firewall['group']:
+                groups = firewall['group'][group_type]
+                for group_name, group in groups.items():
+                    verify_nested_group(group_name, group, groups, [])
+
+    for family in ['ipv4', 'ipv6', 'bridge']:
+        if family in firewall:
+            for chain in ['name','forward','input','output', 'prerouting']:
+                if chain in firewall[family]:
+                    for priority, priority_conf in firewall[family][chain].items():
+                        if 'jump' in priority_conf['default_action'] and 'default_jump_target' not in priority_conf:
+                            raise ConfigError('default-action set to jump, but no default-jump-target specified')
+                        if 'default_jump_target' in priority_conf:
+                            target = priority_conf['default_jump_target']
+                            if 'jump' not in priority_conf['default_action']:
+                                raise ConfigError('default-jump-target defined, but default-action jump needed and it is not defined')
+                            if priority_conf['default_jump_target'] == priority:
+                                raise ConfigError(f'Loop detected on default-jump-target.')
+                            if target not in dict_search_args(firewall[family], 'name'):
+                                raise ConfigError(f'Invalid jump-target. Firewall name {target} does not exist on the system')
+                        if 'rule' in priority_conf:
+                            for rule_id, rule_conf in priority_conf['rule'].items():
+                                verify_rule(firewall, family, chain, priority, rule_id, rule_conf)
+
+    local_zone = False
+    zone_interfaces = []
+
+    if 'zone' in firewall:
+        for zone, zone_conf in firewall['zone'].items():
+            if 'local_zone' not in zone_conf and 'interface' not in zone_conf:
+                raise ConfigError(f'Zone "{zone}" has no interfaces and is not the local zone')
+
+            if 'local_zone' in zone_conf:
+                if local_zone:
+                    raise ConfigError('There cannot be multiple local zones')
+                if 'interface' in zone_conf:
+                    raise ConfigError('Local zone cannot have interfaces assigned')
+                if 'intra_zone_filtering' in zone_conf:
+                    raise ConfigError('Local zone cannot use intra-zone-filtering')
+                local_zone = True
+
+            if 'interface' in zone_conf:
+                found_duplicates = [intf for intf in zone_conf['interface'] if intf in zone_interfaces]
+
+                if found_duplicates:
+                    raise ConfigError(f'Interfaces cannot be assigned to multiple zones')
+
+                zone_interfaces += zone_conf['interface']
+
+            if 'intra_zone_filtering' in zone_conf:
+                intra_zone = zone_conf['intra_zone_filtering']
+
+                if len(intra_zone) > 1:
+                    raise ConfigError('Only one intra-zone-filtering action must be specified')
+
+                if 'firewall' in intra_zone:
+                    v4_name = dict_search_args(intra_zone, 'firewall', 'name')
+                    if v4_name and not dict_search_args(firewall, 'ipv4', 'name', v4_name):
+                        raise ConfigError(f'Firewall name "{v4_name}" does not exist')
+
+                    v6_name = dict_search_args(intra_zone, 'firewall', 'ipv6_name')
+                    if v6_name and not dict_search_args(firewall, 'ipv6', 'name', v6_name):
+                        raise ConfigError(f'Firewall ipv6-name "{v6_name}" does not exist')
+
+                    if not v4_name and not v6_name:
+                        raise ConfigError('No firewall names specified for intra-zone-filtering')
+
+            if 'from' in zone_conf:
+                for from_zone, from_conf in zone_conf['from'].items():
+                    if from_zone not in firewall['zone']:
+                        raise ConfigError(f'Zone "{zone}" refers to a non-existent or deleted zone "{from_zone}"')
+
+                    v4_name = dict_search_args(from_conf, 'firewall', 'name')
+                    if v4_name and not dict_search_args(firewall, 'ipv4', 'name', v4_name):
+                        raise ConfigError(f'Firewall name "{v4_name}" does not exist')
+
+                    v6_name = dict_search_args(from_conf, 'firewall', 'ipv6_name')
+                    if v6_name and not dict_search_args(firewall, 'ipv6', 'name', v6_name):
+                        raise ConfigError(f'Firewall ipv6-name "{v6_name}" does not exist')
+
+    return None
+
+def generate(firewall):
+    if not os.path.exists(nftables_conf):
+        firewall['first_install'] = True
+
+    if 'zone' in firewall:
+        for local_zone, local_zone_conf in firewall['zone'].items():
+            if 'local_zone' not in local_zone_conf:
+                continue
+
+            local_zone_conf['from_local'] = {}
+
+            for zone, zone_conf in firewall['zone'].items():
+                if zone == local_zone or 'from' not in zone_conf:
+                    continue
+                if local_zone in zone_conf['from']:
+                    local_zone_conf['from_local'][zone] = zone_conf['from'][local_zone]
+
+    render(nftables_conf, 'firewall/nftables.j2', firewall)
+    render(sysctl_file, 'firewall/sysctl-firewall.conf.j2', firewall)
+    return None
+
+def parse_firewall_error(output):
+    # Define the regex patterns to extract the error message and the comment
+    error_pattern = re.compile(r'Error:\s*(.*?)\n')
+    comment_pattern = re.compile(r'comment\s+"([^"]+)"')
+    error_output = []
+
+    # Find all error messages in the output
+    error_matches = error_pattern.findall(output)
+    # Find all comment matches in the output
+    comment_matches = comment_pattern.findall(output)
+
+    if not error_matches or not comment_matches:
+        raise ConfigError(f'Unknown firewall error detected: {output}')
+
+    error_output.append('Fail to apply firewall')
+    # Loop over the matches and process them
+    for error_message, comment in zip(error_matches, comment_matches):
+        # Parse the comment
+        parsed_entries = comment.split('-')
+        family = 'bridge' if parsed_entries[0] == 'bri' else parsed_entries[0]
+        if parsed_entries[1] == 'NAM':
+            chain = 'name'
+        elif parsed_entries[1] == 'FWD':
+            chain = 'forward'
+        elif parsed_entries[1] == 'INP':
+            chain = 'input'
+        elif parsed_entries[1] == 'OUT':
+            chain = 'output'
+        elif parsed_entries[1] == 'PRE':
+            chain = 'prerouting'
+        error_output.append(f'Error found on: firewall {family} {chain} {parsed_entries[2]} rule {parsed_entries[3]}')
+        error_output.append(f'\tError message: {error_message.strip()}')
+
+    raise ConfigError('\n'.join(error_output))
+
+def apply(firewall):
+    # Use nft -c option to check current configuration file
+    completed_process = subp_run(['nft', '-c', '--file', nftables_conf], capture_output=True)
+    install_result = completed_process.returncode
+    if install_result == 1:
+        # We need to handle firewall error
+        output = completed_process.stderr
+        parse_firewall_error(output.decode())
+
+    # No error detected during check, we can apply the new configuration
+    install_result, output = rc_cmd(f'nft --file {nftables_conf}')
+    # Double check just in case
+    if install_result == 1:
+        raise ConfigError(f'Failed to apply firewall: {output}')
+
+    # Apply firewall global-options sysctl settings
+    cmd(f'sysctl -f {sysctl_file}')
+
+    call_dependents()
+
+    # T970 Enable a resolver (systemd daemon) that checks
+    # domain-group/fqdn addresses and update entries for domains by timeout
+    # If router loaded without internet connection or for synchronization
+    domain_action = 'stop'
+    if dict_search_args(firewall, 'group', 'domain_group') or firewall['ip_fqdn'] or firewall['ip6_fqdn']:
+        domain_action = 'restart'
+    call(f'systemctl {domain_action} vyos-domain-resolver.service')
+
+    if firewall['geoip_updated']:
+        # Call helper script to Update set contents
+        if 'name' in firewall['geoip_updated'] or 'ipv6_name' in firewall['geoip_updated']:
+            print('Updating GeoIP. Please wait...')
+            geoip_update(firewall)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/high-availability.py b/src/conf_mode/high-availability.py
new file mode 100644
index 0000000..c726db8
--- /dev/null
+++ b/src/conf_mode/high-availability.py
@@ -0,0 +1,236 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+import os
+import time
+
+from sys import exit
+from ipaddress import ip_interface
+from ipaddress import IPv4Interface
+from ipaddress import IPv6Interface
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import leaf_node_changed
+from vyos.ifconfig.vrrp import VRRP
+from vyos.template import render
+from vyos.template import is_ipv4
+from vyos.template import is_ipv6
+from vyos.utils.network import is_ipv6_tentative
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+
+systemd_override = r'/run/systemd/system/keepalived.service.d/10-override.conf'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['high-availability']
+    if not conf.exists(base):
+        return None
+
+    ha = conf.get_config_dict(base, key_mangling=('-', '_'),
+                              no_tag_node_value_mangle=True,
+                              get_first_key=True, with_defaults=True)
+
+    ## Get the sync group used for conntrack-sync
+    conntrack_path = ['service', 'conntrack-sync', 'failover-mechanism', 'vrrp', 'sync-group']
+    if conf.exists(conntrack_path):
+        ha['conntrack_sync_group'] = conf.return_value(conntrack_path)
+
+    if leaf_node_changed(conf, base + ['vrrp', 'snmp']):
+        ha.update({'restart_required': {}})
+
+    return ha
+
+def verify(ha):
+    if not ha or 'disable' in ha:
+        return None
+
+    used_vrid_if = []
+    if 'vrrp' in ha and 'group' in ha['vrrp']:
+        for group, group_config in ha['vrrp']['group'].items():
+            # Check required fields
+            if 'vrid' not in group_config:
+                raise ConfigError(f'VRID is required but not set in VRRP group "{group}"')
+
+            if 'interface' not in group_config:
+                raise ConfigError(f'Interface is required but not set in VRRP group "{group}"')
+
+            if 'address' not in group_config:
+                raise ConfigError(f'Virtual IP address is required but not set in VRRP group "{group}"')
+
+            if 'authentication' in group_config:
+                if not {'password', 'type'} <= set(group_config['authentication']):
+                    raise ConfigError(f'Authentication requires both type and passwortd to be set in VRRP group "{group}"')
+
+            if 'health_check' in group_config:
+                _validate_health_check(group, group_config)
+
+            # Keepalived doesn't allow mixing IPv4 and IPv6 in one group, so we mirror that restriction
+            # We also need to make sure VRID is not used twice on the same interface with the
+            # same address family.
+
+            interface = group_config['interface']
+            vrid = group_config['vrid']
+
+            # XXX: filter on map object is destructive, so we force it to list.
+            # Additionally, filter objects always evaluate to True, empty or not,
+            # so we force them to lists as well.
+            vaddrs = list(map(lambda i: ip_interface(i), group_config['address']))
+            vaddrs4 = list(filter(lambda x: isinstance(x, IPv4Interface), vaddrs))
+            vaddrs6 = list(filter(lambda x: isinstance(x, IPv6Interface), vaddrs))
+
+            if vaddrs4 and vaddrs6:
+                raise ConfigError(f'VRRP group "{group}" mixes IPv4 and IPv6 virtual addresses, this is not allowed.\n' \
+                                  'Create individual groups for IPv4 and IPv6!')
+            if vaddrs4:
+                tmp = {'interface': interface, 'vrid': vrid, 'ipver': 'IPv4'}
+                if tmp in used_vrid_if:
+                    raise ConfigError(f'VRID "{vrid}" can only be used once on interface "{interface} with address family IPv4"!')
+                used_vrid_if.append(tmp)
+
+                if 'hello_source_address' in group_config:
+                    if is_ipv6(group_config['hello_source_address']):
+                        raise ConfigError(f'VRRP group "{group}" uses IPv4 but hello-source-address is IPv6!')
+
+                if 'peer_address' in group_config:
+                    for peer_address in group_config['peer_address']:
+                        if is_ipv6(peer_address):
+                            raise ConfigError(f'VRRP group "{group}" uses IPv4 but peer-address is IPv6!')
+
+            if vaddrs6:
+                tmp = {'interface': interface, 'vrid': vrid, 'ipver': 'IPv6'}
+                if tmp in used_vrid_if:
+                    raise ConfigError(f'VRID "{vrid}" can only be used once on interface "{interface} with address family IPv6"!')
+                used_vrid_if.append(tmp)
+
+                if 'hello_source_address' in group_config:
+                    if is_ipv4(group_config['hello_source_address']):
+                        raise ConfigError(f'VRRP group "{group}" uses IPv6 but hello-source-address is IPv4!')
+
+                if 'peer_address' in group_config:
+                    for peer_address in group_config['peer_address']:
+                        if is_ipv4(peer_address):
+                            raise ConfigError(f'VRRP group "{group}" uses IPv6 but peer-address is IPv4!')
+    # Check sync groups
+    if 'vrrp' in ha and 'sync_group' in ha['vrrp']:
+        for sync_group, sync_config in ha['vrrp']['sync_group'].items():
+            if 'health_check' in sync_config:
+                _validate_health_check(sync_group, sync_config)
+
+            if 'member' in sync_config:
+                for member in sync_config['member']:
+                    if member not in ha['vrrp']['group']:
+                        raise ConfigError(f'VRRP sync-group "{sync_group}" refers to VRRP group "{member}", '\
+                                          'but it does not exist!')
+                    else:
+                        ha['vrrp']['group'][member]['_is_sync_group_member'] = True
+                        if ha['vrrp']['group'][member].get('health_check') is not None:
+                            raise ConfigError(
+                                f'Health check configuration for VRRP group "{member}" will remain unused '
+                                f'while it has member of sync group "{sync_group}" '
+                                f'Only sync group health check will be used'
+                            )
+
+    # Virtual-server
+    if 'virtual_server' in ha:
+        for vs, vs_config in ha['virtual_server'].items():
+
+            if 'address' not in vs_config and 'fwmark' not in vs_config:
+                raise ConfigError('Either address or fwmark is required '
+                                  f'but not set for virtual-server "{vs}"')
+
+            if 'port' not in vs_config and 'fwmark' not in vs_config:
+                raise ConfigError(f'Port or fwmark is required but not set for virtual-server "{vs}"')
+            if 'port' in vs_config and 'fwmark' in vs_config:
+                raise ConfigError(f'Cannot set both port and fwmark for virtual-server "{vs}"')
+            if 'real_server' not in vs_config:
+                raise ConfigError(f'Real-server ip is required but not set for virtual-server "{vs}"')
+        # Real-server
+        for rs, rs_config in vs_config['real_server'].items():
+            if 'port' not in rs_config:
+                raise ConfigError(f'Port is required but not set for virtual-server "{vs}" real-server "{rs}"')
+
+
+def _validate_health_check(group, group_config):
+    health_check_types = ["script", "ping"]
+    from vyos.utils.dict import check_mutually_exclusive_options
+    try:
+        check_mutually_exclusive_options(group_config["health_check"],
+                                         health_check_types, required=True)
+    except ValueError:
+        Warning(
+            f'Health check configuration for VRRP group "{group}" will remain unused ' \
+            f'until it has one of the following options: {health_check_types}')
+        # XXX: health check has default options so we need to remove it
+        # to avoid generating useless config statements in keepalived.conf
+        del group_config["health_check"]
+
+
+def generate(ha):
+    if not ha or 'disable' in ha:
+        if os.path.isfile(systemd_override):
+            os.unlink(systemd_override)
+        return None
+
+    render(VRRP.location['config'], 'high-availability/keepalived.conf.j2', ha)
+    render(systemd_override, 'high-availability/10-override.conf.j2', ha)
+    return None
+
+def apply(ha):
+    service_name = 'keepalived.service'
+    call('systemctl daemon-reload')
+    if not ha or 'disable' in ha:
+        call(f'systemctl stop {service_name}')
+        return None
+
+    # Check if IPv6 address is tentative T5533
+    for group, group_config in ha.get('vrrp', {}).get('group', {}).items():
+        if 'hello_source_address' in group_config:
+            if is_ipv6(group_config['hello_source_address']):
+                ipv6_address = group_config['hello_source_address']
+                interface = group_config['interface']
+                checks = 20
+                interval = 0.1
+                for _ in range(checks):
+                    if is_ipv6_tentative(interface, ipv6_address):
+                        time.sleep(interval)
+
+    systemd_action = 'reload-or-restart'
+    if 'restart_required' in ha:
+        systemd_action = 'restart'
+
+    call(f'systemctl {systemd_action} {service_name}')
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_bonding.py b/src/conf_mode/interfaces_bonding.py
new file mode 100644
index 0000000..bbbfb03
--- /dev/null
+++ b/src/conf_mode/interfaces_bonding.py
@@ -0,0 +1,305 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configdict import leaf_node_changed
+from vyos.configdict import is_member
+from vyos.configdict import is_source_interface
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_dhcpv6
+from vyos.configverify import verify_eapol
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_vlan_config
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import BondIf
+from vyos.ifconfig.ethernet import EthernetIf
+from vyos.ifconfig import Section
+from vyos.template import render_to_string
+from vyos.utils.assertion import assert_mac
+from vyos.utils.dict import dict_search
+from vyos.utils.dict import dict_to_paths_values
+from vyos.utils.network import interface_exists
+from vyos.configdict import has_address_configured
+from vyos.configdict import has_vrf_configured
+from vyos.configdep import set_dependents, call_dependents
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_bond_mode(mode):
+    if mode == 'round-robin':
+        return 'balance-rr'
+    elif mode == 'active-backup':
+        return 'active-backup'
+    elif mode == 'xor-hash':
+        return 'balance-xor'
+    elif mode == 'broadcast':
+        return 'broadcast'
+    elif mode == '802.3ad':
+        return '802.3ad'
+    elif mode == 'transmit-load-balance':
+        return 'balance-tlb'
+    elif mode == 'adaptive-load-balance':
+        return 'balance-alb'
+    else:
+        raise ConfigError(f'invalid bond mode "{mode}"')
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'bonding']
+    ifname, bond = get_interface_dict(conf, base, with_pki=True)
+
+    # To make our own life easier transfor the list of member interfaces
+    # into a dictionary - we will use this to add additional information
+    # later on for each member
+    if 'member' in bond and 'interface' in bond['member']:
+        # convert list of member interfaces to a dictionary
+        bond['member']['interface'] = {k: {} for k in bond['member']['interface']}
+
+    if 'mode' in bond:
+        bond['mode'] = get_bond_mode(bond['mode'])
+
+    tmp = is_node_changed(conf, base + [ifname, 'mode'])
+    if tmp: bond['shutdown_required'] = {}
+
+    tmp = is_node_changed(conf, base + [ifname, 'lacp-rate'])
+    if tmp: bond['shutdown_required'] = {}
+
+    # determine which members have been removed
+    interfaces_removed = leaf_node_changed(conf, base + [ifname, 'member', 'interface'])
+    # Reset config level to interfaces
+    old_level = conf.get_level()
+    conf.set_level(['interfaces'])
+
+    if interfaces_removed:
+        bond['shutdown_required'] = {}
+        if 'member' not in bond:
+            bond['member'] = {}
+
+        tmp = {}
+        for interface in interfaces_removed:
+            # if member is deleted from bond, add dependencies to call
+            # ethernet commit again in apply function
+            # to apply options under ethernet section
+            set_dependents('ethernet', conf, interface)
+            section = Section.section(interface) # this will be 'ethernet' for 'eth0'
+            if conf.exists([section, interface, 'disable']):
+                tmp[interface] = {'disable': ''}
+            else:
+                tmp[interface] = {}
+
+        # also present the interfaces to be removed from the bond as dictionary
+        bond['member']['interface_remove'] = tmp
+
+    # Restore existing config level
+    conf.set_level(old_level)
+
+    if dict_search('member.interface', bond):
+        for interface, interface_config in bond['member']['interface'].items():
+
+            interface_ethernet_config = conf.get_config_dict(
+                ['interfaces', 'ethernet', interface],
+                key_mangling=('-', '_'),
+                get_first_key=True,
+                no_tag_node_value_mangle=True,
+                with_defaults=False,
+                with_recursive_defaults=False)
+
+            interface_config['config_paths'] = dict_to_paths_values(interface_ethernet_config)
+
+            # Check if member interface is a new member
+            if not conf.exists_effective(base + [ifname, 'member', 'interface', interface]):
+                bond['shutdown_required'] = {}
+                interface_config['new_added'] = {}
+
+            # Check if member interface is disabled
+            conf.set_level(['interfaces'])
+
+            section = Section.section(interface) # this will be 'ethernet' for 'eth0'
+            if conf.exists([section, interface, 'disable']):
+                interface_config['disable'] = ''
+
+            conf.set_level(old_level)
+
+            # Check if member interface is already member of another bridge
+            tmp = is_member(conf, interface, 'bridge')
+            if tmp: interface_config['is_bridge_member'] = tmp
+
+            # Check if member interface is already member of a bond
+            tmp = is_member(conf, interface, 'bonding')
+            for tmp in is_member(conf, interface, 'bonding'):
+                if bond['ifname'] == tmp:
+                    continue
+                interface_config['is_bond_member'] = tmp
+
+            # Check if member interface is used as source-interface on another interface
+            tmp = is_source_interface(conf, interface)
+            if tmp: interface_config['is_source_interface'] = tmp
+
+            # bond members must not have an assigned address
+            tmp = has_address_configured(conf, interface)
+            if tmp: interface_config['has_address'] = {}
+
+            # bond members must not have a VRF attached
+            tmp = has_vrf_configured(conf, interface)
+            if tmp: interface_config['has_vrf'] = {}
+    return bond
+
+
+def verify(bond):
+    if 'deleted' in bond:
+        verify_bridge_delete(bond)
+        return None
+
+    if 'arp_monitor' in bond:
+        if 'target' in bond['arp_monitor'] and len(bond['arp_monitor']['target']) > 16:
+            raise ConfigError('The maximum number of arp-monitor targets is 16')
+
+        if 'interval' in bond['arp_monitor'] and int(bond['arp_monitor']['interval']) > 0:
+            if bond['mode'] in ['802.3ad', 'balance-tlb', 'balance-alb']:
+                raise ConfigError('ARP link monitoring does not work for mode 802.3ad, ' \
+                                  'transmit-load-balance or adaptive-load-balance')
+
+    if 'primary' in bond:
+        if bond['mode'] not in ['active-backup', 'balance-tlb', 'balance-alb']:
+            raise ConfigError('Option primary - mode dependency failed, not'
+                              'supported in mode {mode}!'.format(**bond))
+
+    verify_mtu_ipv6(bond)
+    verify_address(bond)
+    verify_dhcpv6(bond)
+    verify_vrf(bond)
+    verify_mirror_redirect(bond)
+    verify_eapol(bond)
+
+    # use common function to verify VLAN configuration
+    verify_vlan_config(bond)
+
+    bond_name = bond['ifname']
+    if dict_search('member.interface', bond):
+        for interface, interface_config in bond['member']['interface'].items():
+            error_msg = f'Can not add interface "{interface}" to bond, '
+
+            if interface == 'lo':
+                raise ConfigError('Loopback interface "lo" can not be added to a bond')
+
+            if not interface_exists(interface):
+                raise ConfigError(error_msg + 'it does not exist!')
+
+            if 'is_bridge_member' in interface_config:
+                tmp = next(iter(interface_config['is_bridge_member']))
+                raise ConfigError(error_msg + f'it is already a member of bridge "{tmp}"!')
+
+            if 'is_bond_member' in interface_config:
+                tmp = next(iter(interface_config['is_bond_member']))
+                raise ConfigError(error_msg + f'it is already a member of bond "{tmp}"!')
+
+            if 'is_source_interface' in interface_config:
+                tmp = interface_config['is_source_interface']
+                raise ConfigError(error_msg + f'it is the source-interface of "{tmp}"!')
+
+            if 'has_address' in interface_config:
+                raise ConfigError(error_msg + 'it has an address assigned!')
+
+            if 'has_vrf' in interface_config:
+                raise ConfigError(error_msg + 'it has a VRF assigned!')
+
+            if 'new_added' in interface_config and 'config_paths' in interface_config:
+                for option_path, option_value in interface_config['config_paths'].items():
+                    if option_path in EthernetIf.get_bond_member_allowed_options() :
+                        continue
+                    if option_path in BondIf.get_inherit_bond_options():
+                        continue
+                    raise ConfigError(error_msg + f'it has a "{option_path.replace(".", " ")}" assigned!')
+
+    if 'primary' in bond:
+        if bond['primary'] not in bond['member']['interface']:
+            raise ConfigError(f'Primary interface of bond "{bond_name}" must be a member interface')
+
+        if bond['mode'] not in ['active-backup', 'balance-tlb', 'balance-alb']:
+            raise ConfigError('primary interface only works for mode active-backup, ' \
+                              'transmit-load-balance or adaptive-load-balance')
+
+    if 'system_mac' in bond:
+        if bond['mode'] != '802.3ad':
+            raise ConfigError('Actor MAC address only available in 802.3ad mode!')
+
+        system_mac = bond['system_mac']
+        try:
+            assert_mac(system_mac, test_all_zero=False)
+        except:
+            raise ConfigError(f'Cannot use a multicast MAC address "{system_mac}" as system-mac!')
+
+    return None
+
+def generate(bond):
+    bond['frr_zebra_config'] = ''
+    if 'deleted' not in bond:
+        bond['frr_zebra_config'] = render_to_string('frr/evpn.mh.frr.j2', bond)
+    return None
+
+def apply(bond):
+    ifname = bond['ifname']
+    b = BondIf(ifname)
+    if 'deleted' in bond:
+        # delete interface
+        b.remove()
+    else:
+        b.update(bond)
+
+    if dict_search('member.interface_remove', bond):
+        try:
+            call_dependents()
+        except ConfigError:
+            raise ConfigError('Error in updating ethernet interface '
+                              'after deleting it from bond')
+
+    zebra_daemon = 'zebra'
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # The route-map used for the FIB (zebra) is part of the zebra daemon
+    frr_cfg.load_configuration(zebra_daemon)
+    frr_cfg.modify_section(f'^interface {ifname}', stop_pattern='^exit', remove_stop_mark=True)
+    if 'frr_zebra_config' in bond:
+        frr_cfg.add_before(frr.default_add_before, bond['frr_zebra_config'])
+    frr_cfg.commit_configuration(zebra_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_bridge.py b/src/conf_mode/interfaces_bridge.py
new file mode 100644
index 0000000..637db44
--- /dev/null
+++ b/src/conf_mode/interfaces_bridge.py
@@ -0,0 +1,219 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import node_changed
+from vyos.configdict import is_member
+from vyos.configdict import is_source_interface
+from vyos.configdict import has_vlan_subinterface_configured
+from vyos.configverify import verify_dhcpv6
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import BridgeIf
+from vyos.configdict import has_address_configured
+from vyos.configdict import has_vrf_configured
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
+from vyos.utils.dict import dict_search
+from vyos.utils.network import interface_exists
+from vyos import ConfigError
+
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'bridge']
+    ifname, bridge = get_interface_dict(conf, base)
+
+    # determine which members have been removed
+    tmp = node_changed(conf, base + [ifname, 'member', 'interface'])
+    if tmp:
+        if 'member' in bridge:
+            bridge['member'].update({'interface_remove': {t: {} for t in tmp}})
+        else:
+            bridge.update({'member': {'interface_remove': {t: {} for t in tmp}}})
+        for interface in tmp:
+            # When using VXLAN member interfaces that are configured for Single
+            # VXLAN Device (SVD) we need to call the VXLAN conf-mode script to
+            # re-create VLAN to VNI mappings if required, but only if the interface
+            # is already live on the system - this must not be done on first commit
+            if interface.startswith('vxlan') and interface_exists(interface):
+                set_dependents('vxlan', conf, interface)
+                _, vxlan = get_interface_dict(conf, ['interfaces', 'vxlan'], ifname=interface)
+                bridge['member']['interface_remove'].update({interface: vxlan})
+            # When using Wireless member interfaces we need to inform hostapd
+            # to properly set-up the bridge
+            elif interface.startswith('wlan') and interface_exists(interface):
+                set_dependents('wlan', conf, interface)
+
+    if dict_search('member.interface', bridge) is not None:
+        for interface in list(bridge['member']['interface']):
+            # Check if member interface is already member of another bridge
+            tmp = is_member(conf, interface, 'bridge')
+            if tmp and bridge['ifname'] not in tmp:
+                bridge['member']['interface'][interface].update({'is_bridge_member' : tmp})
+
+            # Check if member interface is already member of a bond
+            tmp = is_member(conf, interface, 'bonding')
+            if tmp: bridge['member']['interface'][interface].update({'is_bond_member' : tmp})
+
+            # Check if member interface is used as source-interface on another interface
+            tmp = is_source_interface(conf, interface)
+            if tmp: bridge['member']['interface'][interface].update({'is_source_interface' : tmp})
+
+            # Bridge members must not have an assigned address
+            tmp = has_address_configured(conf, interface)
+            if tmp: bridge['member']['interface'][interface].update({'has_address' : ''})
+
+            # Bridge members must not have a VRF attached
+            tmp = has_vrf_configured(conf, interface)
+            if tmp: bridge['member']['interface'][interface].update({'has_vrf' : ''})
+
+            # VLAN-aware bridge members must not have VLAN interface configuration
+            tmp = has_vlan_subinterface_configured(conf,interface)
+            if 'enable_vlan' in bridge and tmp:
+                bridge['member']['interface'][interface].update({'has_vlan' : ''})
+
+            # When using VXLAN member interfaces that are configured for Single
+            # VXLAN Device (SVD) we need to call the VXLAN conf-mode script to
+            # re-create VLAN to VNI mappings if required, but only if the interface
+            # is already live on the system - this must not be done on first commit
+            if interface.startswith('vxlan') and interface_exists(interface):
+                set_dependents('vxlan', conf, interface)
+            # When using Wireless member interfaces we need to inform hostapd
+            # to properly set-up the bridge
+            elif interface.startswith('wlan') and interface_exists(interface):
+                set_dependents('wlan', conf, interface)
+
+    # delete empty dictionary keys - no need to run code paths if nothing is there to do
+    if 'member' in bridge:
+        if 'interface' in bridge['member'] and len(bridge['member']['interface']) == 0:
+            del bridge['member']['interface']
+
+        if len(bridge['member']) == 0:
+            del bridge['member']
+
+    return bridge
+
+def verify(bridge):
+    # to delete interface or remove a member interface VXLAN first need to check if
+    # VXLAN does not require to be a member of a bridge interface
+    if dict_search('member.interface_remove', bridge):
+        for iface, iface_config in bridge['member']['interface_remove'].items():
+            if iface.startswith('vxlan') and dict_search('parameters.neighbor_suppress', iface_config) != None:
+                raise ConfigError(
+                    f'To detach interface {iface} from bridge you must first '
+                    f'disable "neighbor-suppress" parameter in the VXLAN interface {iface}'
+                )
+
+    if 'deleted' in bridge:
+        return None
+
+    verify_dhcpv6(bridge)
+    verify_vrf(bridge)
+    verify_mirror_redirect(bridge)
+
+    ifname = bridge['ifname']
+
+    if dict_search('member.interface', bridge):
+        for interface, interface_config in bridge['member']['interface'].items():
+            error_msg = f'Can not add interface "{interface}" to bridge, '
+
+            if interface == 'lo':
+                raise ConfigError('Loopback interface "lo" can not be added to a bridge')
+
+            if 'is_bridge_member' in interface_config:
+                tmp = next(iter(interface_config['is_bridge_member']))
+                raise ConfigError(error_msg + f'it is already a member of bridge "{tmp}"!')
+
+            if 'is_bond_member' in interface_config:
+                tmp = next(iter(interface_config['is_bond_member']))
+                raise ConfigError(error_msg + f'it is already a member of bond "{tmp}"!')
+
+            if 'is_source_interface' in interface_config:
+                tmp = interface_config['is_source_interface']
+                raise ConfigError(error_msg + f'it is the source-interface of "{tmp}"!')
+
+            if 'has_address' in interface_config:
+                raise ConfigError(error_msg + 'it has an address assigned!')
+
+            if 'has_vrf' in interface_config:
+                raise ConfigError(error_msg + 'it has a VRF assigned!')
+
+            if 'enable_vlan' in bridge:
+                if 'has_vlan' in interface_config:
+                    raise ConfigError(error_msg + 'it has VLAN subinterface(s) assigned!')
+            else:
+                for option in ['allowed_vlan', 'native_vlan']:
+                    if option in interface_config:
+                        raise ConfigError('Can not use VLAN options on non VLAN aware bridge')
+
+    if 'enable_vlan' in bridge:
+        if dict_search('vif.1', bridge):
+            raise ConfigError(f'VLAN 1 sub interface cannot be set for VLAN aware bridge {ifname}, and VLAN 1 is always the parent interface')
+    else:
+        if dict_search('vif', bridge):
+            raise ConfigError(f'You must first activate "enable-vlan" of {ifname} bridge to use "vif"')
+
+    return None
+
+def generate(bridge):
+    return None
+
+def apply(bridge):
+    br = BridgeIf(bridge['ifname'])
+    if 'deleted' in bridge:
+        # delete interface
+        br.remove()
+    else:
+        br.update(bridge)
+
+    tmp = []
+    if 'member' in bridge:
+        if 'interface_remove' in bridge['member']:
+            tmp.extend(bridge['member']['interface_remove'])
+        if 'interface' in bridge['member']:
+            tmp.extend(bridge['member']['interface'])
+
+    for interface in tmp:
+        if interface.startswith(tuple(['vxlan', 'wlan'])) and interface_exists(interface):
+            try:
+                call_dependents()
+            except ConfigError:
+                raise ConfigError(f'Error updating member interface {interface} configuration after changing bridge!')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_dummy.py b/src/conf_mode/interfaces_dummy.py
new file mode 100644
index 0000000..db768b9
--- /dev/null
+++ b/src/conf_mode/interfaces_dummy.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_mirror_redirect
+from vyos.ifconfig import DummyIf
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'dummy']
+    _, dummy = get_interface_dict(conf, base)
+    return dummy
+
+def verify(dummy):
+    if 'deleted' in dummy:
+        verify_bridge_delete(dummy)
+        return None
+
+    verify_vrf(dummy)
+    verify_address(dummy)
+    verify_mirror_redirect(dummy)
+
+    return None
+
+def generate(dummy):
+    return None
+
+def apply(dummy):
+    d = DummyIf(**dummy)
+
+    # Remove dummy interface
+    if 'deleted' in dummy:
+        d.remove()
+    else:
+        d.update(dummy)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_ethernet.py b/src/conf_mode/interfaces_ethernet.py
new file mode 100644
index 0000000..34ce7bc
--- /dev/null
+++ b/src/conf_mode/interfaces_ethernet.py
@@ -0,0 +1,360 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_address
+from vyos.configverify import verify_dhcpv6
+from vyos.configverify import verify_interface_exists
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_mtu
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_vlan_config
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_bond_bridge_member
+from vyos.configverify import verify_eapol
+from vyos.ethtool import Ethtool
+from vyos.ifconfig import EthernetIf
+from vyos.ifconfig import BondIf
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search
+from vyos.utils.dict import dict_to_paths_values
+from vyos.utils.dict import dict_set
+from vyos.utils.dict import dict_delete
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def update_bond_options(conf: Config, eth_conf: dict) -> list:
+    """
+    Return list of blocked options if interface is a bond member
+    :param conf: Config object
+    :type conf: Config
+    :param eth_conf: Ethernet config dictionary
+    :type eth_conf: dict
+    :return: List of blocked options
+    :rtype: list
+    """
+    blocked_list = []
+    bond_name = list(eth_conf['is_bond_member'].keys())[0]
+    config_without_defaults = conf.get_config_dict(
+        ['interfaces', 'ethernet', eth_conf['ifname']],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=False,
+        with_recursive_defaults=False)
+    config_with_defaults = conf.get_config_dict(
+        ['interfaces', 'ethernet', eth_conf['ifname']],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True)
+    bond_config_with_defaults = conf.get_config_dict(
+        ['interfaces', 'bonding', bond_name],
+        key_mangling=('-', '_'),
+        get_first_key=True,
+        no_tag_node_value_mangle=True,
+        with_defaults=True,
+        with_recursive_defaults=True)
+    eth_dict_paths = dict_to_paths_values(config_without_defaults)
+    eth_path_base = ['interfaces', 'ethernet', eth_conf['ifname']]
+
+    #if option is configured under ethernet section
+    for option_path, option_value in eth_dict_paths.items():
+        bond_option_value = dict_search(option_path, bond_config_with_defaults)
+
+        #If option is allowed for changing then continue
+        if option_path in EthernetIf.get_bond_member_allowed_options():
+            continue
+        # if option is inherited from bond then set valued from bond interface
+        if option_path in BondIf.get_inherit_bond_options():
+            # If option equals to bond option then do nothing
+            if option_value == bond_option_value:
+                continue
+            else:
+                # if ethernet has option and bond interface has
+                # then copy it from bond
+                if bond_option_value is not None:
+                    if is_node_changed(conf, eth_path_base + option_path.split('.')):
+                        Warning(
+                            f'Cannot apply "{option_path.replace(".", " ")}" to "{option_value}".' \
+                            f' Interface "{eth_conf["ifname"]}" is a bond member.' \
+                            f' Option is inherited from bond "{bond_name}"')
+                    dict_set(option_path, bond_option_value, eth_conf)
+                    continue
+                # if ethernet has option and bond interface does not have
+                # then delete it form dict and do not apply it
+                else:
+                    if is_node_changed(conf, eth_path_base + option_path.split('.')):
+                        Warning(
+                            f'Cannot apply "{option_path.replace(".", " ")}".' \
+                            f' Interface "{eth_conf["ifname"]}" is a bond member.' \
+                            f' Option is inherited from bond "{bond_name}"')
+                    dict_delete(option_path, eth_conf)
+        blocked_list.append(option_path)
+
+    # if inherited option is not configured under ethernet section but configured under bond section
+    for option_path in BondIf.get_inherit_bond_options():
+        bond_option_value = dict_search(option_path, bond_config_with_defaults)
+        if bond_option_value is not None:
+            if option_path not in eth_dict_paths:
+                if is_node_changed(conf, eth_path_base + option_path.split('.')):
+                    Warning(
+                        f'Cannot apply "{option_path.replace(".", " ")}" to "{dict_search(option_path, config_with_defaults)}".' \
+                        f' Interface "{eth_conf["ifname"]}" is a bond member. ' \
+                        f'Option is inherited from bond "{bond_name}"')
+                dict_set(option_path, bond_option_value, eth_conf)
+    eth_conf['bond_blocked_changes'] = blocked_list
+    return None
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['interfaces', 'ethernet']
+    ifname, ethernet = get_interface_dict(conf, base, with_pki=True)
+
+    # T5862 - default MTU is not acceptable in some environments
+    # There are cloud environments available where the maximum supported
+    # ethernet MTU is e.g. 1450 bytes, thus we clamp this to the adapters
+    # maximum MTU value or 1500 bytes - whatever is lower
+    if 'mtu' not in ethernet:
+        try:
+            ethernet['mtu'] = '1500'
+            max_mtu = EthernetIf(ifname).get_max_mtu()
+            if max_mtu < int(ethernet['mtu']):
+                ethernet['mtu'] = str(max_mtu)
+        except:
+            pass
+
+    if 'is_bond_member' in ethernet:
+        update_bond_options(conf, ethernet)
+
+    tmp = is_node_changed(conf, base + [ifname, 'speed'])
+    if tmp: ethernet.update({'speed_duplex_changed': {}})
+
+    tmp = is_node_changed(conf, base + [ifname, 'duplex'])
+    if tmp: ethernet.update({'speed_duplex_changed': {}})
+
+    return ethernet
+
+def verify_speed_duplex(ethernet: dict, ethtool: Ethtool):
+    """
+     Verify speed and duplex
+    :param ethernet: dictionary which is received from get_interface_dict
+    :type ethernet: dict
+    :param ethtool: Ethernet object
+    :type ethtool: Ethtool
+    """
+    if ((ethernet['speed'] == 'auto' and ethernet['duplex'] != 'auto') or
+            (ethernet['speed'] != 'auto' and ethernet['duplex'] == 'auto')):
+        raise ConfigError(
+            'Speed/Duplex missmatch. Must be both auto or manually configured')
+
+    if ethernet['speed'] != 'auto' and ethernet['duplex'] != 'auto':
+        # We need to verify if the requested speed and duplex setting is
+        # supported by the underlaying NIC.
+        speed = ethernet['speed']
+        duplex = ethernet['duplex']
+        if not ethtool.check_speed_duplex(speed, duplex):
+            raise ConfigError(
+                f'Adapter does not support changing speed ' \
+                f'and duplex settings to: {speed}/{duplex}!')
+
+
+def verify_flow_control(ethernet: dict, ethtool: Ethtool):
+    """
+     Verify flow control
+    :param ethernet: dictionary which is received from get_interface_dict
+    :type ethernet: dict
+    :param ethtool: Ethernet object
+    :type ethtool: Ethtool
+    """
+    if 'disable_flow_control' in ethernet:
+        if not ethtool.check_flow_control():
+            raise ConfigError(
+                'Adapter does not support changing flow-control settings!')
+
+
+def verify_ring_buffer(ethernet: dict, ethtool: Ethtool):
+    """
+     Verify ring buffer
+    :param ethernet: dictionary which is received from get_interface_dict
+    :type ethernet: dict
+    :param ethtool: Ethernet object
+    :type ethtool: Ethtool
+    """
+    if 'ring_buffer' in ethernet:
+        max_rx = ethtool.get_ring_buffer_max('rx')
+        if not max_rx:
+            raise ConfigError(
+                'Driver does not support RX ring-buffer configuration!')
+
+        max_tx = ethtool.get_ring_buffer_max('tx')
+        if not max_tx:
+            raise ConfigError(
+                'Driver does not support TX ring-buffer configuration!')
+
+        rx = dict_search('ring_buffer.rx', ethernet)
+        if rx and int(rx) > int(max_rx):
+            raise ConfigError(f'Driver only supports a maximum RX ring-buffer ' \
+                              f'size of "{max_rx}" bytes!')
+
+        tx = dict_search('ring_buffer.tx', ethernet)
+        if tx and int(tx) > int(max_tx):
+            raise ConfigError(f'Driver only supports a maximum TX ring-buffer ' \
+                              f'size of "{max_tx}" bytes!')
+
+
+def verify_offload(ethernet: dict, ethtool: Ethtool):
+    """
+     Verify offloading capabilities
+    :param ethernet: dictionary which is received from get_interface_dict
+    :type ethernet: dict
+    :param ethtool: Ethernet object
+    :type ethtool: Ethtool
+    """
+    if dict_search('offload.rps', ethernet) != None:
+        if not os.path.exists(f'/sys/class/net/{ethernet["ifname"]}/queues/rx-0/rps_cpus'):
+            raise ConfigError('Interface does not suport RPS!')
+    driver = ethtool.get_driver_name()
+    # T3342 - Xen driver requires special treatment
+    if driver == 'vif':
+        if int(ethernet['mtu']) > 1500 and dict_search('offload.sg', ethernet) == None:
+            raise ConfigError('Xen netback drivers requires scatter-gatter offloading '\
+                              'for MTU size larger then 1500 bytes')
+
+
+def verify_allowedbond_changes(ethernet: dict):
+    """
+     Verify changed options if interface is in bonding
+    :param ethernet: dictionary which is received from get_interface_dict
+    :type ethernet: dict
+    """
+    if 'bond_blocked_changes' in ethernet:
+        for option in ethernet['bond_blocked_changes']:
+            raise ConfigError(f'Cannot configure "{option.replace(".", " ")}"' \
+                              f' on interface "{ethernet["ifname"]}".' \
+                              f' Interface is a bond member')
+
+def verify(ethernet):
+    if 'deleted' in ethernet:
+        return None
+    if 'is_bond_member' in ethernet:
+        verify_bond_member(ethernet)
+    else:
+        verify_ethernet(ethernet)
+
+
+def verify_bond_member(ethernet):
+    """
+     Verification function for ethernet interface which is in bonding
+    :param ethernet: dictionary which is received from get_interface_dict
+    :type ethernet: dict
+    """
+    ifname = ethernet['ifname']
+    verify_interface_exists(ethernet, ifname)
+    verify_eapol(ethernet)
+    verify_mirror_redirect(ethernet)
+    ethtool = Ethtool(ifname)
+    verify_speed_duplex(ethernet, ethtool)
+    verify_flow_control(ethernet, ethtool)
+    verify_ring_buffer(ethernet, ethtool)
+    verify_offload(ethernet, ethtool)
+    verify_allowedbond_changes(ethernet)
+
+def verify_ethernet(ethernet):
+    """
+     Verification function for simple ethernet interface
+    :param ethernet: dictionary which is received from get_interface_dict
+    :type ethernet: dict
+    """
+    ifname = ethernet['ifname']
+    verify_interface_exists(ethernet, ifname)
+    verify_mtu(ethernet)
+    verify_mtu_ipv6(ethernet)
+    verify_dhcpv6(ethernet)
+    verify_address(ethernet)
+    verify_vrf(ethernet)
+    verify_bond_bridge_member(ethernet)
+    verify_eapol(ethernet)
+    verify_mirror_redirect(ethernet)
+    ethtool = Ethtool(ifname)
+    # No need to check speed and duplex keys as both have default values.
+    verify_speed_duplex(ethernet, ethtool)
+    verify_flow_control(ethernet, ethtool)
+    verify_ring_buffer(ethernet, ethtool)
+    verify_offload(ethernet, ethtool)
+    # use common function to verify VLAN configuration
+    verify_vlan_config(ethernet)
+    return None
+
+def generate(ethernet):
+    if 'deleted' in ethernet:
+        return None
+
+    ethernet['frr_zebra_config'] = ''
+    if 'deleted' not in ethernet:
+        ethernet['frr_zebra_config'] = render_to_string('frr/evpn.mh.frr.j2', ethernet)
+
+    return None
+
+def apply(ethernet):
+    ifname = ethernet['ifname']
+
+    e = EthernetIf(ifname)
+    if 'deleted' in ethernet:
+        # delete interface
+        e.remove()
+    else:
+        e.update(ethernet)
+
+    zebra_daemon = 'zebra'
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # The route-map used for the FIB (zebra) is part of the zebra daemon
+    frr_cfg.load_configuration(zebra_daemon)
+    frr_cfg.modify_section(f'^interface {ifname}', stop_pattern='^exit', remove_stop_mark=True)
+    if 'frr_zebra_config' in ethernet:
+        frr_cfg.add_before(frr.default_add_before, ethernet['frr_zebra_config'])
+    frr_cfg.commit_configuration(zebra_daemon)
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_geneve.py b/src/conf_mode/interfaces_geneve.py
new file mode 100644
index 0000000..007708d
--- /dev/null
+++ b/src/conf_mode/interfaces_geneve.py
@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_address
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_bond_bridge_member
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import GeneveIf
+from vyos.utils.network import interface_exists
+from vyos import ConfigError
+
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'geneve']
+    ifname, geneve = get_interface_dict(conf, base)
+
+    # GENEVE interfaces are picky and require recreation if certain parameters
+    # change. But a GENEVE interface should - of course - not be re-created if
+    # it's description or IP address is adjusted. Feels somehow logic doesn't it?
+    for cli_option in ['remote', 'vni', 'parameters']:
+        if is_node_changed(conf, base + [ifname, cli_option]):
+            geneve.update({'rebuild_required': {}})
+
+    return geneve
+
+def verify(geneve):
+    if 'deleted' in geneve:
+        verify_bridge_delete(geneve)
+        return None
+
+    verify_mtu_ipv6(geneve)
+    verify_address(geneve)
+    verify_vrf(geneve)
+    verify_bond_bridge_member(geneve)
+    verify_mirror_redirect(geneve)
+
+    if 'remote' not in geneve:
+        raise ConfigError('Remote side must be configured')
+
+    if 'vni' not in geneve:
+        raise ConfigError('VNI must be configured')
+
+    return None
+
+
+def generate(geneve):
+    return None
+
+def apply(geneve):
+    # Check if GENEVE interface already exists
+    if 'rebuild_required' in geneve or 'delete' in geneve:
+        if interface_exists(geneve['ifname']):
+            g = GeneveIf(**geneve)
+            # GENEVE is super picky and the tunnel always needs to be recreated,
+            # thus we can simply always delete it first.
+            g.remove()
+
+    if 'deleted' not in geneve:
+        # Finally create the new interface
+        g = GeneveIf(**geneve)
+        g.update(geneve)
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_input.py b/src/conf_mode/interfaces_input.py
new file mode 100644
index 0000000..ad24884
--- /dev/null
+++ b/src/conf_mode/interfaces_input.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configverify import verify_mirror_redirect
+from vyos.ifconfig import InputIf
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at
+    least the interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'input']
+    _, ifb = get_interface_dict(conf, base)
+
+    return ifb
+
+def verify(ifb):
+    if 'deleted' in ifb:
+        return None
+
+    verify_mirror_redirect(ifb)
+    return None
+
+def generate(ifb):
+    return None
+
+def apply(ifb):
+    d = InputIf(ifb['ifname'])
+
+    # Remove input interface
+    if 'deleted' in ifb:
+        d.remove()
+    else:
+        d.update(ifb)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_l2tpv3.py b/src/conf_mode/interfaces_l2tpv3.py
new file mode 100644
index 0000000..f0a7043
--- /dev/null
+++ b/src/conf_mode/interfaces_l2tpv3.py
@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import leaf_node_changed
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_bond_bridge_member
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import L2TPv3If
+from vyos.utils.kernel import check_kmod
+from vyos.utils.network import is_addr_assigned
+from vyos.utils.network import interface_exists
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+k_mod = ['l2tp_eth', 'l2tp_netlink', 'l2tp_ip', 'l2tp_ip6']
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'l2tpv3']
+    ifname, l2tpv3 = get_interface_dict(conf, base)
+
+    # To delete an l2tpv3 interface we need the current tunnel and session-id
+    if 'deleted' in l2tpv3:
+        tmp = leaf_node_changed(conf, base + [ifname, 'tunnel-id'])
+        # leaf_node_changed() returns a list
+        l2tpv3.update({'tunnel_id': tmp[0]})
+
+        tmp = leaf_node_changed(conf, base + [ifname, 'session-id'])
+        l2tpv3.update({'session_id': tmp[0]})
+
+    return l2tpv3
+
+def verify(l2tpv3):
+    if 'deleted' in l2tpv3:
+        verify_bridge_delete(l2tpv3)
+        return None
+
+    interface = l2tpv3['ifname']
+
+    for key in ['source_address', 'remote', 'tunnel_id', 'peer_tunnel_id',
+                'session_id', 'peer_session_id']:
+        if key not in l2tpv3:
+            tmp = key.replace('_', '-')
+            raise ConfigError(f'Missing mandatory L2TPv3 option: "{tmp}"!')
+
+    if not is_addr_assigned(l2tpv3['source_address']):
+        raise ConfigError('L2TPv3 source-address address "{source_address}" '
+                          'not configured on any interface!'.format(**l2tpv3))
+
+    verify_mtu_ipv6(l2tpv3)
+    verify_address(l2tpv3)
+    verify_vrf(l2tpv3)
+    verify_bond_bridge_member(l2tpv3)
+    verify_mirror_redirect(l2tpv3)
+    return None
+
+def generate(l2tpv3):
+    return None
+
+def apply(l2tpv3):
+    check_kmod(k_mod)
+
+    # Check if L2TPv3 interface already exists
+    if interface_exists(l2tpv3['ifname']):
+        # L2TPv3 is picky when changing tunnels/sessions, thus we can simply
+        # always delete it first.
+        l = L2TPv3If(**l2tpv3)
+        l.remove()
+
+    if 'deleted' not in l2tpv3:
+        # Finally create the new interface
+        l = L2TPv3If(**l2tpv3)
+        l.update(l2tpv3)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_loopback.py b/src/conf_mode/interfaces_loopback.py
new file mode 100644
index 0000000..a784e9e
--- /dev/null
+++ b/src/conf_mode/interfaces_loopback.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configverify import verify_mirror_redirect
+from vyos.ifconfig import LoopbackIf
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'loopback']
+    _, loopback = get_interface_dict(conf, base)
+    return loopback
+
+def verify(loopback):
+    verify_mirror_redirect(loopback)
+    return None
+
+def generate(loopback):
+    return None
+
+def apply(loopback):
+    l = LoopbackIf(**loopback)
+    if 'deleted' in loopback:
+        l.remove()
+    else:
+        l.update(loopback)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_macsec.py b/src/conf_mode/interfaces_macsec.py
new file mode 100644
index 0000000..3ede437
--- /dev/null
+++ b/src/conf_mode/interfaces_macsec.py
@@ -0,0 +1,207 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configdict import is_source_interface
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_source_interface
+from vyos.configverify import verify_bond_bridge_member
+from vyos.ifconfig import MACsecIf
+from vyos.ifconfig import Interface
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.dict import dict_search
+from vyos.utils.network import interface_exists
+from vyos.utils.process import is_systemd_service_running
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+# XXX: wpa_supplicant works on the source interface
+wpa_suppl_conf = '/run/wpa_supplicant/{source_interface}.conf'
+
+# Constants
+## gcm-aes-128 requires a 128bit long key - 32 characters (string) = 16byte = 128bit
+GCM_AES_128_LEN: int = 32
+GCM_128_KEY_ERROR = 'gcm-aes-128 requires a 128bit long key!'
+## gcm-aes-256 requires a 256bit long key - 64 characters (string) = 32byte = 256bit
+GCM_AES_256_LEN: int = 64
+GCM_256_KEY_ERROR = 'gcm-aes-256 requires a 256bit long key!'
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'macsec']
+    ifname, macsec = get_interface_dict(conf, base)
+
+    # Check if interface has been removed
+    if 'deleted' in macsec:
+        source_interface = conf.return_effective_value(base + [ifname, 'source-interface'])
+        macsec.update({'source_interface': source_interface})
+
+    if is_node_changed(conf, base + [ifname, 'security']):
+        macsec.update({'shutdown_required': {}})
+
+    if is_node_changed(conf, base + [ifname, 'source_interface']):
+        macsec.update({'shutdown_required': {}})
+
+    if 'source_interface' in macsec:
+        tmp = is_source_interface(conf, macsec['source_interface'], ['macsec', 'pseudo-ethernet'])
+        if tmp and tmp != ifname: macsec.update({'is_source_interface' : tmp})
+
+    return macsec
+
+
+def verify(macsec):
+    if 'deleted' in macsec:
+        verify_bridge_delete(macsec)
+        return None
+
+    verify_source_interface(macsec)
+    verify_vrf(macsec)
+    verify_mtu_ipv6(macsec)
+    verify_address(macsec)
+    verify_bond_bridge_member(macsec)
+    verify_mirror_redirect(macsec)
+
+    if dict_search('security.cipher', macsec) == None:
+        raise ConfigError('Cipher suite must be set for MACsec "{ifname}"'.format(**macsec))
+
+    if dict_search('security.encrypt', macsec) != None:
+        # Check that only static or MKA config is present
+        if dict_search('security.static', macsec) != None and (dict_search('security.mka.cak', macsec) != None or dict_search('security.mka.ckn', macsec) != None):
+            raise ConfigError('Only static or MKA can be used!')
+
+        # Logic to check static configuration
+        if dict_search('security.static', macsec) != None:
+            # key must be defined
+            if dict_search('security.static.key', macsec) == None:
+                raise ConfigError('Static MACsec key must be defined.')
+
+            tx_len = len(dict_search('security.static.key', macsec))
+
+            if dict_search('security.cipher', macsec) == 'gcm-aes-128' and tx_len != GCM_AES_128_LEN:
+                raise ConfigError(GCM_128_KEY_ERROR)
+
+            if dict_search('security.cipher', macsec) == 'gcm-aes-256' and tx_len != GCM_AES_256_LEN:
+                raise ConfigError(GCM_256_KEY_ERROR)
+
+            # Make sure at least one peer is defined
+            if 'peer' not in macsec['security']['static']:
+                raise ConfigError('Must have at least one peer defined for static MACsec')
+
+            # For every enabled peer, make sure a MAC and key is defined
+            for peer, peer_config in macsec['security']['static']['peer'].items():
+                if 'disable' not in peer_config and ('mac' not in peer_config or 'key' not in peer_config):
+                    raise ConfigError('Every enabled MACsec static peer must have a MAC address and key defined!')
+
+                # check key length against cipher suite
+                rx_len = len(peer_config['key'])
+
+                if dict_search('security.cipher', macsec) == 'gcm-aes-128' and rx_len != GCM_AES_128_LEN:
+                    raise ConfigError(GCM_128_KEY_ERROR)
+
+                if dict_search('security.cipher', macsec) == 'gcm-aes-256' and rx_len != GCM_AES_256_LEN:
+                    raise ConfigError(GCM_256_KEY_ERROR)
+
+        # Logic to check MKA configuration
+        else:
+            if dict_search('security.mka.cak', macsec) == None or dict_search('security.mka.ckn', macsec) == None:
+                raise ConfigError('Missing mandatory MACsec security keys as encryption is enabled!')
+
+            cak_len = len(dict_search('security.mka.cak', macsec))
+
+            if dict_search('security.cipher', macsec) == 'gcm-aes-128' and cak_len != GCM_AES_128_LEN:
+                raise ConfigError(GCM_128_KEY_ERROR)
+
+            elif dict_search('security.cipher', macsec) == 'gcm-aes-256' and cak_len != GCM_AES_256_LEN:
+                raise ConfigError(GCM_256_KEY_ERROR)
+
+    if 'source_interface' in macsec:
+        # MACsec adds a 40 byte overhead (32 byte MACsec + 8 bytes VLAN 802.1ad
+        # and 802.1q) - we need to check the underlaying MTU if our configured
+        # MTU is at least 40 bytes less then the MTU of our physical interface.
+        lower_mtu = Interface(macsec['source_interface']).get_mtu()
+        if lower_mtu < (int(macsec['mtu']) + 40):
+            raise ConfigError('MACsec overhead does not fit into underlaying device MTU,\n' \
+                              f'{lower_mtu} bytes is too small!')
+
+    return None
+
+
+def generate(macsec):
+    # Only generate wpa_supplicant config if using MKA
+    if dict_search('security.mka.cak', macsec):
+        render(wpa_suppl_conf.format(**macsec), 'macsec/wpa_supplicant.conf.j2', macsec)
+    return None
+
+
+def apply(macsec):
+    systemd_service = 'wpa_supplicant-macsec@{source_interface}'.format(**macsec)
+
+    # Remove macsec interface on deletion or mandatory parameter change
+    if 'deleted' in macsec or 'shutdown_required' in macsec:
+        call(f'systemctl stop {systemd_service}')
+
+        if interface_exists(macsec['ifname']):
+            tmp = MACsecIf(**macsec)
+            tmp.remove()
+
+        if 'deleted' in macsec:
+            # delete configuration on interface removal
+            if os.path.isfile(wpa_suppl_conf.format(**macsec)):
+                os.unlink(wpa_suppl_conf.format(**macsec))
+
+            return None
+
+    # It is safe to "re-create" the interface always, there is a sanity
+    # check that the interface will only be create if its non existent
+    i = MACsecIf(**macsec)
+    i.update(macsec)
+
+    # Only reload/restart if using MKA
+    if dict_search('security.mka.cak', macsec):
+        if not is_systemd_service_running(systemd_service) or 'shutdown_required' in macsec:
+            call(f'systemctl reload-or-restart {systemd_service}')
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_openvpn.py b/src/conf_mode/interfaces_openvpn.py
new file mode 100644
index 0000000..8c1213e
--- /dev/null
+++ b/src/conf_mode/interfaces_openvpn.py
@@ -0,0 +1,808 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import re
+
+from cryptography.hazmat.primitives.asymmetric import ec
+from glob import glob
+from sys import exit
+from ipaddress import IPv4Address
+from ipaddress import IPv4Network
+from ipaddress import IPv6Address
+from ipaddress import IPv6Network
+from ipaddress import summarize_address_range
+from secrets import SystemRandom
+from shutil import rmtree
+
+from vyos.base import DeprecationWarning
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_bond_bridge_member
+from vyos.ifconfig import VTunIf
+from vyos.pki import load_dh_parameters
+from vyos.pki import load_private_key
+from vyos.pki import sort_ca_chain
+from vyos.pki import verify_ca_chain
+from vyos.pki import wrap_certificate
+from vyos.pki import wrap_crl
+from vyos.pki import wrap_dh_parameters
+from vyos.pki import wrap_openvpn_key
+from vyos.pki import wrap_private_key
+from vyos.template import render
+from vyos.template import is_ipv4
+from vyos.template import is_ipv6
+from vyos.utils.dict import dict_search
+from vyos.utils.dict import dict_search_args
+from vyos.utils.list import is_list_equal
+from vyos.utils.file import makedir
+from vyos.utils.file import read_file
+from vyos.utils.file import write_file
+from vyos.utils.kernel import check_kmod
+from vyos.utils.kernel import unload_kmod
+from vyos.utils.process import call
+from vyos.utils.permission import chown
+from vyos.utils.process import cmd
+from vyos.utils.network import is_addr_assigned
+from vyos.utils.network import interface_exists
+
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+user = 'openvpn'
+group = 'openvpn'
+
+cfg_dir = '/run/openvpn'
+cfg_file = '/run/openvpn/{ifname}.conf'
+otp_path = '/config/auth/openvpn'
+otp_file = '/config/auth/openvpn/{ifname}-otp-secrets'
+secret_chars = list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')
+service_file = '/run/systemd/system/openvpn@{ifname}.service.d/20-override.conf'
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'openvpn']
+
+    ifname, openvpn = get_interface_dict(conf, base, with_pki=True)
+    openvpn['auth_user_pass_file'] = '/run/openvpn/{ifname}.pw'.format(**openvpn)
+
+    if 'deleted' in openvpn:
+        return openvpn
+
+    if is_node_changed(conf, base + [ifname, 'openvpn-option']):
+        openvpn.update({'restart_required': {}})
+    if is_node_changed(conf, base + [ifname, 'enable-dco']):
+        openvpn.update({'restart_required': {}})
+
+    # We have to get the dict using 'get_config_dict' instead of 'get_interface_dict'
+    # as 'get_interface_dict' merges the defaults in, so we can not check for defaults in there.
+    tmp = conf.get_config_dict(base + [openvpn['ifname']], get_first_key=True)
+
+    # We have to cleanup the config dict, as default values could enable features
+    # which are not explicitly enabled on the CLI. Example: server mfa totp
+    # originate comes with defaults, which will enable the
+    # totp plugin, even when not set via CLI so we
+    # need to check this first and drop those keys
+    if dict_search('server.mfa.totp', tmp) == None:
+        del openvpn['server']['mfa']
+
+    # OpenVPN Data-Channel-Offload (DCO) is a Kernel module. If loaded it applies to all
+    # OpenVPN interfaces. Check if DCO is used by any other interface instance.
+    tmp = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+    for interface, interface_config in tmp.items():
+        # If one interface has DCO configured, enable it. No need to further check
+        # all other OpenVPN interfaces. We must use a dedicated key to indicate
+        # the Kernel module must be loaded or not. The per interface "offload.dco"
+        # key is required per OpenVPN interface instance.
+        if dict_search('offload.dco', interface_config) != None:
+            openvpn['module_load_dco'] = {}
+            break
+
+    # Calculate the protocol modifier. This is concatenated to the protocol string to direct
+    # OpenVPN to use a specific IP protocol version. If unspecified, the kernel decides which
+    # type of socket to open. In server mode, an additional "ipv6-dual-stack" option forces
+    # binding the socket in IPv6 mode, which can also receive IPv4 traffic (when using the
+    # default "ipv6" mode, we specify "bind ipv6only" to disable kernel dual-stack behaviors).
+    if openvpn['ip_version'] == 'ipv4':
+        openvpn['protocol_modifier'] = '4'
+    elif openvpn['ip_version'] in ['ipv6', 'dual-stack']:
+        openvpn['protocol_modifier']  = '6'
+    else:
+        openvpn['protocol_modifier'] = ''
+
+    return openvpn
+
+def is_ec_private_key(pki, cert_name):
+    if not pki or 'certificate' not in pki:
+        return False
+    if cert_name not in pki['certificate']:
+        return False
+
+    pki_cert = pki['certificate'][cert_name]
+    if 'private' not in pki_cert or 'key' not in pki_cert['private']:
+        return False
+
+    key = load_private_key(pki_cert['private']['key'])
+    return isinstance(key, ec.EllipticCurvePrivateKey)
+
+def verify_pki(openvpn):
+    pki = openvpn['pki']
+    interface = openvpn['ifname']
+    mode = openvpn['mode']
+    shared_secret_key = dict_search_args(openvpn, 'shared_secret_key')
+    tls = dict_search_args(openvpn, 'tls')
+
+    if not bool(shared_secret_key) ^ bool(tls): #  xor check if only one is set
+        raise ConfigError('Must specify only one of "shared-secret-key" and "tls"')
+
+    if mode in ['server', 'client'] and not tls:
+        raise ConfigError('Must specify "tls" for server and client modes')
+
+    if not pki:
+        raise ConfigError('PKI is not configured')
+
+    if shared_secret_key:
+        if not dict_search_args(pki, 'openvpn', 'shared_secret'):
+            raise ConfigError('There are no openvpn shared-secrets in PKI configuration')
+
+        if shared_secret_key not in pki['openvpn']['shared_secret']:
+            raise ConfigError(f'Invalid shared-secret on openvpn interface {interface}')
+
+        # If PSK settings are correct, warn about its deprecation
+        DeprecationWarning('OpenVPN shared-secret support will be removed in future '\
+                           'VyOS versions. Please migrate your site-to-site tunnels to '\
+                           'TLS. You can use self-signed certificates with peer fingerprint '\
+                           'verification, consult the documentation for details.')
+
+    if tls:
+        if mode == 'site-to-site':
+            # XXX: site-to-site with PSKs is the only mode that can work without TLS,
+            # so 'tls role' is not mandatory for it,
+            # but we need to check that if it uses peer certificate fingerprints rather than PSKs,
+            # then the TLS role is set
+            if ('shared_secret_key' not in tls) and ('role' not in tls):
+                raise ConfigError('"tls role" is required for site-to-site OpenVPN with TLS')
+
+        if (mode in ['server', 'client']) and ('ca_certificate' not in tls):
+            raise ConfigError(f'Must specify "tls ca-certificate" on openvpn interface {interface},\
+              it is required in server and client modes')
+        else:
+            if ('ca_certificate' not in tls) and ('peer_fingerprint' not in tls):
+                raise ConfigError('Either "tls ca-certificate" or "tls peer-fingerprint" is required\
+                  on openvpn interface {interface} in site-to-site mode')
+
+        if 'ca_certificate' in tls:
+            for ca_name in tls['ca_certificate']:
+                if ca_name not in pki['ca']:
+                    raise ConfigError(f'Invalid CA certificate on openvpn interface {interface}')
+
+            if len(tls['ca_certificate']) > 1:
+                sorted_chain = sort_ca_chain(tls['ca_certificate'], pki['ca'])
+                if not verify_ca_chain(sorted_chain, pki['ca']):
+                    raise ConfigError(f'CA certificates are not a valid chain')
+
+        if mode != 'client' and 'auth_key' not in tls:
+            if 'certificate' not in tls:
+                raise ConfigError(f'Missing "tls certificate" on openvpn interface {interface}')
+
+        if 'certificate' in tls:
+            if tls['certificate'] not in pki['certificate']:
+                raise ConfigError(f'Invalid certificate on openvpn interface {interface}')
+
+            if dict_search_args(pki, 'certificate', tls['certificate'], 'private', 'password_protected') is not None:
+                raise ConfigError(f'Cannot use encrypted private key on openvpn interface {interface}')
+
+        if 'dh_params' in tls:
+            if 'dh' not in pki:
+                raise ConfigError(f'pki dh is not configured')
+            proposed_dh = tls['dh_params']
+            if proposed_dh not in pki['dh'].keys():
+                raise ConfigError(f"pki dh '{proposed_dh}' is not configured")
+
+            pki_dh = pki['dh'][tls['dh_params']]
+            dh_params = load_dh_parameters(pki_dh['parameters'])
+            dh_numbers = dh_params.parameter_numbers()
+            dh_bits = dh_numbers.p.bit_length()
+
+            if dh_bits < 2048:
+                raise ConfigError(f'Minimum DH key-size is 2048 bits')
+
+
+        if 'auth_key' in tls or 'crypt_key' in tls:
+            if not dict_search_args(pki, 'openvpn', 'shared_secret'):
+                raise ConfigError('There are no openvpn shared-secrets in PKI configuration')
+
+        if 'auth_key' in tls:
+            if tls['auth_key'] not in pki['openvpn']['shared_secret']:
+                raise ConfigError(f'Invalid auth-key on openvpn interface {interface}')
+
+        if 'crypt_key' in tls:
+            if tls['crypt_key'] not in pki['openvpn']['shared_secret']:
+                raise ConfigError(f'Invalid crypt-key on openvpn interface {interface}')
+
+def verify(openvpn):
+    if 'deleted' in openvpn:
+        verify_bridge_delete(openvpn)
+        return None
+
+    if 'mode' not in openvpn:
+        raise ConfigError('Must specify OpenVPN operation mode!')
+
+    #
+    # OpenVPN client mode - VERIFY
+    #
+    if openvpn['mode'] == 'client':
+        if 'local_port' in openvpn:
+            raise ConfigError('Cannot specify "local-port" in client mode')
+
+        if 'local_host' in openvpn:
+            raise ConfigError('Cannot specify "local-host" in client mode')
+
+        if 'remote_host' not in openvpn:
+            raise ConfigError('Must specify "remote-host" in client mode')
+
+        if openvpn['protocol'] == 'tcp-passive':
+            raise ConfigError('Protocol "tcp-passive" is not valid in client mode')
+
+        if 'ip_version' in openvpn and openvpn['ip_version'] == 'dual-stack':
+            raise ConfigError('"ip-version dual-stack" is not supported in client mode')
+
+        if dict_search('tls.dh_params', openvpn):
+            raise ConfigError('Cannot specify "tls dh-params" in client mode')
+
+    #
+    # OpenVPN site-to-site - VERIFY
+    #
+    elif openvpn['mode'] == 'site-to-site':
+        if 'ip_version' in openvpn and openvpn['ip_version'] == 'dual-stack':
+            raise ConfigError('"ip-version dual-stack" is not supported in site-to-site mode')
+
+        if 'local_address' not in openvpn and 'is_bridge_member' not in openvpn:
+            raise ConfigError('Must specify "local-address" or add interface to bridge')
+
+        if 'local_address' in openvpn:
+            if len([addr for addr in openvpn['local_address'] if is_ipv4(addr)]) > 1:
+                raise ConfigError('Only one IPv4 local-address can be specified')
+
+            if len([addr for addr in openvpn['local_address'] if is_ipv6(addr)]) > 1:
+                raise ConfigError('Only one IPv6 local-address can be specified')
+
+        if openvpn['device_type'] == 'tun':
+            if 'remote_address' not in openvpn:
+                raise ConfigError('Must specify "remote-address"')
+
+        if 'remote_address' in openvpn:
+            if len([addr for addr in openvpn['remote_address'] if is_ipv4(addr)]) > 1:
+                raise ConfigError('Only one IPv4 remote-address can be specified')
+
+            if len([addr for addr in openvpn['remote_address'] if is_ipv6(addr)]) > 1:
+                raise ConfigError('Only one IPv6 remote-address can be specified')
+
+            if not 'local_address' in openvpn:
+                raise ConfigError('"remote-address" requires "local-address"')
+
+            v4loAddr = [addr for addr in openvpn['local_address'] if is_ipv4(addr)]
+            v4remAddr = [addr for addr in openvpn['remote_address'] if is_ipv4(addr)]
+            if v4loAddr and not v4remAddr:
+                raise ConfigError('IPv4 "local-address" requires IPv4 "remote-address"')
+            elif v4remAddr and not v4loAddr:
+                raise ConfigError('IPv4 "remote-address" requires IPv4 "local-address"')
+
+            v6remAddr = [addr for addr in openvpn['remote_address'] if is_ipv6(addr)]
+            v6loAddr = [addr for addr in openvpn['local_address'] if is_ipv6(addr)]
+            if v6loAddr and not v6remAddr:
+                raise ConfigError('IPv6 "local-address" requires IPv6 "remote-address"')
+            elif v6remAddr and not v6loAddr:
+                raise ConfigError('IPv6 "remote-address" requires IPv6 "local-address"')
+
+            if is_list_equal(v4loAddr, v4remAddr) or is_list_equal(v6loAddr, v6remAddr):
+                raise ConfigError('"local-address" and "remote-address" cannot be the same')
+
+            if dict_search('local_host', openvpn) in dict_search('local_address', openvpn):
+                raise ConfigError('"local-address" cannot be the same as "local-host"')
+
+            if dict_search('remote_host', openvpn) in dict_search('remote_address', openvpn):
+                raise ConfigError('"remote-address" and "remote-host" can not be the same')
+
+        if openvpn['device_type'] == 'tap' and 'local_address' in openvpn:
+            # we can only have one local_address, this is ensured above
+            v4addr = None
+            for laddr in openvpn['local_address']:
+                if is_ipv4(laddr):
+                    v4addr = laddr
+                    break
+
+            if v4addr in openvpn['local_address'] and 'subnet_mask' not in openvpn['local_address'][v4addr]:
+                raise ConfigError('Must specify IPv4 "subnet-mask" for local-address')
+
+        if dict_search('encryption.data_ciphers', openvpn):
+            raise ConfigError('Cipher negotiation can only be used in client or server mode')
+
+    else:
+        # checks for client-server or site-to-site bridged
+        if 'local_address' in openvpn or 'remote_address' in openvpn:
+            raise ConfigError('Cannot specify "local-address" or "remote-address" ' \
+                              'in client/server or bridge mode')
+
+    #
+    # OpenVPN server mode - VERIFY
+    #
+    if openvpn['mode'] == 'server':
+        if openvpn['protocol'] == 'tcp-active':
+            raise ConfigError('Protocol "tcp-active" is not valid in server mode')
+
+        if dict_search('authentication.username', openvpn) or dict_search('authentication.password', openvpn):
+            raise ConfigError('Cannot specify "authentication" in server mode')
+
+        if 'remote_port' in openvpn:
+            raise ConfigError('Cannot specify "remote-port" in server mode')
+
+        if 'remote_host' in openvpn:
+            raise ConfigError('Cannot specify "remote-host" in server mode')
+
+        tmp = dict_search('server.subnet', openvpn)
+        if tmp:
+            v4_subnets = len([subnet for subnet in tmp if is_ipv4(subnet)])
+            v6_subnets = len([subnet for subnet in tmp if is_ipv6(subnet)])
+            if v4_subnets > 1:
+                raise ConfigError('Cannot specify more than 1 IPv4 server subnet')
+            if v6_subnets > 1:
+                raise ConfigError('Cannot specify more than 1 IPv6 server subnet')
+
+            for subnet in tmp:
+                if is_ipv4(subnet):
+                    subnet = IPv4Network(subnet)
+
+                    if openvpn['device_type'] == 'tun' and subnet.prefixlen > 29:
+                        raise ConfigError('Server subnets smaller than /29 with device type "tun" are not supported')
+                    elif openvpn['device_type'] == 'tap' and subnet.prefixlen > 30:
+                        raise ConfigError('Server subnets smaller than /30 with device type "tap" are not supported')
+
+                    for client in (dict_search('client', openvpn) or []):
+                        if client['ip'] and not IPv4Address(client['ip'][0]) in subnet:
+                            raise ConfigError(f'Client "{client["name"]}" IP {client["ip"][0]} not in server subnet {subnet}')
+
+        else:
+            if 'is_bridge_member' not in openvpn:
+                raise ConfigError('Must specify "server subnet" or add interface to bridge in server mode')
+
+        if hasattr(dict_search('server.client', openvpn), '__iter__'):
+            for client_k, client_v in dict_search('server.client', openvpn).items():
+                if (client_v.get('ip') and len(client_v['ip']) > 1) or (client_v.get('ipv6_ip') and len(client_v['ipv6_ip']) > 1):
+                    raise ConfigError(f'Server client "{client_k}": cannot specify more than 1 IPv4 and 1 IPv6 IP')
+
+        if dict_search('server.bridge', openvpn):
+            # check if server bridge is a tap interfaces
+            if not openvpn['device_type'] == 'tap' and dict_search('server.bridge', openvpn):
+               raise ConfigError('Must specify "device-type tap" with server bridge mode')
+            elif not (dict_search('server.bridge.start', openvpn) and dict_search('server.bridge.stop', openvpn)):
+                raise ConfigError('Server bridge requires both start and stop addresses')
+            else:
+                v4PoolStart = IPv4Address(dict_search('server.bridge.start', openvpn))
+                v4PoolStop = IPv4Address(dict_search('server.bridge.stop', openvpn))
+                if v4PoolStart > v4PoolStop:
+                    raise ConfigError(f'Server bridge start address {v4PoolStart} is larger than stop address {v4PoolStop}')
+
+                v4PoolSize = int(v4PoolStop) - int(v4PoolStart)
+                if v4PoolSize >= 65536:
+                    raise ConfigError(f'Server bridge is too large [{v4PoolStart} -> {v4PoolStop} = {v4PoolSize}], maximum is 65536 addresses.')
+
+        if dict_search('server.client_ip_pool', openvpn):
+            if not (dict_search('server.client_ip_pool.start', openvpn) and dict_search('server.client_ip_pool.stop', openvpn)):
+                raise ConfigError('Server client-ip-pool requires both start and stop addresses')
+            else:
+                v4PoolStart = IPv4Address(dict_search('server.client_ip_pool.start', openvpn))
+                v4PoolStop = IPv4Address(dict_search('server.client_ip_pool.stop', openvpn))
+                if v4PoolStart > v4PoolStop:
+                    raise ConfigError(f'Server client-ip-pool start address {v4PoolStart} is larger than stop address {v4PoolStop}')
+
+                v4PoolSize = int(v4PoolStop) - int(v4PoolStart)
+                if v4PoolSize >= 65536:
+                    raise ConfigError(f'Server client-ip-pool is too large [{v4PoolStart} -> {v4PoolStop} = {v4PoolSize}], maximum is 65536 addresses.')
+
+                v4PoolNets = list(summarize_address_range(v4PoolStart, v4PoolStop))
+                for client in (dict_search('client', openvpn) or []):
+                    if client['ip']:
+                        for v4PoolNet in v4PoolNets:
+                            if IPv4Address(client['ip'][0]) in v4PoolNet:
+                                print(f'Warning: Client "{client["name"]}" IP {client["ip"][0]} is in server IP pool, it is not reserved for this client.')
+            # configuring a client_ip_pool will set 'server ... nopool' which is currently incompatible with 'server-ipv6' (probably to be fixed upstream)
+            for subnet in (dict_search('server.subnet', openvpn) or []):
+                if is_ipv6(subnet):
+                    raise ConfigError(f'Setting client-ip-pool is incompatible having an IPv6 server subnet.')
+
+        for subnet in (dict_search('server.subnet', openvpn) or []):
+            if is_ipv6(subnet):
+                tmp = dict_search('client_ipv6_pool.base', openvpn)
+                if tmp:
+                    if not dict_search('server.client_ip_pool', openvpn):
+                        raise ConfigError('IPv6 server pool requires an IPv4 server pool')
+
+                    if int(tmp.split('/')[1]) >= 112:
+                        raise ConfigError('IPv6 server pool must be larger than /112')
+
+                    #
+                    # todo - weird logic
+                    #
+                    v6PoolStart = IPv6Address(tmp)
+                    v6PoolStop = IPv6Network((v6PoolStart, openvpn['server_ipv6_pool_prefixlen']), strict=False)[-1] # don't remove the parentheses, it's a 2-tuple
+                    v6PoolSize = int(v6PoolStop) - int(v6PoolStart) if int(openvpn['server_ipv6_pool_prefixlen']) > 96 else 65536
+                    if v6PoolSize < v4PoolSize:
+                        raise ConfigError(f'IPv6 server pool must be at least as large as the IPv4 pool (current sizes: IPv6={v6PoolSize} IPv4={v4PoolSize})')
+
+                    v6PoolNets = list(summarize_address_range(v6PoolStart, v6PoolStop))
+                    for client in (dict_search('client', openvpn) or []):
+                        if client['ipv6_ip']:
+                            for v6PoolNet in v6PoolNets:
+                                if IPv6Address(client['ipv6_ip'][0]) in v6PoolNet:
+                                    print(f'Warning: Client "{client["name"]}" IP {client["ipv6_ip"][0]} is in server IP pool, it is not reserved for this client.')
+
+        if 'topology' in openvpn['server']:
+            if openvpn['server']['topology'] == 'net30':
+                DeprecationWarning('Topology net30 is deprecated '\
+                                   'and will be removed in future VyOS versions. '\
+                                   'Switch to "subnet" or "p2p"'
+                )
+
+        # add mfa users to the file the mfa plugin uses
+        if dict_search('server.mfa.totp', openvpn):
+            user_data = ''
+            if not os.path.isfile(otp_file.format(**openvpn)):
+                write_file(otp_file.format(**openvpn), user_data,
+                           user=user, group=group, mode=0o644)
+
+            ovpn_users = read_file(otp_file.format(**openvpn))
+            for client in (dict_search('server.client', openvpn) or []):
+                exists = None
+                for ovpn_user in ovpn_users.split('\n'):
+                    if re.search('^' + client + ' ', ovpn_user):
+                        user_data += f'{ovpn_user}\n'
+                        exists = 'true'
+
+                if not exists:
+                    random = SystemRandom()
+                    totp_secret = ''.join(random.choice(secret_chars) for _ in range(16))
+                    user_data += f'{client} otp totp:sha1:base32:{totp_secret}::xxx *\n'
+
+            write_file(otp_file.format(**openvpn), user_data,
+                           user=user, group=group, mode=0o644)
+
+    else:
+        # checks for both client and site-to-site go here
+        if dict_search('server.reject_unconfigured_clients', openvpn):
+            raise ConfigError('Option reject-unconfigured-clients only supported in server mode')
+
+        if 'replace_default_route' in openvpn and 'remote_host' not in openvpn:
+            raise ConfigError('Cannot set "replace-default-route" without "remote-host"')
+
+    #
+    # OpenVPN common verification section
+    # not depending on any operation mode
+    #
+
+    # verify that local_host/remote_host match with any ip_version override
+    # specified (if a dns name is specified for remote_host, no attempt is made
+    # to verify that record resolves to an address of the configured family)
+    if 'local_host' in openvpn:
+        if openvpn['ip_version'] == 'ipv4' and is_ipv6(openvpn['local_host']):
+            raise ConfigError('Cannot use an IPv6 "local-host" with "ip-version ipv4"')
+        elif openvpn['ip_version'] == 'ipv6' and is_ipv4(openvpn['local_host']):
+            raise ConfigError('Cannot use an IPv4 "local-host" with "ip-version ipv6"')
+        elif openvpn['ip_version'] == 'dual-stack':
+            raise ConfigError('Cannot use "local-host" with "ip-version dual-stack". "dual-stack" is only supported when OpenVPN binds to all available interfaces.')
+
+    if 'remote_host' in openvpn:
+        remote_hosts = dict_search('remote_host', openvpn)
+        for remote_host in remote_hosts:
+            if openvpn['ip_version'] == 'ipv4' and is_ipv6(remote_host):
+                raise ConfigError('Cannot use an IPv6 "remote-host" with "ip-version ipv4"')
+            elif openvpn['ip_version'] == 'ipv6' and is_ipv4(remote_host):
+                raise ConfigError('Cannot use an IPv4 "remote-host" with "ip-version ipv6"')
+
+    # verify specified IP address is present on any interface on this system
+    if 'local_host' in openvpn:
+        if not is_addr_assigned(openvpn['local_host']):
+            print('local-host IP address "{local_host}" not assigned' \
+                  ' to any interface'.format(**openvpn))
+
+    # TCP active
+    if openvpn['protocol'] == 'tcp-active':
+        if 'local_port' in openvpn:
+            raise ConfigError('Cannot specify "local-port" with "tcp-active"')
+
+        if 'remote_host' not in openvpn:
+            raise ConfigError('Must specify "remote-host" with "tcp-active"')
+
+    #
+    # TLS/encryption
+    #
+    if 'shared_secret_key' in openvpn:
+        if dict_search('encryption.cipher', openvpn) in ['aes128gcm', 'aes192gcm', 'aes256gcm']:
+            raise ConfigError('GCM encryption with shared-secret-key not supported')
+
+    if 'tls' in openvpn:
+        if {'auth_key', 'crypt_key'} <= set(openvpn['tls']):
+            raise ConfigError('TLS auth and crypt keys are mutually exclusive')
+
+        tmp = dict_search('tls.role', openvpn)
+        if tmp:
+            if openvpn['mode'] in ['client', 'server']:
+                if not dict_search('tls.auth_key', openvpn):
+                    raise ConfigError('Cannot specify "tls role" in client-server mode')
+
+            if tmp == 'active':
+                if openvpn['protocol'] == 'tcp-passive':
+                    raise ConfigError('Cannot specify "tcp-passive" when "tls role" is "active"')
+
+                if dict_search('tls.dh_params', openvpn):
+                    raise ConfigError('Cannot specify "tls dh-params" when "tls role" is "active"')
+
+            elif tmp == 'passive':
+                if openvpn['protocol'] == 'tcp-active':
+                    raise ConfigError('Cannot specify "tcp-active" when "tls role" is "passive"')
+
+        if 'certificate' in openvpn['tls'] and is_ec_private_key(openvpn['pki'], openvpn['tls']['certificate']):
+            if 'dh_params' in openvpn['tls']:
+                print('Warning: using dh-params and EC keys simultaneously will ' \
+                      'lead to DH ciphers being used instead of ECDH')
+
+        if dict_search('encryption.cipher', openvpn):
+            raise ConfigError('"encryption cipher" option is deprecated for TLS mode. '
+                              'Use "encryption data-ciphers" instead')
+
+    if dict_search('encryption.cipher', openvpn) == 'none':
+        print('Warning: "encryption none" was specified!')
+        print('No encryption will be performed and data is transmitted in ' \
+              'plain text over the network!')
+
+    verify_pki(openvpn)
+
+    #
+    # Auth user/pass
+    #
+    if (dict_search('authentication.username', openvpn) and not
+        dict_search('authentication.password', openvpn)):
+            raise ConfigError('Password for authentication is missing')
+
+    if (dict_search('authentication.password', openvpn) and not
+        dict_search('authentication.username', openvpn)):
+            raise ConfigError('Username for authentication is missing')
+
+    verify_vrf(openvpn)
+    verify_bond_bridge_member(openvpn)
+    verify_mirror_redirect(openvpn)
+
+    return None
+
+def generate_pki_files(openvpn):
+    pki = openvpn['pki']
+    if not pki:
+        return None
+
+    interface = openvpn['ifname']
+    shared_secret_key = dict_search_args(openvpn, 'shared_secret_key')
+    tls = dict_search_args(openvpn, 'tls')
+
+    if shared_secret_key:
+        pki_key = pki['openvpn']['shared_secret'][shared_secret_key]
+        key_path = os.path.join(cfg_dir, f'{interface}_shared.key')
+        write_file(key_path, wrap_openvpn_key(pki_key['key']),
+                   user=user, group=group)
+
+    if tls:
+        if 'ca_certificate' in tls:
+            cert_path = os.path.join(cfg_dir, f'{interface}_ca.pem')
+            crl_path = os.path.join(cfg_dir, f'{interface}_crl.pem')
+
+            if os.path.exists(cert_path):
+                os.unlink(cert_path)
+
+            if os.path.exists(crl_path):
+                os.unlink(crl_path)
+
+            for cert_name in sort_ca_chain(tls['ca_certificate'], pki['ca']):
+                pki_ca = pki['ca'][cert_name]
+
+                if 'certificate' in pki_ca:
+                    write_file(cert_path, wrap_certificate(pki_ca['certificate']) + "\n",
+                               user=user, group=group, mode=0o600, append=True)
+
+                if 'crl' in pki_ca:
+                    for crl in pki_ca['crl']:
+                        write_file(crl_path, wrap_crl(crl) + "\n", user=user, group=group,
+                                   mode=0o600, append=True)
+
+                    openvpn['tls']['crl'] = True
+
+        if 'certificate' in tls:
+            cert_name = tls['certificate']
+            pki_cert = pki['certificate'][cert_name]
+
+            if 'certificate' in pki_cert:
+                cert_path = os.path.join(cfg_dir, f'{interface}_cert.pem')
+                write_file(cert_path, wrap_certificate(pki_cert['certificate']),
+                           user=user, group=group, mode=0o600)
+
+            if 'private' in pki_cert and 'key' in pki_cert['private']:
+                key_path = os.path.join(cfg_dir, f'{interface}_cert.key')
+                write_file(key_path, wrap_private_key(pki_cert['private']['key']),
+                           user=user, group=group, mode=0o600)
+
+                openvpn['tls']['private_key'] = True
+
+        if 'dh_params' in tls:
+            dh_name = tls['dh_params']
+            pki_dh = pki['dh'][dh_name]
+
+            if 'parameters' in pki_dh:
+                dh_path = os.path.join(cfg_dir, f'{interface}_dh.pem')
+                write_file(dh_path, wrap_dh_parameters(pki_dh['parameters']),
+                           user=user, group=group, mode=0o600)
+
+        if 'auth_key' in tls:
+            key_name = tls['auth_key']
+            pki_key = pki['openvpn']['shared_secret'][key_name]
+
+            if 'key' in pki_key:
+                key_path = os.path.join(cfg_dir, f'{interface}_auth.key')
+                write_file(key_path, wrap_openvpn_key(pki_key['key']),
+                           user=user, group=group, mode=0o600)
+
+        if 'crypt_key' in tls:
+            key_name = tls['crypt_key']
+            pki_key = pki['openvpn']['shared_secret'][key_name]
+
+            if 'key' in pki_key:
+                key_path = os.path.join(cfg_dir, f'{interface}_crypt.key')
+                write_file(key_path, wrap_openvpn_key(pki_key['key']),
+                           user=user, group=group, mode=0o600)
+
+
+def generate(openvpn):
+    if 'deleted' in openvpn:
+        # remove totp secrets file if totp is not configured
+        if os.path.isfile(otp_file.format(**openvpn)):
+            os.remove(otp_file.format(**openvpn))
+        return None
+
+    if 'disable' in openvpn:
+        return None
+
+    interface = openvpn['ifname']
+    directory = os.path.dirname(cfg_file.format(**openvpn))
+    openvpn['plugin_dir'] = '/usr/lib/openvpn'
+
+    # create base config directory on demand
+    makedir(directory, user, group)
+    # enforce proper permissions on /run/openvpn
+    chown(directory, user, group)
+
+    # we can't know in advance which clients have been removed,
+    # thus all client configs will be removed and re-added on demand
+    ccd_dir = os.path.join(directory, 'ccd', interface)
+    if os.path.isdir(ccd_dir):
+        rmtree(ccd_dir, ignore_errors=True)
+
+    # Remove systemd directories with overrides
+    service_dir = os.path.dirname(service_file.format(**openvpn))
+    if os.path.isdir(service_dir):
+        rmtree(service_dir, ignore_errors=True)
+
+    # create client config directory on demand
+    makedir(ccd_dir, user, group)
+
+    # Fix file permissons for keys
+    generate_pki_files(openvpn)
+
+    # Generate User/Password authentication file
+    if 'authentication' in openvpn:
+        render(openvpn['auth_user_pass_file'], 'openvpn/auth.pw.j2', openvpn,
+               user=user, group=group, permission=0o600)
+    else:
+        # delete old auth file if present
+        if os.path.isfile(openvpn['auth_user_pass_file']):
+            os.remove(openvpn['auth_user_pass_file'])
+
+    # Generate client specific configuration
+    server_client = dict_search_args(openvpn, 'server', 'client')
+    if server_client:
+        for client, client_config in server_client.items():
+            client_file = os.path.join(ccd_dir, client)
+
+            # Our client need's to know its subnet mask ...
+            client_config['server_subnet'] = dict_search('server.subnet', openvpn)
+
+            render(client_file, 'openvpn/client.conf.j2', client_config,
+                   user=user, group=group)
+
+    # we need to support quoting of raw parameters from OpenVPN CLI
+    # see https://vyos.dev/T1632
+    render(cfg_file.format(**openvpn), 'openvpn/server.conf.j2', openvpn,
+           formater=lambda _: _.replace("&quot;", '"'), user=user, group=group)
+
+    # Render 20-override.conf for OpenVPN service
+    render(service_file.format(**openvpn), 'openvpn/service-override.conf.j2', openvpn,
+           formater=lambda _: _.replace("&quot;", '"'), user=user, group=group)
+    # Reload systemd services config to apply an override
+    call(f'systemctl daemon-reload')
+
+    return None
+
+def apply(openvpn):
+    interface = openvpn['ifname']
+
+    # Do some cleanup when OpenVPN is disabled/deleted
+    if 'deleted' in openvpn or 'disable' in openvpn:
+        call(f'systemctl stop openvpn@{interface}.service')
+        for cleanup_file in glob(f'/run/openvpn/{interface}.*'):
+            if os.path.isfile(cleanup_file):
+                os.unlink(cleanup_file)
+
+        if interface_exists(interface):
+            VTunIf(interface).remove()
+
+    # dynamically load/unload DCO Kernel extension if requested
+    dco_module = 'ovpn_dco_v2'
+    if 'module_load_dco' in openvpn:
+        check_kmod(dco_module)
+    else:
+        unload_kmod(dco_module)
+
+    # Now bail out early if interface is disabled or got deleted
+    if 'deleted' in openvpn or 'disable' in openvpn:
+        return None
+
+    # verify specified IP address is present on any interface on this system
+    # Allow to bind service to nonlocal address, if it virtaual-vrrp address
+    # or if address will be assign later
+    if 'local_host' in openvpn:
+        if not is_addr_assigned(openvpn['local_host']):
+            cmd('sysctl -w net.ipv4.ip_nonlocal_bind=1')
+
+    # No matching OpenVPN process running - maybe it got killed or none
+    # existed - nevertheless, spawn new OpenVPN process
+    action = 'reload-or-restart'
+    if 'restart_required' in openvpn:
+        action = 'restart'
+    call(f'systemctl {action} openvpn@{interface}.service')
+
+    o = VTunIf(**openvpn)
+    o.update(openvpn)
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_pppoe.py b/src/conf_mode/interfaces_pppoe.py
new file mode 100644
index 0000000..412676c
--- /dev/null
+++ b/src/conf_mode/interfaces_pppoe.py
@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_authentication
+from vyos.configverify import verify_source_interface
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_mirror_redirect
+from vyos.ifconfig import PPPoEIf
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.process import is_systemd_service_running
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'pppoe']
+    ifname, pppoe = get_interface_dict(conf, base)
+
+    # We should only terminate the PPPoE session if critical parameters change.
+    # All parameters that can be changed on-the-fly (like interface description)
+    # should not lead to a reconnect!
+    for options in ['access-concentrator', 'connect-on-demand', 'service-name',
+                    'source-interface', 'vrf', 'no-default-route',
+                    'authentication', 'host_uniq']:
+        if is_node_changed(conf, base + [ifname, options]):
+            pppoe.update({'shutdown_required': {}})
+            # bail out early - no need to further process other nodes
+            break
+
+    if 'deleted' not in pppoe:
+        # We always set the MRU value to the MTU size. This code path only re-creates
+        # the old behavior if MRU is not set on the CLI.
+        if 'mru' not in pppoe:
+            pppoe['mru'] = pppoe['mtu']
+
+    return pppoe
+
+def verify(pppoe):
+    if 'deleted' in pppoe:
+        # bail out early
+        return None
+
+    verify_source_interface(pppoe)
+    verify_authentication(pppoe)
+    verify_vrf(pppoe)
+    verify_mtu_ipv6(pppoe)
+    verify_mirror_redirect(pppoe)
+
+    if {'connect_on_demand', 'vrf'} <= set(pppoe):
+        raise ConfigError('On-demand dialing and VRF can not be used at the same time')
+
+    # both MTU and MRU have default values, thus we do not need to check
+    # if the key exists
+    if int(pppoe['mru']) > int(pppoe['mtu']):
+        raise ConfigError('PPPoE MRU needs to be lower then MTU!')
+
+    return None
+
+def generate(pppoe):
+    # set up configuration file path variables where our templates will be
+    # rendered into
+    ifname = pppoe['ifname']
+    config_pppoe = f'/etc/ppp/peers/{ifname}'
+
+    if 'deleted' in pppoe or 'disable' in pppoe:
+        if os.path.exists(config_pppoe):
+            os.unlink(config_pppoe)
+
+        return None
+
+    # Create PPP configuration files
+    render(config_pppoe, 'pppoe/peer.j2', pppoe, permission=0o640)
+
+    return None
+
+def apply(pppoe):
+    ifname = pppoe['ifname']
+    if 'deleted' in pppoe or 'disable' in pppoe:
+        if os.path.isdir(f'/sys/class/net/{ifname}'):
+            p = PPPoEIf(ifname)
+            p.remove()
+        call(f'systemctl stop ppp@{ifname}.service')
+        return None
+
+    # reconnect should only be necessary when certain config options change,
+    # like ACS name, authentication ... (see get_config() for details)
+    if ((not is_systemd_service_running(f'ppp@{ifname}.service')) or
+        'shutdown_required' in pppoe):
+
+        # cleanup system (e.g. FRR routes first)
+        if os.path.isdir(f'/sys/class/net/{ifname}'):
+            p = PPPoEIf(ifname)
+            p.remove()
+
+        call(f'systemctl restart ppp@{ifname}.service')
+        # When interface comes "live" a hook is called:
+        # /etc/ppp/ip-up.d/99-vyos-pppoe-callback
+        # which triggers PPPoEIf.update()
+    else:
+        if os.path.isdir(f'/sys/class/net/{ifname}'):
+            p = PPPoEIf(ifname)
+            p.update(pppoe)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_pseudo-ethernet.py b/src/conf_mode/interfaces_pseudo-ethernet.py
new file mode 100644
index 0000000..446beff
--- /dev/null
+++ b/src/conf_mode/interfaces_pseudo-ethernet.py
@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configdict import is_source_interface
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_source_interface
+from vyos.configverify import verify_vlan_config
+from vyos.configverify import verify_mtu_parent
+from vyos.configverify import verify_mirror_redirect
+from vyos.ifconfig import MACVLANIf
+from vyos.utils.network import interface_exists
+from vyos import ConfigError
+
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at
+    least the interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'pseudo-ethernet']
+    ifname, peth = get_interface_dict(conf, base)
+
+    mode = is_node_changed(conf, ['mode'])
+    if mode: peth.update({'shutdown_required' : {}})
+
+    if is_node_changed(conf, base + [ifname, 'mode']):
+        peth.update({'rebuild_required': {}})
+
+    if 'source_interface' in peth:
+        _, peth['parent'] = get_interface_dict(conf, ['interfaces', 'ethernet'],
+                                               peth['source_interface'])
+        # test if source-interface is maybe already used by another interface
+        tmp = is_source_interface(conf, peth['source_interface'], ['macsec'])
+        if tmp and tmp != ifname: peth.update({'is_source_interface' : tmp})
+
+    return peth
+
+def verify(peth):
+    if 'deleted' in peth:
+        verify_bridge_delete(peth)
+        return None
+
+    verify_source_interface(peth)
+    verify_vrf(peth)
+    verify_address(peth)
+    verify_mtu_parent(peth, peth['parent'])
+    verify_mirror_redirect(peth)
+    # use common function to verify VLAN configuration
+    verify_vlan_config(peth)
+
+    return None
+
+def generate(peth):
+    return None
+
+def apply(peth):
+    # Check if the MACVLAN interface already exists
+    if 'rebuild_required' in peth or 'deleted' in peth:
+        if interface_exists(peth['ifname']):
+            p = MACVLANIf(**peth)
+            # MACVLAN is always needs to be recreated,
+            # thus we can simply always delete it first.
+            p.remove()
+
+    if 'deleted' not in peth:
+        p = MACVLANIf(**peth)
+        p.update(peth)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_sstpc.py b/src/conf_mode/interfaces_sstpc.py
new file mode 100644
index 0000000..b9d7a74
--- /dev/null
+++ b/src/conf_mode/interfaces_sstpc.py
@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_authentication
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import SSTPCIf
+from vyos.pki import encode_certificate
+from vyos.pki import find_chain
+from vyos.pki import load_certificate
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.dict import dict_search
+from vyos.utils.process import is_systemd_service_running
+from vyos.utils.file import write_file
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'sstpc']
+    ifname, sstpc = get_interface_dict(conf, base, with_pki=True)
+
+    # We should only terminate the SSTP client session if critical parameters
+    # change. All parameters that can be changed on-the-fly (like interface
+    # description) should not lead to a reconnect!
+    for options in ['authentication', 'no_peer_dns', 'no_default_route',
+                    'server', 'ssl']:
+        if is_node_changed(conf, base + [ifname, options]):
+            sstpc.update({'shutdown_required': {}})
+            # bail out early - no need to further process other nodes
+            break
+
+    return sstpc
+
+def verify(sstpc):
+    if 'deleted' in sstpc:
+        return None
+
+    verify_authentication(sstpc)
+    verify_vrf(sstpc)
+
+    if not dict_search('server', sstpc):
+        raise ConfigError('Remote SSTP server must be specified!')
+
+    if not dict_search('ssl.ca_certificate', sstpc):
+        raise ConfigError('Missing mandatory CA certificate!')
+
+    return None
+
+def generate(sstpc):
+    ifname = sstpc['ifname']
+    config_sstpc = f'/etc/ppp/peers/{ifname}'
+
+    sstpc['ca_file_path'] = f'/run/sstpc/{ifname}_ca-cert.pem'
+
+    if 'deleted' in sstpc:
+        for file in [sstpc['ca_file_path'], config_sstpc]:
+            if os.path.exists(file):
+                os.unlink(file)
+        return None
+
+    ca_name = sstpc['ssl']['ca_certificate']
+    pki_ca_cert = sstpc['pki']['ca'][ca_name]
+
+    loaded_ca_cert = load_certificate(pki_ca_cert['certificate'])
+    loaded_ca_certs = {load_certificate(c['certificate'])
+            for c in sstpc['pki']['ca'].values()} if 'ca' in sstpc['pki'] else {}
+
+    ca_full_chain = find_chain(loaded_ca_cert, loaded_ca_certs)
+
+    write_file(sstpc['ca_file_path'], '\n'.join(encode_certificate(c) for c in ca_full_chain))
+    render(config_sstpc, 'sstp-client/peer.j2', sstpc, permission=0o640)
+
+    return None
+
+def apply(sstpc):
+    ifname = sstpc['ifname']
+    if 'deleted' in sstpc or 'disable' in sstpc:
+        if os.path.isdir(f'/sys/class/net/{ifname}'):
+            p = SSTPCIf(ifname)
+            p.remove()
+        call(f'systemctl stop ppp@{ifname}.service')
+        return None
+
+    # reconnect should only be necessary when specific options change,
+    # like server, authentication ... (see get_config() for details)
+    if ((not is_systemd_service_running(f'ppp@{ifname}.service')) or
+        'shutdown_required' in sstpc):
+
+        # cleanup system (e.g. FRR routes first)
+        if os.path.isdir(f'/sys/class/net/{ifname}'):
+            p = SSTPCIf(ifname)
+            p.remove()
+
+        call(f'systemctl restart ppp@{ifname}.service')
+        # When interface comes "live" a hook is called:
+        # /etc/ppp/ip-up.d/96-vyos-sstpc-callback
+        # which triggers SSTPCIf.update()
+    else:
+        if os.path.isdir(f'/sys/class/net/{ifname}'):
+            p = SSTPCIf(ifname)
+            p.update(sstpc)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_tunnel.py b/src/conf_mode/interfaces_tunnel.py
new file mode 100644
index 0000000..98ef98d
--- /dev/null
+++ b/src/conf_mode/interfaces_tunnel.py
@@ -0,0 +1,230 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 yOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_source_interface
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_tunnel
+from vyos.configverify import verify_bond_bridge_member
+from vyos.ifconfig import Interface
+from vyos.ifconfig import TunnelIf
+from vyos.utils.dict import dict_search
+from vyos.utils.network import get_interface_config
+from vyos.utils.network import interface_exists
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least
+    the interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'tunnel']
+    ifname, tunnel = get_interface_dict(conf, base)
+
+    if 'deleted' not in tunnel:
+        tmp = is_node_changed(conf, base + [ifname, 'encapsulation'])
+        if tmp: tunnel.update({'encapsulation_changed': {}})
+
+        tmp = is_node_changed(conf, base + [ifname, 'parameters', 'ip', 'key'])
+        if tmp: tunnel.update({'key_changed': {}})
+
+        # We also need to inspect other configured tunnels as there are Kernel
+        # restrictions where we need to comply. E.g. GRE tunnel key can't be used
+        # twice, or with multiple GRE tunnels to the same location we must specify
+        # a GRE key
+        conf.set_level(base)
+        tunnel['other_tunnels'] = conf.get_config_dict([], key_mangling=('-', '_'),
+                                                      get_first_key=True,
+                                                      no_tag_node_value_mangle=True)
+        # delete our own instance from this dict
+        ifname = tunnel['ifname']
+        del tunnel['other_tunnels'][ifname]
+        # if only one tunnel is present on the system, no need to keep this key
+        if len(tunnel['other_tunnels']) == 0:
+            del tunnel['other_tunnels']
+
+    # We must check if our interface is configured to be a DMVPN member
+    nhrp_base = ['protocols', 'nhrp', 'tunnel']
+    conf.set_level(nhrp_base)
+    nhrp = conf.get_config_dict([], key_mangling=('-', '_'), get_first_key=True)
+    if nhrp: tunnel.update({'nhrp' : list(nhrp.keys())})
+
+    if 'encapsulation' in tunnel and tunnel['encapsulation'] not in ['erspan', 'ip6erspan']:
+        del tunnel['parameters']['erspan']
+
+    return tunnel
+
+def verify(tunnel):
+    if 'deleted' in tunnel:
+        verify_bridge_delete(tunnel)
+
+        if 'nhrp' in tunnel and tunnel['ifname'] in tunnel['nhrp']:
+            raise ConfigError('Tunnel used for NHRP, it can not be deleted!')
+
+        return None
+
+    verify_tunnel(tunnel)
+
+    if tunnel['encapsulation'] in ['erspan', 'ip6erspan']:
+        if dict_search('parameters.ip.key', tunnel) == None:
+            raise ConfigError('ERSPAN requires ip key parameter!')
+
+        # this is a default field
+        ver = int(tunnel['parameters']['erspan']['version'])
+        if ver == 1:
+            if 'hw_id' in tunnel['parameters']['erspan']:
+                raise ConfigError('ERSPAN version 1 does not support hw-id!')
+            if 'direction' in tunnel['parameters']['erspan']:
+                raise ConfigError('ERSPAN version 1 does not support direction!')
+        elif ver == 2:
+            if 'idx' in tunnel['parameters']['erspan']:
+                raise ConfigError('ERSPAN version 2 does not index parameter!')
+            if 'direction' not in tunnel['parameters']['erspan']:
+                raise ConfigError('ERSPAN version 2 requires direction to be set!')
+
+    # If tunnel source is any and gre key is not set
+    interface = tunnel['ifname']
+    if tunnel['encapsulation'] in ['gre'] and \
+       dict_search('source_address', tunnel) == '0.0.0.0' and \
+       dict_search('parameters.ip.key', tunnel) == None:
+        raise ConfigError(f'"parameters ip key" must be set for {interface} when '\
+                           'encapsulation is GRE!')
+
+    gre_encapsulations = ['gre', 'gretap']
+    if tunnel['encapsulation'] in gre_encapsulations and 'other_tunnels' in tunnel:
+        # Check pairs tunnel source-address/encapsulation/key with exists tunnels.
+        # Prevent the same key for 2 tunnels with same source-address/encap. T2920
+        for o_tunnel, o_tunnel_conf in tunnel['other_tunnels'].items():
+            # no match on encapsulation - bail out
+            our_encapsulation = tunnel['encapsulation']
+            their_encapsulation = o_tunnel_conf['encapsulation']
+            if our_encapsulation in gre_encapsulations and their_encapsulation \
+                not in gre_encapsulations:
+                continue
+
+            our_address = dict_search('source_address', tunnel)
+            our_key = dict_search('parameters.ip.key', tunnel)
+            their_address = dict_search('source_address', o_tunnel_conf)
+            their_key = dict_search('parameters.ip.key', o_tunnel_conf)
+            if our_key != None:
+                if their_address == our_address and their_key == our_key:
+                    raise ConfigError(f'Key "{our_key}" for source-address "{our_address}" ' \
+                                      f'is already used for tunnel "{o_tunnel}"!')
+            else:
+                our_source_if = dict_search('source_interface', tunnel)
+                their_source_if = dict_search('source_interface', o_tunnel_conf)
+                our_remote = dict_search('remote', tunnel)
+                their_remote = dict_search('remote', o_tunnel_conf)
+                # If no IP GRE key is defined we can not have more then one GRE tunnel
+                # bound to any one interface/IP address and the same remote. This will
+                # result in a OS  PermissionError: add tunnel "gre0" failed: File exists
+                if our_remote == their_remote:
+                    if our_address is not None and their_address == our_address: 
+                        # If set to the same values, this is always a fail 
+                        raise ConfigError(f'Missing required "ip key" parameter when '\
+                                           'running more then one GRE based tunnel on the '\
+                                           'same source-address')
+
+                    if their_source_if == our_source_if and their_address == our_address:
+                        # Note that lack of None check on these is deliberate. 
+                        # source-if and source-ip matching while unset (all None) is a fail
+                        # source-ifs set and matching with unset source-ips is a fail
+                        raise ConfigError(f'Missing required "ip key" parameter when '\
+                                           'running more then one GRE based tunnel on the '\
+                                           'same source-interface')
+
+    # Keys are not allowed with ipip and sit tunnels
+    if tunnel['encapsulation'] in ['ipip', 'sit']:
+        if dict_search('parameters.ip.key', tunnel) != None:
+            raise ConfigError('Keys are not allowed with ipip and sit tunnels!')
+
+    verify_mtu_ipv6(tunnel)
+    verify_address(tunnel)
+    verify_vrf(tunnel)
+    verify_bond_bridge_member(tunnel)
+    verify_mirror_redirect(tunnel)
+
+    if 'source_interface' in tunnel:
+        verify_source_interface(tunnel)
+
+    # TTL != 0 and nopmtudisc are incompatible, parameters and ip use default
+    # values, thus the keys are always present.
+    if dict_search('parameters.ip.no_pmtu_discovery', tunnel) != None:
+        if dict_search('parameters.ip.ttl', tunnel) != '0':
+            raise ConfigError('Disabled PMTU requires TTL set to "0"!')
+        if tunnel['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
+            raise ConfigError('Can not disable PMTU discovery for given encapsulation')
+
+    if dict_search('parameters.ip.ignore_df', tunnel) != None:
+        if tunnel['encapsulation'] not in ['gretap']:
+            raise ConfigError('Option ignore-df can only be used on GRETAP tunnels!')
+
+        if dict_search('parameters.ip.no_pmtu_discovery', tunnel) == None:
+            raise ConfigError('Option ignore-df requires path MTU discovery to be disabled!')
+
+
+def generate(tunnel):
+    return None
+
+def apply(tunnel):
+    interface = tunnel['ifname']
+    # If a gretap tunnel is already existing we can not "simply" change local or
+    # remote addresses. This returns "Operation not supported" by the Kernel.
+    # There is no other solution to destroy and recreate the tunnel.
+    encap = ''
+    remote = ''
+    tmp = get_interface_config(interface)
+    if tmp:
+        encap = dict_search('linkinfo.info_kind', tmp)
+        remote = dict_search('linkinfo.info_data.remote', tmp)
+
+    if ('deleted' in tunnel or 'encapsulation_changed' in tunnel or encap in
+        ['gretap', 'ip6gretap', 'erspan', 'ip6erspan'] or remote in ['any'] or
+        'key_changed' in tunnel):
+        if interface_exists(interface):
+            tmp = Interface(interface)
+            tmp.remove()
+        if 'deleted' in tunnel:
+            return None
+
+    tun = TunnelIf(**tunnel)
+    tun.update(tunnel)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        generate(c)
+        verify(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_virtual-ethernet.py b/src/conf_mode/interfaces_virtual-ethernet.py
new file mode 100644
index 0000000..cb6104f
--- /dev/null
+++ b/src/conf_mode/interfaces_virtual-ethernet.py
@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos import ConfigError
+from vyos import airbag
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import VethIf
+from vyos.utils.network import interface_exists
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at
+    least the interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'virtual-ethernet']
+    ifname, veth = get_interface_dict(conf, base)
+
+    # We need to know all other veth related interfaces as veth requires a 1:1
+    # mapping for the peer-names. The Linux kernel automatically creates both
+    # interfaces, the local one and the peer-name, but VyOS also needs a peer
+    # interfaces configrued on the CLI so we can assign proper IP addresses etc.
+    veth['other_interfaces'] = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                     get_first_key=True, no_tag_node_value_mangle=True)
+
+    return veth
+
+
+def verify(veth):
+    if 'deleted' in veth:
+        verify_bridge_delete(veth)
+        # Prevent to delete veth interface which used for another "vethX peer-name"
+        for iface, iface_config in veth['other_interfaces'].items():
+            if veth['ifname'] in iface_config['peer_name']:
+                ifname = veth['ifname']
+                raise ConfigError(
+                    f'Cannot delete "{ifname}" used for "interface {iface} peer-name"'
+                )
+        return None
+
+    verify_vrf(veth)
+    verify_address(veth)
+
+    if 'peer_name' not in veth:
+        raise ConfigError(f'Remote peer name must be set for "{veth["ifname"]}"!')
+
+    peer_name = veth['peer_name']
+    ifname = veth['ifname']
+
+    if veth['peer_name'] not in veth['other_interfaces']:
+        raise ConfigError(f'Used peer-name "{peer_name}" on interface "{ifname}" ' \
+                          'is not configured!')
+
+    if veth['other_interfaces'][peer_name]['peer_name'] != ifname:
+        raise ConfigError(
+            f'Configuration mismatch between "{ifname}" and "{peer_name}"!')
+
+    if peer_name == ifname:
+        raise ConfigError(
+            f'Peer-name "{peer_name}" cannot be the same as interface "{ifname}"!')
+
+    return None
+
+
+def generate(peth):
+    return None
+
+def apply(veth):
+    # Check if the Veth interface already exists
+    if 'rebuild_required' in veth or 'deleted' in veth:
+        if interface_exists(veth['ifname']):
+            p = VethIf(**veth)
+            p.remove()
+
+    if 'deleted' not in veth:
+        p = VethIf(**veth)
+        p.update(veth)
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_vti.py b/src/conf_mode/interfaces_vti.py
new file mode 100644
index 0000000..20629c6
--- /dev/null
+++ b/src/conf_mode/interfaces_vti.py
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import VTIIf
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'vti']
+    _, vti = get_interface_dict(conf, base)
+    return vti
+
+def verify(vti):
+    verify_vrf(vti)
+    verify_mirror_redirect(vti)
+    return None
+
+def generate(vti):
+    return None
+
+def apply(vti):
+    # Remove macsec interface
+    if 'deleted' in vti:
+        VTIIf(**vti).remove()
+        return None
+
+    tmp = VTIIf(**vti)
+    tmp.update(vti)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_vxlan.py b/src/conf_mode/interfaces_vxlan.py
new file mode 100644
index 0000000..68646e8
--- /dev/null
+++ b/src/conf_mode/interfaces_vxlan.py
@@ -0,0 +1,259 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import leaf_node_changed
+from vyos.configdict import is_node_changed
+from vyos.configdict import node_changed
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_source_interface
+from vyos.configverify import verify_bond_bridge_member
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import Interface
+from vyos.ifconfig import VXLANIf
+from vyos.template import is_ipv6
+from vyos.utils.dict import dict_search
+from vyos.utils.network import interface_exists
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least
+    the interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'vxlan']
+    ifname, vxlan = get_interface_dict(conf, base)
+
+    # VXLAN interfaces are picky and require recreation if certain parameters
+    # change. But a VXLAN interface should - of course - not be re-created if
+    # it's description or IP address is adjusted. Feels somehow logic doesn't it?
+    for cli_option in ['parameters', 'gpe', 'group', 'port', 'remote',
+                       'source-address', 'source-interface', 'vni']:
+        if is_node_changed(conf, base + [ifname, cli_option]):
+            vxlan.update({'rebuild_required': {}})
+            break
+
+    # When dealing with VNI filtering we need to know what VNI was actually removed,
+    # so build up a dict matching the vlan_to_vni structure but with removed values.
+    tmp = node_changed(conf, base + [ifname, 'vlan-to-vni'], recursive=True)
+    if tmp:
+        vxlan.update({'vlan_to_vni_removed': {}})
+        for vlan in tmp:
+            vni = leaf_node_changed(conf, base + [ifname, 'vlan-to-vni', vlan, 'vni'])
+            vxlan['vlan_to_vni_removed'].update({vlan : {'vni' : vni[0]}})
+
+    # We need to verify that no other VXLAN tunnel is configured when external
+    # mode is in use - Linux Kernel limitation
+    conf.set_level(base)
+    vxlan['other_tunnels'] = conf.get_config_dict([], key_mangling=('-', '_'),
+                                                  get_first_key=True,
+                                                  no_tag_node_value_mangle=True)
+
+    # This if-clause is just to be sure - it will always evaluate to true
+    ifname = vxlan['ifname']
+    if ifname in vxlan['other_tunnels']:
+        del vxlan['other_tunnels'][ifname]
+    if len(vxlan['other_tunnels']) == 0:
+        del vxlan['other_tunnels']
+
+    return vxlan
+
+def verify(vxlan):
+    if 'deleted' in vxlan:
+        verify_bridge_delete(vxlan)
+        return None
+
+    if int(vxlan['mtu']) < 1500:
+        Warning('RFC7348 recommends VXLAN tunnels preserve a 1500 byte MTU')
+
+    if 'group' in vxlan:
+        if 'source_interface' not in vxlan:
+            raise ConfigError('Multicast VXLAN requires an underlaying interface')
+        verify_source_interface(vxlan)
+
+    if not any(tmp in ['group', 'remote', 'source_address', 'source_interface'] for tmp in vxlan):
+        raise ConfigError('Group, remote, source-address or source-interface must be configured')
+
+    if 'vni' not in vxlan and dict_search('parameters.external', vxlan) == None:
+        raise ConfigError('Must either configure VXLAN "vni" or use "external" CLI option!')
+
+    if dict_search('parameters.external', vxlan) != None:
+        if 'vni' in vxlan:
+            raise ConfigError('Can not specify both "external" and "VNI"!')
+
+        if 'other_tunnels' in vxlan:
+            # When multiple VXLAN interfaces are defined and "external" is used,
+            # all VXLAN interfaces need to have vni-filter enabled!
+            # See Linux Kernel commit f9c4bb0b245cee35ef66f75bf409c9573d934cf9
+            other_vni_filter = False
+            for tunnel, tunnel_config in vxlan['other_tunnels'].items():
+                if dict_search('parameters.vni_filter', tunnel_config) != None:
+                    other_vni_filter = True
+                    break
+            # eqivalent of the C foo ? 'a' : 'b' statement
+            vni_filter = True and (dict_search('parameters.vni_filter', vxlan) != None) or False
+            # If either one is enabled, so must be the other. Both can be off and both can be on
+            if (vni_filter and not other_vni_filter) or (not vni_filter and other_vni_filter):
+                raise ConfigError(f'Using multiple VXLAN interfaces with "external" '\
+                    'requires all VXLAN interfaces to have "vni-filter" configured!')
+
+            if not vni_filter and not other_vni_filter:
+                other_tunnels = ', '.join(vxlan['other_tunnels'])
+                raise ConfigError(f'Only one VXLAN tunnel is supported when "external" '\
+                                f'CLI option is used and "vni-filter" is unset. '\
+                                f'Additional tunnels: {other_tunnels}')
+
+    if 'gpe' in vxlan and 'external' not in vxlan:
+        raise ConfigError(f'VXLAN-GPE is only supported when "external" '\
+                          f'CLI option is used.')
+
+    if 'source_interface' in vxlan:
+        # VXLAN adds at least an overhead of 50 byte - we need to check the
+        # underlaying device if our VXLAN package is not going to be fragmented!
+        vxlan_overhead = 50
+        if 'source_address' in vxlan and is_ipv6(vxlan['source_address']):
+            # IPv6 adds an extra 20 bytes overhead because the IPv6 header is 20
+            # bytes larger than the IPv4 header - assuming no extra options are
+            # in use.
+            vxlan_overhead += 20
+
+        # If source_address is not used - check IPv6 'remote' list
+        elif 'remote' in vxlan:
+            if any(is_ipv6(a) for a in vxlan['remote']):
+                vxlan_overhead += 20
+
+        lower_mtu = Interface(vxlan['source_interface']).get_mtu()
+        if lower_mtu < (int(vxlan['mtu']) + vxlan_overhead):
+            raise ConfigError(f'Underlaying device MTU is to small ({lower_mtu} '\
+                              f'bytes) for VXLAN overhead ({vxlan_overhead} bytes!)')
+
+    # Check for mixed IPv4 and IPv6 addresses
+    protocol = None
+    if 'source_address' in vxlan:
+        if is_ipv6(vxlan['source_address']):
+            protocol = 'ipv6'
+        else:
+            protocol = 'ipv4'
+
+    if 'remote' in vxlan:
+        error_msg = 'Can not mix both IPv4 and IPv6 for VXLAN underlay'
+        for remote in vxlan['remote']:
+            if is_ipv6(remote):
+                if protocol == 'ipv4':
+                    raise ConfigError(error_msg)
+                protocol = 'ipv6'
+            else:
+                if protocol == 'ipv6':
+                    raise ConfigError(error_msg)
+                protocol = 'ipv4'
+
+    if 'vlan_to_vni' in vxlan:
+        if 'is_bridge_member' not in vxlan:
+            raise ConfigError('VLAN to VNI mapping requires that VXLAN interface '\
+                              'is member of a bridge interface!')
+
+        vnis_used = []
+        vlans_used = []
+        for vif, vif_config in vxlan['vlan_to_vni'].items():
+            if 'vni' not in vif_config:
+                raise ConfigError(f'Must define VNI for VLAN "{vif}"!')
+            vni = vif_config['vni']
+
+            err_msg = f'VLAN range "{vif}" does not match VNI range "{vni}"!'
+            vif_range, vni_range = list(map(int, vif.split('-'))), list(map(int, vni.split('-')))
+
+            if len(vif_range) != len(vni_range):
+                raise ConfigError(err_msg)
+
+            if len(vif_range) > 1:
+                if vni_range[0] > vni_range[-1] or vif_range[0] > vif_range[-1]:
+                    raise ConfigError('The upper bound of the range must be greater than the lower bound!')
+                vni_range = range(vni_range[0], vni_range[1] + 1)
+                vif_range = range(vif_range[0], vif_range[1] + 1)
+
+            if len(vif_range) != len(vni_range):
+                raise ConfigError(err_msg)
+
+            for vni_id in vni_range:
+                if vni_id in vnis_used:
+                    raise ConfigError(f'VNI "{vni_id}" is already assigned to a different VLAN!')
+                vnis_used.append(vni_id)
+
+            for vif_id in vif_range:
+                if vif_id in vlans_used:
+                    raise ConfigError(f'VLAN "{vif_id}" is already in use!')
+                vlans_used.append(vif_id)
+
+    if dict_search('parameters.neighbor_suppress', vxlan) != None:
+        if 'is_bridge_member' not in vxlan:
+            raise ConfigError('Neighbor suppression requires that VXLAN interface '\
+                              'is member of a bridge interface!')
+
+    verify_mtu_ipv6(vxlan)
+    verify_address(vxlan)
+    verify_vrf(vxlan)
+    verify_bond_bridge_member(vxlan)
+    verify_mirror_redirect(vxlan)
+
+    # We use a defaultValue for port, thus it's always safe to use
+    if vxlan['port'] == '8472':
+        Warning('Starting from VyOS 1.4, the default port for VXLAN '\
+                'has been changed to 4789. This matches the IANA assigned '\
+                'standard port number!')
+
+    return None
+
+def generate(vxlan):
+    return None
+
+def apply(vxlan):
+    # Check if the VXLAN interface already exists
+    if 'rebuild_required' in vxlan or 'delete' in vxlan:
+        if interface_exists(vxlan['ifname']):
+            v = VXLANIf(**vxlan)
+            # VXLAN is super picky and the tunnel always needs to be recreated,
+            # thus we can simply always delete it first.
+            v.remove()
+
+    if 'deleted' not in vxlan:
+        # Finally create the new interface
+        v = VXLANIf(**vxlan)
+        v.update(vxlan)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_wireguard.py b/src/conf_mode/interfaces_wireguard.py
new file mode 100644
index 0000000..7abdfdb
--- /dev/null
+++ b/src/conf_mode/interfaces_wireguard.py
@@ -0,0 +1,136 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_mtu_ipv6
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_bond_bridge_member
+from vyos.ifconfig import WireGuardIf
+from vyos.utils.kernel import check_kmod
+from vyos.utils.network import check_port_availability
+from vyos.utils.network import is_wireguard_key_pair
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'wireguard']
+    ifname, wireguard = get_interface_dict(conf, base)
+
+    # Check if a port was changed
+    tmp = is_node_changed(conf, base + [ifname, 'port'])
+    if tmp: wireguard['port_changed'] = {}
+
+    # T4702: If anything on a peer changes we remove the peer first and re-add it
+    if is_node_changed(conf, base + [ifname, 'peer']):
+        wireguard.update({'rebuild_required': {}})
+
+    return wireguard
+
+def verify(wireguard):
+    if 'deleted' in wireguard:
+        verify_bridge_delete(wireguard)
+        return None
+
+    verify_mtu_ipv6(wireguard)
+    verify_address(wireguard)
+    verify_vrf(wireguard)
+    verify_bond_bridge_member(wireguard)
+    verify_mirror_redirect(wireguard)
+
+    if 'private_key' not in wireguard:
+        raise ConfigError('Wireguard private-key not defined')
+
+    if 'peer' not in wireguard:
+        raise ConfigError('At least one Wireguard peer is required!')
+
+    if 'port' in wireguard and 'port_changed' in wireguard:
+        listen_port = int(wireguard['port'])
+        if check_port_availability('0.0.0.0', listen_port, 'udp') is not True:
+            raise ConfigError(f'UDP port {listen_port} is busy or unavailable and '
+                               'cannot be used for the interface!')
+
+    # run checks on individual configured WireGuard peer
+    public_keys = []
+    for tmp in wireguard['peer']:
+        peer = wireguard['peer'][tmp]
+
+        if 'allowed_ips' not in peer:
+            raise ConfigError(f'Wireguard allowed-ips required for peer "{tmp}"!')
+
+        if 'public_key' not in peer:
+            raise ConfigError(f'Wireguard public-key required for peer "{tmp}"!')
+
+        if ('address' in peer and 'port' not in peer) or ('port' in peer and 'address' not in peer):
+            raise ConfigError('Both Wireguard port and address must be defined '
+                              f'for peer "{tmp}" if either one of them is set!')
+
+        if peer['public_key'] in public_keys:
+            raise ConfigError(f'Duplicate public-key defined on peer "{tmp}"')
+
+        if 'disable' not in peer:
+            if is_wireguard_key_pair(wireguard['private_key'], peer['public_key']):
+                raise ConfigError(f'Peer "{tmp}" has the same public key as the interface "{wireguard["ifname"]}"')
+
+        public_keys.append(peer['public_key'])
+
+def generate(wireguard):
+    return None
+
+def apply(wireguard):
+    check_kmod('wireguard')
+
+    if 'rebuild_required' in wireguard or 'deleted' in wireguard:
+        wg = WireGuardIf(**wireguard)
+        # WireGuard only supports peer removal based on the configured public-key,
+        # by deleting the entire interface this is the shortcut instead of parsing
+        # out all peers and removing them one by one.
+        #
+        # Peer reconfiguration will always come with a short downtime while the
+        # WireGuard interface is recreated (see below)
+        wg.remove()
+
+    # Create the new interface if required
+    if 'deleted' not in wireguard:
+        wg = WireGuardIf(**wireguard)
+        wg.update(wireguard)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_wireless.py b/src/conf_mode/interfaces_wireless.py
new file mode 100644
index 0000000..d24675e
--- /dev/null
+++ b/src/conf_mode/interfaces_wireless.py
@@ -0,0 +1,344 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from re import findall
+from netaddr import EUI, mac_unix_expanded
+from time import sleep
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import dict_merge
+from vyos.configverify import verify_address
+from vyos.configverify import verify_bridge_delete
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_vlan_config
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_bond_bridge_member
+from vyos.ifconfig import WiFiIf
+from vyos.template import render
+from vyos.utils.dict import dict_search
+from vyos.utils.kernel import check_kmod
+from vyos.utils.process import call
+from vyos.utils.process import is_systemd_service_active
+from vyos.utils.process import is_systemd_service_running
+from vyos.utils.network import interface_exists
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+# XXX: wpa_supplicant works on the source interface
+wpa_suppl_conf = '/run/wpa_supplicant/{ifname}.conf'
+hostapd_conf = '/run/hostapd/{ifname}.conf'
+hostapd_accept_station_conf = '/run/hostapd/{ifname}_station_accept.conf'
+hostapd_deny_station_conf = '/run/hostapd/{ifname}_station_deny.conf'
+
+country_code_path = ['system', 'wireless', 'country-code']
+
+def find_other_stations(conf, base, ifname):
+    """
+    Only one wireless interface per phy can be in station mode -
+    find all interfaces attached to a phy which run in station mode
+    """
+    old_level = conf.get_level()
+    conf.set_level(base)
+    dict = {}
+    for phy in os.listdir('/sys/class/ieee80211'):
+        list = []
+        for interface in conf.list_nodes([]):
+            if interface == ifname:
+                continue
+            # the following node is mandatory
+            if conf.exists([interface, 'physical-device', phy]):
+                tmp = conf.return_value([interface, 'type'])
+                if tmp == 'station':
+                    list.append(interface)
+        if list:
+            dict.update({phy: list})
+    conf.set_level(old_level)
+    return dict
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'wireless']
+
+    _, wifi = get_interface_dict(conf, base)
+
+    # retrieve global Wireless regulatory domain setting
+    if conf.exists(country_code_path):
+        wifi['country_code'] = conf.return_value(country_code_path)
+
+    if 'deleted' not in wifi:
+        # then get_interface_dict provides default keys
+        if wifi.from_defaults(['security', 'wep']): # if not set by user
+            del wifi['security']['wep']
+        if wifi.from_defaults(['security', 'wpa']): # if not set by user
+            del wifi['security']['wpa']
+
+    # XXX: Jinja2 can not operate on a dictionary key when it starts of with a number
+    if '40mhz_incapable' in (dict_search('capabilities.ht', wifi) or []):
+        wifi['capabilities']['ht']['fourtymhz_incapable'] = wifi['capabilities']['ht']['40mhz_incapable']
+        del wifi['capabilities']['ht']['40mhz_incapable']
+
+    if dict_search('security.wpa', wifi) != None:
+        wpa_cipher = wifi['security']['wpa'].get('cipher')
+        wpa_mode = wifi['security']['wpa'].get('mode')
+        if not wpa_cipher:
+            tmp = None
+            if wpa_mode == 'wpa':
+                tmp = {'security': {'wpa': {'cipher' : ['TKIP', 'CCMP']}}}
+            elif wpa_mode == 'wpa2':
+                tmp = {'security': {'wpa': {'cipher' : ['CCMP']}}}
+            elif wpa_mode == 'both':
+                tmp = {'security': {'wpa': {'cipher' : ['CCMP', 'TKIP']}}}
+            elif wpa_mode == 'wpa3':
+                # According to WiFi specs (https://www.wi-fi.org/file/wpa3-specification)
+                # section 3.5: WPA3-Enterprise 192-bit mode
+                # WiFi NICs which would be able to connect to WPA3-Enterprise managed
+                # networks MUST support GCMP-256.
+                # Reasoning: Provided that chipsets would most likely _not_ be
+                # "private user only", they all would come with built-in support
+                # for GCMP-256.
+                tmp = {'security': {'wpa': {'cipher' : ['CCMP', 'CCMP-256', 'GCMP', 'GCMP-256']}}}
+
+            if tmp: wifi = dict_merge(tmp, wifi)
+
+    # Only one wireless interface per phy can be in station mode
+    tmp = find_other_stations(conf, base, wifi['ifname'])
+    if tmp: wifi['station_interfaces'] = tmp
+
+    # used in hostapd.conf.j2
+    wifi['hostapd_accept_station_conf'] = hostapd_accept_station_conf.format(**wifi)
+    wifi['hostapd_deny_station_conf'] = hostapd_deny_station_conf.format(**wifi)
+
+    return wifi
+
+def verify(wifi):
+    if 'deleted' in wifi:
+        verify_bridge_delete(wifi)
+        return None
+
+    if 'physical_device' not in wifi:
+        raise ConfigError('You must specify a physical-device "phy"')
+
+    physical_device = wifi['physical_device']
+    if not os.path.exists(f'/sys/class/ieee80211/{physical_device}'):
+        raise ConfigError(f'Wirelss interface PHY "{physical_device}" does not exist!')
+
+    if 'type' not in wifi:
+        raise ConfigError('You must specify a WiFi mode')
+
+    if 'ssid' not in wifi and wifi['type'] != 'monitor':
+        raise ConfigError('SSID must be configured unless type is set to "monitor"!')
+
+    if wifi['type'] == 'access-point':
+        if 'country_code' not in wifi:
+            raise ConfigError(f'Wireless country-code is mandatory, use: '\
+                              f'"set {" ".join(country_code_path)}"!')
+
+        if 'channel' not in wifi:
+            raise ConfigError('Wireless channel must be configured!')
+
+        if 'capabilities' in wifi and 'he' in wifi['capabilities']:
+            if 'channel_set_width' not in wifi['capabilities']['he']:
+                raise ConfigError('Channel width must be configured!')
+
+        # op_modes drawn from:
+        # https://w1.fi/cgit/hostap/tree/src/common/ieee802_11_common.c?id=195cc3d919503fb0d699d9a56a58a72602b25f51#n1525
+        # 802.11ax (WiFi-6e - HE) can use up to 160MHz bandwidth channels
+        six_ghz_op_modes_he = ['131', '132', '133', '134', '135']
+        # 802.11be (WiFi-7 - EHT) can use up to 320MHz bandwidth channels
+        six_ghz_op_modes_eht = six_ghz_op_modes_he.append('137')
+        if 'security' in wifi and 'wpa' in wifi['security'] and 'mode' in wifi['security']['wpa']:
+            if wifi['security']['wpa']['mode'] == 'wpa3':
+                if 'he' in wifi['capabilities']:
+                    if wifi['capabilities']['he']['channel_set_width'] in six_ghz_op_modes_he:
+                        if 'mgmt_frame_protection' not in wifi or wifi['mgmt_frame_protection'] != 'required':
+                            raise ConfigError('Management Frame Protection (MFP) is required with WPA3 at 6GHz! Consider also enabling Beacon Frame Protection (BFP) if your device supports it.')
+
+    if 'security' in wifi:
+        if {'wep', 'wpa'} <= set(wifi.get('security', {})):
+            raise ConfigError('Must either use WEP or WPA security!')
+
+        if 'wep' in wifi['security']:
+            if 'key' in wifi['security']['wep'] and len(wifi['security']['wep']) > 4:
+                raise ConfigError('No more then 4 WEP keys configurable')
+            elif 'key' not in wifi['security']['wep']:
+                raise ConfigError('Security WEP configured - missing WEP keys!')
+
+        elif 'wpa' in wifi['security']:
+            wpa = wifi['security']['wpa']
+            if not any(i in ['passphrase', 'radius'] for i in wpa):
+                raise ConfigError('Misssing WPA key or RADIUS server')
+
+            if 'username' in wpa:
+                if 'passphrase' not in wpa:
+                    raise ConfigError('WPA-Enterprise configured - missing passphrase!')
+            elif 'passphrase' in wpa:
+                # check if passphrase meets the regex .{8,63}
+                if len(wpa['passphrase']) < 8 or len(wpa['passphrase']) > 63:
+                    raise ConfigError('WPA passphrase must be between 8 and 63 characters long')
+            if 'radius' in wpa:
+                if 'server' in wpa['radius']:
+                    for server in wpa['radius']['server']:
+                        if 'key' not in wpa['radius']['server'][server]:
+                            raise ConfigError(f'Missing RADIUS shared secret key for server: {server}')
+
+    if 'capabilities' in wifi:
+        capabilities = wifi['capabilities']
+        if 'vht' in capabilities:
+            if 'ht' not in capabilities:
+                raise ConfigError('Specify HT flags if you want to use VHT!')
+
+            if {'beamform', 'antenna_count'} <= set(capabilities.get('vht', {})):
+                if capabilities['vht']['antenna_count'] == '1':
+                    raise ConfigError('Cannot use beam forming with just one antenna!')
+
+                if capabilities['vht']['beamform'] == 'single-user-beamformer':
+                    if int(capabilities['vht']['antenna_count']) < 3:
+                        # Nasty Gotcha: see lines 708-721 in:
+                        # https://w1.fi/cgit/hostap/tree/hostapd/hostapd.conf?h=hostap_2_10&id=cff80b4f7d3c0a47c052e8187d671710f48939e4#n708
+                        raise ConfigError('Single-user beam former requires at least 3 antennas!')
+
+    if 'station_interfaces' in wifi and wifi['type'] == 'station':
+        phy = wifi['physical_device']
+        if phy in wifi['station_interfaces']:
+            if len(wifi['station_interfaces'][phy]) > 0:
+                raise ConfigError('Only one station per wireless physical interface possible!')
+
+    verify_address(wifi)
+    verify_vrf(wifi)
+    verify_bond_bridge_member(wifi)
+    verify_mirror_redirect(wifi)
+
+    # use common function to verify VLAN configuration
+    verify_vlan_config(wifi)
+
+    return None
+
+def generate(wifi):
+    check_kmod('mac80211')
+
+    interface = wifi['ifname']
+
+    # Delete config files if interface is removed
+    if 'deleted' in wifi:
+        if os.path.isfile(hostapd_conf.format(**wifi)):
+            os.unlink(hostapd_conf.format(**wifi))
+        if os.path.isfile(hostapd_accept_station_conf.format(**wifi)):
+            os.unlink(hostapd_accept_station_conf.format(**wifi))
+        if os.path.isfile(hostapd_deny_station_conf.format(**wifi)):
+            os.unlink(hostapd_deny_station_conf.format(**wifi))
+        if os.path.isfile(wpa_suppl_conf.format(**wifi)):
+            os.unlink(wpa_suppl_conf.format(**wifi))
+
+        return None
+
+    if 'mac' not in wifi:
+        # http://wiki.stocksy.co.uk/wiki/Multiple_SSIDs_with_hostapd
+        # generate locally administered MAC address from used phy interface
+        with open('/sys/class/ieee80211/{physical_device}/addresses'.format(**wifi), 'r') as f:
+            # some PHYs tend to have multiple interfaces and thus supply multiple MAC
+            # addresses - we only need the first one for our calculation
+            tmp = f.readline().rstrip()
+            tmp = EUI(tmp).value
+            # mask last nibble from the MAC address
+            tmp &= 0xfffffffffff0
+            # set locally administered bit in MAC address
+            tmp |= 0x020000000000
+            # we now need to add an offset to our MAC address indicating this
+            # subinterfaces index
+            tmp += int(findall(r'\d+', interface)[0])
+
+            # convert integer to "real" MAC address representation
+            mac = EUI(hex(tmp).split('x')[-1])
+            # change dialect to use : as delimiter instead of -
+            mac.dialect = mac_unix_expanded
+            wifi['mac'] = str(mac)
+
+    # render appropriate new config files depending on access-point or station mode
+    if wifi['type'] == 'access-point':
+        render(hostapd_conf.format(**wifi), 'wifi/hostapd.conf.j2', wifi)
+        render(hostapd_accept_station_conf.format(**wifi), 'wifi/hostapd_accept_station.conf.j2', wifi)
+        render(hostapd_deny_station_conf.format(**wifi), 'wifi/hostapd_deny_station.conf.j2', wifi)
+
+    elif wifi['type'] == 'station':
+        render(wpa_suppl_conf.format(**wifi), 'wifi/wpa_supplicant.conf.j2', wifi)
+
+    return None
+
+def apply(wifi):
+    interface = wifi['ifname']
+    # From systemd source code:
+    # If there's a stop job queued before we enter the DEAD state, we shouldn't act on Restart=,
+    # in order to not undo what has already been enqueued. */
+    #
+    # It was found that calling restart on hostapd will (4 out of 10 cases) deactivate
+    # the service instead of restarting it, when it was not yet properly stopped
+    # systemd[1]: hostapd@wlan1.service: Deactivated successfully.
+    # Thus kill all WIFI service and start them again after it's ensured nothing lives
+    call(f'systemctl stop hostapd@{interface}.service')
+    call(f'systemctl stop wpa_supplicant@{interface}.service')
+
+    if 'deleted' in wifi:
+        WiFiIf(**wifi).remove()
+        return None
+
+    while (is_systemd_service_running(f'hostapd@{interface}.service') or \
+           is_systemd_service_active(f'hostapd@{interface}.service')):
+        sleep(0.250) # wait 250ms
+
+    # Finally create the new interface
+    w = WiFiIf(**wifi)
+    w.update(wifi)
+
+    # Enable/Disable interface - interface is always placed in
+    # administrative down state in WiFiIf class
+    if 'disable' not in wifi:
+        # Wait until interface was properly added to the Kernel
+        ii = 0
+        while not (interface_exists(interface) and ii < 20):
+            sleep(0.250) # wait 250ms
+            ii += 1
+
+        # Physical interface is now configured. Proceed by starting hostapd or
+        # wpa_supplicant daemon. When type is monitor we can just skip this.
+        if wifi['type'] == 'access-point':
+            call(f'systemctl start hostapd@{interface}.service')
+
+        elif wifi['type'] == 'station':
+            call(f'systemctl start wpa_supplicant@{interface}.service')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/interfaces_wwan.py b/src/conf_mode/interfaces_wwan.py
new file mode 100644
index 0000000..230eb14
--- /dev/null
+++ b/src/conf_mode/interfaces_wwan.py
@@ -0,0 +1,189 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from time import sleep
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_authentication
+from vyos.configverify import verify_interface_exists
+from vyos.configverify import verify_mirror_redirect
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import WWANIf
+from vyos.utils.dict import dict_search
+from vyos.utils.process import cmd
+from vyos.utils.process import call
+from vyos.utils.process import DEVNULL
+from vyos.utils.process import is_systemd_service_active
+from vyos.utils.file import write_file
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+service_name = 'ModemManager.service'
+cron_script = '/etc/cron.d/vyos-wwan'
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
+    interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'wwan']
+    ifname, wwan = get_interface_dict(conf, base)
+
+    # We should only terminate the WWAN session if critical parameters change.
+    # All parameters that can be changed on-the-fly (like interface description)
+    # should not lead to a reconnect!
+    tmp = is_node_changed(conf, base + [ifname, 'address'])
+    if tmp: wwan.update({'shutdown_required': {}})
+
+    tmp = is_node_changed(conf, base + [ifname, 'apn'])
+    if tmp: wwan.update({'shutdown_required': {}})
+
+    tmp = is_node_changed(conf, base + [ifname, 'disable'])
+    if tmp: wwan.update({'shutdown_required': {}})
+
+    tmp = is_node_changed(conf, base + [ifname, 'vrf'])
+    if tmp: wwan.update({'shutdown_required': {}})
+
+    tmp = is_node_changed(conf, base + [ifname, 'authentication'])
+    if tmp: wwan.update({'shutdown_required': {}})
+
+    tmp = is_node_changed(conf, base + [ifname, 'ipv6', 'address', 'autoconf'])
+    if tmp: wwan.update({'shutdown_required': {}})
+
+    # We need to know the amount of other WWAN interfaces as ModemManager needs
+    # to be started or stopped.
+    wwan['other_interfaces'] = conf.get_config_dict([], key_mangling=('-', '_'),
+                                                       get_first_key=True,
+                                                       no_tag_node_value_mangle=True)
+
+    # This if-clause is just to be sure - it will always evaluate to true
+    if ifname in wwan['other_interfaces']:
+        del wwan['other_interfaces'][ifname]
+    if len(wwan['other_interfaces']) == 0:
+        del wwan['other_interfaces']
+
+    return wwan
+
+def verify(wwan):
+    if 'deleted' in wwan:
+        return None
+
+    ifname = wwan['ifname']
+    if not 'apn' in wwan:
+        raise ConfigError(f'No APN configured for "{ifname}"!')
+
+    verify_interface_exists(wwan, ifname)
+    verify_authentication(wwan)
+    verify_vrf(wwan)
+    verify_mirror_redirect(wwan)
+
+    return None
+
+def generate(wwan):
+    if 'deleted' in wwan:
+        # We are the last WWAN interface - there are no other ones remaining
+        # thus the cronjob needs to go away, too
+        if 'other_interfaces' not in wwan:
+            if os.path.exists(cron_script):
+                os.unlink(cron_script)
+        return None
+
+    # Install cron triggered helper script to re-dial WWAN interfaces on
+    # disconnect - e.g. happens during RF signal loss. The script watches every
+    # WWAN interface - so there is only one instance.
+    if not os.path.exists(cron_script):
+        write_file(cron_script, '*/5 * * * * root /usr/libexec/vyos/vyos-check-wwan.py\n')
+
+    return None
+
+def apply(wwan):
+    # ModemManager is required to dial WWAN connections - one instance is
+    # required to serve all modems. Activate ModemManager on first invocation
+    # of any WWAN interface.
+    if not is_systemd_service_active(service_name):
+        cmd(f'systemctl start {service_name}')
+
+        counter = 100
+        # Wait until a modem is detected and then we can continue
+        while counter > 0:
+            counter -= 1
+            tmp = cmd('mmcli -L')
+            if tmp != 'No modems were found':
+                break
+            sleep(0.250)
+
+    if 'shutdown_required' in wwan:
+        # we only need the modem number. wwan0 -> 0, wwan1 -> 1
+        modem = wwan['ifname'].lstrip('wwan')
+        base_cmd = f'mmcli --modem {modem}'
+        # Number of bearers is limited - always disconnect first
+        cmd(f'{base_cmd} --simple-disconnect')
+
+    w = WWANIf(wwan['ifname'])
+    if 'deleted' in wwan or 'disable' in wwan:
+        w.remove()
+
+        # We are the last WWAN interface - there are no other WWAN interfaces
+        # remaining, thus we can stop ModemManager and free resources.
+        if 'other_interfaces' not in wwan:
+            cmd(f'systemctl stop {service_name}')
+            # Clean CRON helper script which is used for to re-connect when
+            # RF signal is lost
+            if os.path.exists(cron_script):
+                os.unlink(cron_script)
+
+        return None
+
+    if 'shutdown_required' in wwan:
+        ip_type = 'ipv4'
+        slaac = dict_search('ipv6.address.autoconf', wwan) != None
+        if 'address' in wwan:
+            if 'dhcp' in wwan['address'] and ('dhcpv6' in wwan['address'] or slaac):
+                ip_type = 'ipv4v6'
+            elif 'dhcpv6' in wwan['address'] or slaac:
+                ip_type = 'ipv6'
+            elif 'dhcp' in wwan['address']:
+                ip_type = 'ipv4'
+
+        options = f'ip-type={ip_type},apn=' + wwan['apn']
+        if 'authentication' in wwan:
+            options += ',user={username},password={password}'.format(**wwan['authentication'])
+
+        command = f'{base_cmd} --simple-connect="{options}"'
+        call(command, stdout=DEVNULL)
+
+    w.update(wwan)
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/load-balancing_reverse-proxy.py b/src/conf_mode/load-balancing_reverse-proxy.py
new file mode 100644
index 0000000..17226ef
--- /dev/null
+++ b/src/conf_mode/load-balancing_reverse-proxy.py
@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from shutil import rmtree
+
+from vyos.config import Config
+from vyos.configverify import verify_pki_certificate
+from vyos.configverify import verify_pki_ca_certificate
+from vyos.utils.dict import dict_search
+from vyos.utils.process import call
+from vyos.utils.network import check_port_availability
+from vyos.utils.network import is_listen_port_bind_service
+from vyos.pki import find_chain
+from vyos.pki import load_certificate
+from vyos.pki import load_private_key
+from vyos.pki import encode_certificate
+from vyos.pki import encode_private_key
+from vyos.template import render
+from vyos.utils.file import write_file
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+load_balancing_dir = '/run/haproxy'
+load_balancing_conf_file = f'{load_balancing_dir}/haproxy.cfg'
+systemd_service = 'haproxy.service'
+systemd_override = '/run/systemd/system/haproxy.service.d/10-override.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['load-balancing', 'reverse-proxy']
+    if not conf.exists(base):
+        return None
+    lb = conf.get_config_dict(base,
+                              get_first_key=True,
+                              key_mangling=('-', '_'),
+                              no_tag_node_value_mangle=True,
+                              with_recursive_defaults=True,
+                              with_pki=True)
+
+    return lb
+
+def verify(lb):
+    if not lb:
+        return None
+
+    if 'backend' not in lb or 'service' not in lb:
+        raise ConfigError(f'"service" and "backend" must be configured!')
+
+    for front, front_config in lb['service'].items():
+        if 'port' not in front_config:
+            raise ConfigError(f'"{front} service port" must be configured!')
+
+        # Check if bind address:port are used by another service
+        tmp_address = front_config.get('address', '0.0.0.0')
+        tmp_port = front_config['port']
+        if check_port_availability(tmp_address, int(tmp_port), 'tcp') is not True and \
+                not is_listen_port_bind_service(int(tmp_port), 'haproxy'):
+            raise ConfigError(f'"TCP" port "{tmp_port}" is used by another service')
+
+    for back, back_config in lb['backend'].items():
+        if 'http_check' in back_config:
+            http_check = back_config['http_check']
+            if 'expect' in http_check and 'status' in http_check['expect'] and 'string' in http_check['expect']:
+                raise ConfigError(f'"expect status" and "expect string" can not be configured together!')
+
+        if 'health_check' in back_config:
+            if back_config['mode'] != 'tcp':
+                raise ConfigError(f'backend "{back}" can only be configured with {back_config["health_check"]} ' +
+                                  f'health-check whilst in TCP mode!')
+            if 'http_check' in back_config:
+                raise ConfigError(f'backend "{back}" cannot be configured with both http-check and health-check!')
+
+        if 'server' not in back_config:
+            raise ConfigError(f'"{back} server" must be configured!')
+
+        for bk_server, bk_server_conf in back_config['server'].items():
+            if 'address' not in bk_server_conf or 'port' not in bk_server_conf:
+                raise ConfigError(f'"backend {back} server {bk_server} address and port" must be configured!')
+
+            if {'send_proxy', 'send_proxy_v2'} <= set(bk_server_conf):
+                raise ConfigError(f'Cannot use both "send-proxy" and "send-proxy-v2" for server "{bk_server}"')
+
+        if 'ssl' in back_config:
+            if {'no_verify', 'ca_certificate'} <= set(back_config['ssl']):
+                raise ConfigError(f'backend {back} cannot have both ssl options no-verify and ca-certificate set!')
+
+    # Check if http-response-headers are configured in any frontend/backend where mode != http
+    for group in ['service', 'backend']:
+        for config_name, config in lb[group].items():
+            if 'http_response_headers' in config and config['mode'] != 'http':
+                raise ConfigError(f'{group} {config_name} must be set to http mode to use http_response_headers!')
+
+    for front, front_config in lb['service'].items():
+        for cert in dict_search('ssl.certificate', front_config) or []:
+            verify_pki_certificate(lb, cert)
+
+    for back, back_config in lb['backend'].items():
+        tmp = dict_search('ssl.ca_certificate', back_config)
+        if tmp: verify_pki_ca_certificate(lb, tmp)
+
+
+def generate(lb):
+    if not lb:
+        # Delete /run/haproxy/haproxy.cfg
+        config_files = [load_balancing_conf_file, systemd_override]
+        for file in config_files:
+            if os.path.isfile(file):
+                os.unlink(file)
+        # Delete old directories
+        if os.path.isdir(load_balancing_dir):
+            rmtree(load_balancing_dir, ignore_errors=True)
+
+        return None
+
+    # Create load-balance dir
+    if not os.path.isdir(load_balancing_dir):
+        os.mkdir(load_balancing_dir)
+
+    loaded_ca_certs = {load_certificate(c['certificate'])
+        for c in lb['pki']['ca'].values()} if 'ca' in lb['pki'] else {}
+
+    # SSL Certificates for frontend
+    for front, front_config in lb['service'].items():
+        if 'ssl' not in front_config:
+            continue
+
+        if 'certificate' in front_config['ssl']:
+            cert_names = front_config['ssl']['certificate']
+
+            for cert_name in cert_names:
+                pki_cert = lb['pki']['certificate'][cert_name]
+                cert_file_path = os.path.join(load_balancing_dir, f'{cert_name}.pem')
+                cert_key_path = os.path.join(load_balancing_dir, f'{cert_name}.pem.key')
+
+                loaded_pki_cert = load_certificate(pki_cert['certificate'])
+                cert_full_chain = find_chain(loaded_pki_cert, loaded_ca_certs)
+
+                write_file(cert_file_path,
+                   '\n'.join(encode_certificate(c) for c in cert_full_chain))
+
+                if 'private' in pki_cert and 'key' in pki_cert['private']:
+                    loaded_key = load_private_key(pki_cert['private']['key'], passphrase=None, wrap_tags=True)
+                    key_pem = encode_private_key(loaded_key, passphrase=None)
+                    write_file(cert_key_path, key_pem)
+
+    # SSL Certificates for backend
+    for back, back_config in lb['backend'].items():
+        if 'ssl' not in back_config:
+            continue
+
+        if 'ca_certificate' in back_config['ssl']:
+            ca_name = back_config['ssl']['ca_certificate']
+            ca_cert_file_path = os.path.join(load_balancing_dir, f'{ca_name}.pem')
+            ca_chains = []
+
+            pki_ca_cert = lb['pki']['ca'][ca_name]
+            loaded_ca_cert = load_certificate(pki_ca_cert['certificate'])
+            ca_full_chain = find_chain(loaded_ca_cert, loaded_ca_certs)
+            ca_chains.append('\n'.join(encode_certificate(c) for c in ca_full_chain))
+            write_file(ca_cert_file_path, '\n'.join(ca_chains))
+
+    render(load_balancing_conf_file, 'load-balancing/haproxy.cfg.j2', lb)
+    render(systemd_override, 'load-balancing/override_haproxy.conf.j2', lb)
+
+    return None
+
+def apply(lb):
+    call('systemctl daemon-reload')
+    if not lb:
+        call(f'systemctl stop {systemd_service}')
+    else:
+        call(f'systemctl reload-or-restart {systemd_service}')
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/load-balancing_wan.py b/src/conf_mode/load-balancing_wan.py
new file mode 100644
index 0000000..5da0b90
--- /dev/null
+++ b/src/conf_mode/load-balancing_wan.py
@@ -0,0 +1,151 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from shutil import rmtree
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdep import set_dependents, call_dependents
+from vyos.utils.process import cmd
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+load_balancing_dir = '/run/load-balance'
+load_balancing_conf_file = f'{load_balancing_dir}/wlb.conf'
+systemd_service = 'vyos-wan-load-balance.service'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['load-balancing', 'wan']
+    lb = conf.get_config_dict(base, key_mangling=('-', '_'),
+                              no_tag_node_value_mangle=True,
+                              get_first_key=True,
+                              with_recursive_defaults=True)
+
+    # prune limit key if not set by user
+    for rule in lb.get('rule', []):
+        if lb.from_defaults(['rule', rule, 'limit']):
+            del lb['rule'][rule]['limit']
+
+    set_dependents('conntrack', conf)
+
+    return lb
+
+
+def verify(lb):
+    if not lb:
+        return None
+
+    if 'interface_health' not in lb:
+        raise ConfigError(
+            'A valid WAN load-balance configuration requires an interface with a nexthop!'
+        )
+
+    for interface, interface_config in lb['interface_health'].items():
+        if 'nexthop' not in interface_config:
+            raise ConfigError(
+                f'interface-health {interface} nexthop must be specified!')
+
+        if 'test' in interface_config:
+            for test_rule, test_config in interface_config['test'].items():
+                if 'type' in test_config:
+                    if test_config['type'] == 'user-defined' and 'test_script' not in test_config:
+                        raise ConfigError(
+                            f'test {test_rule} script must be defined for test-script!'
+                        )
+
+    if 'rule' not in lb:
+        Warning(
+            'At least one rule with an (outbound) interface must be defined for WAN load balancing to be active!'
+        )
+    else:
+        for rule, rule_config in lb['rule'].items():
+            if 'inbound_interface' not in rule_config:
+                raise ConfigError(f'rule {rule} inbound-interface must be specified!')
+            if {'failover', 'exclude'} <= set(rule_config):
+                raise ConfigError(f'rule {rule} failover cannot be configured with exclude!')
+            if {'limit', 'exclude'} <= set(rule_config):
+                raise ConfigError(f'rule {rule} limit cannot be used with exclude!')
+            if 'interface' not in rule_config:
+                if 'exclude' not in rule_config:
+                    Warning(
+                        f'rule {rule} will be inactive because no (outbound) interfaces have been defined for this rule'
+                    )
+            for direction in {'source', 'destination'}:
+                if direction in rule_config:
+                    if 'protocol' in rule_config and 'port' in rule_config[
+                            direction]:
+                        if rule_config['protocol'] not in {'tcp', 'udp'}:
+                            raise ConfigError('ports can only be specified when protocol is "tcp" or "udp"')
+
+
+def generate(lb):
+    if not lb:
+        # Delete /run/load-balance/wlb.conf
+        if os.path.isfile(load_balancing_conf_file):
+            os.unlink(load_balancing_conf_file)
+        # Delete old directories
+        if os.path.isdir(load_balancing_dir):
+            rmtree(load_balancing_dir, ignore_errors=True)
+        if os.path.exists('/var/run/load-balance/wlb.out'):
+            os.unlink('/var/run/load-balance/wlb.out')
+
+        return None
+
+    # Create load-balance dir
+    if not os.path.isdir(load_balancing_dir):
+        os.mkdir(load_balancing_dir)
+
+    render(load_balancing_conf_file, 'load-balancing/wlb.conf.j2', lb)
+
+    return None
+
+
+def apply(lb):
+    if not lb:
+        try:
+            cmd(f'systemctl stop {systemd_service}')
+        except Exception as e:
+            print(f"Error message: {e}")
+
+    else:
+        cmd('sudo sysctl -w net.netfilter.nf_conntrack_acct=1')
+        cmd(f'systemctl restart {systemd_service}')
+
+    call_dependents()
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/nat.py b/src/conf_mode/nat.py
new file mode 100644
index 0000000..39803fa
--- /dev/null
+++ b/src/conf_mode/nat.py
@@ -0,0 +1,264 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdep import set_dependents, call_dependents
+from vyos.template import render
+from vyos.template import is_ip_network
+from vyos.utils.kernel import check_kmod
+from vyos.utils.dict import dict_search
+from vyos.utils.dict import dict_search_args
+from vyos.utils.process import cmd
+from vyos.utils.process import run
+from vyos.utils.network import is_addr_assigned
+from vyos.utils.network import interface_exists
+from vyos import ConfigError
+
+from vyos import airbag
+airbag.enable()
+
+k_mod = ['nft_nat', 'nft_chain_nat']
+
+nftables_nat_config = '/run/nftables_nat.conf'
+nftables_static_nat_conf = '/run/nftables_static-nat-rules.nft'
+
+valid_groups = [
+    'address_group',
+    'domain_group',
+    'network_group',
+    'port_group'
+]
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['nat']
+    nat = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True,
+                               with_recursive_defaults=True)
+
+    set_dependents('conntrack', conf)
+
+    if not conf.exists(base):
+        nat['deleted'] = ''
+        return nat
+
+    nat['firewall_group'] = conf.get_config_dict(['firewall', 'group'], key_mangling=('-', '_'), get_first_key=True,
+                                    no_tag_node_value_mangle=True)
+
+    # Remove dynamic firewall groups if present:
+    if 'dynamic_group' in nat['firewall_group']:
+        del nat['firewall_group']['dynamic_group']
+
+    return nat
+
+def verify_rule(config, err_msg, groups_dict):
+    """ Common verify steps used for both source and destination NAT """
+
+    if (dict_search('translation.port', config) != None or
+        dict_search('translation.redirect.port', config) != None or
+        dict_search('destination.port', config) != None or
+        dict_search('source.port', config)):
+
+        if config['protocol'] not in ['tcp', 'udp', 'tcp_udp']:
+            raise ConfigError(f'{err_msg} ports can only be specified when '\
+                              'protocol is either tcp, udp or tcp_udp!')
+
+    for side in ['destination', 'source']:
+        if side in config:
+            side_conf = config[side]
+
+            if len({'address', 'fqdn'} & set(side_conf)) > 1:
+                raise ConfigError('Only one of address, fqdn or geoip can be specified')
+
+            if 'group' in side_conf:
+                if len({'address_group', 'network_group', 'domain_group'} & set(side_conf['group'])) > 1:
+                    raise ConfigError('Only one address-group, network-group or domain-group can be specified')
+
+                for group in valid_groups:
+                    if group in side_conf['group']:
+                        group_name = side_conf['group'][group]
+                        error_group = group.replace("_", "-")
+
+                        if group in ['address_group', 'network_group', 'domain_group']:
+                            types = [t for t in ['address', 'fqdn'] if t in side_conf]
+                            if types:
+                                raise ConfigError(f'{error_group} and {types[0]} cannot both be defined')
+
+                        if group_name and group_name[0] == '!':
+                            group_name = group_name[1:]
+
+                        group_obj = dict_search_args(groups_dict, group, group_name)
+
+                        if group_obj is None:
+                            raise ConfigError(f'Invalid {error_group} "{group_name}" on nat rule')
+
+                        if not group_obj:
+                            Warning(f'{error_group} "{group_name}" has no members!')
+
+            if dict_search_args(side_conf, 'group', 'port_group'):
+                if 'protocol' not in config:
+                    raise ConfigError('Protocol must be defined if specifying a port-group')
+
+                if config['protocol'] not in ['tcp', 'udp', 'tcp_udp']:
+                    raise ConfigError('Protocol must be tcp, udp, or tcp_udp when specifying a port-group')
+
+    if 'load_balance' in config:
+        for item in ['source-port', 'destination-port']:
+            if item in config['load_balance']['hash'] and config['protocol'] not in ['tcp', 'udp']:
+                raise ConfigError('Protocol must be tcp or udp when specifying hash ports')
+        count = 0
+        if 'backend' in config['load_balance']:
+            for member in config['load_balance']['backend']:
+                weight = config['load_balance']['backend'][member]['weight']
+                count = count +  int(weight)
+            if count != 100:
+                Warning(f'Sum of weight for nat load balance rule is not 100. You may get unexpected behaviour')
+
+def verify(nat):
+    if not nat or 'deleted' in nat:
+        # no need to verify the CLI as NAT is going to be deactivated
+        return None
+
+    if dict_search('source.rule', nat):
+        for rule, config in dict_search('source.rule', nat).items():
+            err_msg = f'Source NAT configuration error in rule {rule}:'
+
+            if 'outbound_interface' in config:
+                if 'name' in config['outbound_interface'] and 'group' in config['outbound_interface']:
+                    raise ConfigError(f'{err_msg} cannot specify both interface group and interface name for nat source rule "{rule}"')
+                elif 'name' in config['outbound_interface']:
+                    interface_name = config['outbound_interface']['name']
+                    if interface_name not in 'any':
+                        if interface_name.startswith('!'):
+                            interface_name = interface_name[1:]
+                        if not interface_exists(interface_name):
+                            Warning(f'Interface "{interface_name}" for source NAT rule "{rule}" does not exist!')
+                else:
+                    group_name = config['outbound_interface']['group']
+                    if group_name[0] == '!':
+                        group_name = group_name[1:]
+                    group_obj = dict_search_args(nat['firewall_group'], 'interface_group', group_name)
+                    if group_obj is None:
+                        raise ConfigError(f'Invalid interface group "{group_name}" on source nat rule')
+                    if not group_obj:
+                        Warning(f'interface-group "{group_name}" has no members!')
+
+            if not dict_search('translation.address', config) and not dict_search('translation.port', config):
+                if 'exclude' not in config and 'backend' not in config['load_balance']:
+                    raise ConfigError(f'{err_msg} translation requires address and/or port')
+
+            addr = dict_search('translation.address', config)
+            if addr != None and addr != 'masquerade' and not is_ip_network(addr):
+                for ip in addr.split('-'):
+                    if not is_addr_assigned(ip):
+                        Warning(f'IP address {ip} does not exist on the system!')
+
+            # common rule verification
+            verify_rule(config, err_msg, nat['firewall_group'])
+
+    if dict_search('destination.rule', nat):
+        for rule, config in dict_search('destination.rule', nat).items():
+            err_msg = f'Destination NAT configuration error in rule {rule}:'
+
+            if 'inbound_interface' in config:
+                if 'name' in config['inbound_interface'] and 'group' in config['inbound_interface']:
+                    raise ConfigError(f'{err_msg} cannot specify both interface group and interface name for destination nat rule "{rule}"')
+                elif 'name' in config['inbound_interface']:
+                    interface_name = config['inbound_interface']['name']
+                    if interface_name not in 'any':
+                        if interface_name.startswith('!'):
+                            interface_name = interface_name[1:]
+                        if not interface_exists(interface_name):
+                            Warning(f'Interface "{interface_name}" for destination NAT rule "{rule}" does not exist!')
+                else:
+                    group_name = config['inbound_interface']['group']
+                    if group_name[0] == '!':
+                        group_name = group_name[1:]
+                    group_obj = dict_search_args(nat['firewall_group'], 'interface_group', group_name)
+                    if group_obj is None:
+                        raise ConfigError(f'Invalid interface group "{group_name}" on destination nat rule')
+                    if not group_obj:
+                        Warning(f'interface-group "{group_name}" has no members!')
+
+            if not dict_search('translation.address', config) and not dict_search('translation.port', config) and 'redirect' not in config['translation']:
+                if 'exclude' not in config and 'backend' not in config['load_balance']:
+                    raise ConfigError(f'{err_msg} translation requires address and/or port')
+
+            # common rule verification
+            verify_rule(config, err_msg, nat['firewall_group'])
+
+    if dict_search('static.rule', nat):
+        for rule, config in dict_search('static.rule', nat).items():
+            err_msg = f'Static NAT configuration error in rule {rule}:'
+
+            if 'inbound_interface' not in config:
+                raise ConfigError(f'{err_msg} inbound-interface not specified')
+
+            # common rule verification
+            verify_rule(config, err_msg, nat['firewall_group'])
+
+    return None
+
+def generate(nat):
+    if not os.path.exists(nftables_nat_config):
+        nat['first_install'] = True
+
+    render(nftables_nat_config, 'firewall/nftables-nat.j2', nat)
+    render(nftables_static_nat_conf, 'firewall/nftables-static-nat.j2', nat)
+
+    # dry-run newly generated configuration
+    tmp = run(f'nft --check --file {nftables_nat_config}')
+    if tmp > 0:
+        raise ConfigError('Configuration file errors encountered!')
+
+    tmp = run(f'nft --check --file {nftables_static_nat_conf}')
+    if tmp > 0:
+        raise ConfigError('Configuration file errors encountered!')
+
+    return None
+
+def apply(nat):
+    check_kmod(k_mod)
+
+    cmd(f'nft --file {nftables_nat_config}')
+    cmd(f'nft --file {nftables_static_nat_conf}')
+
+    if not nat or 'deleted' in nat:
+        os.unlink(nftables_nat_config)
+        os.unlink(nftables_static_nat_conf)
+
+    call_dependents()
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/nat64.py b/src/conf_mode/nat64.py
new file mode 100644
index 0000000..df501ce
--- /dev/null
+++ b/src/conf_mode/nat64.py
@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# pylint: disable=empty-docstring,missing-module-docstring
+
+import csv
+import os
+import re
+
+from ipaddress import IPv6Network, IPv6Address
+from json import dumps as json_write
+
+from vyos import ConfigError
+from vyos import airbag
+from vyos.config import Config
+from vyos.configdict import is_node_changed
+from vyos.utils.dict import dict_search
+from vyos.utils.file import write_file
+from vyos.utils.kernel import check_kmod
+from vyos.utils.process import cmd
+from vyos.utils.process import run
+
+airbag.enable()
+
+INSTANCE_REGEX = re.compile(r"instance-(\d+)")
+JOOL_CONFIG_DIR = "/run/jool"
+
+
+def get_config(config: Config | None = None) -> None:
+    if config is None:
+        config = Config()
+
+    base = ["nat64"]
+    nat64 = config.get_config_dict(base, key_mangling=("-", "_"), get_first_key=True)
+
+    return nat64
+
+
+def verify(nat64) -> None:
+    check_kmod(["jool"])
+    base_src = ["nat64", "source", "rule"]
+
+    # Load in existing instances so we can destroy any unknown
+    lines = cmd("jool instance display --csv").splitlines()
+    for _, instance, _ in csv.reader(lines):
+        match = INSTANCE_REGEX.fullmatch(instance)
+        if not match:
+            # FIXME: Instances that don't match should be ignored but WARN'ed to the user
+            continue
+        num = match.group(1)
+
+        rules = nat64.setdefault("source", {}).setdefault("rule", {})
+        # Mark it for deletion
+        if num not in rules:
+            rules[num] = {"deleted": True}
+            continue
+
+        # If the user changes the mode, recreate the instance else Jool fails with:
+        # Jool error: Sorry; you can't change an instance's framework for now.
+        if is_node_changed(config, base_src + [f"instance-{num}", "mode"]):
+            rules[num]["recreate"] = True
+
+        # If the user changes the pool6, recreate the instance else Jool fails with:
+        # Jool error: Sorry; you can't change a NAT64 instance's pool6 for now.
+        if dict_search("source.prefix", rules[num]) and is_node_changed(
+            config,
+            base_src + [num, "source", "prefix"],
+        ):
+            rules[num]["recreate"] = True
+
+    if not nat64:
+        # nothing left to do
+        return
+
+    if dict_search("source.rule", nat64):
+        # Ensure only 1 netfilter instance per namespace
+        nf_rules = filter(
+            lambda i: "deleted" not in i and i.get('mode') == "netfilter",
+            nat64["source"]["rule"].values(),
+        )
+        next(nf_rules, None)  # Discard the first element
+        if next(nf_rules, None) is not None:
+            raise ConfigError(
+                "Jool permits only 1 NAT64 netfilter instance (per network namespace)"
+            )
+
+        for rule, instance in nat64["source"]["rule"].items():
+            if "deleted" in instance:
+                continue
+
+            # Verify that source.prefix is set and is a /96
+            if not dict_search("source.prefix", instance):
+                raise ConfigError(f"Source NAT64 rule {rule} missing source prefix")
+            src_prefix = IPv6Network(instance["source"]["prefix"])
+            if src_prefix.prefixlen != 96:
+                raise ConfigError(f"Source NAT64 rule {rule} source prefix must be /96")
+            if (int(src_prefix[0]) & int(IPv6Address('0:0:0:0:ff00::'))) != 0:
+                raise ConfigError(
+                    f'Source NAT64 rule {rule} source prefix is not RFC6052-compliant: '
+                    'bits 64 to 71 (9th octet) must be zeroed'
+                )
+
+            pools = dict_search("translation.pool", instance)
+            if pools:
+                for num, pool in pools.items():
+                    if "address" not in pool:
+                        raise ConfigError(
+                            f"Source NAT64 rule {rule} translation pool "
+                            f"{num} missing address/prefix"
+                        )
+                    if "port" not in pool:
+                        raise ConfigError(
+                            f"Source NAT64 rule {rule} translation pool "
+                            f"{num} missing port(-range)"
+                        )
+
+
+def generate(nat64) -> None:
+    if not nat64:
+        return
+
+    os.makedirs(JOOL_CONFIG_DIR, exist_ok=True)
+
+    if dict_search("source.rule", nat64):
+        for rule, instance in nat64["source"]["rule"].items():
+            if "deleted" in instance:
+                # Delete the unused instance file
+                os.unlink(os.path.join(JOOL_CONFIG_DIR, f"instance-{rule}.json"))
+                continue
+
+            name = f"instance-{rule}"
+            config = {
+                "instance": name,
+                "framework": "netfilter",
+                "global": {
+                    "pool6": instance["source"]["prefix"],
+                    "manually-enabled": "disable" not in instance,
+                },
+                # "bib": [],
+            }
+
+            if "description" in instance:
+                config["comment"] = instance["description"]
+
+            if dict_search("translation.pool", instance):
+                pool4 = []
+                # mark
+                mark = ''
+                if dict_search("match.mark", instance):
+                    mark = instance["match"]["mark"]
+
+                for pool in instance["translation"]["pool"].values():
+                    if "disable" in pool:
+                        continue
+
+                    protos = pool.get("protocol", {}).keys() or ("tcp", "udp", "icmp")
+                    for proto in protos:
+                        obj = {
+                            "protocol": proto.upper(),
+                            "prefix": pool["address"],
+                            "port range": pool["port"],
+                        }
+                        if mark:
+                            obj["mark"] = int(mark)
+                        if "description" in pool:
+                            obj["comment"] = pool["description"]
+
+                        pool4.append(obj)
+
+                if pool4:
+                    config["pool4"] = pool4
+
+            write_file(f'{JOOL_CONFIG_DIR}/{name}.json', json_write(config, indent=2))
+
+
+def apply(nat64) -> None:
+    if not nat64:
+        unload_kmod(['jool'])
+        return
+
+    if dict_search("source.rule", nat64):
+        # Deletions first to avoid conflicts
+        for rule, instance in nat64["source"]["rule"].items():
+            if not any(k in instance for k in ("deleted", "recreate")):
+                continue
+
+            ret = run(f"jool instance remove instance-{rule}")
+            if ret != 0:
+                raise ConfigError(
+                    f"Failed to remove nat64 source rule {rule} (jool instance instance-{rule})"
+                )
+
+        # Now creations
+        for rule, instance in nat64["source"]["rule"].items():
+            if "deleted" in instance:
+                continue
+
+            name = f"instance-{rule}"
+            ret = run(f"jool -i {name} file handle {JOOL_CONFIG_DIR}/{name}.json")
+            if ret != 0:
+                raise ConfigError(f"Failed to set jool instance {name}")
+
+
+if __name__ == "__main__":
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/nat66.py b/src/conf_mode/nat66.py
new file mode 100644
index 0000000..95dfae3
--- /dev/null
+++ b/src/conf_mode/nat66.py
@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdep import set_dependents, call_dependents
+from vyos.template import render
+from vyos.utils.dict import dict_search
+from vyos.utils.kernel import check_kmod
+from vyos.utils.network import interface_exists
+from vyos.utils.process import cmd
+from vyos.utils.process import run
+from vyos.template import is_ipv6
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+k_mod = ['nft_nat', 'nft_chain_nat']
+
+nftables_nat66_config = '/run/nftables_nat66.nft'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['nat66']
+    nat = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+    set_dependents('conntrack', conf)
+
+    if not conf.exists(base):
+        nat['deleted'] = ''
+        return nat
+
+    nat['firewall_group'] = conf.get_config_dict(['firewall', 'group'], key_mangling=('-', '_'), get_first_key=True,
+                                    no_tag_node_value_mangle=True)
+
+    # Remove dynamic firewall groups if present:
+    if 'dynamic_group' in nat['firewall_group']:
+        del nat['firewall_group']['dynamic_group']
+
+    return nat
+
+def verify(nat):
+    if not nat or 'deleted' in nat:
+        # no need to verify the CLI as NAT66 is going to be deactivated
+        return None
+
+    if dict_search('source.rule', nat):
+        for rule, config in dict_search('source.rule', nat).items():
+            err_msg = f'Source NAT66 configuration error in rule {rule}:'
+
+            if 'outbound_interface' in config:
+                if 'name' in config['outbound_interface'] and 'group' in config['outbound_interface']:
+                    raise ConfigError(f'{err_msg} cannot specify both interface group and interface name for nat source rule "{rule}"')
+                elif 'name' in config['outbound_interface']:
+                    interface_name = config['outbound_interface']['name']
+                    if interface_name not in 'any':
+                        if interface_name.startswith('!'):
+                            interface_name = interface_name[1:]
+                        if not interface_exists(interface_name):
+                            Warning(f'Interface "{interface_name}" for source NAT66 rule "{rule}" does not exist!')
+
+            addr = dict_search('translation.address', config)
+            if addr != None:
+                if addr != 'masquerade' and not is_ipv6(addr):
+                    raise ConfigError(f'IPv6 address {addr} is not a valid address')
+            else:
+                if 'exclude' not in config:
+                    raise ConfigError(f'{err_msg} translation address not specified')
+
+            prefix = dict_search('source.prefix', config)
+            if prefix != None:
+                if not is_ipv6(prefix):
+                    raise ConfigError(f'{err_msg} source-prefix not specified')
+
+    if dict_search('destination.rule', nat):
+        for rule, config in dict_search('destination.rule', nat).items():
+            err_msg = f'Destination NAT66 configuration error in rule {rule}:'
+
+            if 'inbound_interface' in config:
+                if 'name' in config['inbound_interface'] and 'group' in config['inbound_interface']:
+                    raise ConfigError(f'{err_msg} cannot specify both interface group and interface name for destination nat rule "{rule}"')
+                elif 'name' in config['inbound_interface']:
+                    interface_name = config['inbound_interface']['name']
+                    if interface_name not in 'any':
+                        if interface_name.startswith('!'):
+                            interface_name = interface_name[1:]
+                        if not interface_exists(interface_name):
+                            Warning(f'Interface "{interface_name}" for destination NAT66 rule "{rule}" does not exist!')
+
+            if 'destination' in config and 'group' in config['destination']:
+                if len({'address_group', 'network_group', 'domain_group'} & set(config['destination']['group'])) > 1:
+                    raise ConfigError('Only one address-group, network-group or domain-group can be specified')
+
+    return None
+
+def generate(nat):
+    if not os.path.exists(nftables_nat66_config):
+        nat['first_install'] = True
+
+    render(nftables_nat66_config, 'firewall/nftables-nat66.j2', nat)
+
+    # dry-run newly generated configuration
+    tmp = run(f'nft --check --file {nftables_nat66_config}')
+    if tmp > 0:
+        raise ConfigError('Configuration file errors encountered!')
+
+    return None
+
+def apply(nat):
+    check_kmod(k_mod)
+
+    cmd(f'nft --file {nftables_nat66_config}')
+
+    if not nat or 'deleted' in nat:
+        os.unlink(nftables_nat66_config)
+
+    call_dependents()
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/nat_cgnat.py b/src/conf_mode/nat_cgnat.py
new file mode 100644
index 0000000..3484e58
--- /dev/null
+++ b/src/conf_mode/nat_cgnat.py
@@ -0,0 +1,475 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import ipaddress
+import jmespath
+import logging
+import os
+
+from sys import exit
+from logging.handlers import SysLogHandler
+
+from vyos.config import Config
+from vyos.configdict import is_node_changed
+from vyos.template import render
+from vyos.utils.process import cmd
+from vyos.utils.process import run
+from vyos import ConfigError
+from vyos import airbag
+
+airbag.enable()
+
+
+nftables_cgnat_config = '/run/nftables-cgnat.nft'
+
+# Logging
+logger = logging.getLogger('cgnat')
+logger.setLevel(logging.DEBUG)
+
+syslog_handler = SysLogHandler(address="/dev/log")
+syslog_handler.setLevel(logging.INFO)
+
+formatter = logging.Formatter('%(name)s: %(message)s')
+syslog_handler.setFormatter(formatter)
+
+logger.addHandler(syslog_handler)
+
+
+class IPOperations:
+    def __init__(self, ip_prefix: str):
+        self.ip_prefix = ip_prefix
+        self.ip_network = ipaddress.ip_network(ip_prefix) if '/' in ip_prefix else None
+
+    def get_ips_count(self) -> int:
+        """Returns the number of IPs in a prefix or range.
+
+        Example:
+        % ip = IPOperations('192.0.2.0/30')
+        % ip.get_ips_count()
+        4
+        % ip = IPOperations('192.0.2.0-192.0.2.2')
+        % ip.get_ips_count()
+        3
+        """
+        if '-' in self.ip_prefix:
+            start_ip, end_ip = self.ip_prefix.split('-')
+            start_ip = ipaddress.ip_address(start_ip)
+            end_ip = ipaddress.ip_address(end_ip)
+            return int(end_ip) - int(start_ip) + 1
+        elif '/31' in self.ip_prefix:
+            return 2
+        elif '/32' in self.ip_prefix:
+            return 1
+        else:
+            return sum(
+                1
+                for _ in [self.ip_network.network_address]
+                + list(self.ip_network.hosts())
+                + [self.ip_network.broadcast_address]
+            )
+
+    def convert_prefix_to_list_ips(self) -> list:
+        """Converts a prefix or IP range to a list of IPs including the network and broadcast addresses.
+
+        Example:
+        % ip = IPOperations('192.0.2.0/30')
+        % ip.convert_prefix_to_list_ips()
+        ['192.0.2.0', '192.0.2.1', '192.0.2.2', '192.0.2.3']
+        %
+        % ip = IPOperations('192.0.0.1-192.0.2.5')
+        % ip.convert_prefix_to_list_ips()
+        ['192.0.2.1', '192.0.2.2', '192.0.2.3', '192.0.2.4', '192.0.2.5']
+        """
+        if '-' in self.ip_prefix:
+            start_ip, end_ip = self.ip_prefix.split('-')
+            start_ip = ipaddress.ip_address(start_ip)
+            end_ip = ipaddress.ip_address(end_ip)
+            return [
+                str(ipaddress.ip_address(ip))
+                for ip in range(int(start_ip), int(end_ip) + 1)
+            ]
+        elif '/31' in self.ip_prefix:
+            return [
+                str(ip)
+                for ip in [
+                    self.ip_network.network_address,
+                    self.ip_network.broadcast_address,
+                ]
+            ]
+        elif '/32' in self.ip_prefix:
+            return [str(self.ip_network.network_address)]
+        else:
+            return [
+                str(ip)
+                for ip in [self.ip_network.network_address]
+                + list(self.ip_network.hosts())
+                + [self.ip_network.broadcast_address]
+            ]
+
+    def get_prefix_by_ip_range(self) -> list[ipaddress.IPv4Network]:
+        """Return the common prefix for the address range
+
+        Example:
+            % ip = IPOperations('100.64.0.1-100.64.0.5')
+            % ip.get_prefix_by_ip_range()
+            [IPv4Network('100.64.0.1/32'), IPv4Network('100.64.0.2/31'), IPv4Network('100.64.0.4/31')]
+        """
+        # We do not need to convert the IP range to network
+        # if it is already in network format
+        if self.ip_network:
+            return [self.ip_network]
+
+        # Raise an error if the IP range is not in the correct format
+        if '-' not in self.ip_prefix:
+            raise ValueError(
+                'Invalid IP range format. Please provide the IP range in CIDR format or with "-" separator.'
+            )
+        # Split the IP range and convert it to IP address objects
+        range_start, range_end = self.ip_prefix.split('-')
+        range_start = ipaddress.IPv4Address(range_start)
+        range_end = ipaddress.IPv4Address(range_end)
+
+        # Return the summarized IP networks list
+        return list(ipaddress.summarize_address_range(range_start, range_end))
+
+
+def _delete_conntrack_entries(source_prefixes: list[ipaddress.IPv4Network]) -> None:
+    """Delete all conntrack entries for the list of prefixes"""
+    for source_prefix in source_prefixes:
+        run(f'conntrack -D -s {source_prefix}')
+
+
+def generate_port_rules(
+    external_hosts: list,
+    internal_hosts: list,
+    port_count: int,
+    global_port_range: str = '1024-65535',
+) -> list:
+    """Generates a list of nftables option rules for the batch file.
+
+    Args:
+        external_hosts (list): A list of external host IPs.
+        internal_hosts (list): A list of internal host IPs.
+        port_count (int): The number of ports required per host.
+        global_port_range (str): The global port range to be used. Default is '1024-65535'.
+
+    Returns:
+        list: A list containing two elements:
+            - proto_map_elements (list): A list of proto map elements.
+            - other_map_elements (list): A list of other map elements.
+    """
+    rules = []
+    proto_map_elements = []
+    other_map_elements = []
+    start_port, end_port = map(int, global_port_range.split('-'))
+    total_possible_ports = (end_port - start_port) + 1
+
+    # Calculate the required number of ports per host
+    required_ports_per_host = port_count
+    current_port = start_port
+    current_external_index = 0
+
+    for internal_host in internal_hosts:
+        external_host = external_hosts[current_external_index]
+        next_end_port = current_port + required_ports_per_host - 1
+
+        # If the port range exceeds the end_port, move to the next external host
+        while next_end_port > end_port:
+            current_external_index = (current_external_index + 1) % len(external_hosts)
+            external_host = external_hosts[current_external_index]
+            current_port = start_port
+            next_end_port = current_port + required_ports_per_host - 1
+
+        proto_map_elements.append(
+            f'{internal_host} : {external_host} . {current_port}-{next_end_port}'
+        )
+        other_map_elements.append(f'{internal_host} : {external_host}')
+
+        current_port = next_end_port + 1
+        if current_port > end_port:
+            current_port = start_port
+            current_external_index += 1  # Move to the next external host
+
+    return [proto_map_elements, other_map_elements]
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['nat', 'cgnat']
+    config = conf.get_config_dict(
+        base,
+        get_first_key=True,
+        key_mangling=('-', '_'),
+        no_tag_node_value_mangle=True,
+        with_recursive_defaults=True,
+    )
+
+    effective_config = conf.get_config_dict(
+        base,
+        get_first_key=True,
+        key_mangling=('-', '_'),
+        no_tag_node_value_mangle=True,
+        effective=True,
+    )
+
+    # Check if the pool configuration has changed
+    if not conf.exists(base) or is_node_changed(conf, base + ['pool']):
+        config['delete_conntrack_entries'] = {}
+
+    # add running config
+    if effective_config:
+        config['effective'] = effective_config
+
+    if not conf.exists(base):
+        config['deleted'] = {}
+
+    return config
+
+
+def verify(config):
+    # bail out early - looks like removal from running config
+    if 'deleted' in config:
+        return None
+
+    if 'pool' not in config:
+        raise ConfigError(f'Pool must be defined!')
+    if 'rule' not in config:
+        raise ConfigError(f'Rule must be defined!')
+
+    for pool in ('external', 'internal'):
+        if pool not in config['pool']:
+            raise ConfigError(f'{pool} pool must be defined!')
+        for pool_name, pool_config in config['pool'][pool].items():
+            if 'range' not in pool_config:
+                raise ConfigError(
+                    f'Range for "{pool} pool {pool_name}" must be defined!'
+                )
+
+    external_pools_query = "keys(pool.external)"
+    external_pools: list = jmespath.search(external_pools_query, config)
+    internal_pools_query = "keys(pool.internal)"
+    internal_pools: list = jmespath.search(internal_pools_query, config)
+
+    used_external_pools = {}
+    used_internal_pools = {}
+    for rule, rule_config in config['rule'].items():
+        if 'source' not in rule_config:
+            raise ConfigError(f'Rule "{rule}" source pool must be defined!')
+        if 'pool' not in rule_config['source']:
+            raise ConfigError(f'Rule "{rule}" source pool must be defined!')
+
+        if 'translation' not in rule_config:
+            raise ConfigError(f'Rule "{rule}" translation pool must be defined!')
+
+        # Check if pool exists
+        internal_pool = rule_config['source']['pool']
+        if internal_pool not in internal_pools:
+            raise ConfigError(f'Internal pool "{internal_pool}" does not exist!')
+        external_pool = rule_config['translation']['pool']
+        if external_pool not in external_pools:
+            raise ConfigError(f'External pool "{external_pool}" does not exist!')
+
+        # Check pool duplication in different rules
+        if external_pool in used_external_pools:
+            raise ConfigError(
+                f'External pool "{external_pool}" is already used in rule '
+                f'{used_external_pools[external_pool]} and cannot be used in '
+                f'rule {rule}!'
+            )
+
+        if internal_pool in used_internal_pools:
+            raise ConfigError(
+                f'Internal pool "{internal_pool}" is already used in rule '
+                f'{used_internal_pools[internal_pool]} and cannot be used in '
+                f'rule {rule}!'
+            )
+
+        used_external_pools[external_pool] = rule
+        used_internal_pools[internal_pool] = rule
+
+        # Check calculation for allocation
+        external_port_range: str = config['pool']['external'][external_pool]['external_port_range']
+
+        external_ip_ranges: list = list(
+            config['pool']['external'][external_pool]['range']
+        )
+        internal_ip_ranges: list = config['pool']['internal'][internal_pool]['range']
+        start_port, end_port = map(int, external_port_range.split('-'))
+        ports_per_range_count: int = (end_port - start_port) + 1
+
+        external_list_hosts_count = []
+        external_list_hosts = []
+        internal_list_hosts_count = []
+        internal_list_hosts = []
+        for ext_range in external_ip_ranges:
+            # External hosts count
+            e_count = IPOperations(ext_range).get_ips_count()
+            external_list_hosts_count.append(e_count)
+            # External hosts list
+            e_hosts = IPOperations(ext_range).convert_prefix_to_list_ips()
+            external_list_hosts.extend(e_hosts)
+        for int_range in internal_ip_ranges:
+            # Internal hosts count
+            i_count = IPOperations(int_range).get_ips_count()
+            internal_list_hosts_count.append(i_count)
+            # Internal hosts list
+            i_hosts = IPOperations(int_range).convert_prefix_to_list_ips()
+            internal_list_hosts.extend(i_hosts)
+
+        external_host_count = sum(external_list_hosts_count)
+        internal_host_count = sum(internal_list_hosts_count)
+        ports_per_user: int = int(
+            config['pool']['external'][external_pool]['per_user_limit']['port']
+        )
+        users_per_extip = ports_per_range_count // ports_per_user
+        max_users = users_per_extip * external_host_count
+
+        if internal_host_count > max_users:
+            raise ConfigError(
+                f'Rule "{rule}" does not have enough ports available for the '
+                f'specified parameters'
+            )
+
+
+def generate(config):
+    if 'deleted' in config:
+        return None
+
+    proto_maps = []
+    other_maps = []
+
+    for rule, rule_config in config['rule'].items():
+        ext_pool_name: str = rule_config['translation']['pool']
+        int_pool_name: str = rule_config['source']['pool']
+
+        # Sort the external ranges by sequence
+        external_ranges: list = sorted(
+            config['pool']['external'][ext_pool_name]['range'],
+            key=lambda r: int(config['pool']['external'][ext_pool_name]['range'][r].get('seq', 999999))
+        )
+        internal_ranges: list = [range for range in config['pool']['internal'][int_pool_name]['range']]
+        external_list_hosts_count = []
+        external_list_hosts = []
+        internal_list_hosts_count = []
+        internal_list_hosts = []
+
+        for ext_range in external_ranges:
+            # External hosts count
+            e_count = IPOperations(ext_range).get_ips_count()
+            external_list_hosts_count.append(e_count)
+            # External hosts list
+            e_hosts = IPOperations(ext_range).convert_prefix_to_list_ips()
+            external_list_hosts.extend(e_hosts)
+
+        for int_range in internal_ranges:
+            # Internal hosts count
+            i_count = IPOperations(int_range).get_ips_count()
+            internal_list_hosts_count.append(i_count)
+            # Internal hosts list
+            i_hosts = IPOperations(int_range).convert_prefix_to_list_ips()
+            internal_list_hosts.extend(i_hosts)
+
+        external_host_count = sum(external_list_hosts_count)
+        internal_host_count = sum(internal_list_hosts_count)
+        ports_per_user = int(
+            jmespath.search(f'pool.external."{ext_pool_name}".per_user_limit.port', config)
+        )
+        external_port_range: str = jmespath.search(
+            f'pool.external."{ext_pool_name}".external_port_range', config
+        )
+
+        rule_proto_maps, rule_other_maps = generate_port_rules(
+            external_list_hosts, internal_list_hosts, ports_per_user, external_port_range
+        )
+
+        proto_maps.extend(rule_proto_maps)
+        other_maps.extend(rule_other_maps)
+
+    config['proto_map_elements'] = ', '.join(proto_maps)
+    config['other_map_elements'] = ', '.join(other_maps)
+
+    render(nftables_cgnat_config, 'firewall/nftables-cgnat.j2', config)
+
+    # dry-run newly generated configuration
+    tmp = run(f'nft --check --file {nftables_cgnat_config}')
+    if tmp > 0:
+        raise ConfigError('Configuration file errors encountered!')
+
+
+def apply(config):
+    if 'deleted' in config:
+        # Cleanup cgnat
+        cmd('nft delete table ip cgnat')
+        if os.path.isfile(nftables_cgnat_config):
+            os.unlink(nftables_cgnat_config)
+    else:
+        cmd(f'nft --file {nftables_cgnat_config}')
+
+    # Delete conntrack entries
+    # if the pool configuration has changed
+    if 'delete_conntrack_entries' in config and 'effective' in config:
+        # Prepare the list of internal pool prefixes
+        internal_pool_prefix_list: list[ipaddress.IPv4Network] = []
+
+        # Get effective rules configurations
+        for rule_config in config['effective'].get('rule', {}).values():
+            # Get effective internal pool configuration
+            internal_pool = rule_config['source']['pool']
+            # Find the internal IP ranges for the internal pool
+            internal_ip_ranges: list[str] = config['effective']['pool']['internal'][
+                internal_pool
+            ]['range']
+            # Get the IP prefixes for the internal IP range
+            for internal_range in internal_ip_ranges:
+                ip_prefix: list[ipaddress.IPv4Network] = IPOperations(
+                    internal_range
+                ).get_prefix_by_ip_range()
+                # Add the IP prefixes to the list of all internal pool prefixes
+                internal_pool_prefix_list += ip_prefix
+
+        # Delete required sources for conntrack
+        _delete_conntrack_entries(internal_pool_prefix_list)
+
+    # Logging allocations
+    if 'log_allocation' in config:
+        allocations = config['proto_map_elements']
+        allocations = allocations.split(',')
+        for allocation in allocations:
+            try:
+                # Split based on the delimiters used in the nft data format
+                internal_host, rest = allocation.split(' : ')
+                external_host, port_range = rest.split(' . ')
+                # Log the parsed data
+                logger.info(
+                    f'Internal host: {internal_host.lstrip()}, external host: {external_host}, Port range: {port_range}')
+            except ValueError as e:
+                # Log error message
+                logger.error(f"Error processing line '{allocation}': {e}")
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/netns.py b/src/conf_mode/netns.py
new file mode 100644
index 0000000..b57e46a
--- /dev/null
+++ b/src/conf_mode/netns.py
@@ -0,0 +1,115 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import node_changed
+from vyos.utils.process import call
+from vyos.utils.dict import dict_search
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+
+def netns_interfaces(c, match):
+    """
+    get NETNS bound interfaces
+    """
+    matched = []
+    old_level = c.get_level()
+    c.set_level(['interfaces'])
+    section = c.get_config_dict([], get_first_key=True)
+    for type in section:
+        interfaces = section[type]
+        for name in interfaces:
+            interface = interfaces[name]
+            if 'netns' in interface:
+                v = interface.get('netns', '')
+                if v == match:
+                    matched.append(name)
+
+    c.set_level(old_level)
+    return matched
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['netns']
+    netns = conf.get_config_dict(base, get_first_key=True,
+                                       no_tag_node_value_mangle=True)
+
+    # determine which NETNS has been removed
+    for name in node_changed(conf, base + ['name']):
+        if 'netns_remove' not in netns:
+            netns.update({'netns_remove' : {}})
+
+        netns['netns_remove'][name] = {}
+        # get NETNS bound interfaces
+        interfaces = netns_interfaces(conf, name)
+        if interfaces: netns['netns_remove'][name]['interface'] = interfaces
+
+    return netns
+
+def verify(netns):
+    # ensure NETNS is not assigned to any interface
+    if 'netns_remove' in netns:
+        for name, config in netns['netns_remove'].items():
+            if 'interface' in config:
+                raise ConfigError(f'Can not remove network namespace "{name}", it '\
+                                  f'still has member interfaces!')
+
+    if 'name' in netns:
+        for name, config in netns['name'].items():
+            # no tests (yet)
+            pass
+
+    return None
+
+def generate(netns):
+    if not netns:
+        return None
+
+    return None
+
+
+def apply(netns):
+
+    for tmp in (dict_search('netns_remove', netns) or []):
+        if os.path.isfile(f'/run/netns/{tmp}'):
+            call(f'ip netns del {tmp}')
+
+    if 'name' in netns:
+        for name, config in netns['name'].items():
+            if not os.path.isfile(f'/run/netns/{name}'):
+                call(f'ip netns add {name}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
new file mode 100644
index 0000000..215b22b
--- /dev/null
+++ b/src/conf_mode/pki.py
@@ -0,0 +1,486 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import argv
+from sys import exit
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
+from vyos.configdict import node_changed
+from vyos.configdiff import Diff
+from vyos.configdiff import get_config_diff
+from vyos.defaults import directories
+from vyos.pki import is_ca_certificate
+from vyos.pki import load_certificate
+from vyos.pki import load_public_key
+from vyos.pki import load_openssh_public_key
+from vyos.pki import load_openssh_private_key
+from vyos.pki import load_private_key
+from vyos.pki import load_crl
+from vyos.pki import load_dh_parameters
+from vyos.utils.boot import boot_configuration_complete
+from vyos.utils.dict import dict_search
+from vyos.utils.dict import dict_search_args
+from vyos.utils.dict import dict_search_recursive
+from vyos.utils.process import call
+from vyos.utils.process import cmd
+from vyos.utils.process import is_systemd_service_active
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+vyos_certbot_dir = directories['certbot']
+
+# keys to recursively search for under specified path
+sync_search = [
+    {
+        'keys': ['certificate'],
+        'path': ['service', 'https'],
+    },
+    {
+        'keys': ['certificate', 'ca_certificate'],
+        'path': ['interfaces', 'ethernet'],
+    },
+    {
+        'keys': ['certificate', 'ca_certificate', 'dh_params', 'shared_secret_key', 'auth_key', 'crypt_key'],
+        'path': ['interfaces', 'openvpn'],
+    },
+    {
+        'keys': ['ca_certificate'],
+        'path': ['interfaces', 'sstpc'],
+    },
+    {
+        'keys': ['certificate', 'ca_certificate'],
+        'path': ['load_balancing', 'reverse_proxy'],
+    },
+    {
+        'keys': ['key'],
+        'path': ['protocols', 'rpki', 'cache'],
+    },
+    {
+        'keys': ['certificate', 'ca_certificate', 'local_key', 'remote_key'],
+        'path': ['vpn', 'ipsec'],
+    },
+    {
+        'keys': ['certificate', 'ca_certificate'],
+        'path': ['vpn', 'openconnect'],
+    },
+    {
+        'keys': ['certificate', 'ca_certificate'],
+        'path': ['vpn', 'sstp'],
+    },
+    {
+        'keys': ['certificate', 'ca_certificate'],
+        'path': ['service', 'stunnel'],
+    }
+]
+
+# key from other config nodes -> key in pki['changed'] and pki
+sync_translate = {
+    'certificate': 'certificate',
+    'ca_certificate': 'ca',
+    'dh_params': 'dh',
+    'local_key': 'key_pair',
+    'remote_key': 'key_pair',
+    'shared_secret_key': 'openvpn',
+    'auth_key': 'openvpn',
+    'crypt_key': 'openvpn',
+    'key': 'openssh',
+}
+
+def certbot_delete(certificate):
+    if not boot_configuration_complete():
+        return
+    if os.path.exists(f'{vyos_certbot_dir}/renewal/{certificate}.conf'):
+        cmd(f'certbot delete --non-interactive --config-dir {vyos_certbot_dir} --cert-name {certificate}')
+
+def certbot_request(name: str, config: dict, dry_run: bool=True):
+    # We do not call certbot when booting the system - there is no need to do so and
+    # request new certificates during boot/image upgrade as the certbot configuration
+    # is stored persistent under /config - thus we do not open the door to transient
+    # errors
+    if not boot_configuration_complete():
+        return
+
+    domains = '--domains ' + ' --domains '.join(config['domain_name'])
+    tmp = f'certbot certonly --non-interactive --config-dir {vyos_certbot_dir} --cert-name {name} '\
+          f'--standalone --agree-tos --no-eff-email --expand --server {config["url"]} '\
+          f'--email {config["email"]} --key-type rsa --rsa-key-size {config["rsa_key_size"]} '\
+          f'{domains}'
+    if 'listen_address' in config:
+        tmp += f' --http-01-address {config["listen_address"]}'
+    # verify() does not need to actually request a cert but only test for plausability
+    if dry_run:
+        tmp += ' --dry-run'
+
+    cmd(tmp, raising=ConfigError, message=f'ACME certbot request failed for "{name}"!')
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['pki']
+
+    pki = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                     get_first_key=True,
+                                     no_tag_node_value_mangle=True)
+
+    if len(argv) > 1 and argv[1] == 'certbot_renew':
+        pki['certbot_renew'] = {}
+
+    tmp = node_changed(conf, base + ['ca'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
+    if tmp:
+        if 'changed' not in pki: pki.update({'changed':{}})
+        pki['changed'].update({'ca' : tmp})
+
+    tmp = node_changed(conf, base + ['certificate'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
+    if tmp:
+        if 'changed' not in pki: pki.update({'changed':{}})
+        pki['changed'].update({'certificate' : tmp})
+
+    tmp = node_changed(conf, base + ['dh'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
+    if tmp:
+        if 'changed' not in pki: pki.update({'changed':{}})
+        pki['changed'].update({'dh' : tmp})
+
+    tmp = node_changed(conf, base + ['key-pair'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
+    if tmp:
+        if 'changed' not in pki: pki.update({'changed':{}})
+        pki['changed'].update({'key_pair' : tmp})
+
+    tmp = node_changed(conf, base + ['openssh'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
+    if tmp:
+        if 'changed' not in pki: pki.update({'changed':{}})
+        pki['changed'].update({'openssh' : tmp})
+
+    tmp = node_changed(conf, base + ['openvpn', 'shared-secret'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
+    if tmp:
+        if 'changed' not in pki: pki.update({'changed':{}})
+        pki['changed'].update({'openvpn' : tmp})
+
+    # We only merge on the defaults of there is a configuration at all
+    if conf.exists(base):
+        # We have gathered the dict representation of the CLI, but there are default
+        # options which we need to update into the dictionary retrived.
+        default_values = conf.get_config_defaults(**pki.kwargs, recursive=True)
+        # remove ACME default configuration if unused by CLI
+        if 'certificate' in pki:
+            for name, cert_config in pki['certificate'].items():
+                if 'acme' not in cert_config:
+                    # Remove ACME default values
+                    del default_values['certificate'][name]['acme']
+
+        # merge CLI and default dictionary
+        pki = config_dict_merge(default_values, pki)
+
+    # Certbot triggered an external renew of the certificates.
+    # Mark all ACME based certificates as "changed" to trigger
+    # update of dependent services
+    if 'certificate' in pki and 'certbot_renew' in pki:
+        renew = []
+        for name, cert_config in pki['certificate'].items():
+            if 'acme' in cert_config:
+                renew.append(name)
+        # If triggered externally by certbot, certificate key is not present in changed
+        if 'changed' not in pki: pki.update({'changed':{}})
+        pki['changed'].update({'certificate' : renew})
+
+    # We need to get the entire system configuration to verify that we are not
+    # deleting a certificate that is still referenced somewhere!
+    pki['system'] = conf.get_config_dict([], key_mangling=('-', '_'),
+                                         get_first_key=True,
+                                         no_tag_node_value_mangle=True)
+    D = get_config_diff(conf)
+
+    for search in sync_search:
+        for key in search['keys']:
+            changed_key = sync_translate[key]
+            if 'changed' not in pki or changed_key not in pki['changed']:
+                continue
+
+            for item_name in pki['changed'][changed_key]:
+                node_present = False
+                if changed_key == 'openvpn':
+                    node_present = dict_search_args(pki, 'openvpn', 'shared_secret', item_name)
+                else:
+                    node_present = dict_search_args(pki, changed_key, item_name)
+
+                if node_present:
+                    search_dict = dict_search_args(pki['system'], *search['path'])
+                    if not search_dict:
+                        continue
+                    for found_name, found_path in dict_search_recursive(search_dict, key):
+                        if isinstance(found_name, list) and item_name not in found_name:
+                            continue
+
+                        if isinstance(found_name, str) and found_name != item_name:
+                            continue
+
+                        path = search['path']
+                        path_str = ' '.join(path + found_path)
+                        #print(f'PKI: Updating config: {path_str} {item_name}')
+
+                        if path[0] == 'interfaces':
+                            ifname = found_path[0]
+                            if not D.node_changed_presence(path + [ifname]):
+                                set_dependents(path[1], conf, ifname)
+                        else:
+                            if not D.node_changed_presence(path):
+                                set_dependents(path[1], conf)
+
+    return pki
+
+def is_valid_certificate(raw_data):
+    # If it loads correctly we're good, or return False
+    return load_certificate(raw_data, wrap_tags=True)
+
+def is_valid_ca_certificate(raw_data):
+    # Check if this is a valid certificate with CA attributes
+    cert = load_certificate(raw_data, wrap_tags=True)
+    if not cert:
+        return False
+    return is_ca_certificate(cert)
+
+def is_valid_public_key(raw_data):
+    # If it loads correctly we're good, or return False
+    return load_public_key(raw_data, wrap_tags=True)
+
+def is_valid_private_key(raw_data, protected=False):
+    # If it loads correctly we're good, or return False
+    # With encrypted private keys, we always return true as we cannot ask for password to verify
+    if protected:
+        return True
+    return load_private_key(raw_data, passphrase=None, wrap_tags=True)
+
+def is_valid_openssh_public_key(raw_data, type):
+    # If it loads correctly we're good, or return False
+    return load_openssh_public_key(raw_data, type)
+
+def is_valid_openssh_private_key(raw_data, protected=False):
+    # If it loads correctly we're good, or return False
+    # With encrypted private keys, we always return true as we cannot ask for password to verify
+    if protected:
+        return True
+    return load_openssh_private_key(raw_data, passphrase=None, wrap_tags=True)
+
+def is_valid_crl(raw_data):
+    # If it loads correctly we're good, or return False
+    return load_crl(raw_data, wrap_tags=True)
+
+def is_valid_dh_parameters(raw_data):
+    # If it loads correctly we're good, or return False
+    return load_dh_parameters(raw_data, wrap_tags=True)
+
+def verify(pki):
+    if not pki:
+        return None
+
+    if 'ca' in pki:
+        for name, ca_conf in pki['ca'].items():
+            if 'certificate' in ca_conf:
+                if not is_valid_ca_certificate(ca_conf['certificate']):
+                    raise ConfigError(f'Invalid certificate on CA certificate "{name}"')
+
+            if 'private' in ca_conf and 'key' in ca_conf['private']:
+                private = ca_conf['private']
+                protected = 'password_protected' in private
+
+                if not is_valid_private_key(private['key'], protected):
+                    raise ConfigError(f'Invalid private key on CA certificate "{name}"')
+
+            if 'crl' in ca_conf:
+                ca_crls = ca_conf['crl']
+                if isinstance(ca_crls, str):
+                    ca_crls = [ca_crls]
+
+                for crl in ca_crls:
+                    if not is_valid_crl(crl):
+                        raise ConfigError(f'Invalid CRL on CA certificate "{name}"')
+
+    if 'certificate' in pki:
+        for name, cert_conf in pki['certificate'].items():
+            if 'certificate' in cert_conf:
+                if not is_valid_certificate(cert_conf['certificate']):
+                    raise ConfigError(f'Invalid certificate on certificate "{name}"')
+
+            if 'private' in cert_conf and 'key' in cert_conf['private']:
+                private = cert_conf['private']
+                protected = 'password_protected' in private
+
+                if not is_valid_private_key(private['key'], protected):
+                    raise ConfigError(f'Invalid private key on certificate "{name}"')
+
+            if 'acme' in cert_conf:
+                if 'domain_name' not in cert_conf['acme']:
+                    raise ConfigError(f'At least one domain-name is required to request '\
+                                    f'certificate for "{name}" via ACME!')
+
+                if 'email' not in cert_conf['acme']:
+                    raise ConfigError(f'An email address is required to request '\
+                                    f'certificate for "{name}" via ACME!')
+
+                if 'certbot_renew' not in pki:
+                    # Only run the ACME command if something on this entity changed,
+                    # as this is time intensive
+                    tmp = dict_search('changed.certificate', pki)
+                    if tmp != None and name in tmp:
+                        certbot_request(name, cert_conf['acme'])
+
+    if 'dh' in pki:
+        for name, dh_conf in pki['dh'].items():
+            if 'parameters' in dh_conf:
+                if not is_valid_dh_parameters(dh_conf['parameters']):
+                    raise ConfigError(f'Invalid DH parameters on "{name}"')
+
+    if 'key_pair' in pki:
+        for name, key_conf in pki['key_pair'].items():
+            if 'public' in key_conf and 'key' in key_conf['public']:
+                if not is_valid_public_key(key_conf['public']['key']):
+                    raise ConfigError(f'Invalid public key on key-pair "{name}"')
+
+            if 'private' in key_conf and 'key' in key_conf['private']:
+                private = key_conf['private']
+                protected = 'password_protected' in private
+                if not is_valid_private_key(private['key'], protected):
+                    raise ConfigError(f'Invalid private key on key-pair "{name}"')
+
+    if 'openssh' in pki:
+        for name, key_conf in pki['openssh'].items():
+            if 'public' in key_conf and 'key' in key_conf['public']:
+                if 'type' not in key_conf['public']:
+                    raise ConfigError(f'Must define OpenSSH public key type for "{name}"')
+                if not is_valid_openssh_public_key(key_conf['public']['key'], key_conf['public']['type']):
+                    raise ConfigError(f'Invalid OpenSSH public key "{name}"')
+
+            if 'private' in key_conf and 'key' in key_conf['private']:
+                private = key_conf['private']
+                protected = 'password_protected' in private
+                if not is_valid_openssh_private_key(private['key'], protected):
+                    raise ConfigError(f'Invalid OpenSSH private key "{name}"')
+
+    if 'x509' in pki:
+        if 'default' in pki['x509']:
+            default_values = pki['x509']['default']
+            if 'country' in default_values:
+                country = default_values['country']
+                if len(country) != 2 or not country.isalpha():
+                    raise ConfigError(f'Invalid default country value. Value must be 2 alpha characters.')
+
+    if 'changed' in pki:
+        # if the list is getting longer, we can move to a dict() and also embed the
+        # search key as value from line 173 or 176
+        for search in sync_search:
+            for key in search['keys']:
+                changed_key = sync_translate[key]
+
+                if changed_key not in pki['changed']:
+                    continue
+
+                for item_name in pki['changed'][changed_key]:
+                    node_present = False
+                    if changed_key == 'openvpn':
+                        node_present = dict_search_args(pki, 'openvpn', 'shared_secret', item_name)
+                    else:
+                        node_present = dict_search_args(pki, changed_key, item_name)
+
+                    if not node_present:
+                        search_dict = dict_search_args(pki['system'], *search['path'])
+
+                        if not search_dict:
+                            continue
+
+                        for found_name, found_path in dict_search_recursive(search_dict, key):
+                            if found_name == item_name:
+                                path_str = " ".join(search['path'] + found_path)
+                                raise ConfigError(f'PKI object "{item_name}" still in use by "{path_str}"')
+
+    return None
+
+def generate(pki):
+    if not pki:
+        return None
+
+    # Certbot renewal only needs to re-trigger the services to load up the
+    # new PEM file
+    if 'certbot_renew' in pki:
+        return None
+
+    certbot_list = []
+    certbot_list_on_disk = []
+    if os.path.exists(f'{vyos_certbot_dir}/live'):
+        certbot_list_on_disk = [f.path.split('/')[-1] for f in os.scandir(f'{vyos_certbot_dir}/live') if f.is_dir()]
+
+    if 'certificate' in pki:
+        changed_certificates = dict_search('changed.certificate', pki)
+        for name, cert_conf in pki['certificate'].items():
+            if 'acme' in cert_conf:
+                certbot_list.append(name)
+                # generate certificate if not found on disk
+                if name not in certbot_list_on_disk:
+                    certbot_request(name, cert_conf['acme'], dry_run=False)
+                elif changed_certificates != None and name in changed_certificates:
+                    # when something for the certificate changed, we should delete it
+                    if name in certbot_list_on_disk:
+                        certbot_delete(name)
+                    certbot_request(name, cert_conf['acme'], dry_run=False)
+
+    # Cleanup certbot configuration and certificates if no longer in use by CLI
+    # Get foldernames under vyos_certbot_dir which each represent a certbot cert
+    if os.path.exists(f'{vyos_certbot_dir}/live'):
+        for cert in certbot_list_on_disk:
+            if cert not in certbot_list:
+                # certificate is no longer active on the CLI - remove it
+                certbot_delete(cert)
+
+    return None
+
+def apply(pki):
+    systemd_certbot_name = 'certbot.timer'
+    if not pki:
+        call(f'systemctl stop {systemd_certbot_name}')
+        return None
+
+    has_certbot = False
+    if 'certificate' in pki:
+        for name, cert_conf in pki['certificate'].items():
+            if 'acme' in cert_conf:
+                has_certbot = True
+                break
+
+    if not has_certbot:
+        call(f'systemctl stop {systemd_certbot_name}')
+    elif has_certbot and not is_systemd_service_active(systemd_certbot_name):
+        call(f'systemctl restart {systemd_certbot_name}')
+
+    if 'changed' in pki:
+        call_dependents()
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/policy.py b/src/conf_mode/policy.py
new file mode 100644
index 0000000..a5963e7
--- /dev/null
+++ b/src/conf_mode/policy.py
@@ -0,0 +1,323 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+
+airbag.enable()
+
+
+def community_action_compatibility(actions: dict) -> bool:
+    """
+    Check compatibility of values in community and large community sections
+    :param actions: dictionary with community
+    :type actions: dict
+    :return: true if compatible, false if not
+    :rtype: bool
+    """
+    if ('none' in actions) and ('replace' in actions or 'add' in actions):
+        return False
+    if 'replace' in actions and 'add' in actions:
+        return False
+    if ('delete' in actions) and ('none' in actions or 'replace' in actions):
+        return False
+    return True
+
+
+def extcommunity_action_compatibility(actions: dict) -> bool:
+    """
+    Check compatibility of values in extended community sections
+    :param actions: dictionary with community
+    :type actions: dict
+    :return: true if compatible, false if not
+    :rtype: bool
+    """
+    if ('none' in actions) and (
+            'rt' in actions or 'soo' in actions or 'bandwidth' in actions or 'bandwidth_non_transitive' in actions):
+        return False
+    if ('bandwidth_non_transitive' in actions) and ('bandwidth' not in actions):
+        return False
+    return True
+
+def routing_policy_find(key, dictionary):
+    # Recursively traverse a dictionary and extract the value assigned to
+    # a given key as generator object. This is made for routing policies,
+    # thus also import/export is checked
+    for k, v in dictionary.items():
+        if k == key:
+            if isinstance(v, dict):
+                for a, b in v.items():
+                    if a in ['import', 'export']:
+                        yield b
+            else:
+                yield v
+        elif isinstance(v, dict):
+            for result in routing_policy_find(key, v):
+                yield result
+        elif isinstance(v, list):
+            for d in v:
+                if isinstance(d, dict):
+                    for result in routing_policy_find(key, d):
+                        yield result
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['policy']
+    policy = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                  get_first_key=True,
+                                  no_tag_node_value_mangle=True)
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['protocols'], key_mangling=('-', '_'),
+                               no_tag_node_value_mangle=True)
+    # Merge policy dict into "regular" config dict
+    policy = dict_merge(tmp, policy)
+    return policy
+
+
+def verify(policy):
+    if not policy:
+        return None
+
+    for policy_type in ['access_list', 'access_list6', 'as_path_list',
+                        'community_list', 'extcommunity_list',
+                        'large_community_list',
+                        'prefix_list', 'prefix_list6', 'route_map']:
+        # Bail out early and continue with next policy type
+        if policy_type not in policy:
+            continue
+
+        # instance can be an ACL name/number, prefix-list name or route-map name
+        for instance, instance_config in policy[policy_type].items():
+            # If no rule was found within the instance ... sad, but we can leave
+            # early as nothing needs to be verified
+            if 'rule' not in instance_config:
+                continue
+
+            # human readable instance name (hypen instead of underscore)
+            policy_hr = policy_type.replace('_', '-')
+            entries = []
+            for rule, rule_config in instance_config['rule'].items():
+                mandatory_error = f'must be specified for "{policy_hr} {instance} rule {rule}"!'
+                if 'action' not in rule_config:
+                    raise ConfigError(f'Action {mandatory_error}')
+
+                if policy_type == 'access_list':
+                    if 'source' not in rule_config:
+                        raise ConfigError(f'A source {mandatory_error}')
+
+                    if int(instance) in range(100, 200) or int(
+                            instance) in range(2000, 2700):
+                        if 'destination' not in rule_config:
+                            raise ConfigError(
+                                f'A destination {mandatory_error}')
+
+                if policy_type == 'access_list6':
+                    if 'source' not in rule_config:
+                        raise ConfigError(f'A source {mandatory_error}')
+
+                if policy_type in ['as_path_list', 'community_list',
+                                   'extcommunity_list',
+                                   'large_community_list']:
+                    if 'regex' not in rule_config:
+                        raise ConfigError(f'A regex {mandatory_error}')
+
+                if policy_type in ['prefix_list', 'prefix_list6']:
+                    if 'prefix' not in rule_config:
+                        raise ConfigError(f'A prefix {mandatory_error}')
+
+                    if rule_config in entries:
+                        raise ConfigError(
+                            f'Rule "{rule}" contains a duplicate prefix definition!')
+                    entries.append(rule_config)
+
+    # route-maps tend to be a bit more complex so they get their own verify() section
+    if 'route_map' in policy:
+        for route_map, route_map_config in policy['route_map'].items():
+            if 'rule' not in route_map_config:
+                continue
+
+            for rule, rule_config in route_map_config['rule'].items():
+                # Action 'deny' cannot be used with "continue" or "on-match"
+                # FRR does not validate it T4827, T6676
+                if rule_config['action'] == 'deny' and ('continue' in rule_config or 'on_match' in rule_config):
+                    raise ConfigError(f'rule {rule} "continue" or "on-match" cannot be used with action deny!')
+
+                # Specified community-list must exist
+                tmp = dict_search('match.community.community_list',
+                                  rule_config)
+                if tmp and tmp not in policy.get('community_list', []):
+                    raise ConfigError(f'community-list {tmp} does not exist!')
+
+                # Specified extended community-list must exist
+                tmp = dict_search('match.extcommunity', rule_config)
+                if tmp and tmp not in policy.get('extcommunity_list', []):
+                    raise ConfigError(
+                        f'extcommunity-list {tmp} does not exist!')
+
+                # Specified large-community-list must exist
+                tmp = dict_search('match.large_community.large_community_list',
+                                  rule_config)
+                if tmp and tmp not in policy.get('large_community_list', []):
+                    raise ConfigError(
+                        f'large-community-list {tmp} does not exist!')
+
+                # Specified prefix-list must exist
+                tmp = dict_search('match.ip.address.prefix_list', rule_config)
+                if tmp and tmp not in policy.get('prefix_list', []):
+                    raise ConfigError(f'prefix-list {tmp} does not exist!')
+
+                # Specified prefix-list must exist
+                tmp = dict_search('match.ipv6.address.prefix_list',
+                                  rule_config)
+                if tmp and tmp not in policy.get('prefix_list6', []):
+                    raise ConfigError(f'prefix-list6 {tmp} does not exist!')
+
+                # Specified access_list6 in nexthop must exist
+                tmp = dict_search('match.ipv6.nexthop.access_list',
+                                  rule_config)
+                if tmp and tmp not in policy.get('access_list6', []):
+                    raise ConfigError(f'access_list6 {tmp} does not exist!')
+
+                # Specified prefix-list6 in nexthop must exist
+                tmp = dict_search('match.ipv6.nexthop.prefix_list',
+                                  rule_config)
+                if tmp and tmp not in policy.get('prefix_list6', []):
+                    raise ConfigError(f'prefix-list6 {tmp} does not exist!')
+
+                tmp = dict_search('set.community.delete', rule_config)
+                if tmp and tmp not in policy.get('community_list', []):
+                    raise ConfigError(f'community-list {tmp} does not exist!')
+
+                tmp = dict_search('set.large_community.delete',
+                                  rule_config)
+                if tmp and tmp not in policy.get('large_community_list', []):
+                    raise ConfigError(
+                        f'large-community-list {tmp} does not exist!')
+
+                if 'set' in rule_config:
+                    rule_action = rule_config['set']
+                    if 'community' in rule_action:
+                        if not community_action_compatibility(
+                                rule_action['community']):
+                            raise ConfigError(
+                                f'Unexpected combination between action replace, add, delete or none in community')
+                    if 'large_community' in rule_action:
+                        if not community_action_compatibility(
+                                rule_action['large_community']):
+                            raise ConfigError(
+                                f'Unexpected combination between action replace, add, delete or none in large-community')
+                    if 'extcommunity' in rule_action:
+                        if not extcommunity_action_compatibility(
+                                rule_action['extcommunity']):
+                            raise ConfigError(
+                                f'Unexpected combination between none, rt, soo, bandwidth, bandwidth-non-transitive in extended-community')
+    # When routing protocols are active some use prefix-lists, route-maps etc.
+    # to apply the systems routing policy to the learned or redistributed routes.
+    # When the "routing policy" changes and policies, route-maps etc. are deleted,
+    # it is our responsibility to verify that the policy can not be deleted if it
+    # is used by any routing protocol
+    if 'protocols' in policy:
+        for policy_type in ['access_list', 'access_list6', 'as_path_list',
+                            'community_list',
+                            'extcommunity_list', 'large_community_list',
+                            'prefix_list', 'route_map']:
+            if policy_type in policy:
+                for policy_name in list(set(routing_policy_find(policy_type,
+                                                                policy[
+                                                                    'protocols']))):
+                    found = False
+                    if policy_name in policy[policy_type]:
+                        found = True
+                    # BGP uses prefix-list for selecting both an IPv4 or IPv6 AFI related
+                    # list - we need to go the extra mile here and check both prefix-lists
+                    if policy_type == 'prefix_list' and 'prefix_list6' in policy and policy_name in \
+                            policy['prefix_list6']:
+                        found = True
+                    if not found:
+                        tmp = policy_type.replace('_', '-')
+                        raise ConfigError(
+                            f'Can not delete {tmp} "{policy_name}", still in use!')
+
+    return None
+
+
+def generate(policy):
+    if not policy:
+        return None
+    policy['new_frr_config'] = render_to_string('frr/policy.frr.j2', policy)
+    return None
+
+
+def apply(policy):
+    bgp_daemon = 'bgpd'
+    zebra_daemon = 'zebra'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # The route-map used for the FIB (zebra) is part of the zebra daemon
+    frr_cfg.load_configuration(bgp_daemon)
+    frr_cfg.modify_section(r'^bgp as-path access-list .*')
+    frr_cfg.modify_section(r'^bgp community-list .*')
+    frr_cfg.modify_section(r'^bgp extcommunity-list .*')
+    frr_cfg.modify_section(r'^bgp large-community-list .*')
+    frr_cfg.modify_section(r'^route-map .*', stop_pattern='^exit',
+                           remove_stop_mark=True)
+    if 'new_frr_config' in policy:
+        frr_cfg.add_before(frr.default_add_before, policy['new_frr_config'])
+    frr_cfg.commit_configuration(bgp_daemon)
+
+    # The route-map used for the FIB (zebra) is part of the zebra daemon
+    frr_cfg.load_configuration(zebra_daemon)
+    frr_cfg.modify_section(r'^access-list .*')
+    frr_cfg.modify_section(r'^ipv6 access-list .*')
+    frr_cfg.modify_section(r'^ip prefix-list .*')
+    frr_cfg.modify_section(r'^ipv6 prefix-list .*')
+    frr_cfg.modify_section(r'^route-map .*', stop_pattern='^exit',
+                           remove_stop_mark=True)
+    if 'new_frr_config' in policy:
+        frr_cfg.add_before(frr.default_add_before, policy['new_frr_config'])
+    frr_cfg.commit_configuration(zebra_daemon)
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/policy_local-route.py b/src/conf_mode/policy_local-route.py
new file mode 100644
index 0000000..331fd97
--- /dev/null
+++ b/src/conf_mode/policy_local-route.py
@@ -0,0 +1,310 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from itertools import product
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
+from vyos.configdict import leaf_node_changed
+from vyos.configverify import verify_interface_exists
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['policy']
+
+    pbr = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+    for route in ['local_route', 'local_route6']:
+        dict_id = 'rule_remove' if route == 'local_route' else 'rule6_remove'
+        route_key = 'local-route' if route == 'local_route' else 'local-route6'
+        base_rule = base + [route_key, 'rule']
+
+        # delete policy local-route
+        dict = {}
+        tmp = node_changed(conf, base_rule, key_mangling=('-', '_'))
+        if tmp:
+            for rule in (tmp or []):
+                src = leaf_node_changed(conf, base_rule + [rule, 'source', 'address'])
+                src_port = leaf_node_changed(conf, base_rule + [rule, 'source', 'port'])
+                fwmk = leaf_node_changed(conf, base_rule + [rule, 'fwmark'])
+                iif = leaf_node_changed(conf, base_rule + [rule, 'inbound-interface'])
+                dst = leaf_node_changed(conf, base_rule + [rule, 'destination', 'address'])
+                dst_port = leaf_node_changed(conf, base_rule + [rule, 'destination', 'port'])
+                table = leaf_node_changed(conf, base_rule + [rule, 'set', 'table'])
+                proto = leaf_node_changed(conf, base_rule + [rule, 'protocol'])
+                rule_def = {}
+                if src:
+                    rule_def = dict_merge({'source': {'address': src}}, rule_def)
+                if src_port:
+                    rule_def = dict_merge({'source': {'port': src_port}}, rule_def)
+                if fwmk:
+                    rule_def = dict_merge({'fwmark' : fwmk}, rule_def)
+                if iif:
+                    rule_def = dict_merge({'inbound_interface' : iif}, rule_def)
+                if dst:
+                    rule_def = dict_merge({'destination': {'address': dst}}, rule_def)
+                if dst_port:
+                    rule_def = dict_merge({'destination': {'port': dst_port}}, rule_def)
+                if table:
+                    rule_def = dict_merge({'table' : table}, rule_def)
+                if proto:
+                    rule_def = dict_merge({'protocol' : proto}, rule_def)
+                dict = dict_merge({dict_id : {rule : rule_def}}, dict)
+                pbr.update(dict)
+
+        if not route in pbr:
+            continue
+
+        # delete policy local-route rule x source x.x.x.x
+        # delete policy local-route rule x fwmark x
+        # delete policy local-route rule x destination x.x.x.x
+        if 'rule' in pbr[route]:
+            for rule, rule_config in pbr[route]['rule'].items():
+                src = leaf_node_changed(conf, base_rule + [rule, 'source', 'address'])
+                src_port = leaf_node_changed(conf, base_rule + [rule, 'source', 'port'])
+                fwmk = leaf_node_changed(conf, base_rule + [rule, 'fwmark'])
+                iif = leaf_node_changed(conf, base_rule + [rule, 'inbound-interface'])
+                dst = leaf_node_changed(conf, base_rule + [rule, 'destination', 'address'])
+                dst_port = leaf_node_changed(conf, base_rule + [rule, 'destination', 'port'])
+                table = leaf_node_changed(conf, base_rule + [rule, 'set', 'table'])
+                proto = leaf_node_changed(conf, base_rule + [rule, 'protocol'])
+                # keep track of changes in configuration
+                # otherwise we might remove an existing node although nothing else has changed
+                changed = False
+
+                rule_def = {}
+                # src is None if there are no changes to src
+                if src is None:
+                    # if src hasn't changed, include it in the removal selector
+                    # if a new selector is added, we have to remove all previous rules without this selector
+                    # to make sure we remove all previous rules with this source(s), it will be included
+                    if 'source' in rule_config:
+                        if 'address' in rule_config['source']:
+                            rule_def = dict_merge({'source': {'address': rule_config['source']['address']}}, rule_def)
+                else:
+                    # if src is not None, it's previous content will be returned
+                    # this can be an empty array if it's just being set, or the previous value
+                    # either way, something has to be changed and we only want to remove previous values
+                    changed = True
+                    # set the old value for removal if it's not empty
+                    if len(src) > 0:
+                        rule_def = dict_merge({'source': {'address': src}}, rule_def)
+
+                # source port
+                if src_port is None:
+                    if 'source' in rule_config:
+                        if 'port' in rule_config['source']:
+                            tmp = rule_config['source']['port']
+                            if isinstance(tmp, str):
+                                tmp = [tmp]
+                            rule_def = dict_merge({'source': {'port': tmp}}, rule_def)
+                else:
+                    changed = True
+                    if len(src_port) > 0:
+                        rule_def = dict_merge({'source': {'port': src_port}}, rule_def)
+
+                # fwmark
+                if fwmk is None:
+                    if 'fwmark' in rule_config:
+                        tmp = rule_config['fwmark']
+                        if isinstance(tmp, str):
+                            tmp = [tmp]
+                        rule_def = dict_merge({'fwmark': tmp}, rule_def)
+                else:
+                    changed = True
+                    if len(fwmk) > 0:
+                        rule_def = dict_merge({'fwmark' : fwmk}, rule_def)
+
+                # inbound-interface
+                if iif is None:
+                    if 'inbound_interface' in rule_config:
+                        rule_def = dict_merge({'inbound_interface': rule_config['inbound_interface']}, rule_def)
+                else:
+                    changed = True
+                    if len(iif) > 0:
+                        rule_def = dict_merge({'inbound_interface' : iif}, rule_def)
+
+                # destination address
+                if dst is None:
+                    if 'destination' in rule_config:
+                        if 'address' in rule_config['destination']:
+                            rule_def = dict_merge({'destination': {'address': rule_config['destination']['address']}}, rule_def)
+                else:
+                    changed = True
+                    if len(dst) > 0:
+                        rule_def = dict_merge({'destination': {'address': dst}}, rule_def)
+
+                # destination port
+                if dst_port is None:
+                    if 'destination' in rule_config:
+                        if 'port' in rule_config['destination']:
+                            tmp = rule_config['destination']['port']
+                            if isinstance(tmp, str):
+                                tmp = [tmp]
+                            rule_def = dict_merge({'destination': {'port': tmp}}, rule_def)
+                else:
+                    changed = True
+                    if len(dst_port) > 0:
+                        rule_def = dict_merge({'destination': {'port': dst_port}}, rule_def)
+
+                # table
+                if table is None:
+                    if 'set' in rule_config and 'table' in rule_config['set']:
+                        rule_def = dict_merge({'table': [rule_config['set']['table']]}, rule_def)
+                else:
+                    changed = True
+                    if len(table) > 0:
+                        rule_def = dict_merge({'table' : table}, rule_def)
+
+                # protocol
+                if proto is None:
+                    if 'protocol' in rule_config:
+                        tmp = rule_config['protocol']
+                        if isinstance(tmp, str):
+                            tmp = [tmp]
+                        rule_def = dict_merge({'protocol': tmp}, rule_def)
+                else:
+                    changed = True
+                    if len(proto) > 0:
+                        rule_def = dict_merge({'protocol' : proto}, rule_def)
+
+                if changed:
+                    dict = dict_merge({dict_id : {rule : rule_def}}, dict)
+                    pbr.update(dict)
+
+    return pbr
+
+def verify(pbr):
+    # bail out early - looks like removal from running config
+    if not pbr:
+        return None
+
+    for route in ['local_route', 'local_route6']:
+        if not route in pbr:
+            continue
+
+        pbr_route = pbr[route]
+        if 'rule' in pbr_route:
+            for rule in pbr_route['rule']:
+                if (
+                    'source' not in pbr_route['rule'][rule] and
+                    'destination' not in pbr_route['rule'][rule] and
+                    'fwmark' not in pbr_route['rule'][rule] and
+                    'inbound_interface' not in pbr_route['rule'][rule] and
+                    'protocol' not in pbr_route['rule'][rule]
+                ):
+                    raise ConfigError('Source or destination address or fwmark or inbound-interface or protocol is required!')
+
+                if 'set' not in pbr_route['rule'][rule] or 'table' not in pbr_route['rule'][rule]['set']:
+                    raise ConfigError('Table set is required!')
+
+                if 'inbound_interface' in pbr_route['rule'][rule]:
+                    interface = pbr_route['rule'][rule]['inbound_interface']
+                    verify_interface_exists(pbr, interface)
+
+    return None
+
+def generate(pbr):
+    if not pbr:
+        return None
+
+    return None
+
+def apply(pbr):
+    if not pbr:
+        return None
+
+    # Delete old rule if needed
+    for rule_rm in ['rule_remove', 'rule6_remove']:
+        if rule_rm in pbr:
+            v6 = " -6" if rule_rm == 'rule6_remove' else ""
+
+            for rule, rule_config in pbr[rule_rm].items():
+                source = rule_config.get('source', {}).get('address', [''])
+                source_port = rule_config.get('source', {}).get('port', [''])
+                destination = rule_config.get('destination', {}).get('address', [''])
+                destination_port = rule_config.get('destination', {}).get('port', [''])
+                fwmark = rule_config.get('fwmark', [''])
+                inbound_interface = rule_config.get('inbound_interface', [''])
+                protocol = rule_config.get('protocol', [''])
+                table = rule_config.get('table', [''])
+
+                for src, dst, src_port, dst_port, fwmk, iif, proto, table in product(
+                        source, destination, source_port, destination_port,
+                        fwmark, inbound_interface, protocol, table):
+                    f_src = '' if src == '' else f' from {src} '
+                    f_src_port = '' if src_port == '' else f' sport {src_port} '
+                    f_dst = '' if dst == '' else f' to {dst} '
+                    f_dst_port = '' if dst_port == '' else f' dport {dst_port} '
+                    f_fwmk = '' if fwmk == '' else f' fwmark {fwmk} '
+                    f_iif = '' if iif == '' else f' iif {iif} '
+                    f_proto = '' if proto == '' else f' ipproto {proto} '
+                    f_table = '' if table == '' else f' lookup {table} '
+
+                    call(f'ip{v6} rule del prio {rule} {f_src}{f_dst}{f_proto}{f_src_port}{f_dst_port}{f_fwmk}{f_iif}{f_table}')
+
+    # Generate new config
+    for route in ['local_route', 'local_route6']:
+        if not route in pbr:
+            continue
+
+        v6 = " -6" if route == 'local_route6' else ""
+        pbr_route = pbr[route]
+
+        if 'rule' in pbr_route:
+            for rule, rule_config in pbr_route['rule'].items():
+                table = rule_config['set'].get('table', '')
+                source = rule_config.get('source', {}).get('address', ['all'])
+                source_port = rule_config.get('source', {}).get('port', '')
+                destination = rule_config.get('destination', {}).get('address', ['all'])
+                destination_port = rule_config.get('destination', {}).get('port', '')
+                fwmark = rule_config.get('fwmark', '')
+                inbound_interface = rule_config.get('inbound_interface', '')
+                protocol = rule_config.get('protocol', '')
+
+                for src in source:
+                    f_src = f' from {src} ' if src else ''
+                    for dst in destination:
+                        f_dst = f' to {dst} ' if dst else ''
+                        f_src_port = f' sport {source_port} ' if source_port else ''
+                        f_dst_port = f' dport {destination_port} ' if destination_port else ''
+                        f_fwmk = f' fwmark {fwmark} ' if fwmark else ''
+                        f_iif = f' iif {inbound_interface} ' if inbound_interface else ''
+                        f_proto = f' ipproto {protocol} ' if protocol else ''
+
+                        call(f'ip{v6} rule add prio {rule}{f_src}{f_dst}{f_proto}{f_src_port}{f_dst_port}{f_fwmk}{f_iif} lookup {table}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/policy_route.py b/src/conf_mode/policy_route.py
new file mode 100644
index 0000000..223175b
--- /dev/null
+++ b/src/conf_mode/policy_route.py
@@ -0,0 +1,216 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from json import loads
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.dict import dict_search_args
+from vyos.utils.process import cmd
+from vyos.utils.process import run
+from vyos.utils.network import get_vrf_tableid
+from vyos.defaults import rt_global_table
+from vyos.defaults import rt_global_vrf
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+mark_offset = 0x7FFFFFFF
+nftables_conf = '/run/nftables_policy.conf'
+
+valid_groups = [
+    'address_group',
+    'domain_group',
+    'network_group',
+    'port_group',
+    'interface_group'
+]
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['policy']
+
+    policy = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True,
+                                    no_tag_node_value_mangle=True)
+
+    policy['firewall_group'] = conf.get_config_dict(['firewall', 'group'], key_mangling=('-', '_'), get_first_key=True,
+                                    no_tag_node_value_mangle=True)
+
+    # Remove dynamic firewall groups if present:
+    if 'dynamic_group' in policy['firewall_group']:
+        del policy['firewall_group']['dynamic_group']
+
+    return policy
+
+def verify_rule(policy, name, rule_conf, ipv6, rule_id):
+    icmp = 'icmp' if not ipv6 else 'icmpv6'
+    if icmp in rule_conf:
+        icmp_defined = False
+        if 'type_name' in rule_conf[icmp]:
+            icmp_defined = True
+            if 'code' in rule_conf[icmp] or 'type' in rule_conf[icmp]:
+                raise ConfigError(f'{name} rule {rule_id}: Cannot use ICMP type/code with ICMP type-name')
+        if 'code' in rule_conf[icmp]:
+            icmp_defined = True
+            if 'type' not in rule_conf[icmp]:
+                raise ConfigError(f'{name} rule {rule_id}: ICMP code can only be defined if ICMP type is defined')
+        if 'type' in rule_conf[icmp]:
+            icmp_defined = True
+
+        if icmp_defined and 'protocol' not in rule_conf or rule_conf['protocol'] != icmp:
+            raise ConfigError(f'{name} rule {rule_id}: ICMP type/code or type-name can only be defined if protocol is ICMP')
+
+    if 'set' in rule_conf:
+        if 'tcp_mss' in rule_conf['set']:
+            tcp_flags = dict_search_args(rule_conf, 'tcp', 'flags')
+            if not tcp_flags or 'syn' not in tcp_flags:
+                raise ConfigError(f'{name} rule {rule_id}: TCP SYN flag must be set to modify TCP-MSS')
+
+        if 'vrf' in rule_conf['set'] and 'table' in rule_conf['set']:
+            raise ConfigError(f'{name} rule {rule_id}: Cannot set both forwarding route table and VRF')
+
+    tcp_flags = dict_search_args(rule_conf, 'tcp', 'flags')
+    if tcp_flags:
+        if dict_search_args(rule_conf, 'protocol') != 'tcp':
+            raise ConfigError('Protocol must be tcp when specifying tcp flags')
+
+        not_flags = dict_search_args(rule_conf, 'tcp', 'flags', 'not')
+        if not_flags:
+            duplicates = [flag for flag in tcp_flags if flag in not_flags]
+            if duplicates:
+                raise ConfigError(f'Cannot match a tcp flag as set and not set')
+
+    for side in ['destination', 'source']:
+        if side in rule_conf:
+            side_conf = rule_conf[side]
+
+            if 'group' in side_conf:
+                if len({'address_group', 'domain_group', 'network_group'} & set(side_conf['group'])) > 1:
+                    raise ConfigError('Only one address-group, domain-group or network-group can be specified')
+
+                for group in valid_groups:
+                    if group in side_conf['group']:
+                        group_name = side_conf['group'][group]
+
+                        if group_name.startswith('!'):
+                            group_name = group_name[1:]
+
+                        fw_group = f'ipv6_{group}' if ipv6 and group in ['address_group', 'network_group'] else group
+                        error_group = fw_group.replace("_", "-")
+                        group_obj = dict_search_args(policy['firewall_group'], fw_group, group_name)
+
+                        if group_obj is None:
+                            raise ConfigError(f'Invalid {error_group} "{group_name}" on policy route rule')
+
+                        if not group_obj:
+                            Warning(f'{error_group} "{group_name}" has no members')
+
+            if 'port' in side_conf or dict_search_args(side_conf, 'group', 'port_group'):
+                if 'protocol' not in rule_conf:
+                    raise ConfigError('Protocol must be defined if specifying a port or port-group')
+
+                if rule_conf['protocol'] not in ['tcp', 'udp', 'tcp_udp']:
+                    raise ConfigError('Protocol must be tcp, udp, or tcp_udp when specifying a port or port-group')
+
+def verify(policy):
+    for route in ['route', 'route6']:
+        ipv6 = route == 'route6'
+        if route in policy:
+            for name, pol_conf in policy[route].items():
+                if 'rule' in pol_conf:
+                    for rule_id, rule_conf in pol_conf['rule'].items():
+                        verify_rule(policy, name, rule_conf, ipv6, rule_id)
+
+    return None
+
+def generate(policy):
+    if not os.path.exists(nftables_conf):
+        policy['first_install'] = True
+
+    render(nftables_conf, 'firewall/nftables-policy.j2', policy)
+    return None
+
+def apply_table_marks(policy):
+    for route in ['route', 'route6']:
+        if route in policy:
+            cmd_str = 'ip' if route == 'route' else 'ip -6'
+            tables = []
+            for name, pol_conf in policy[route].items():
+                if 'rule' in pol_conf:
+                    for rule_id, rule_conf in pol_conf['rule'].items():
+                        vrf_table_id = None
+                        set_table = dict_search_args(rule_conf, 'set', 'table')
+                        set_vrf = dict_search_args(rule_conf, 'set', 'vrf')
+                        if set_vrf:
+                            if set_vrf == 'default':
+                                vrf_table_id = rt_global_vrf
+                            else:
+                                vrf_table_id = get_vrf_tableid(set_vrf)
+                        elif set_table:
+                            if set_table == 'main':
+                                vrf_table_id = rt_global_table
+                            else:
+                                vrf_table_id = set_table
+                        if vrf_table_id is not None:
+                            vrf_table_id = int(vrf_table_id)
+                            if vrf_table_id in tables:
+                                continue
+                            tables.append(vrf_table_id)
+                            table_mark = mark_offset - vrf_table_id
+                            cmd(f'{cmd_str} rule add pref {vrf_table_id} fwmark {table_mark} table {vrf_table_id}')
+
+def cleanup_table_marks():
+    for cmd_str in ['ip', 'ip -6']:
+        json_rules = cmd(f'{cmd_str} -j -N rule list')
+        rules = loads(json_rules)
+        for rule in rules:
+            if 'fwmark' not in rule or 'table' not in rule:
+                continue
+            fwmark = rule['fwmark']
+            table = int(rule['table'])
+            if fwmark[:2] == '0x':
+                fwmark = int(fwmark, 16)
+            if (int(fwmark) == (mark_offset - table)):
+                cmd(f'{cmd_str} rule del fwmark {fwmark} table {table}')
+
+def apply(policy):
+    install_result = run(f'nft --file {nftables_conf}')
+    if install_result == 1:
+        raise ConfigError('Failed to apply policy based routing')
+
+    if 'first_install' not in policy:
+        cleanup_table_marks()
+
+    apply_table_marks(policy)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_babel.py b/src/conf_mode/protocols_babel.py
new file mode 100644
index 0000000..90b6e4a
--- /dev/null
+++ b/src/conf_mode/protocols_babel.py
@@ -0,0 +1,159 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
+from vyos.configverify import verify_access_list
+from vyos.configverify import verify_prefix_list
+from vyos.utils.dict import dict_search
+from vyos.template import render_to_string
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['protocols', 'babel']
+    babel = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 get_first_key=True)
+
+    # FRR has VRF support for different routing daemons. As interfaces belong
+    # to VRFs - or the global VRF, we need to check for changed interfaces so
+    # that they will be properly rendered for the FRR config. Also this eases
+    # removal of interfaces from the running configuration.
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        babel['interface_removed'] = list(interfaces_removed)
+
+    # Bail out early if configuration tree does not exist
+    if not conf.exists(base):
+        babel.update({'deleted' : ''})
+        return babel
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # values which we need to update into the dictionary retrieved.
+    default_values = conf.get_config_defaults(base, key_mangling=('-', '_'),
+                                              get_first_key=True,
+                                              recursive=True)
+
+    # merge in default values
+    babel = config_dict_merge(default_values, babel)
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['policy'])
+    # Merge policy dict into "regular" config dict
+    babel = dict_merge(tmp, babel)
+    return babel
+
+def verify(babel):
+    if not babel:
+        return None
+
+    # verify distribute_list
+    if "distribute_list" in babel:
+        acl_keys = {
+            "ipv4": [
+                "distribute_list.ipv4.access_list.in",
+                "distribute_list.ipv4.access_list.out",
+            ],
+            "ipv6": [
+                "distribute_list.ipv6.access_list.in",
+                "distribute_list.ipv6.access_list.out",
+            ]
+        }
+        prefix_list_keys = {
+            "ipv4": [
+                "distribute_list.ipv4.prefix_list.in",
+                "distribute_list.ipv4.prefix_list.out",
+            ],
+            "ipv6":[
+                "distribute_list.ipv6.prefix_list.in",
+                "distribute_list.ipv6.prefix_list.out",
+            ]
+        }
+        for address_family in ["ipv4", "ipv6"]:
+            for iface_key in babel["distribute_list"].get(address_family, {}).get("interface", {}).keys():
+                acl_keys[address_family].extend([
+                    f"distribute_list.{address_family}.interface.{iface_key}.access_list.in",
+                    f"distribute_list.{address_family}.interface.{iface_key}.access_list.out"
+                ])
+                prefix_list_keys[address_family].extend([
+                    f"distribute_list.{address_family}.interface.{iface_key}.prefix_list.in",
+                    f"distribute_list.{address_family}.interface.{iface_key}.prefix_list.out"
+                ])
+
+        for address_family, keys in acl_keys.items():
+            for key in keys:
+                acl = dict_search(key, babel)
+                if acl:
+                    verify_access_list(acl, babel, version='6' if address_family == 'ipv6' else '')
+
+        for address_family, keys in prefix_list_keys.items():
+            for key in keys:
+                prefix_list = dict_search(key, babel)
+                if prefix_list:
+                    verify_prefix_list(prefix_list, babel, version='6' if address_family == 'ipv6' else '')
+
+
+def generate(babel):
+    if not babel or 'deleted' in babel:
+        return None
+
+    babel['new_frr_config'] = render_to_string('frr/babeld.frr.j2', babel)
+    return None
+
+def apply(babel):
+    babel_daemon = 'babeld'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    frr_cfg.load_configuration(babel_daemon)
+    frr_cfg.modify_section('^router babel', stop_pattern='^exit', remove_stop_mark=True)
+
+    for key in ['interface', 'interface_removed']:
+        if key not in babel:
+            continue
+        for interface in babel[key]:
+            frr_cfg.modify_section(f'^interface {interface}', stop_pattern='^exit', remove_stop_mark=True)
+
+    if 'new_frr_config' in babel:
+        frr_cfg.add_before(frr.default_add_before, babel['new_frr_config'])
+    frr_cfg.commit_configuration(babel_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_bfd.py b/src/conf_mode/protocols_bfd.py
new file mode 100644
index 0000000..1361bb1
--- /dev/null
+++ b/src/conf_mode/protocols_bfd.py
@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from vyos.config import Config
+from vyos.configverify import verify_vrf
+from vyos.template import is_ipv6
+from vyos.template import render_to_string
+from vyos.utils.network import is_ipv6_link_local
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['protocols', 'bfd']
+    bfd = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True,
+                               no_tag_node_value_mangle=True)
+    # Bail out early if configuration tree does not exist
+    if not conf.exists(base):
+        return bfd
+
+    bfd = conf.merge_defaults(bfd, recursive=True)
+
+    return bfd
+
+def verify(bfd):
+    if not bfd:
+        return None
+
+    if 'peer' in bfd:
+        for peer, peer_config in bfd['peer'].items():
+            # IPv6 link local peers require an explicit local address/interface
+            if is_ipv6_link_local(peer):
+                if 'source' not in peer_config or len(peer_config['source']) < 2:
+                    raise ConfigError('BFD IPv6 link-local peers require explicit local address and interface setting')
+
+            # IPv6 peers require an explicit local address
+            if is_ipv6(peer):
+                if 'source' not in peer_config or 'address' not in peer_config['source']:
+                    raise ConfigError('BFD IPv6 peers require explicit local address setting')
+
+            if 'multihop' in peer_config:
+                # multihop require source address
+                if 'source' not in peer_config or 'address' not in peer_config['source']:
+                    raise ConfigError('BFD multihop require source address')
+
+                # multihop and echo-mode cannot be used together
+                if 'echo_mode' in peer_config:
+                    raise ConfigError('BFD multihop and echo-mode cannot be used together')
+
+                # multihop doesn't accept interface names
+                if 'source' in peer_config and 'interface' in peer_config['source']:
+                    raise ConfigError('BFD multihop and source interface cannot be used together')
+
+            if 'minimum_ttl' in peer_config and 'multihop' not in peer_config:
+                raise ConfigError('Minimum TTL is only available for multihop BFD sessions!')
+
+            if 'profile' in peer_config:
+                profile_name = peer_config['profile']
+                if 'profile' not in bfd or profile_name not in bfd['profile']:
+                    raise ConfigError(f'BFD profile "{profile_name}" does not exist!')
+
+            if 'vrf' in peer_config:
+                verify_vrf(peer_config)
+
+    return None
+
+def generate(bfd):
+    if not bfd:
+        return None
+    bfd['new_frr_config'] = render_to_string('frr/bfdd.frr.j2', bfd)
+
+def apply(bfd):
+    bfd_daemon = 'bfdd'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+    frr_cfg.load_configuration(bfd_daemon)
+    frr_cfg.modify_section('^bfd', stop_pattern='^exit', remove_stop_mark=True)
+    if 'new_frr_config' in bfd:
+        frr_cfg.add_before(frr.default_add_before, bfd['new_frr_config'])
+    frr_cfg.commit_configuration(bfd_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_bgp.py b/src/conf_mode/protocols_bgp.py
new file mode 100644
index 0000000..22f0200
--- /dev/null
+++ b/src/conf_mode/protocols_bgp.py
@@ -0,0 +1,655 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+from sys import argv
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
+from vyos.configverify import verify_prefix_list
+from vyos.configverify import verify_route_map
+from vyos.configverify import verify_vrf
+from vyos.template import is_ip
+from vyos.template import is_interface
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search
+from vyos.utils.network import get_interface_vrf
+from vyos.utils.network import is_addr_assigned
+from vyos.utils.process import process_named_running
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    vrf = None
+    if len(argv) > 1:
+        vrf = argv[1]
+
+    base_path = ['protocols', 'bgp']
+
+    # eqivalent of the C foo ? 'a' : 'b' statement
+    base = vrf and ['vrf', 'name', vrf, 'protocols', 'bgp'] or base_path
+    bgp = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True, no_tag_node_value_mangle=True)
+
+    bgp['dependent_vrfs'] = conf.get_config_dict(['vrf', 'name'],
+                                                 key_mangling=('-', '_'),
+                                                 get_first_key=True,
+                                                 no_tag_node_value_mangle=True)
+
+    # Remove per interface MPLS configuration - get a list if changed
+    # nodes under the interface tagNode
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        bgp['interface_removed'] = list(interfaces_removed)
+
+    # Assign the name of our VRF context. This MUST be done before the return
+    # statement below, else on deletion we will delete the default instance
+    # instead of the VRF instance.
+    if vrf:
+        bgp.update({'vrf' : vrf})
+        # We can not delete the BGP VRF instance if there is a L3VNI configured
+        # FRR L3VNI must be deleted first otherwise we will see error:
+        # "FRR error: Please unconfigure l3vni 3000"
+        tmp = ['vrf', 'name', vrf, 'vni']
+        if conf.exists_effective(tmp):
+            bgp.update({'vni' : conf.return_effective_value(tmp)})
+        # We can safely delete ourself from the dependent vrf list
+        if vrf in bgp['dependent_vrfs']:
+            del bgp['dependent_vrfs'][vrf]
+
+        bgp['dependent_vrfs'].update({'default': {'protocols': {
+            'bgp': conf.get_config_dict(base_path, key_mangling=('-', '_'),
+                                        get_first_key=True,
+                                        no_tag_node_value_mangle=True)}}})
+
+    if not conf.exists(base):
+        # If bgp instance is deleted then mark it
+        bgp.update({'deleted' : ''})
+        return bgp
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    bgp = conf.merge_defaults(bgp, recursive=True)
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['policy'])
+    # Merge policy dict into "regular" config dict
+    bgp = dict_merge(tmp, bgp)
+
+    return bgp
+
+
+def verify_vrf_as_import(search_vrf_name: str, afi_name: str, vrfs_config: dict) -> bool:
+    """
+    :param search_vrf_name: search vrf name in import list
+    :type search_vrf_name: str
+    :param afi_name: afi/safi name
+    :type afi_name: str
+    :param vrfs_config: configuration dependents vrfs
+    :type vrfs_config: dict
+    :return: if vrf in import list retrun true else false
+    :rtype: bool
+    """
+    for vrf_name, vrf_config in vrfs_config.items():
+        import_list = dict_search(
+            f'protocols.bgp.address_family.{afi_name}.import.vrf',
+            vrf_config)
+        if import_list:
+            if search_vrf_name in import_list:
+               return True
+    return False
+
+def verify_vrf_import_options(afi_config: dict) -> bool:
+    """
+    Search if afi contains one of options
+    :param afi_config: afi/safi
+    :type afi_config: dict
+    :return: if vrf contains rd and route-target options return true else false
+    :rtype: bool
+    """
+    options = [
+        f'rd.vpn.export',
+        f'route_target.vpn.import',
+        f'route_target.vpn.export',
+        f'route_target.vpn.both'
+    ]
+    for option in options:
+        if dict_search(option, afi_config):
+            return True
+    return False
+
+def verify_vrf_import(vrf_name: str, vrfs_config: dict, afi_name: str) -> bool:
+    """
+    Verify if vrf exists and contain options
+    :param vrf_name: name of VRF
+    :type vrf_name: str
+    :param vrfs_config: dependent vrfs config
+    :type vrfs_config: dict
+    :param afi_name: afi/safi name
+    :type afi_name: str
+    :return: if vrf contains rd and route-target options return true else false
+    :rtype: bool
+    """
+    if vrf_name != 'default':
+        verify_vrf({'vrf': vrf_name})
+    if dict_search(f'{vrf_name}.protocols.bgp.address_family.{afi_name}',
+                   vrfs_config):
+        afi_config = \
+        vrfs_config[vrf_name]['protocols']['bgp']['address_family'][
+            afi_name]
+        if verify_vrf_import_options(afi_config):
+            return True
+    return False
+
+def verify_vrflist_import(afi_name: str, afi_config: dict, vrfs_config: dict) -> bool:
+    """
+    Call function to verify
+    if scpecific vrf contains rd and route-target
+    options return true else false
+
+    :param afi_name: afi/safi name
+    :type afi_name: str
+    :param afi_config: afi/safi configuration
+    :type afi_config: dict
+    :param vrfs_config: dependent vrfs config
+    :type vrfs_config:dict
+    :return: if vrf contains rd and route-target options return true else false
+    :rtype: bool
+    """
+    for vrf_name in afi_config['import']['vrf']:
+        if verify_vrf_import(vrf_name, vrfs_config, afi_name):
+            return True
+    return False
+
+def verify_remote_as(peer_config, bgp_config):
+    if 'remote_as' in peer_config:
+        return peer_config['remote_as']
+
+    if 'peer_group' in peer_config:
+        peer_group_name = peer_config['peer_group']
+        tmp = dict_search(f'peer_group.{peer_group_name}.remote_as', bgp_config)
+        if tmp: return tmp
+
+    if 'interface' in peer_config:
+        if 'remote_as' in peer_config['interface']:
+            return peer_config['interface']['remote_as']
+
+        if 'peer_group' in peer_config['interface']:
+            peer_group_name = peer_config['interface']['peer_group']
+            tmp = dict_search(f'peer_group.{peer_group_name}.remote_as', bgp_config)
+            if tmp: return tmp
+
+        if 'v6only' in peer_config['interface']:
+            if 'remote_as' in peer_config['interface']['v6only']:
+                return peer_config['interface']['v6only']['remote_as']
+            if 'peer_group' in peer_config['interface']['v6only']:
+                peer_group_name = peer_config['interface']['v6only']['peer_group']
+                tmp = dict_search(f'peer_group.{peer_group_name}.remote_as', bgp_config)
+                if tmp: return tmp
+
+    return None
+
+def verify_afi(peer_config, bgp_config):
+    # If address_family configured under neighboor
+    if 'address_family' in peer_config:
+        return True
+
+    # If address_family configured under peer-group
+    # if neighbor interface configured
+    peer_group_name = None
+    if dict_search('interface.peer_group', peer_config):
+        peer_group_name = peer_config['interface']['peer_group']
+    elif dict_search('interface.v6only.peer_group', peer_config):
+        peer_group_name = peer_config['interface']['v6only']['peer_group']
+
+    # if neighbor IP configured.
+    if 'peer_group' in peer_config:
+        peer_group_name = peer_config['peer_group']
+    if peer_group_name:
+        tmp = dict_search(f'peer_group.{peer_group_name}.address_family', bgp_config)
+        if tmp: return True
+    return False
+
+def verify(bgp):
+    if 'deleted' in bgp:
+        if 'vrf' in bgp:
+            # Cannot delete vrf if it exists in import vrf list in other vrfs
+            for tmp_afi in ['ipv4_unicast', 'ipv6_unicast']:
+                if verify_vrf_as_import(bgp['vrf'], tmp_afi, bgp['dependent_vrfs']):
+                    raise ConfigError(f'Cannot delete VRF instance "{bgp["vrf"]}", ' \
+                                      'unconfigure "import vrf" commands!')
+        else:
+            # We are running in the default VRF context, thus we can not delete
+            # our main BGP instance if there are dependent BGP VRF instances.
+            if 'dependent_vrfs' in bgp:
+                for vrf, vrf_options in bgp['dependent_vrfs'].items():
+                    if vrf != 'default':
+                        if dict_search('protocols.bgp', vrf_options):
+                            raise ConfigError('Cannot delete default BGP instance, ' \
+                                              'dependent VRF instance(s) exist(s)!')
+                        if 'vni' in vrf_options:
+                            raise ConfigError('Cannot delete default BGP instance, ' \
+                                              'dependent L3VNI exists!')
+
+        return None
+
+    if 'system_as' not in bgp:
+        raise ConfigError('BGP system-as number must be defined!')
+
+    # Verify BMP
+    if 'bmp' in bgp:
+        # check bmp flag "bgpd -d -F traditional --daemon -A 127.0.0.1 -M rpki -M bmp"
+        if not process_named_running('bgpd', 'bmp'):
+            raise ConfigError(
+                f'"bmp" flag is not found in bgpd. Configure "set system frr bmp" and restart bgp process'
+            )
+        # check bmp target
+        if 'target' in bgp['bmp']:
+            for target, target_config in bgp['bmp']['target'].items():
+                if 'address' not in target_config:
+                    raise ConfigError(f'BMP target "{target}" address must be defined!')
+
+    # Verify vrf on interface and bgp section
+    if 'interface' in bgp:
+        for interface in bgp['interface']:
+            error_msg = f'Interface "{interface}" belongs to different VRF instance'
+            tmp = get_interface_vrf(interface)
+            if 'vrf' in bgp:
+                if bgp['vrf'] != tmp:
+                    vrf = bgp['vrf']
+                    raise ConfigError(f'{error_msg} "{vrf}"!')
+            elif tmp != 'default':
+                raise ConfigError(f'{error_msg} "{tmp}"!')
+
+    peer_groups_context = dict()
+    # Common verification for both peer-group and neighbor statements
+    for neighbor in ['neighbor', 'peer_group']:
+        # bail out early if there is no neighbor or peer-group statement
+        # this also saves one indention level
+        if neighbor not in bgp:
+            continue
+
+        for peer, peer_config in bgp[neighbor].items():
+            # Only regular "neighbor" statement can have a peer-group set
+            # Check if the configure peer-group exists
+            if 'peer_group' in peer_config:
+                peer_group = peer_config['peer_group']
+                if 'peer_group' not in bgp or peer_group not in bgp['peer_group']:
+                    raise ConfigError(f'Specified peer-group "{peer_group}" for '\
+                                      f'neighbor "{neighbor}" does not exist!')
+
+                if 'remote_as' in peer_config:
+                    is_ibgp = True
+                    if peer_config['remote_as'] != 'internal' and \
+                            peer_config['remote_as'] != bgp['system_as']:
+                        is_ibgp = False
+
+                    if peer_group not in peer_groups_context:
+                        peer_groups_context[peer_group] = is_ibgp
+                    elif peer_groups_context[peer_group] != is_ibgp:
+                        raise ConfigError(f'Peer-group members must be '
+                                          f'all internal or all external')
+
+            if 'local_role' in peer_config:
+                #Ensure Local Role has only one value.
+                if len(peer_config['local_role']) > 1:
+                    raise ConfigError(f'Only one local role can be specified for peer "{peer}"!')
+
+            if 'local_as' in peer_config:
+                if len(peer_config['local_as']) > 1:
+                    raise ConfigError(f'Only one local-as number can be specified for peer "{peer}"!')
+
+                # Neighbor local-as override can not be the same as the local-as
+                # we use for this BGP instane!
+                asn = list(peer_config['local_as'].keys())[0]
+                if asn == bgp['system_as']:
+                    raise ConfigError('Cannot have local-as same as system-as number')
+
+                # Neighbor AS specified for local-as and remote-as can not be the same
+                if dict_search('remote_as', peer_config) == asn and neighbor != 'peer_group':
+                     raise ConfigError(f'Neighbor "{peer}" has local-as specified which is '\
+                                        'the same as remote-as, this is not allowed!')
+
+            # ttl-security and ebgp-multihop can't be used in the same configration
+            if 'ebgp_multihop' in peer_config and 'ttl_security' in peer_config:
+                raise ConfigError('You can not set both ebgp-multihop and ttl-security hops')
+
+            # interface and ebgp-multihop can't be used in the same configration
+            if 'ebgp_multihop' in peer_config and 'interface' in peer_config:
+                raise ConfigError(f'Ebgp-multihop can not be used with directly connected '\
+                                  f'neighbor "{peer}"')
+
+            # Check if neighbor has both override capability and strict capability match
+            # configured at the same time.
+            if 'override_capability' in peer_config and 'strict_capability_match' in peer_config:
+                raise ConfigError(f'Neighbor "{peer}" cannot have both override-capability and '\
+                                  'strict-capability-match configured at the same time!')
+
+            # Check spaces in the password
+            if 'password' in peer_config and ' ' in peer_config['password']:
+                raise ConfigError('Whitespace is not allowed in passwords!')
+
+            # Some checks can/must only be done on a neighbor and not a peer-group
+            if neighbor == 'neighbor':
+                # remote-as must be either set explicitly for the neighbor
+                # or for the entire peer-group
+                if not verify_remote_as(peer_config, bgp):
+                    raise ConfigError(f'Neighbor "{peer}" remote-as must be set!')
+
+                if not verify_afi(peer_config, bgp):
+                    Warning(f'BGP neighbor "{peer}" requires address-family!')
+
+                # Peer-group member cannot override remote-as of peer-group
+                if 'peer_group' in peer_config:
+                    peer_group = peer_config['peer_group']
+                    if 'remote_as' in peer_config and 'remote_as' in bgp['peer_group'][peer_group]:
+                        raise ConfigError(f'Peer-group member "{peer}" cannot override remote-as of peer-group "{peer_group}"!')
+                if 'interface' in peer_config:
+                    if 'peer_group' in peer_config['interface']:
+                        peer_group = peer_config['interface']['peer_group']
+                        if 'remote_as' in peer_config['interface'] and 'remote_as' in bgp['peer_group'][peer_group]:
+                            raise ConfigError(f'Peer-group member "{peer}" cannot override remote-as of peer-group "{peer_group}"!')
+                    if 'v6only' in peer_config['interface']:
+                        if 'peer_group' in peer_config['interface']['v6only']:
+                            peer_group = peer_config['interface']['v6only']['peer_group']
+                            if 'remote_as' in peer_config['interface']['v6only'] and 'remote_as' in bgp['peer_group'][peer_group]:
+                                raise ConfigError(f'Peer-group member "{peer}" cannot override remote-as of peer-group "{peer_group}"!')
+
+                # Only checks for ipv4 and ipv6 neighbors
+                # Check if neighbor address is assigned as system interface address
+                vrf = None
+                vrf_error_msg = f' in default VRF!'
+                if 'vrf' in bgp:
+                    vrf = bgp['vrf']
+                    vrf_error_msg = f' in VRF "{vrf}"!'
+
+                if is_ip(peer) and is_addr_assigned(peer, vrf):
+                    raise ConfigError(f'Can not configure local address as neighbor "{peer}"{vrf_error_msg}')
+                elif is_interface(peer):
+                    if 'peer_group' in peer_config:
+                        raise ConfigError(f'peer-group must be set under the interface node of "{peer}"')
+                    if 'remote_as' in peer_config:
+                        raise ConfigError(f'remote-as must be set under the interface node of "{peer}"')
+                    if 'source_interface' in peer_config['interface']:
+                        raise ConfigError(f'"source-interface" option not allowed for neighbor "{peer}"')
+
+            # Local-AS allowed only for EBGP peers
+            if 'local_as' in peer_config:
+                remote_as = verify_remote_as(peer_config, bgp)
+                if remote_as == bgp['system_as']:
+                    raise ConfigError(f'local-as configured for "{peer}", allowed only for eBGP peers!')
+
+            for afi in ['ipv4_unicast', 'ipv4_multicast', 'ipv4_labeled_unicast', 'ipv4_flowspec',
+                        'ipv6_unicast', 'ipv6_multicast', 'ipv6_labeled_unicast', 'ipv6_flowspec',
+                        'l2vpn_evpn']:
+                # Bail out early if address family is not configured
+                if 'address_family' not in peer_config or afi not in peer_config['address_family']:
+                    continue
+
+                # Check if neighbor has both ipv4 unicast and ipv4 labeled unicast configured at the same time.
+                if 'ipv4_unicast' in peer_config['address_family'] and 'ipv4_labeled_unicast' in peer_config['address_family']:
+                    raise ConfigError(f'Neighbor "{peer}" cannot have both ipv4-unicast and ipv4-labeled-unicast configured at the same time!')
+
+                # Check if neighbor has both ipv6 unicast and ipv6 labeled unicast configured at the same time.
+                if 'ipv6_unicast' in peer_config['address_family'] and 'ipv6_labeled_unicast' in peer_config['address_family']:
+                    raise ConfigError(f'Neighbor "{peer}" cannot have both ipv6-unicast and ipv6-labeled-unicast configured at the same time!')
+
+                afi_config = peer_config['address_family'][afi]
+
+                if 'conditionally_advertise' in afi_config:
+                    if 'advertise_map' not in afi_config['conditionally_advertise']:
+                        raise ConfigError('Must speficy advertise-map when conditionally-advertise is in use!')
+                    # Verify advertise-map (which is a route-map) exists
+                    verify_route_map(afi_config['conditionally_advertise']['advertise_map'], bgp)
+
+                    if ('exist_map' not in afi_config['conditionally_advertise'] and
+                        'non_exist_map' not in afi_config['conditionally_advertise']):
+                        raise ConfigError('Must either speficy exist-map or non-exist-map when ' \
+                                          'conditionally-advertise is in use!')
+
+                    if {'exist_map', 'non_exist_map'} <= set(afi_config['conditionally_advertise']):
+                        raise ConfigError('Can not specify both exist-map and non-exist-map for ' \
+                                          'conditionally-advertise!')
+
+                    if 'exist_map' in afi_config['conditionally_advertise']:
+                        verify_route_map(afi_config['conditionally_advertise']['exist_map'], bgp)
+
+                    if 'non_exist_map' in afi_config['conditionally_advertise']:
+                        verify_route_map(afi_config['conditionally_advertise']['non_exist_map'], bgp)
+
+                # T4332: bgp deterministic-med cannot be disabled while addpath-tx-bestpath-per-AS is in use
+                if 'addpath_tx_per_as' in afi_config:
+                    if dict_search('parameters.deterministic_med', bgp) == None:
+                        raise ConfigError('addpath-tx-per-as requires BGP deterministic-med paramtere to be set!')
+
+                # Validate if configured Prefix list exists
+                if 'prefix_list' in afi_config:
+                    for tmp in ['import', 'export']:
+                        if tmp not in afi_config['prefix_list']:
+                            # bail out early
+                            continue
+                        if afi == 'ipv4_unicast':
+                            verify_prefix_list(afi_config['prefix_list'][tmp], bgp)
+                        elif afi == 'ipv6_unicast':
+                            verify_prefix_list(afi_config['prefix_list'][tmp], bgp, version='6')
+
+                if 'route_map' in afi_config:
+                    for tmp in ['import', 'export']:
+                        if tmp in afi_config['route_map']:
+                            verify_route_map(afi_config['route_map'][tmp], bgp)
+
+                if 'route_reflector_client' in afi_config:
+                    peer_group_as = peer_config.get('remote_as')
+
+                    if peer_group_as is None or (peer_group_as != 'internal' and peer_group_as != bgp['system_as']):
+                        raise ConfigError('route-reflector-client only supported for iBGP peers')
+                    else:
+                        if 'peer_group' in peer_config:
+                            peer_group_as = dict_search(f'peer_group.{peer_group}.remote_as', bgp)
+                            if peer_group_as is None or (peer_group_as != 'internal' and peer_group_as != bgp['system_as']):
+                                raise ConfigError('route-reflector-client only supported for iBGP peers')
+
+            # T5833 not all AFIs are supported for VRF
+            if 'vrf' in bgp and 'address_family' in peer_config:
+                unsupported_vrf_afi = {
+                    'ipv4_flowspec',
+                    'ipv6_flowspec',
+                    'ipv4_labeled_unicast',
+                    'ipv6_labeled_unicast',
+                    'ipv4_vpn',
+                    'ipv6_vpn',
+                }
+                for afi in peer_config['address_family']:
+                    if afi in unsupported_vrf_afi:
+                        raise ConfigError(
+                            f"VRF is not allowed for address-family '{afi.replace('_', '-')}'"
+                        )
+
+    # Throw an error if a peer group is not configured for allow range
+    for prefix in dict_search('listen.range', bgp) or []:
+        # we can not use dict_search() here as prefix contains dots ...
+        if 'peer_group' not in bgp['listen']['range'][prefix]:
+            raise ConfigError(f'Listen range for prefix "{prefix}" has no peer group configured.')
+
+        peer_group = bgp['listen']['range'][prefix]['peer_group']
+        if 'peer_group' not in bgp or peer_group not in bgp['peer_group']:
+            raise ConfigError(f'Peer-group "{peer_group}" for listen range "{prefix}" does not exist!')
+
+        if not verify_remote_as(bgp['listen']['range'][prefix], bgp):
+            raise ConfigError(f'Peer-group "{peer_group}" requires remote-as to be set!')
+
+    # Throw an error if the global administrative distance parameters aren't all filled out.
+    if dict_search('parameters.distance.global', bgp) != None:
+        for key in ['external', 'internal', 'local']:
+            if dict_search(f'parameters.distance.global.{key}', bgp) == None:
+                raise ConfigError('Missing mandatory configuration option for '\
+                                 f'global administrative distance {key}!')
+
+    # TCP keepalive requires all three parameters to be set
+    if dict_search('parameters.tcp_keepalive', bgp) != None:
+        if not {'idle', 'interval', 'probes'} <= set(bgp['parameters']['tcp_keepalive']):
+            raise ConfigError('TCP keepalive incomplete - idle, keepalive and probes must be set')
+
+    # Address Family specific validation
+    if 'address_family' in bgp:
+        for afi, afi_config in bgp['address_family'].items():
+            if 'distance' in afi_config:
+                # Throw an error if the address family specific administrative
+                # distance parameters aren't all filled out.
+                for key in ['external', 'internal', 'local']:
+                    if key not in afi_config['distance']:
+                        raise ConfigError('Missing mandatory configuration option for '\
+                                         f'{afi} administrative distance {key}!')
+
+            if afi in ['ipv4_unicast', 'ipv6_unicast']:
+                vrf_name = bgp['vrf'] if dict_search('vrf', bgp) else 'default'
+                # Verify if currant VRF contains rd and route-target options
+                # and does not exist in import list in other VRFs
+                if dict_search(f'rd.vpn.export', afi_config):
+                    if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Command "import vrf" conflicts with "rd vpn export" command!')
+                    if not dict_search('parameters.router_id', bgp):
+                        Warning(f'BGP "router-id" is required when using "rd" and "route-target"!')
+
+                if dict_search('route_target.vpn.both', afi_config):
+                    if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Command "import vrf" conflicts with "route-target vpn both" command!')
+                    if dict_search('route_target.vpn.export', afi_config):
+                        raise ConfigError(
+                            'Command "route-target vpn export" conflicts '\
+                            'with "route-target vpn both" command!')
+                    if dict_search('route_target.vpn.import', afi_config):
+                        raise ConfigError(
+                            'Command "route-target vpn import" conflicts '\
+                            'with "route-target vpn both" command!')
+
+                if dict_search('route_target.vpn.import', afi_config):
+                    if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Command "import vrf conflicts" with "route-target vpn import" command!')
+
+                if dict_search('route_target.vpn.export', afi_config):
+                    if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Command "import vrf" conflicts with "route-target vpn export" command!')
+
+                # Verify if VRFs in import do not contain rd
+                # and route-target options
+                if dict_search('import.vrf', afi_config) is not None:
+                    # Verify if VRF with import does not contain rd
+                    # and route-target options
+                    if verify_vrf_import_options(afi_config):
+                        raise ConfigError(
+                            'Please unconfigure "import vrf" commands before using vpn commands in the same VRF!')
+                    # Verify if VRFs in import list do not contain rd
+                    # and route-target options
+                    if verify_vrflist_import(afi, afi_config, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Please unconfigure import vrf commands before using vpn commands in dependent VRFs!')
+
+                    # FRR error: please unconfigure vpn to vrf commands before
+                    # using import vrf commands
+                    if 'vpn' in afi_config['import'] or dict_search('export.vpn', afi_config) != None:
+                        raise ConfigError('Please unconfigure VPN to VRF commands before '\
+                                          'using "import vrf" commands!')
+
+                # Verify that the export/import route-maps do exist
+                for export_import in ['export', 'import']:
+                    tmp = dict_search(f'route_map.vpn.{export_import}', afi_config)
+                    if tmp: verify_route_map(tmp, bgp)
+
+                # per-vrf sid and per-af sid are mutually exclusive
+                if 'sid' in afi_config and 'sid' in bgp:
+                    raise ConfigError('SID per VRF and SID per address-family are mutually exclusive!')
+
+            # Checks only required for L2VPN EVPN
+            if afi in ['l2vpn_evpn']:
+                if 'vni' in afi_config:
+                    for vni, vni_config in afi_config['vni'].items():
+                        if 'rd' in vni_config and 'advertise_all_vni' not in afi_config:
+                            raise ConfigError('BGP EVPN "rd" requires "advertise-all-vni" to be set!')
+                        if 'route_target' in vni_config and 'advertise_all_vni' not in afi_config:
+                            raise ConfigError('BGP EVPN "route-target" requires "advertise-all-vni" to be set!')
+
+    return None
+
+def generate(bgp):
+    if not bgp or 'deleted' in bgp:
+        return None
+
+    bgp['frr_bgpd_config']  = render_to_string('frr/bgpd.frr.j2', bgp)
+    return None
+
+def apply(bgp):
+    if 'deleted' in bgp:
+        # We need to ensure that the L3VNI is deleted first.
+        # This is not possible with old config backend
+        # priority bug
+        if {'vrf', 'vni'} <= set(bgp):
+            call('vtysh -c "conf t" -c "vrf {vrf}" -c "no vni {vni}"'.format(**bgp))
+
+    bgp_daemon = 'bgpd'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # Generate empty helper string which can be ammended to FRR commands, it
+    # will be either empty (default VRF) or contain the "vrf <name" statement
+    vrf = ''
+    if 'vrf' in bgp:
+        vrf = ' vrf ' + bgp['vrf']
+
+    frr_cfg.load_configuration(bgp_daemon)
+
+    # Remove interface specific config
+    for key in ['interface', 'interface_removed']:
+        if key not in bgp:
+            continue
+        for interface in bgp[key]:
+            frr_cfg.modify_section(f'^interface {interface}', stop_pattern='^exit', remove_stop_mark=True)
+
+    frr_cfg.modify_section(f'^router bgp \d+{vrf}', stop_pattern='^exit', remove_stop_mark=True)
+    if 'frr_bgpd_config' in bgp:
+        frr_cfg.add_before(frr.default_add_before, bgp['frr_bgpd_config'])
+    frr_cfg.commit_configuration(bgp_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_eigrp.py b/src/conf_mode/protocols_eigrp.py
new file mode 100644
index 0000000..c13e52a
--- /dev/null
+++ b/src/conf_mode/protocols_eigrp.py
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+from sys import argv
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configverify import verify_vrf
+from vyos.template import render_to_string
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    vrf = None
+    if len(argv) > 1:
+        vrf = argv[1]
+
+    base_path = ['protocols', 'eigrp']
+
+    # eqivalent of the C foo ? 'a' : 'b' statement
+    base = vrf and ['vrf', 'name', vrf, 'protocols', 'eigrp'] or base_path
+    eigrp = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True, no_tag_node_value_mangle=True)
+
+    # Assign the name of our VRF context. This MUST be done before the return
+    # statement below, else on deletion we will delete the default instance
+    # instead of the VRF instance.
+    if vrf: eigrp.update({'vrf' : vrf})
+
+    if not conf.exists(base):
+        eigrp.update({'deleted' : ''})
+        if not vrf:
+            # We are running in the default VRF context, thus we can not delete
+            # our main EIGRP instance if there are dependent EIGRP VRF instances.
+            eigrp['dependent_vrfs'] = conf.get_config_dict(['vrf', 'name'],
+                key_mangling=('-', '_'),
+                get_first_key=True,
+                no_tag_node_value_mangle=True)
+
+        return eigrp
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['policy'])
+    # Merge policy dict into "regular" config dict
+    eigrp = dict_merge(tmp, eigrp)
+
+    return eigrp
+
+def verify(eigrp):
+    if not eigrp or 'deleted' in eigrp:
+        return
+
+    if 'system_as' not in eigrp:
+        raise ConfigError('EIGRP system-as must be defined!')
+
+    if 'vrf' in eigrp:
+        verify_vrf(eigrp)
+
+def generate(eigrp):
+    if not eigrp or 'deleted' in eigrp:
+        return None
+
+    eigrp['frr_eigrpd_config']  = render_to_string('frr/eigrpd.frr.j2', eigrp)
+
+def apply(eigrp):
+    eigrp_daemon = 'eigrpd'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # Generate empty helper string which can be ammended to FRR commands, it
+    # will be either empty (default VRF) or contain the "vrf <name" statement
+    vrf = ''
+    if 'vrf' in eigrp:
+        vrf = ' vrf ' + eigrp['vrf']
+
+    frr_cfg.load_configuration(eigrp_daemon)
+    frr_cfg.modify_section(f'^router eigrp \d+{vrf}', stop_pattern='^exit', remove_stop_mark=True)
+    if 'frr_eigrpd_config' in eigrp:
+        frr_cfg.add_before(frr.default_add_before, eigrp['frr_eigrpd_config'])
+    frr_cfg.commit_configuration(eigrp_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_failover.py b/src/conf_mode/protocols_failover.py
new file mode 100644
index 0000000..e7e44db
--- /dev/null
+++ b/src/conf_mode/protocols_failover.py
@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import json
+
+from pathlib import Path
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+
+airbag.enable()
+
+
+service_name = 'vyos-failover'
+service_conf = Path(f'/run/{service_name}.conf')
+systemd_service = '/run/systemd/system/vyos-failover.service'
+rt_proto_failover = '/etc/iproute2/rt_protos.d/failover.conf'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['protocols', 'failover']
+    failover = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                    get_first_key=True)
+
+    # Set default values only if we set config
+    if failover.get('route') is not None:
+        failover = conf.merge_defaults(failover, recursive=True)
+
+    return failover
+
+def verify(failover):
+    # bail out early - looks like removal from running config
+    if not failover:
+        return None
+
+    if 'route' not in failover:
+        raise ConfigError(f'Failover "route" is mandatory!')
+
+    for route, route_config in failover['route'].items():
+        if not route_config.get('next_hop'):
+            raise ConfigError(f'Next-hop for "{route}" is mandatory!')
+
+        for next_hop, next_hop_config in route_config.get('next_hop').items():
+            if 'interface' not in next_hop_config:
+                raise ConfigError(f'Interface for route "{route}" next-hop "{next_hop}" is mandatory!')
+
+            if not next_hop_config.get('check'):
+                raise ConfigError(f'Check target for next-hop "{next_hop}" is mandatory!')
+
+            if 'target' not in next_hop_config['check']:
+                raise ConfigError(f'Check target for next-hop "{next_hop}" is mandatory!')
+
+            check_type = next_hop_config['check']['type']
+            if check_type == 'tcp' and 'port' not in next_hop_config['check']:
+                raise ConfigError(f'Check port for next-hop "{next_hop}" and type TCP is mandatory!')
+
+    return None
+
+def generate(failover):
+    if not failover:
+        service_conf.unlink(missing_ok=True)
+        return None
+
+    # Add own rt_proto 'failover'
+    # Helps to detect all own routes 'proto failover'
+    with open(rt_proto_failover, 'w') as f:
+        f.write('111  failover\n')
+
+    # Write configuration file
+    conf_json = json.dumps(failover, indent=4)
+    service_conf.write_text(conf_json)
+    render(systemd_service, 'protocols/systemd_vyos_failover_service.j2', failover)
+
+    return None
+
+def apply(failover):
+    if not failover:
+        call(f'systemctl stop {service_name}.service')
+        call('ip route flush protocol failover')
+    else:
+        call('systemctl daemon-reload')
+        call(f'systemctl restart {service_name}.service')
+        call(f'ip route flush protocol failover')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_igmp-proxy.py b/src/conf_mode/protocols_igmp-proxy.py
new file mode 100644
index 0000000..9a07adf
--- /dev/null
+++ b/src/conf_mode/protocols_igmp-proxy.py
@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configverify import verify_interface_exists
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.dict import dict_search
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/etc/igmpproxy.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['protocols', 'igmp-proxy']
+    igmp_proxy = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                      get_first_key=True,
+                                      with_defaults=True)
+
+    if conf.exists(['protocols', 'igmp']):
+        igmp_proxy.update({'igmp_configured': ''})
+
+    if conf.exists(['protocols', 'pim']):
+        igmp_proxy.update({'pim_configured': ''})
+
+    return igmp_proxy
+
+def verify(igmp_proxy):
+    # bail out early - looks like removal from running config
+    if not igmp_proxy or 'disable' in igmp_proxy:
+        return None
+
+    if 'igmp_configured' in igmp_proxy or 'pim_configured' in igmp_proxy:
+        raise ConfigError('Can not configure both IGMP proxy and PIM '\
+                          'at the same time')
+
+    # at least two interfaces are required, one upstream and one downstream
+    if 'interface' not in igmp_proxy or len(igmp_proxy['interface']) < 2:
+        raise ConfigError('Must define exactly one upstream and at least one ' \
+                          'downstream interface!')
+
+    upstream = 0
+    for interface, config in igmp_proxy['interface'].items():
+        verify_interface_exists(igmp_proxy, interface)
+        if dict_search('role', config) == 'upstream':
+            upstream += 1
+
+    if upstream == 0:
+        raise ConfigError('At least 1 upstream interface is required!')
+    elif upstream > 1:
+        raise ConfigError('Only 1 upstream interface allowed!')
+
+    return None
+
+def generate(igmp_proxy):
+    # bail out early - looks like removal from running config
+    if not igmp_proxy:
+        return None
+
+    # bail out early - service is disabled, but inform user
+    if 'disable' in igmp_proxy:
+        Warning('IGMP Proxy will be deactivated because it is disabled')
+        return None
+
+    render(config_file, 'igmp-proxy/igmpproxy.conf.j2', igmp_proxy)
+
+    return None
+
+def apply(igmp_proxy):
+    if not igmp_proxy or 'disable' in igmp_proxy:
+         # IGMP Proxy support is removed in the commit
+         call('systemctl stop igmpproxy.service')
+         if os.path.exists(config_file):
+             os.unlink(config_file)
+    else:
+        call('systemctl restart igmpproxy.service')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_isis.py b/src/conf_mode/protocols_isis.py
new file mode 100644
index 0000000..ba2f3cf
--- /dev/null
+++ b/src/conf_mode/protocols_isis.py
@@ -0,0 +1,312 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+from sys import argv
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
+from vyos.configverify import verify_common_route_maps
+from vyos.configverify import verify_interface_exists
+from vyos.ifconfig import Interface
+from vyos.utils.dict import dict_search
+from vyos.utils.network import get_interface_config
+from vyos.template import render_to_string
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    vrf = None
+    if len(argv) > 1:
+        vrf = argv[1]
+
+    base_path = ['protocols', 'isis']
+
+    # eqivalent of the C foo ? 'a' : 'b' statement
+    base = vrf and ['vrf', 'name', vrf, 'protocols', 'isis'] or base_path
+    isis = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                get_first_key=True,
+                                no_tag_node_value_mangle=True)
+
+    # Assign the name of our VRF context. This MUST be done before the return
+    # statement below, else on deletion we will delete the default instance
+    # instead of the VRF instance.
+    if vrf: isis['vrf'] = vrf
+
+    # FRR has VRF support for different routing daemons. As interfaces belong
+    # to VRFs - or the global VRF, we need to check for changed interfaces so
+    # that they will be properly rendered for the FRR config. Also this eases
+    # removal of interfaces from the running configuration.
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        isis['interface_removed'] = list(interfaces_removed)
+
+    # Bail out early if configuration tree does no longer exist. this must
+    # be done after retrieving the list of interfaces to be removed.
+    if not conf.exists(base):
+        isis.update({'deleted' : ''})
+        return isis
+
+    # merge in default values
+    isis = conf.merge_defaults(isis, recursive=True)
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['policy'])
+    # Merge policy dict into "regular" config dict
+    isis = dict_merge(tmp, isis)
+
+    return isis
+
+def verify(isis):
+    # bail out early - looks like removal from running config
+    if not isis or 'deleted' in isis:
+        return None
+
+    if 'net' not in isis:
+        raise ConfigError('Network entity is mandatory!')
+
+    # last byte in IS-IS area address must be 0
+    tmp = isis['net'].split('.')
+    if int(tmp[-1]) != 0:
+        raise ConfigError('Last byte of IS-IS network entity title must always be 0!')
+
+    verify_common_route_maps(isis)
+
+    # If interface not set
+    if 'interface' not in isis:
+        raise ConfigError('Interface used for routing updates is mandatory!')
+
+    for interface in isis['interface']:
+        verify_interface_exists(isis, interface)
+        # Interface MTU must be >= configured lsp-mtu
+        mtu = Interface(interface).get_mtu()
+        area_mtu = isis['lsp_mtu']
+        # Recommended maximum PDU size = interface MTU - 3 bytes
+        recom_area_mtu = mtu - 3
+        if mtu < int(area_mtu) or int(area_mtu) > recom_area_mtu:
+            raise ConfigError(f'Interface {interface} has MTU {mtu}, ' \
+                              f'current area MTU is {area_mtu}! \n' \
+                              f'Recommended area lsp-mtu {recom_area_mtu} or less ' \
+                              '(calculated on MTU size).')
+
+        if 'vrf' in isis:
+            # If interface specific options are set, we must ensure that the
+            # interface is bound to our requesting VRF. Due to the VyOS
+            # priorities the interface is bound to the VRF after creation of
+            # the VRF itself, and before any routing protocol is configured.
+            vrf = isis['vrf']
+            tmp = get_interface_config(interface)
+            if 'master' not in tmp or tmp['master'] != vrf:
+                raise ConfigError(f'Interface "{interface}" is not a member of VRF "{vrf}"!')
+
+    # If md5 and plaintext-password set at the same time
+    for password in ['area_password', 'domain_password']:
+        if password in isis:
+            if {'md5', 'plaintext_password'} <= set(isis[password]):
+                tmp = password.replace('_', '-')
+                raise ConfigError(f'Can use either md5 or plaintext-password for {tmp}!')
+
+    # If one param from delay set, but not set others
+    if 'spf_delay_ietf' in isis:
+        required_timers = ['holddown', 'init_delay', 'long_delay', 'short_delay', 'time_to_learn']
+        exist_timers = []
+        for elm_timer in required_timers:
+            if elm_timer in isis['spf_delay_ietf']:
+                exist_timers.append(elm_timer)
+
+        exist_timers = set(required_timers).difference(set(exist_timers))
+        if len(exist_timers) > 0:
+            raise ConfigError('All types of spf-delay must be configured. Missing: ' + ', '.join(exist_timers).replace('_', '-'))
+
+    # If Redistribute set, but level don't set
+    if 'redistribute' in isis:
+        proc_level = isis.get('level','').replace('-','_')
+        for afi in ['ipv4', 'ipv6']:
+            if afi not in isis['redistribute']:
+                continue
+
+            for proto, proto_config in isis['redistribute'][afi].items():
+                if 'level_1' not in proto_config and 'level_2' not in proto_config:
+                    raise ConfigError(f'Redistribute level-1 or level-2 should be specified in ' \
+                                      f'"protocols isis redistribute {afi} {proto}"!')
+
+                for redistr_level, redistr_config in proto_config.items():
+                    if proc_level and proc_level != 'level_1_2' and proc_level != redistr_level:
+                        raise ConfigError(f'"protocols isis redistribute {afi} {proto} {redistr_level}" ' \
+                                          f'can not be used with \"protocols isis level {proc_level}\"!')
+
+    # Segment routing checks
+    if dict_search('segment_routing.global_block', isis):
+        g_high_label_value = dict_search('segment_routing.global_block.high_label_value', isis)
+        g_low_label_value = dict_search('segment_routing.global_block.low_label_value', isis)
+
+        # If segment routing global block high or low value is blank, throw error
+        if not (g_low_label_value or g_high_label_value):
+            raise ConfigError('Segment routing global-block requires both low and high value!')
+
+        # If segment routing global block low value is higher than the high value, throw error
+        if int(g_low_label_value) > int(g_high_label_value):
+            raise ConfigError('Segment routing global-block low value must be lower than high value')
+
+    if dict_search('segment_routing.local_block', isis):
+        if dict_search('segment_routing.global_block', isis) == None:
+            raise ConfigError('Segment routing local-block requires global-block to be configured!')
+
+        l_high_label_value = dict_search('segment_routing.local_block.high_label_value', isis)
+        l_low_label_value = dict_search('segment_routing.local_block.low_label_value', isis)
+
+        # If segment routing local-block high or low value is blank, throw error
+        if not (l_low_label_value or l_high_label_value):
+            raise ConfigError('Segment routing local-block requires both high and low value!')
+
+        # If segment routing local-block low value is higher than the high value, throw error
+        if int(l_low_label_value) > int(l_high_label_value):
+            raise ConfigError('Segment routing local-block low value must be lower than high value')
+
+        # local-block most live outside global block
+        global_range = range(int(g_low_label_value), int(g_high_label_value) +1)
+        local_range  = range(int(l_low_label_value), int(l_high_label_value) +1)
+
+        # Check for overlapping ranges
+        if list(set(global_range) & set(local_range)):
+            raise ConfigError(f'Segment-Routing Global Block ({g_low_label_value}/{g_high_label_value}) '\
+                              f'conflicts with Local Block ({l_low_label_value}/{l_high_label_value})!')
+
+    # Check for a blank or invalid value per prefix
+    if dict_search('segment_routing.prefix', isis):
+        for prefix, prefix_config in isis['segment_routing']['prefix'].items():
+            if 'absolute' in prefix_config:
+                if prefix_config['absolute'].get('value') is None:
+                    raise ConfigError(f'Segment routing prefix {prefix} absolute value cannot be blank.')
+            elif 'index' in prefix_config:
+                if prefix_config['index'].get('value') is None:
+                    raise ConfigError(f'Segment routing prefix {prefix} index value cannot be blank.')
+
+    # Check for explicit-null and no-php-flag configured at the same time per prefix
+    if dict_search('segment_routing.prefix', isis):
+        for prefix, prefix_config in isis['segment_routing']['prefix'].items():
+            if 'absolute' in prefix_config:
+                if ("explicit_null" in prefix_config['absolute']) and ("no_php_flag" in prefix_config['absolute']):
+                    raise ConfigError(f'Segment routing prefix {prefix} cannot have both explicit-null '\
+                                      f'and no-php-flag configured at the same time.')
+            elif 'index' in prefix_config:
+                if ("explicit_null" in prefix_config['index']) and ("no_php_flag" in prefix_config['index']):
+                    raise ConfigError(f'Segment routing prefix {prefix} cannot have both explicit-null '\
+                                      f'and no-php-flag configured at the same time.')
+
+    # Check for index ranges being larger than the segment routing global block
+    if dict_search('segment_routing.global_block', isis):
+        g_high_label_value = dict_search('segment_routing.global_block.high_label_value', isis)
+        g_low_label_value = dict_search('segment_routing.global_block.low_label_value', isis)
+        g_label_difference = int(g_high_label_value) - int(g_low_label_value)
+        if dict_search('segment_routing.prefix', isis):
+            for prefix, prefix_config in isis['segment_routing']['prefix'].items():
+                if 'index' in prefix_config:
+                    index_size = isis['segment_routing']['prefix'][prefix]['index']['value']
+                    if int(index_size) > int(g_label_difference):
+                        raise ConfigError(f'Segment routing prefix {prefix} cannot have an '\
+                                          f'index base size larger than the SRGB label base.')
+
+    # Check for LFA tiebreaker index duplication
+    if dict_search('fast_reroute.lfa.local.tiebreaker', isis):
+        comparison_dictionary = {}
+        for item, item_options in isis['fast_reroute']['lfa']['local']['tiebreaker'].items():
+            for index, index_options in item_options.items():
+                for index_value, index_value_options in index_options.items():
+                    if index_value not in comparison_dictionary.keys():
+                        comparison_dictionary[index_value] = [item]
+                    else:
+                        comparison_dictionary[index_value].append(item)
+        for index, index_length in comparison_dictionary.items():
+            if int(len(index_length)) > 1:
+                raise ConfigError(f'LFA index {index} cannot have more than one tiebreaker configured.')
+
+    # Check for LFA priority-limit configured multiple times per level
+    if dict_search('fast_reroute.lfa.local.priority_limit', isis):
+        comparison_dictionary = {}
+        for priority, priority_options in isis['fast_reroute']['lfa']['local']['priority_limit'].items():
+            for level, level_options in priority_options.items():
+                if level not in comparison_dictionary.keys():
+                    comparison_dictionary[level] = [priority]
+                else:
+                    comparison_dictionary[level].append(priority)
+            for level, level_length in comparison_dictionary.items():
+                if int(len(level_length)) > 1:
+                    raise ConfigError(f'LFA priority-limit on {level.replace("_", "-")} cannot have more than one priority configured.')
+
+    # Check for LFA remote prefix list configured with more than one list
+    if dict_search('fast_reroute.lfa.remote.prefix_list', isis):
+        if int(len(isis['fast_reroute']['lfa']['remote']['prefix_list'].items())) > 1:
+            raise ConfigError(f'LFA remote prefix-list has more than one configured. Cannot have more than one configured.')
+
+    return None
+
+def generate(isis):
+    if not isis or 'deleted' in isis:
+        return None
+
+    isis['frr_isisd_config'] = render_to_string('frr/isisd.frr.j2', isis)
+    return None
+
+def apply(isis):
+    isis_daemon = 'isisd'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # Generate empty helper string which can be ammended to FRR commands, it
+    # will be either empty (default VRF) or contain the "vrf <name" statement
+    vrf = ''
+    if 'vrf' in isis:
+        vrf = ' vrf ' + isis['vrf']
+
+    frr_cfg.load_configuration(isis_daemon)
+    frr_cfg.modify_section(f'^router isis VyOS{vrf}', stop_pattern='^exit', remove_stop_mark=True)
+
+    for key in ['interface', 'interface_removed']:
+        if key not in isis:
+            continue
+        for interface in isis[key]:
+            frr_cfg.modify_section(f'^interface {interface}', stop_pattern='^exit', remove_stop_mark=True)
+
+    if 'frr_isisd_config' in isis:
+        frr_cfg.add_before(frr.default_add_before, isis['frr_isisd_config'])
+
+    frr_cfg.commit_configuration(isis_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_mpls.py b/src/conf_mode/protocols_mpls.py
new file mode 100644
index 0000000..ad164db
--- /dev/null
+++ b/src/conf_mode/protocols_mpls.py
@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from glob import glob
+from vyos.config import Config
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search
+from vyos.utils.file import read_file
+from vyos.utils.system import sysctl_write
+from vyos.configverify import verify_interface_exists
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/tmp/ldpd.frr'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['protocols', 'mpls']
+
+    mpls = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+    return mpls
+
+def verify(mpls):
+    # If no config, then just bail out early.
+    if not mpls:
+        return None
+
+    if 'interface' in mpls:
+        for interface in mpls['interface']:
+            verify_interface_exists(mpls, interface)
+
+    # Checks to see if LDP is properly configured
+    if 'ldp' in mpls:
+        # If router ID not defined
+        if 'router_id' not in mpls['ldp']:
+            raise ConfigError('Router ID missing. An LDP router id is mandatory!')
+
+        # If interface not set
+        if 'interface' not in mpls['ldp']:
+            raise ConfigError('LDP interfaces are missing. An LDP interface is mandatory!')
+
+        # If transport addresses are not set
+        if not dict_search('ldp.discovery.transport_ipv4_address', mpls) and \
+           not dict_search('ldp.discovery.transport_ipv6_address', mpls):
+                raise ConfigError('LDP transport address missing!')
+
+    return None
+
+def generate(mpls):
+    # If there's no MPLS config generated, create dictionary key with no value.
+    if not mpls or 'deleted' in mpls:
+        return None
+
+    mpls['frr_ldpd_config'] = render_to_string('frr/ldpd.frr.j2', mpls)
+    return None
+
+def apply(mpls):
+    ldpd_damon = 'ldpd'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    frr_cfg.load_configuration(ldpd_damon)
+    frr_cfg.modify_section(f'^mpls ldp', stop_pattern='^exit', remove_stop_mark=True)
+
+    if 'frr_ldpd_config' in mpls:
+        frr_cfg.add_before(frr.default_add_before, mpls['frr_ldpd_config'])
+    frr_cfg.commit_configuration(ldpd_damon)
+
+    # Set number of entries in the platform label tables
+    labels = '0'
+    if 'interface' in mpls:
+        labels = '1048575'
+    sysctl_write('net.mpls.platform_labels', labels)
+
+    # Check for changes in global MPLS options
+    if 'parameters' in mpls:
+            # Choose whether to copy IP TTL to MPLS header TTL
+        if 'no_propagate_ttl' in mpls['parameters']:
+            sysctl_write('net.mpls.ip_ttl_propagate', 0)
+            # Choose whether to limit maximum MPLS header TTL
+        if 'maximum_ttl' in mpls['parameters']:
+            ttl = mpls['parameters']['maximum_ttl']
+            sysctl_write('net.mpls.default_ttl', ttl)
+    else:
+        # Set default global MPLS options if not defined.
+        sysctl_write('net.mpls.ip_ttl_propagate', 1)
+        sysctl_write('net.mpls.default_ttl', 255)
+
+    # Enable and disable MPLS processing on interfaces per configuration
+    if 'interface' in mpls:
+        system_interfaces = []
+        # Populate system interfaces list with local MPLS capable interfaces
+        for interface in glob('/proc/sys/net/mpls/conf/*'):
+            system_interfaces.append(os.path.basename(interface))
+        # This is where the comparison is done on if an interface needs to be enabled/disabled.
+        for system_interface in system_interfaces:
+            interface_state = read_file(f'/proc/sys/net/mpls/conf/{system_interface}/input')
+            if '1' in interface_state:
+                if system_interface not in mpls['interface']:
+                    system_interface = system_interface.replace('.', '/')
+                    sysctl_write(f'net.mpls.conf.{system_interface}.input', 0)
+            elif '0' in interface_state:
+                if system_interface in mpls['interface']:
+                    system_interface = system_interface.replace('.', '/')
+                    sysctl_write(f'net.mpls.conf.{system_interface}.input', 1)
+    else:
+        system_interfaces = []
+        # If MPLS interfaces are not configured, set MPLS processing disabled
+        for interface in glob('/proc/sys/net/mpls/conf/*'):
+            system_interfaces.append(os.path.basename(interface))
+        for system_interface in system_interfaces:
+            system_interface = system_interface.replace('.', '/')
+            sysctl_write(f'net.mpls.conf.{system_interface}.input', 0)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_nhrp.py b/src/conf_mode/protocols_nhrp.py
new file mode 100644
index 0000000..0bd68b7
--- /dev/null
+++ b/src/conf_mode/protocols_nhrp.py
@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from vyos.config import Config
+from vyos.configdict import node_changed
+from vyos.template import render
+from vyos.utils.process import run
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+opennhrp_conf = '/run/opennhrp/opennhrp.conf'
+nhrp_nftables_conf = '/run/nftables_nhrp.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['protocols', 'nhrp']
+
+    nhrp = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                get_first_key=True, no_tag_node_value_mangle=True)
+    nhrp['del_tunnels'] = node_changed(conf, base + ['tunnel'])
+
+    if not conf.exists(base):
+        return nhrp
+
+    nhrp['if_tunnel'] = conf.get_config_dict(['interfaces', 'tunnel'], key_mangling=('-', '_'),
+                                get_first_key=True, no_tag_node_value_mangle=True)
+
+    nhrp['profile_map'] = {}
+    profile = conf.get_config_dict(['vpn', 'ipsec', 'profile'], key_mangling=('-', '_'),
+                                get_first_key=True, no_tag_node_value_mangle=True)
+
+    for name, profile_conf in profile.items():
+        if 'bind' in profile_conf and 'tunnel' in profile_conf['bind']:
+            interfaces = profile_conf['bind']['tunnel']
+            if isinstance(interfaces, str):
+                interfaces = [interfaces]
+            for interface in interfaces:
+                nhrp['profile_map'][interface] = name
+
+    return nhrp
+
+def verify(nhrp):
+    if 'tunnel' in nhrp:
+        for name, nhrp_conf in nhrp['tunnel'].items():
+            if not nhrp['if_tunnel'] or name not in nhrp['if_tunnel']:
+                raise ConfigError(f'Tunnel interface "{name}" does not exist')
+
+            tunnel_conf = nhrp['if_tunnel'][name]
+
+            if 'encapsulation' not in tunnel_conf or tunnel_conf['encapsulation'] != 'gre':
+                raise ConfigError(f'Tunnel "{name}" is not an mGRE tunnel')
+
+            if 'remote' in tunnel_conf:
+                raise ConfigError(f'Tunnel "{name}" cannot have a remote address defined')
+
+            if 'map' in nhrp_conf:
+                for map_name, map_conf in nhrp_conf['map'].items():
+                    if 'nbma_address' not in map_conf:
+                        raise ConfigError(f'nbma-address missing on map {map_name} on tunnel {name}')
+
+            if 'dynamic_map' in nhrp_conf:
+                for map_name, map_conf in nhrp_conf['dynamic_map'].items():
+                    if 'nbma_domain_name' not in map_conf:
+                        raise ConfigError(f'nbma-domain-name missing on dynamic-map {map_name} on tunnel {name}')
+    return None
+
+def generate(nhrp):
+    if not os.path.exists(nhrp_nftables_conf):
+        nhrp['first_install'] = True
+
+    render(opennhrp_conf, 'nhrp/opennhrp.conf.j2', nhrp)
+    render(nhrp_nftables_conf, 'nhrp/nftables.conf.j2', nhrp)
+    return None
+
+def apply(nhrp):
+    nft_rc = run(f'nft --file {nhrp_nftables_conf}')
+    if nft_rc != 0:
+        raise ConfigError('Failed to apply NHRP tunnel firewall rules')
+
+    action = 'restart' if nhrp and 'tunnel' in nhrp else 'stop'
+    service_rc = run(f'systemctl {action} opennhrp.service')
+    if service_rc != 0:
+        raise ConfigError(f'Failed to {action} the NHRP service')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_openfabric.py b/src/conf_mode/protocols_openfabric.py
new file mode 100644
index 0000000..8e8c50c
--- /dev/null
+++ b/src/conf_mode/protocols_openfabric.py
@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import node_changed
+from vyos.configverify import verify_interface_exists
+from vyos.template import render_to_string
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base_path = ['protocols', 'openfabric']
+
+    openfabric = conf.get_config_dict(base_path, key_mangling=('-', '_'),
+                                get_first_key=True,
+                                no_tag_node_value_mangle=True)
+
+    # Remove per domain MPLS configuration - get a list of all changed Openfabric domains
+    # (removed and added) so that they will be properly rendered for the FRR config.
+    openfabric['domains_all'] = list(conf.list_nodes(' '.join(base_path) + f' domain') +
+                                         node_changed(conf, base_path + ['domain']))
+
+    # Get a list of all interfaces
+    openfabric['interfaces_all'] = []
+    for domain in openfabric['domains_all']:
+        interfaces_modified = list(node_changed(conf, base_path + ['domain', domain, 'interface']) +
+                                  conf.list_nodes(' '.join(base_path) + f' domain {domain} interface'))
+        openfabric['interfaces_all'].extend(interfaces_modified)
+
+    if not conf.exists(base_path):
+        openfabric.update({'deleted': ''})
+
+    return openfabric
+
+def verify(openfabric):
+    # bail out early - looks like removal from running config
+    if not openfabric or 'deleted' in openfabric:
+        return None
+
+    if 'net' not in openfabric:
+        raise ConfigError('Network entity is mandatory!')
+
+    # last byte in OpenFabric area address must be 0
+    tmp = openfabric['net'].split('.')
+    if int(tmp[-1]) != 0:
+        raise ConfigError('Last byte of OpenFabric network entity title must always be 0!')
+
+    if 'domain' not in openfabric:
+        raise ConfigError('OpenFabric domain name is mandatory!')
+
+    interfaces_used = []
+
+    for domain, domain_config in openfabric['domain'].items():
+        # If interface not set
+        if 'interface' not in domain_config:
+            raise ConfigError(f'Interface used for routing updates in OpenFabric "{domain}" is mandatory!')
+
+        for iface, iface_config in domain_config['interface'].items():
+            verify_interface_exists(openfabric, iface)
+
+            # interface can be activated only on one OpenFabric instance
+            if iface in interfaces_used:
+                raise ConfigError(f'Interface {iface} is already used in different OpenFabric instance!')
+
+            if 'address_family' not in iface_config or len(iface_config['address_family']) < 1:
+                raise ConfigError(f'Need to specify address family for the interface "{iface}"!')
+
+            # If md5 and plaintext-password set at the same time
+            if 'password' in iface_config:
+                if {'md5', 'plaintext_password'} <= set(iface_config['password']):
+                    raise ConfigError(f'Can use either md5 or plaintext-password for password for the interface!')
+
+            if iface == 'lo' and 'passive' not in iface_config:
+                Warning('For loopback interface passive mode is implied!')
+
+            interfaces_used.append(iface)
+
+        # If md5 and plaintext-password set at the same time
+        password = 'domain_password'
+        if password in domain_config:
+            if {'md5', 'plaintext_password'} <= set(domain_config[password]):
+                raise ConfigError(f'Can use either md5 or plaintext-password for domain-password!')
+
+    return None
+
+def generate(openfabric):
+    if not openfabric or 'deleted' in openfabric:
+        return None
+
+    openfabric['frr_fabricd_config'] = render_to_string('frr/fabricd.frr.j2', openfabric)
+    return None
+
+def apply(openfabric):
+    openfabric_daemon = 'fabricd'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    frr_cfg.load_configuration(openfabric_daemon)
+    for domain in openfabric['domains_all']:
+        frr_cfg.modify_section(f'^router openfabric {domain}', stop_pattern='^exit', remove_stop_mark=True)
+
+    for interface in openfabric['interfaces_all']:
+        frr_cfg.modify_section(f'^interface {interface}', stop_pattern='^exit', remove_stop_mark=True)
+
+    if 'frr_fabricd_config' in openfabric:
+        frr_cfg.add_before(frr.default_add_before, openfabric['frr_fabricd_config'])
+
+    frr_cfg.commit_configuration(openfabric_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_ospf.py b/src/conf_mode/protocols_ospf.py
new file mode 100644
index 0000000..7347c4f
--- /dev/null
+++ b/src/conf_mode/protocols_ospf.py
@@ -0,0 +1,290 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+from sys import argv
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
+from vyos.configverify import verify_common_route_maps
+from vyos.configverify import verify_route_map
+from vyos.configverify import verify_interface_exists
+from vyos.configverify import verify_access_list
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search
+from vyos.utils.network import get_interface_config
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    vrf = None
+    if len(argv) > 1:
+        vrf = argv[1]
+
+    base_path = ['protocols', 'ospf']
+
+    # eqivalent of the C foo ? 'a' : 'b' statement
+    base = vrf and ['vrf', 'name', vrf, 'protocols', 'ospf'] or base_path
+    ospf = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                get_first_key=True)
+
+    # Assign the name of our VRF context. This MUST be done before the return
+    # statement below, else on deletion we will delete the default instance
+    # instead of the VRF instance.
+    if vrf: ospf['vrf'] = vrf
+
+    # FRR has VRF support for different routing daemons. As interfaces belong
+    # to VRFs - or the global VRF, we need to check for changed interfaces so
+    # that they will be properly rendered for the FRR config. Also this eases
+    # removal of interfaces from the running configuration.
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        ospf['interface_removed'] = list(interfaces_removed)
+
+    # Bail out early if configuration tree does no longer exist. this must
+    # be done after retrieving the list of interfaces to be removed.
+    if not conf.exists(base):
+        ospf.update({'deleted' : ''})
+        return ospf
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    default_values = conf.get_config_defaults(**ospf.kwargs, recursive=True)
+
+    # We have to cleanup the default dict, as default values could enable features
+    # which are not explicitly enabled on the CLI. Example: default-information
+    # originate comes with a default metric-type of 2, which will enable the
+    # entire default-information originate tree, even when not set via CLI so we
+    # need to check this first and probably drop that key.
+    if dict_search('default_information.originate', ospf) is None:
+        del default_values['default_information']
+    if 'mpls_te' not in ospf:
+        del default_values['mpls_te']
+    if 'graceful_restart' not in ospf:
+        del default_values['graceful_restart']
+    for area_num in default_values.get('area', []):
+        if dict_search(f'area.{area_num}.area_type.nssa', ospf) is None:
+            del default_values['area'][area_num]['area_type']['nssa']
+
+    for protocol in ['babel', 'bgp', 'connected', 'isis', 'kernel', 'rip', 'static']:
+        if dict_search(f'redistribute.{protocol}', ospf) is None:
+            del default_values['redistribute'][protocol]
+    if not bool(default_values['redistribute']):
+        del default_values['redistribute']
+
+    for interface in ospf.get('interface', []):
+        # We need to reload the defaults on every pass b/c of
+        # hello-multiplier dependency on dead-interval
+        # If hello-multiplier is set, we need to remove the default from
+        # dead-interval.
+        if 'hello_multiplier' in ospf['interface'][interface]:
+            del default_values['interface'][interface]['dead_interval']
+
+    ospf = config_dict_merge(default_values, ospf)
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['policy'])
+    # Merge policy dict into "regular" config dict
+    ospf = dict_merge(tmp, ospf)
+
+    return ospf
+
+def verify(ospf):
+    if not ospf:
+        return None
+
+    verify_common_route_maps(ospf)
+
+    # As we can have a default-information route-map, we need to validate it!
+    route_map_name = dict_search('default_information.originate.route_map', ospf)
+    if route_map_name: verify_route_map(route_map_name, ospf)
+
+    # Validate if configured Access-list exists
+    if 'area' in ospf:
+          networks = []
+          for area, area_config in ospf['area'].items():
+              if 'import_list' in area_config:
+                  acl_import = area_config['import_list']
+                  if acl_import: verify_access_list(acl_import, ospf)
+              if 'export_list' in area_config:
+                  acl_export = area_config['export_list']
+                  if acl_export: verify_access_list(acl_export, ospf)
+
+              if 'network' in area_config:
+                  for network in area_config['network']:
+                      if network in networks:
+                          raise ConfigError(f'Network "{network}" already defined in different area!')
+                      networks.append(network)
+
+    if 'interface' in ospf:
+        for interface, interface_config in ospf['interface'].items():
+            verify_interface_exists(ospf, interface)
+            # One can not use dead-interval and hello-multiplier at the same
+            # time. FRR will only activate the last option set via CLI.
+            if {'hello_multiplier', 'dead_interval'} <= set(interface_config):
+                raise ConfigError(f'Can not use hello-multiplier and dead-interval ' \
+                                  f'concurrently for {interface}!')
+
+            # One can not use the "network <prefix> area <id>" command and an
+            # per interface area assignment at the same time. FRR will error
+            # out using: "Please remove all network commands first."
+            if 'area' in ospf and 'area' in interface_config:
+                for area, area_config in ospf['area'].items():
+                    if 'network' in area_config:
+                        raise ConfigError('Can not use OSPF interface area and area ' \
+                                          'network configuration at the same time!')
+
+            # If interface specific options are set, we must ensure that the
+            # interface is bound to our requesting VRF. Due to the VyOS
+            # priorities the interface is bound to the VRF after creation of
+            # the VRF itself, and before any routing protocol is configured.
+            if 'vrf' in ospf:
+                vrf = ospf['vrf']
+                tmp = get_interface_config(interface)
+                if 'master' not in tmp or tmp['master'] != vrf:
+                    raise ConfigError(f'Interface "{interface}" is not a member of VRF "{vrf}"!')
+
+    # Segment routing checks
+    if dict_search('segment_routing.global_block', ospf):
+        g_high_label_value = dict_search('segment_routing.global_block.high_label_value', ospf)
+        g_low_label_value = dict_search('segment_routing.global_block.low_label_value', ospf)
+
+        # If segment routing global block high or low value is blank, throw error
+        if not (g_low_label_value or g_high_label_value):
+            raise ConfigError('Segment routing global-block requires both low and high value!')
+
+        # If segment routing global block low value is higher than the high value, throw error
+        if int(g_low_label_value) > int(g_high_label_value):
+            raise ConfigError('Segment routing global-block low value must be lower than high value')
+
+    if dict_search('segment_routing.local_block', ospf):
+        if dict_search('segment_routing.global_block', ospf) == None:
+            raise ConfigError('Segment routing local-block requires global-block to be configured!')
+
+        l_high_label_value = dict_search('segment_routing.local_block.high_label_value', ospf)
+        l_low_label_value = dict_search('segment_routing.local_block.low_label_value', ospf)
+
+        # If segment routing local-block high or low value is blank, throw error
+        if not (l_low_label_value or l_high_label_value):
+            raise ConfigError('Segment routing local-block requires both high and low value!')
+
+        # If segment routing local-block low value is higher than the high value, throw error
+        if int(l_low_label_value) > int(l_high_label_value):
+            raise ConfigError('Segment routing local-block low value must be lower than high value')
+
+        # local-block most live outside global block
+        global_range = range(int(g_low_label_value), int(g_high_label_value) +1)
+        local_range  = range(int(l_low_label_value), int(l_high_label_value) +1)
+
+        # Check for overlapping ranges
+        if list(set(global_range) & set(local_range)):
+            raise ConfigError(f'Segment-Routing Global Block ({g_low_label_value}/{g_high_label_value}) '\
+                              f'conflicts with Local Block ({l_low_label_value}/{l_high_label_value})!')
+
+    # Check for a blank or invalid value per prefix
+    if dict_search('segment_routing.prefix', ospf):
+        for prefix, prefix_config in ospf['segment_routing']['prefix'].items():
+            if 'index' in prefix_config:
+                if prefix_config['index'].get('value') is None:
+                    raise ConfigError(f'Segment routing prefix {prefix} index value cannot be blank.')
+
+    # Check for explicit-null and no-php-flag configured at the same time per prefix
+    if dict_search('segment_routing.prefix', ospf):
+        for prefix, prefix_config in ospf['segment_routing']['prefix'].items():
+            if 'index' in prefix_config:
+                if ("explicit_null" in prefix_config['index']) and ("no_php_flag" in prefix_config['index']):
+                    raise ConfigError(f'Segment routing prefix {prefix} cannot have both explicit-null '\
+                                      f'and no-php-flag configured at the same time.')
+
+    # Check for index ranges being larger than the segment routing global block
+    if dict_search('segment_routing.global_block', ospf):
+        g_high_label_value = dict_search('segment_routing.global_block.high_label_value', ospf)
+        g_low_label_value = dict_search('segment_routing.global_block.low_label_value', ospf)
+        g_label_difference = int(g_high_label_value) - int(g_low_label_value)
+        if dict_search('segment_routing.prefix', ospf):
+            for prefix, prefix_config in ospf['segment_routing']['prefix'].items():
+                if 'index' in prefix_config:
+                    index_size = ospf['segment_routing']['prefix'][prefix]['index']['value']
+                    if int(index_size) > int(g_label_difference):
+                        raise ConfigError(f'Segment routing prefix {prefix} cannot have an '\
+                                          f'index base size larger than the SRGB label base.')
+
+    # Check route summarisation
+    if 'summary_address' in ospf:
+        for prefix, prefix_options in ospf['summary_address'].items():
+            if {'tag', 'no_advertise'} <= set(prefix_options):
+                raise ConfigError(f'Can not set both "tag" and "no-advertise" for Type-5 '\
+                                  f'and Type-7 route summarisation of "{prefix}"!')
+
+    return None
+
+def generate(ospf):
+    if not ospf or 'deleted' in ospf:
+        return None
+
+    ospf['frr_ospfd_config'] = render_to_string('frr/ospfd.frr.j2', ospf)
+    return None
+
+def apply(ospf):
+    ospf_daemon = 'ospfd'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # Generate empty helper string which can be ammended to FRR commands, it
+    # will be either empty (default VRF) or contain the "vrf <name" statement
+    vrf = ''
+    if 'vrf' in ospf:
+        vrf = ' vrf ' + ospf['vrf']
+
+    frr_cfg.load_configuration(ospf_daemon)
+    frr_cfg.modify_section(f'^router ospf{vrf}', stop_pattern='^exit', remove_stop_mark=True)
+
+    for key in ['interface', 'interface_removed']:
+        if key not in ospf:
+            continue
+        for interface in ospf[key]:
+            frr_cfg.modify_section(f'^interface {interface}', stop_pattern='^exit', remove_stop_mark=True)
+
+    if 'frr_ospfd_config' in ospf:
+        frr_cfg.add_before(frr.default_add_before, ospf['frr_ospfd_config'])
+
+    frr_cfg.commit_configuration(ospf_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_ospfv3.py b/src/conf_mode/protocols_ospfv3.py
new file mode 100644
index 0000000..60c2a9b
--- /dev/null
+++ b/src/conf_mode/protocols_ospfv3.py
@@ -0,0 +1,191 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+from sys import argv
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
+from vyos.configverify import verify_common_route_maps
+from vyos.configverify import verify_route_map
+from vyos.configverify import verify_interface_exists
+from vyos.template import render_to_string
+from vyos.ifconfig import Interface
+from vyos.utils.dict import dict_search
+from vyos.utils.network import get_interface_config
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    vrf = None
+    if len(argv) > 1:
+        vrf = argv[1]
+
+    base_path = ['protocols', 'ospfv3']
+
+    # eqivalent of the C foo ? 'a' : 'b' statement
+    base = vrf and ['vrf', 'name', vrf, 'protocols', 'ospfv3'] or base_path
+    ospfv3 = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+    # Assign the name of our VRF context. This MUST be done before the return
+    # statement below, else on deletion we will delete the default instance
+    # instead of the VRF instance.
+    if vrf: ospfv3['vrf'] = vrf
+
+    # FRR has VRF support for different routing daemons. As interfaces belong
+    # to VRFs - or the global VRF, we need to check for changed interfaces so
+    # that they will be properly rendered for the FRR config. Also this eases
+    # removal of interfaces from the running configuration.
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        ospfv3['interface_removed'] = list(interfaces_removed)
+
+    # Bail out early if configuration tree does no longer exist. this must
+    # be done after retrieving the list of interfaces to be removed.
+    if not conf.exists(base):
+        ospfv3.update({'deleted' : ''})
+        return ospfv3
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    default_values = conf.get_config_defaults(**ospfv3.kwargs,
+                                              recursive=True)
+
+    # We have to cleanup the default dict, as default values could enable features
+    # which are not explicitly enabled on the CLI. Example: default-information
+    # originate comes with a default metric-type of 2, which will enable the
+    # entire default-information originate tree, even when not set via CLI so we
+    # need to check this first and probably drop that key.
+    if dict_search('default_information.originate', ospfv3) is None:
+        del default_values['default_information']
+    if 'graceful_restart' not in ospfv3:
+        del default_values['graceful_restart']
+
+    for protocol in ['babel', 'bgp', 'connected', 'isis', 'kernel', 'ripng', 'static']:
+        if dict_search(f'redistribute.{protocol}', ospfv3) is None:
+            del default_values['redistribute'][protocol]
+    if not bool(default_values['redistribute']):
+        del default_values['redistribute']
+
+    default_values.pop('interface', {})
+
+    # merge in remaining default values
+    ospfv3 = config_dict_merge(default_values, ospfv3)
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['policy'])
+    # Merge policy dict into "regular" config dict
+    ospfv3 = dict_merge(tmp, ospfv3)
+
+    return ospfv3
+
+def verify(ospfv3):
+    if not ospfv3:
+        return None
+
+    verify_common_route_maps(ospfv3)
+
+    # As we can have a default-information route-map, we need to validate it!
+    route_map_name = dict_search('default_information.originate.route_map', ospfv3)
+    if route_map_name: verify_route_map(route_map_name, ospfv3)
+
+    if 'area' in ospfv3:
+        for area, area_config in ospfv3['area'].items():
+            if 'area_type' in area_config:
+                if len(area_config['area_type']) > 1:
+                    raise ConfigError(f'Can only configure one area-type for OSPFv3 area "{area}"!')
+            if 'range' in area_config:
+                for range, range_config in area_config['range'].items():
+                    if {'not_advertise', 'advertise'} <= range_config.keys():
+                        raise ConfigError(f'"not-advertise" and "advertise" for "range {range}" cannot be both configured at the same time!')
+
+    if 'interface' in ospfv3:
+        for interface, interface_config in ospfv3['interface'].items():
+            verify_interface_exists(ospfv3, interface)
+            if 'ifmtu' in interface_config:
+                mtu = Interface(interface).get_mtu()
+                if int(interface_config['ifmtu']) > int(mtu):
+                    raise ConfigError(f'OSPFv3 ifmtu can not exceed physical MTU of "{mtu}"')
+
+            # If interface specific options are set, we must ensure that the
+            # interface is bound to our requesting VRF. Due to the VyOS
+            # priorities the interface is bound to the VRF after creation of
+            # the VRF itself, and before any routing protocol is configured.
+            if 'vrf' in ospfv3:
+                vrf = ospfv3['vrf']
+                tmp = get_interface_config(interface)
+                if 'master' not in tmp or tmp['master'] != vrf:
+                    raise ConfigError(f'Interface "{interface}" is not a member of VRF "{vrf}"!')
+
+    return None
+
+def generate(ospfv3):
+    if not ospfv3 or 'deleted' in ospfv3:
+        return None
+
+    ospfv3['new_frr_config'] = render_to_string('frr/ospf6d.frr.j2', ospfv3)
+    return None
+
+def apply(ospfv3):
+    ospf6_daemon = 'ospf6d'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # Generate empty helper string which can be ammended to FRR commands, it
+    # will be either empty (default VRF) or contain the "vrf <name" statement
+    vrf = ''
+    if 'vrf' in ospfv3:
+        vrf = ' vrf ' + ospfv3['vrf']
+
+    frr_cfg.load_configuration(ospf6_daemon)
+    frr_cfg.modify_section(f'^router ospf6{vrf}', stop_pattern='^exit', remove_stop_mark=True)
+
+    for key in ['interface', 'interface_removed']:
+        if key not in ospfv3:
+            continue
+        for interface in ospfv3[key]:
+            frr_cfg.modify_section(f'^interface {interface}', stop_pattern='^exit', remove_stop_mark=True)
+
+    if 'new_frr_config' in ospfv3:
+        frr_cfg.add_before(frr.default_add_before, ospfv3['new_frr_config'])
+
+    frr_cfg.commit_configuration(ospf6_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_pim.py b/src/conf_mode/protocols_pim.py
new file mode 100644
index 0000000..79294a1
--- /dev/null
+++ b/src/conf_mode/protocols_pim.py
@@ -0,0 +1,172 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from ipaddress import IPv4Address
+from ipaddress import IPv4Network
+from signal import SIGTERM
+from sys import exit
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configdict import node_changed
+from vyos.configverify import verify_interface_exists
+from vyos.utils.process import process_named_running
+from vyos.utils.process import call
+from vyos.template import render_to_string
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+RESERVED_MC_NET = '224.0.0.0/24'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['protocols', 'pim']
+
+    pim = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True, no_tag_node_value_mangle=True)
+
+    # We can not run both IGMP proxy and PIM at the same time - get IGMP
+    # proxy status
+    if conf.exists(['protocols', 'igmp-proxy']):
+        pim.update({'igmp_proxy_enabled' : {}})
+
+    # FRR has VRF support for different routing daemons. As interfaces belong
+    # to VRFs - or the global VRF, we need to check for changed interfaces so
+    # that they will be properly rendered for the FRR config. Also this eases
+    # removal of interfaces from the running configuration.
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        pim['interface_removed'] = list(interfaces_removed)
+
+    # Bail out early if configuration tree does no longer exist. this must
+    # be done after retrieving the list of interfaces to be removed.
+    if not conf.exists(base):
+        pim.update({'deleted' : ''})
+        return pim
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    default_values = conf.get_config_defaults(**pim.kwargs, recursive=True)
+
+    # We have to cleanup the default dict, as default values could enable features
+    # which are not explicitly enabled on the CLI. Example: default-information
+    # originate comes with a default metric-type of 2, which will enable the
+    # entire default-information originate tree, even when not set via CLI so we
+    # need to check this first and probably drop that key.
+    for interface in pim.get('interface', []):
+        # We need to reload the defaults on every pass b/c of
+        # hello-multiplier dependency on dead-interval
+        # If hello-multiplier is set, we need to remove the default from
+        # dead-interval.
+        if 'igmp' not in pim['interface'][interface]:
+            del default_values['interface'][interface]['igmp']
+
+    pim = config_dict_merge(default_values, pim)
+    return pim
+
+def verify(pim):
+    if not pim or 'deleted' in pim:
+        return None
+
+    if 'igmp_proxy_enabled' in pim:
+        raise ConfigError('IGMP proxy and PIM cannot be configured at the same time!')
+
+    if 'interface' not in pim:
+        raise ConfigError('PIM require defined interfaces!')
+
+    for interface, interface_config in pim['interface'].items():
+        verify_interface_exists(pim, interface)
+
+        # Check join group in reserved net
+        if 'igmp' in interface_config and 'join' in interface_config['igmp']:
+            for join_addr in interface_config['igmp']['join']:
+                if IPv4Address(join_addr) in IPv4Network(RESERVED_MC_NET):
+                    raise ConfigError(f'Groups within {RESERVED_MC_NET} are reserved and cannot be joined!')
+
+    if 'rp' in pim:
+        if 'address' not in pim['rp']:
+            raise ConfigError('PIM rendezvous point needs to be defined!')
+
+        # Check unique multicast groups
+        unique = []
+        pim_base_error = 'PIM rendezvous point group'
+        for address, address_config in pim['rp']['address'].items():
+            if 'group' not in address_config:
+                raise ConfigError(f'{pim_base_error} should be defined for "{address}"!')
+
+            # Check if it is a multicast group
+            for gr_addr in address_config['group']:
+                if not IPv4Network(gr_addr).is_multicast:
+                    raise ConfigError(f'{pim_base_error} "{gr_addr}" is not a multicast group!')
+                if gr_addr in unique:
+                    raise ConfigError(f'{pim_base_error} must be unique!')
+                unique.append(gr_addr)
+
+def generate(pim):
+    if not pim or 'deleted' in pim:
+        return None
+    pim['frr_pimd_config']  = render_to_string('frr/pimd.frr.j2', pim)
+    return None
+
+def apply(pim):
+    pim_daemon = 'pimd'
+    pim_pid = process_named_running(pim_daemon)
+
+    if not pim or 'deleted' in pim:
+        if 'deleted' in pim:
+            os.kill(int(pim_pid), SIGTERM)
+
+        return None
+
+    if not pim_pid:
+        call('/usr/lib/frr/pimd -d -F traditional --daemon -A 127.0.0.1')
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    frr_cfg.load_configuration(pim_daemon)
+    frr_cfg.modify_section(f'^ip pim')
+    frr_cfg.modify_section(f'^ip igmp')
+
+    for key in ['interface', 'interface_removed']:
+        if key not in pim:
+            continue
+        for interface in pim[key]:
+            frr_cfg.modify_section(f'^interface {interface}', stop_pattern='^exit', remove_stop_mark=True)
+
+    if 'frr_pimd_config' in pim:
+        frr_cfg.add_before(frr.default_add_before, pim['frr_pimd_config'])
+    frr_cfg.commit_configuration(pim_daemon)
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_pim6.py b/src/conf_mode/protocols_pim6.py
new file mode 100644
index 0000000..581ffe2
--- /dev/null
+++ b/src/conf_mode/protocols_pim6.py
@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from ipaddress import IPv6Address
+from ipaddress import IPv6Network
+from sys import exit
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configdict import node_changed
+from vyos.configverify import verify_interface_exists
+from vyos.template import render_to_string
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['protocols', 'pim6']
+    pim6 = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 get_first_key=True, with_recursive_defaults=True)
+
+    # FRR has VRF support for different routing daemons. As interfaces belong
+    # to VRFs - or the global VRF, we need to check for changed interfaces so
+    # that they will be properly rendered for the FRR config. Also this eases
+    # removal of interfaces from the running configuration.
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        pim6['interface_removed'] = list(interfaces_removed)
+
+    # Bail out early if configuration tree does no longer exist. this must
+    # be done after retrieving the list of interfaces to be removed.
+    if not conf.exists(base):
+        pim6.update({'deleted' : ''})
+        return pim6
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    default_values = conf.get_config_defaults(**pim6.kwargs, recursive=True)
+
+    pim6 = config_dict_merge(default_values, pim6)
+    return pim6
+
+def verify(pim6):
+    if not pim6 or 'deleted' in pim6:
+        return
+
+    for interface, interface_config in pim6.get('interface', {}).items():
+        verify_interface_exists(pim6, interface)
+        if 'mld' in interface_config:
+            mld = interface_config['mld']
+            for group in mld.get('join', {}).keys():
+                # Validate multicast group address
+                if not IPv6Address(group).is_multicast:
+                    raise ConfigError(f"{group} is not a multicast group")
+
+    if 'rp' in pim6:
+        if 'address' not in pim6['rp']:
+            raise ConfigError('PIM6 rendezvous point needs to be defined!')
+
+        # Check unique multicast groups
+        unique = []
+        pim_base_error = 'PIM6 rendezvous point group'
+
+        if {'address', 'prefix-list6'} <= set(pim6['rp']):
+            raise ConfigError(f'{pim_base_error} supports either address or a prefix-list!')
+
+        for address, address_config in pim6['rp']['address'].items():
+            if 'group' not in address_config:
+                raise ConfigError(f'{pim_base_error} should be defined for "{address}"!')
+
+            # Check if it is a multicast group
+            for gr_addr in address_config['group']:
+                if not IPv6Network(gr_addr).is_multicast:
+                    raise ConfigError(f'{pim_base_error} "{gr_addr}" is not a multicast group!')
+                if gr_addr in unique:
+                    raise ConfigError(f'{pim_base_error} must be unique!')
+                unique.append(gr_addr)
+
+def generate(pim6):
+    if not pim6 or 'deleted' in pim6:
+        return
+    pim6['new_frr_config'] = render_to_string('frr/pim6d.frr.j2', pim6)
+    return None
+
+def apply(pim6):
+    if pim6 is None:
+        return
+
+    pim6_daemon = 'pim6d'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    frr_cfg.load_configuration(pim6_daemon)
+
+    for key in ['interface', 'interface_removed']:
+        if key not in pim6:
+            continue
+        for interface in pim6[key]:
+            frr_cfg.modify_section(f'^interface {interface}', stop_pattern='^exit', remove_stop_mark=True)
+
+    if 'new_frr_config' in pim6:
+        frr_cfg.add_before(frr.default_add_before, pim6['new_frr_config'])
+    frr_cfg.commit_configuration(pim6_daemon)
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_rip.py b/src/conf_mode/protocols_rip.py
new file mode 100644
index 0000000..9afac54
--- /dev/null
+++ b/src/conf_mode/protocols_rip.py
@@ -0,0 +1,139 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
+from vyos.configverify import verify_common_route_maps
+from vyos.configverify import verify_access_list
+from vyos.configverify import verify_prefix_list
+from vyos.utils.dict import dict_search
+from vyos.template import render_to_string
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['protocols', 'rip']
+    rip = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+    # FRR has VRF support for different routing daemons. As interfaces belong
+    # to VRFs - or the global VRF, we need to check for changed interfaces so
+    # that they will be properly rendered for the FRR config. Also this eases
+    # removal of interfaces from the running configuration.
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        rip['interface_removed'] = list(interfaces_removed)
+
+    # Bail out early if configuration tree does not exist
+    if not conf.exists(base):
+        rip.update({'deleted' : ''})
+        return rip
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    rip = conf.merge_defaults(rip, recursive=True)
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['policy'])
+    # Merge policy dict into "regular" config dict
+    rip = dict_merge(tmp, rip)
+
+    return rip
+
+def verify(rip):
+    if not rip:
+        return None
+
+    verify_common_route_maps(rip)
+
+    acl_in = dict_search('distribute_list.access_list.in', rip)
+    if acl_in: verify_access_list(acl_in, rip)
+
+    acl_out = dict_search('distribute_list.access_list.out', rip)
+    if acl_out: verify_access_list(acl_out, rip)
+
+    prefix_list_in = dict_search('distribute_list.prefix-list.in', rip)
+    if prefix_list_in: verify_prefix_list(prefix_list_in, rip)
+
+    prefix_list_out = dict_search('distribute_list.prefix_list.out', rip)
+    if prefix_list_out: verify_prefix_list(prefix_list_out, rip)
+
+    if 'interface' in rip:
+        for interface, interface_options in rip['interface'].items():
+            if 'authentication' in interface_options:
+                if {'md5', 'plaintext_password'} <= set(interface_options['authentication']):
+                    raise ConfigError('Can not use both md5 and plaintext-password at the same time!')
+            if 'split_horizon' in interface_options:
+                if {'disable', 'poison_reverse'} <= set(interface_options['split_horizon']):
+                    raise ConfigError(f'You can not have "split-horizon poison-reverse" enabled ' \
+                                      f'with "split-horizon disable" for "{interface}"!')
+
+def generate(rip):
+    if not rip or 'deleted' in rip:
+        return None
+
+    rip['new_frr_config'] = render_to_string('frr/ripd.frr.j2', rip)
+    return None
+
+def apply(rip):
+    rip_daemon = 'ripd'
+    zebra_daemon = 'zebra'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # The route-map used for the FIB (zebra) is part of the zebra daemon
+    frr_cfg.load_configuration(zebra_daemon)
+    frr_cfg.modify_section('^ip protocol rip route-map [-a-zA-Z0-9.]+', stop_pattern='(\s|!)')
+    frr_cfg.commit_configuration(zebra_daemon)
+
+    frr_cfg.load_configuration(rip_daemon)
+    frr_cfg.modify_section('^key chain \S+', stop_pattern='^exit', remove_stop_mark=True)
+    frr_cfg.modify_section('^router rip', stop_pattern='^exit', remove_stop_mark=True)
+
+    for key in ['interface', 'interface_removed']:
+        if key not in rip:
+            continue
+        for interface in rip[key]:
+            frr_cfg.modify_section(f'^interface {interface}', stop_pattern='^exit', remove_stop_mark=True)
+
+    if 'new_frr_config' in rip:
+        frr_cfg.add_before(frr.default_add_before, rip['new_frr_config'])
+    frr_cfg.commit_configuration(rip_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_ripng.py b/src/conf_mode/protocols_ripng.py
new file mode 100644
index 0000000..23416ff
--- /dev/null
+++ b/src/conf_mode/protocols_ripng.py
@@ -0,0 +1,124 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configverify import verify_common_route_maps
+from vyos.configverify import verify_access_list
+from vyos.configverify import verify_prefix_list
+from vyos.utils.dict import dict_search
+from vyos.template import render_to_string
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['protocols', 'ripng']
+    ripng = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+    # Bail out early if configuration tree does not exist
+    if not conf.exists(base):
+        return ripng
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    ripng = conf.merge_defaults(ripng, recursive=True)
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['policy'])
+    # Merge policy dict into "regular" config dict
+    ripng = dict_merge(tmp, ripng)
+
+    return ripng
+
+def verify(ripng):
+    if not ripng:
+        return None
+
+    verify_common_route_maps(ripng)
+
+    acl_in = dict_search('distribute_list.access_list.in', ripng)
+    if acl_in: verify_access_list(acl_in, ripng, version='6')
+
+    acl_out = dict_search('distribute_list.access_list.out', ripng)
+    if acl_out: verify_access_list(acl_out, ripng, version='6')
+
+    prefix_list_in = dict_search('distribute_list.prefix_list.in', ripng)
+    if prefix_list_in: verify_prefix_list(prefix_list_in, ripng, version='6')
+
+    prefix_list_out = dict_search('distribute_list.prefix_list.out', ripng)
+    if prefix_list_out: verify_prefix_list(prefix_list_out, ripng, version='6')
+
+    if 'interface' in ripng:
+        for interface, interface_options in ripng['interface'].items():
+            if 'authentication' in interface_options:
+                if {'md5', 'plaintext_password'} <= set(interface_options['authentication']):
+                    raise ConfigError('Can not use both md5 and plaintext-password at the same time!')
+            if 'split_horizon' in interface_options:
+                if {'disable', 'poison_reverse'} <= set(interface_options['split_horizon']):
+                    raise ConfigError(f'You can not have "split-horizon poison-reverse" enabled ' \
+                                      f'with "split-horizon disable" for "{interface}"!')
+
+def generate(ripng):
+    if not ripng:
+        ripng['new_frr_config'] = ''
+        return None
+
+    ripng['new_frr_config'] = render_to_string('frr/ripngd.frr.j2', ripng)
+    return None
+
+def apply(ripng):
+    ripng_daemon = 'ripngd'
+    zebra_daemon = 'zebra'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # The route-map used for the FIB (zebra) is part of the zebra daemon
+    frr_cfg.load_configuration(zebra_daemon)
+    frr_cfg.modify_section('^ipv6 protocol ripng route-map [-a-zA-Z0-9.]+', stop_pattern='(\s|!)')
+    frr_cfg.commit_configuration(zebra_daemon)
+
+    frr_cfg.load_configuration(ripng_daemon)
+    frr_cfg.modify_section('key chain \S+', stop_pattern='^exit', remove_stop_mark=True)
+    frr_cfg.modify_section('interface \S+', stop_pattern='^exit', remove_stop_mark=True)
+    frr_cfg.modify_section('^router ripng', stop_pattern='^exit', remove_stop_mark=True)
+    if 'new_frr_config' in ripng:
+        frr_cfg.add_before(frr.default_add_before, ripng['new_frr_config'])
+    frr_cfg.commit_configuration(ripng_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_rpki.py b/src/conf_mode/protocols_rpki.py
new file mode 100644
index 0000000..a59ecf3
--- /dev/null
+++ b/src/conf_mode/protocols_rpki.py
@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from glob import glob
+from sys import exit
+
+from vyos.config import Config
+from vyos.pki import wrap_openssh_public_key
+from vyos.pki import wrap_openssh_private_key
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search_args
+from vyos.utils.file import write_file
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+rpki_ssh_key_base = '/run/frr/id_rpki'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['protocols', 'rpki']
+
+    rpki = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                get_first_key=True, with_pki=True)
+    # Bail out early if configuration tree does not exist
+    if not conf.exists(base):
+        rpki.update({'deleted' : ''})
+        return rpki
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    rpki = conf.merge_defaults(rpki, recursive=True)
+
+    return rpki
+
+def verify(rpki):
+    if not rpki:
+        return None
+
+    if 'cache' in rpki:
+        preferences = []
+        for peer, peer_config in rpki['cache'].items():
+            for mandatory in ['port', 'preference']:
+                if mandatory not in peer_config:
+                    raise ConfigError(f'RPKI cache "{peer}" {mandatory} must be defined!')
+
+            if 'preference' in peer_config:
+                preference = peer_config['preference']
+                if preference in preferences:
+                    raise ConfigError(f'RPKI cache with preference {preference} already configured!')
+                preferences.append(preference)
+
+            if 'ssh' in peer_config:
+                if 'username' not in peer_config['ssh']:
+                    raise ConfigError('RPKI+SSH requires username to be defined!')
+
+                if 'key' not in peer_config['ssh'] or 'openssh' not in rpki['pki']:
+                    raise ConfigError('RPKI+SSH requires key to be defined!')
+
+                if peer_config['ssh']['key'] not in rpki['pki']['openssh']:
+                    raise ConfigError('RPKI+SSH key not found on PKI subsystem!')
+
+    return None
+
+def generate(rpki):
+    for key in glob(f'{rpki_ssh_key_base}*'):
+        os.unlink(key)
+
+    if not rpki:
+        return
+
+    if 'cache' in rpki:
+        for cache, cache_config in rpki['cache'].items():
+            if 'ssh' in cache_config:
+                key_name = cache_config['ssh']['key']
+                public_key_data = dict_search_args(rpki['pki'], 'openssh', key_name, 'public', 'key')
+                public_key_type = dict_search_args(rpki['pki'], 'openssh', key_name, 'public', 'type')
+                private_key_data = dict_search_args(rpki['pki'], 'openssh', key_name, 'private', 'key')
+
+                cache_config['ssh']['public_key_file'] = f'{rpki_ssh_key_base}_{cache}.pub'
+                cache_config['ssh']['private_key_file'] = f'{rpki_ssh_key_base}_{cache}'
+
+                write_file(cache_config['ssh']['public_key_file'], wrap_openssh_public_key(public_key_data, public_key_type))
+                write_file(cache_config['ssh']['private_key_file'], wrap_openssh_private_key(private_key_data))
+
+    rpki['new_frr_config'] = render_to_string('frr/rpki.frr.j2', rpki)
+
+    return None
+
+def apply(rpki):
+    bgp_daemon = 'bgpd'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+    frr_cfg.load_configuration(bgp_daemon)
+    frr_cfg.modify_section('^rpki', stop_pattern='^exit', remove_stop_mark=True)
+    if 'new_frr_config' in rpki:
+        frr_cfg.add_before(frr.default_add_before, rpki['new_frr_config'])
+
+    frr_cfg.commit_configuration(bgp_daemon)
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_segment-routing.py b/src/conf_mode/protocols_segment-routing.py
new file mode 100644
index 0000000..b36c2ca
--- /dev/null
+++ b/src/conf_mode/protocols_segment-routing.py
@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import node_changed
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search
+from vyos.utils.system import sysctl_write
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['protocols', 'segment-routing']
+    sr = conf.get_config_dict(base, key_mangling=('-', '_'),
+                              get_first_key=True,
+                              no_tag_node_value_mangle=True,
+                              with_recursive_defaults=True)
+
+    # FRR has VRF support for different routing daemons. As interfaces belong
+    # to VRFs - or the global VRF, we need to check for changed interfaces so
+    # that they will be properly rendered for the FRR config. Also this eases
+    # removal of interfaces from the running configuration.
+    interfaces_removed = node_changed(conf, base + ['interface'])
+    if interfaces_removed:
+        sr['interface_removed'] = list(interfaces_removed)
+
+    import pprint
+    pprint.pprint(sr)
+    return sr
+
+def verify(sr):
+    if 'srv6' in sr:
+        srv6_enable = False
+        if 'interface' in sr:
+            for interface, interface_config in sr['interface'].items():
+                if 'srv6' in interface_config:
+                    srv6_enable = True
+                    break
+        if not srv6_enable:
+            raise ConfigError('SRv6 should be enabled on at least one interface!')
+    return None
+
+def generate(sr):
+    if not sr:
+        return None
+
+    sr['new_frr_config'] = render_to_string('frr/zebra.segment_routing.frr.j2', sr)
+    return None
+
+def apply(sr):
+    zebra_daemon = 'zebra'
+
+    if 'interface_removed' in sr:
+        for interface in sr['interface_removed']:
+            # Disable processing of IPv6-SR packets
+            sysctl_write(f'net.ipv6.conf.{interface}.seg6_enabled', '0')
+
+    if 'interface' in sr:
+        for interface, interface_config in sr['interface'].items():
+            # Accept or drop SR-enabled IPv6 packets on this interface
+            if 'srv6' in interface_config:
+                sysctl_write(f'net.ipv6.conf.{interface}.seg6_enabled', '1')
+                # Define HMAC policy for ingress SR-enabled packets on this interface
+                # It's a redundant check as HMAC has a default value - but better safe
+                # then sorry
+                tmp = dict_search('srv6.hmac', interface_config)
+                if tmp == 'accept':
+                    sysctl_write(f'net.ipv6.conf.{interface}.seg6_require_hmac', '0')
+                elif tmp == 'drop':
+                    sysctl_write(f'net.ipv6.conf.{interface}.seg6_require_hmac', '1')
+                elif tmp == 'ignore':
+                    sysctl_write(f'net.ipv6.conf.{interface}.seg6_require_hmac', '-1')
+            else:
+                sysctl_write(f'net.ipv6.conf.{interface}.seg6_enabled', '0')
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+    frr_cfg.load_configuration(zebra_daemon)
+    frr_cfg.modify_section(r'^segment-routing')
+    if 'new_frr_config' in sr:
+        frr_cfg.add_before(frr.default_add_before, sr['new_frr_config'])
+    frr_cfg.commit_configuration(zebra_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_static.py b/src/conf_mode/protocols_static.py
new file mode 100644
index 0000000..a237321
--- /dev/null
+++ b/src/conf_mode/protocols_static.py
@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+from sys import argv
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configdict import get_dhcp_interfaces
+from vyos.configdict import get_pppoe_interfaces
+from vyos.configverify import verify_common_route_maps
+from vyos.configverify import verify_vrf
+from vyos.template import render
+from vyos.template import render_to_string
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+config_file = '/etc/iproute2/rt_tables.d/vyos-static.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    vrf = None
+    if len(argv) > 1:
+        vrf = argv[1]
+
+    base_path = ['protocols', 'static']
+    # eqivalent of the C foo ? 'a' : 'b' statement
+    base = vrf and ['vrf', 'name', vrf, 'protocols', 'static'] or base_path
+    static = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True, no_tag_node_value_mangle=True)
+
+    # Assign the name of our VRF context
+    if vrf: static['vrf'] = vrf
+
+    # We also need some additional information from the config, prefix-lists
+    # and route-maps for instance. They will be used in verify().
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = conf.get_config_dict(['policy'])
+    # Merge policy dict into "regular" config dict
+    static = dict_merge(tmp, static)
+
+    # T3680 - get a list of all interfaces currently configured to use DHCP
+    tmp = get_dhcp_interfaces(conf, vrf)
+    if tmp: static.update({'dhcp' : tmp})
+    tmp = get_pppoe_interfaces(conf, vrf)
+    if tmp: static.update({'pppoe' : tmp})
+
+    return static
+
+def verify(static):
+    verify_common_route_maps(static)
+
+    for route in ['route', 'route6']:
+        # if there is no route(6) key in the dictionary we can immediately
+        # bail out early
+        if route not in static:
+            continue
+
+        # When leaking routes to other VRFs we must ensure that the destination
+        # VRF exists
+        for prefix, prefix_options in static[route].items():
+            # both the interface and next-hop CLI node can have a VRF subnode,
+            # thus we check this using a for loop
+            for type in ['interface', 'next_hop']:
+                if type in prefix_options:
+                    for interface, interface_config in prefix_options[type].items():
+                        verify_vrf(interface_config)
+
+            if {'blackhole', 'reject'} <= set(prefix_options):
+                raise ConfigError(f'Can not use both blackhole and reject for '\
+                                  'prefix "{prefix}"!')
+
+    return None
+
+def generate(static):
+    if not static:
+        return None
+
+    # Put routing table names in /etc/iproute2/rt_tables
+    render(config_file, 'iproute2/static.conf.j2', static)
+    static['new_frr_config'] = render_to_string('frr/staticd.frr.j2', static)
+    return None
+
+def apply(static):
+    static_daemon = 'staticd'
+
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+    frr_cfg.load_configuration(static_daemon)
+
+    if 'vrf' in static:
+        vrf = static['vrf']
+        frr_cfg.modify_section(f'^vrf {vrf}', stop_pattern='^exit-vrf', remove_stop_mark=True)
+    else:
+        frr_cfg.modify_section(r'^ip route .*')
+        frr_cfg.modify_section(r'^ipv6 route .*')
+
+    if 'new_frr_config' in static:
+        frr_cfg.add_before(frr.default_add_before, static['new_frr_config'])
+    frr_cfg.commit_configuration(static_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_static_arp.py b/src/conf_mode/protocols_static_arp.py
new file mode 100644
index 0000000..b141f11
--- /dev/null
+++ b/src/conf_mode/protocols_static_arp.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import node_changed
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['protocols', 'static', 'arp']
+    arp = conf.get_config_dict(base, get_first_key=True)
+
+    if 'interface' in arp:
+        for interface in arp['interface']:
+            tmp = node_changed(conf, base + ['interface', interface, 'address'], recursive=True)
+            if tmp: arp['interface'][interface].update({'address_old' : tmp})
+
+    return arp
+
+def verify(arp):
+    pass
+
+def generate(arp):
+    pass
+
+def apply(arp):
+    if not arp:
+        return None
+
+    if 'interface' in arp:
+        for interface, interface_config in arp['interface'].items():
+            # Delete old static ARP assignments first
+            if 'address_old' in interface_config:
+                for address in interface_config['address_old']:
+                    call(f'ip neigh del {address} dev {interface}')
+
+            # Add new static ARP entries to interface
+            if 'address' not in interface_config:
+                continue
+            for address, address_config in interface_config['address'].items():
+                mac = address_config['mac']
+                call(f'ip neigh replace {address} lladdr {mac} dev {interface}')
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_static_multicast.py b/src/conf_mode/protocols_static_multicast.py
new file mode 100644
index 0000000..d323ceb
--- /dev/null
+++ b/src/conf_mode/protocols_static_multicast.py
@@ -0,0 +1,135 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+
+from ipaddress import IPv4Address
+from sys import exit
+
+from vyos import ConfigError
+from vyos import frr
+from vyos.config import Config
+from vyos.template import render_to_string
+
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/tmp/static_mcast.frr'
+
+# Get configuration for static multicast route
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    mroute = {
+        'old_mroute' : {},
+        'mroute' : {}
+    }
+
+    base_path = "protocols static multicast"
+
+    if not (conf.exists(base_path) or conf.exists_effective(base_path)):
+        return None
+
+    conf.set_level(base_path)
+
+    # Get multicast effective routes
+    for route in conf.list_effective_nodes('route'):
+        mroute['old_mroute'][route] = {}
+        for next_hop in conf.list_effective_nodes('route {0} next-hop'.format(route)):
+            mroute['old_mroute'][route].update({
+                next_hop : conf.return_value('route {0} next-hop {1} distance'.format(route, next_hop))
+            })
+
+    # Get multicast effective interface-routes
+    for route in conf.list_effective_nodes('interface-route'):
+        if not route in  mroute['old_mroute']:
+            mroute['old_mroute'][route] = {}
+        for next_hop in conf.list_effective_nodes('interface-route {0} next-hop-interface'.format(route)):
+            mroute['old_mroute'][route].update({
+                next_hop : conf.return_value('interface-route {0} next-hop-interface {1} distance'.format(route, next_hop))
+            })
+
+    # Get multicast routes
+    for route in conf.list_nodes('route'):
+        mroute['mroute'][route] = {}
+        for next_hop in conf.list_nodes('route {0} next-hop'.format(route)):
+            mroute['mroute'][route].update({
+                next_hop : conf.return_value('route {0} next-hop {1} distance'.format(route, next_hop))
+            })
+
+    # Get multicast interface-routes
+    for route in conf.list_nodes('interface-route'):
+        if not route in  mroute['mroute']:
+            mroute['mroute'][route] = {}
+        for next_hop in conf.list_nodes('interface-route {0} next-hop-interface'.format(route)):
+            mroute['mroute'][route].update({
+                next_hop : conf.return_value('interface-route {0} next-hop-interface {1} distance'.format(route, next_hop))
+            })
+
+    return mroute
+
+def verify(mroute):
+    if mroute is None:
+        return None
+
+    for route in mroute['mroute']:
+        route = route.split('/')
+        if IPv4Address(route[0]) < IPv4Address('224.0.0.0'):
+            raise ConfigError(route + " not a multicast network")
+
+
+def generate(mroute):
+    if mroute is None:
+        return None
+
+    mroute['new_frr_config'] = render_to_string('frr/static_mcast.frr.j2', mroute)
+    return None
+
+
+def apply(mroute):
+    if mroute is None:
+        return None
+    static_daemon = 'staticd'
+
+    frr_cfg = frr.FRRConfig()
+    frr_cfg.load_configuration(static_daemon)
+
+    if 'old_mroute' in mroute:
+        for route_gr in mroute['old_mroute']:
+            for nh in mroute['old_mroute'][route_gr]:
+                if mroute['old_mroute'][route_gr][nh]:
+                    frr_cfg.modify_section(f'^ip mroute {route_gr} {nh} {mroute["old_mroute"][route_gr][nh]}')
+                else:
+                    frr_cfg.modify_section(f'^ip mroute {route_gr} {nh}')
+
+    if 'new_frr_config' in mroute:
+        frr_cfg.add_before(frr.default_add_before, mroute['new_frr_config'])
+
+    frr_cfg.commit_configuration(static_daemon)
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_static_neighbor-proxy.py b/src/conf_mode/protocols_static_neighbor-proxy.py
new file mode 100644
index 0000000..8a1ea1d
--- /dev/null
+++ b/src/conf_mode/protocols_static_neighbor-proxy.py
@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['protocols', 'static', 'neighbor-proxy']
+    config = conf.get_config_dict(base, get_first_key=True)
+
+    return config
+
+def verify(config):
+    if 'arp' in config:
+        for neighbor, neighbor_conf in config['arp'].items():
+            if 'interface' not in neighbor_conf:
+                raise ConfigError(
+                    f"ARP neighbor-proxy for '{neighbor}' requires an interface to be set!"
+                )
+
+    if 'nd' in config:
+        for neighbor, neighbor_conf in config['nd'].items():
+            if 'interface' not in neighbor_conf:
+                raise ConfigError(
+                    f"ARP neighbor-proxy for '{neighbor}' requires an interface to be set!"
+                )
+
+def generate(config):
+    pass
+
+def apply(config):
+    if not config:
+        # Cleanup proxy
+        call('ip neighbor flush proxy')
+        call('ip -6 neighbor flush proxy')
+        return None
+
+    # Add proxy ARP
+    if 'arp' in config:
+        # Cleanup entries before config
+        call('ip neighbor flush proxy')
+        for neighbor, neighbor_conf in config['arp'].items():
+            for interface in neighbor_conf.get('interface'):
+                call(f'ip neighbor add proxy {neighbor} dev {interface}')
+
+    # Add proxy NDP
+    if 'nd' in config:
+        # Cleanup entries before config
+        call('ip -6 neighbor flush proxy')
+        for neighbor, neighbor_conf in config['nd'].items():
+            for interface in neighbor_conf['interface']:
+                call(f'ip -6 neighbor add proxy {neighbor} dev {interface}')
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/qos.py b/src/conf_mode/qos.py
new file mode 100644
index 0000000..7dfad31
--- /dev/null
+++ b/src/conf_mode/qos.py
@@ -0,0 +1,332 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+from netifaces import interfaces
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
+from vyos.configdict import dict_merge
+from vyos.configverify import verify_interface_exists
+from vyos.ifconfig import Section
+from vyos.qos import CAKE
+from vyos.qos import DropTail
+from vyos.qos import FairQueue
+from vyos.qos import FQCodel
+from vyos.qos import Limiter
+from vyos.qos import NetEm
+from vyos.qos import Priority
+from vyos.qos import RandomDetect
+from vyos.qos import RateLimiter
+from vyos.qos import RoundRobin
+from vyos.qos import TrafficShaper
+from vyos.qos import TrafficShaperHFSC
+from vyos.utils.dict import dict_search_recursive
+from vyos.utils.process import run
+from vyos import ConfigError
+from vyos import airbag
+from vyos.xml_ref import relative_defaults
+
+
+airbag.enable()
+
+map_vyops_tc = {
+    'cake'             : CAKE,
+    'drop_tail'        : DropTail,
+    'fair_queue'       : FairQueue,
+    'fq_codel'         : FQCodel,
+    'limiter'          : Limiter,
+    'network_emulator' : NetEm,
+    'priority_queue'   : Priority,
+    'random_detect'    : RandomDetect,
+    'rate_control'     : RateLimiter,
+    'round_robin'      : RoundRobin,
+    'shaper'           : TrafficShaper,
+    'shaper_hfsc'      : TrafficShaperHFSC,
+}
+
+def get_shaper(qos, interface_config, direction):
+    policy_name = interface_config[direction]
+    # An interface might have a QoS configuration, search the used
+    # configuration referenced by this. Path will hold the dict element
+    # referenced by the config, as this will be of sort:
+    #
+    # ['policy', 'drop_tail', 'foo-dtail'] <- we are only interested in
+    # drop_tail as the policy/shaper type
+    _, path = next(dict_search_recursive(qos, policy_name))
+    shaper_type = path[1]
+    shaper_config = qos['policy'][shaper_type][policy_name]
+
+    return (map_vyops_tc[shaper_type], shaper_config)
+
+
+def _clean_conf_dict(conf):
+    """
+    Delete empty nodes from config e.g.
+        match ADDRESS30 {
+            ip {
+                source {}
+            }
+        }
+    """
+    if isinstance(conf, dict):
+        return {node: _clean_conf_dict(val) for node, val in conf.items() if val != {} and _clean_conf_dict(val) != {}}
+    else:
+        return conf
+
+
+def _get_group_filters(config: dict, group_name: str, visited=None) -> dict:
+    filters = dict()
+    if not visited:
+        visited = [group_name, ]
+    else:
+        if group_name in visited:
+            return filters
+        visited.append(group_name)
+
+    for filter, filter_config in config.get(group_name, {}).items():
+        if filter == 'match':
+            for match, match_config in filter_config.items():
+               filters[f'{group_name}-{match}'] = match_config
+        elif filter == 'match_group':
+            for group in filter_config:
+                filters.update(_get_group_filters(config, group, visited))
+
+    return filters
+
+
+def _get_group_match(config:dict, group_name:str) -> dict:
+    match = dict()
+    for key, val in _get_group_filters(config, group_name).items():
+        # delete duplicate matches
+        if val not in match.values():
+            match[key] = val
+
+    return match
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['qos']
+    if not conf.exists(base):
+        return None
+
+    qos = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True,
+                               no_tag_node_value_mangle=True)
+
+    for ifname in interfaces():
+        if_node = Section.get_config_path(ifname)
+
+        if not if_node:
+            continue
+
+        path = f'interfaces {if_node}'
+        if conf.exists(f'{path} mirror') or conf.exists(f'{path} redirect'):
+            type_node = path.split(" ")[1] # return only interface type node
+            set_dependents(type_node, conf, ifname.split(".")[0])
+
+    for policy in qos.get('policy', []):
+        if policy in ['random_detect']:
+            for rd_name in list(qos['policy'][policy]):
+                # There are eight precedence levels - ensure all are present
+                # to be filled later down with the appropriate default values
+                default_p_val = relative_defaults(
+                    ['qos', 'policy', 'random-detect', rd_name, 'precedence'],
+                    {'precedence': {'0': {}}},
+                    get_first_key=True, recursive=True
+                )['0']
+                default_p_val = {key.replace('-', '_'): value for key, value in default_p_val.items()}
+                default_precedence = {
+                    'precedence': {'0': default_p_val, '1': default_p_val,
+                                   '2': default_p_val, '3': default_p_val,
+                                   '4': default_p_val, '5': default_p_val,
+                                   '6': default_p_val, '7': default_p_val}}
+
+                qos['policy']['random_detect'][rd_name] = dict_merge(
+                    default_precedence, qos['policy']['random_detect'][rd_name])
+
+    qos = conf.merge_defaults(qos, recursive=True)
+
+    if 'traffic_match_group' in qos:
+        for group, group_config in qos['traffic_match_group'].items():
+            if 'match_group' in group_config:
+                qos['traffic_match_group'][group]['match'] = _get_group_match(qos['traffic_match_group'], group)
+
+    for policy in qos.get('policy', []):
+        for p_name, p_config in qos['policy'][policy].items():
+            # cleanup empty match config
+            if 'class' in p_config:
+                for cls, cls_config in p_config['class'].items():
+                    if 'match_group' in cls_config:
+                        # merge group match to match
+                        for group in cls_config['match_group']:
+                            for match, match_conf in qos['traffic_match_group'].get(group, {'match': {}})['match'].items():
+                                if 'match' not in cls_config:
+                                    cls_config['match'] = dict()
+                                if match in cls_config['match']:
+                                    cls_config['match'][f'{group}-{match}'] = match_conf
+                                else:
+                                    cls_config['match'][match] = match_conf
+
+                    if 'match' in cls_config:
+                        cls_config['match'] = _clean_conf_dict(cls_config['match'])
+                        if cls_config['match'] == {}:
+                            del cls_config['match']
+
+    return qos
+
+
+def _verify_match(cls_config: dict) -> None:
+    if 'match' in cls_config:
+        for match, match_config in cls_config['match'].items():
+            if {'ip', 'ipv6'} <= set(match_config):
+                raise ConfigError(
+                    f'Can not use both IPv6 and IPv4 in one match ({match})!')
+
+
+def _verify_match_group_exist(cls_config, qos):
+    if 'match_group' in cls_config:
+        for group in cls_config['match_group']:
+            if 'traffic_match_group' not in qos or group not in qos['traffic_match_group']:
+                Warning(f'Match group "{group}" does not exist!')
+
+
+def verify(qos):
+    if not qos or 'interface' not in qos:
+        return None
+
+    # network policy emulator
+    # reorder rerquires delay to be set
+    if 'policy' in qos:
+        for policy_type in qos['policy']:
+            for policy, policy_config in qos['policy'][policy_type].items():
+                # a policy with it's given name is only allowed to exist once
+                # on the system. This is because an interface selects a policy
+                # for ingress/egress traffic, and thus there can only be one
+                # policy with a given name.
+                #
+                # We check if the policy name occurs more then once - error out
+                # if this is true
+                counter = 0
+                for _, path in dict_search_recursive(qos['policy'], policy):
+                    counter += 1
+                    if counter > 1:
+                        raise ConfigError(f'Conflicting policy name "{policy}", already in use!')
+
+                if 'class' in policy_config:
+                    for cls, cls_config in policy_config['class'].items():
+                        # bandwidth is not mandatory for priority-queue - that is why this is on the exception list
+                        if 'bandwidth' not in cls_config and policy_type not in ['priority_queue', 'round_robin', 'shaper_hfsc']:
+                            raise ConfigError(f'Bandwidth must be defined for policy "{policy}" class "{cls}"!')
+                        _verify_match(cls_config)
+                        _verify_match_group_exist(cls_config, qos)
+                if policy_type in ['random_detect']:
+                    if 'precedence' in policy_config:
+                        for precedence, precedence_config in policy_config['precedence'].items():
+                            max_tr = int(precedence_config['maximum_threshold'])
+                            if {'maximum_threshold', 'minimum_threshold'} <= set(precedence_config):
+                                min_tr = int(precedence_config['minimum_threshold'])
+                                if min_tr >= max_tr:
+                                    raise ConfigError(f'Policy "{policy}" uses min-threshold "{min_tr}" >= max-threshold "{max_tr}"!')
+
+                            if {'maximum_threshold', 'queue_limit'} <= set(precedence_config):
+                                queue_lim = int(precedence_config['queue_limit'])
+                                if queue_lim < max_tr:
+                                    raise ConfigError(f'Policy "{policy}" uses queue-limit "{queue_lim}" < max-threshold "{max_tr}"!')
+                if policy_type in ['priority_queue']:
+                    if 'default' not in policy_config:
+                        raise ConfigError(f'Policy {policy} misses "default" class!')
+                if 'default' in policy_config:
+                    if 'bandwidth' not in policy_config['default'] and policy_type not in ['priority_queue', 'round_robin', 'shaper_hfsc']:
+                        raise ConfigError('Bandwidth not defined for default traffic!')
+
+    # we should check interface ingress/egress configuration after verifying that
+    # the policy name is used only once - this makes the logic easier!
+    for interface, interface_config in qos['interface'].items():
+        for direction in ['egress', 'ingress']:
+            # bail out early if shaper for given direction is not used at all
+            if direction not in interface_config:
+                continue
+
+            policy_name = interface_config[direction]
+            if 'policy' not in qos or list(dict_search_recursive(qos['policy'], policy_name)) == []:
+                raise ConfigError(f'Selected QoS policy "{policy_name}" does not exist!')
+
+            shaper_type, shaper_config = get_shaper(qos, interface_config, direction)
+            tmp = shaper_type(interface).get_direction()
+            if direction not in tmp:
+                raise ConfigError(f'Selected QoS policy on interface "{interface}" only supports "{tmp}"!')
+
+    if 'traffic_match_group' in qos:
+        for group, group_config in qos['traffic_match_group'].items():
+            _verify_match(group_config)
+            _verify_match_group_exist(group_config, qos)
+
+    return None
+
+
+def generate(qos):
+    if not qos or 'interface' not in qos:
+        return None
+
+    return None
+
+def apply(qos):
+    # Always delete "old" shapers first
+    for interface in interfaces():
+        # Ignore errors (may have no qdisc)
+        run(f'tc qdisc del dev {interface} parent ffff:')
+        run(f'tc qdisc del dev {interface} root')
+
+    call_dependents()
+
+    if not qos or 'interface' not in qos:
+        return None
+
+    for interface, interface_config in qos['interface'].items():
+        if not verify_interface_exists(qos, interface, state_required=True, warning_only=True):
+            # When shaper is bound to a dialup (e.g. PPPoE) interface it is
+            # possible that it is yet not availbale when to QoS code runs.
+            # Skip the configuration and inform the user via warning_only=True
+            continue
+
+        for direction in ['egress', 'ingress']:
+            # bail out early if shaper for given direction is not used at all
+            if direction not in interface_config:
+                continue
+
+            shaper_type, shaper_config = get_shaper(qos, interface_config, direction)
+            tmp = shaper_type(interface)
+            tmp.update(shaper_config, direction)
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_aws_glb.py b/src/conf_mode/service_aws_glb.py
new file mode 100644
index 0000000..d1ed5a0
--- /dev/null
+++ b/src/conf_mode/service_aws_glb.py
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+systemd_service = 'aws-gwlbtun.service'
+systemd_override = '/run/systemd/system/aws-gwlbtun.service.d/10-override.conf'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'aws', 'glb']
+    if not conf.exists(base):
+        return None
+
+    glb = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                      get_first_key=True,
+                                      no_tag_node_value_mangle=True)
+
+    return glb
+
+
+def verify(glb):
+    # bail out early - looks like removal from running config
+    if not glb:
+        return None
+
+
+def generate(glb):
+    if not glb:
+         return None
+
+    render(systemd_override, 'aws/override_aws_gwlbtun.conf.j2', glb)
+
+
+def apply(glb):
+    call('systemctl daemon-reload')
+    if not glb:
+        call(f'systemctl stop {systemd_service}')
+    else:
+        call(f'systemctl restart {systemd_service}')
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_broadcast-relay.py b/src/conf_mode/service_broadcast-relay.py
new file mode 100644
index 0000000..d359547
--- /dev/null
+++ b/src/conf_mode/service_broadcast-relay.py
@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2017-2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from glob import glob
+from netifaces import AF_INET
+from sys import exit
+
+from vyos.config import Config
+from vyos.configverify import verify_interface_exists
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.network import is_afi_configured
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file_base = r'/etc/default/udp-broadcast-relay'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'broadcast-relay']
+
+    relay = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+    return relay
+
+def verify(relay):
+    if not relay or 'disabled' in relay:
+        return None
+
+    for instance, config in relay.get('id', {}).items():
+        # we don't have to check this instance when it's disabled
+        if 'disabled' in config:
+            continue
+
+        # we certainly require a UDP port to listen to
+        if 'port' not in config:
+            raise ConfigError(f'Port number is mandatory for UDP broadcast relay "{instance}"')
+
+        # Relaying data without two interface is kinda senseless ...
+        if len(config.get('interface', [])) < 2:
+            raise ConfigError('At least two interfaces are required for UDP broadcast relay "{instance}"')
+
+        for interface in config.get('interface', []):
+            verify_interface_exists(relay, interface)
+            if not is_afi_configured(interface, AF_INET):
+                raise ConfigError(f'Interface "{interface}" has no IPv4 address configured!')
+
+    return None
+
+def generate(relay):
+    if not relay or 'disabled' in relay:
+        return None
+
+    for config in glob(config_file_base + '*'):
+        os.remove(config)
+
+    for instance, config in relay.get('id').items():
+        # we don't have to check this instance when it's disabled
+        if 'disabled' in config:
+            continue
+
+        config['instance'] = instance
+        render(config_file_base + instance, 'bcast-relay/udp-broadcast-relay.j2',
+               config)
+
+    return None
+
+def apply(relay):
+    # first stop all running services
+    call('systemctl stop udp-broadcast-relay@*.service')
+
+    if not relay or 'disable' in relay:
+        return None
+
+    # start only required service instances
+    for instance, config in relay.get('id').items():
+        # we don't have to check this instance when it's disabled
+        if 'disabled' in config:
+            continue
+
+        call(f'systemctl start udp-broadcast-relay@{instance}.service')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_config-sync.py b/src/conf_mode/service_config-sync.py
new file mode 100644
index 0000000..4b8a7f6
--- /dev/null
+++ b/src/conf_mode/service_config-sync.py
@@ -0,0 +1,105 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import json
+from pathlib import Path
+
+from vyos.config import Config
+from vyos import ConfigError
+from vyos import airbag
+
+airbag.enable()
+
+
+service_conf = Path(f'/run/config_sync_conf.conf')
+post_commit_dir = '/run/scripts/commit/post-hooks.d'
+post_commit_file_src = '/usr/libexec/vyos/vyos_config_sync.py'
+post_commit_file = f'{post_commit_dir}/vyos_config_sync'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['service', 'config-sync']
+    if not conf.exists(base):
+        return None
+    config = conf.get_config_dict(base, get_first_key=True,
+                                  with_recursive_defaults=True)
+
+    return config
+
+
+def verify(config):
+    # bail out early - looks like removal from running config
+    if not config:
+        return None
+
+    if 'mode' not in config:
+        raise ConfigError(f'config-sync mode is mandatory!')
+
+    for option in ['secondary', 'section']:
+        if option not in config:
+            raise ConfigError(f"config-sync '{option}' is not configured!")
+
+    if 'address' not in config['secondary']:
+        raise ConfigError(f'secondary address is mandatory!')
+    if 'key' not in config['secondary']:
+        raise ConfigError(f'secondary key is mandatory!')
+
+
+def generate(config):
+    if not config:
+
+        if os.path.exists(post_commit_file):
+            os.unlink(post_commit_file)
+
+        if service_conf.exists():
+            service_conf.unlink()
+
+        return None
+
+    # Write configuration file
+    conf_json = json.dumps(config, indent=4)
+    service_conf.write_text(conf_json)
+
+    # Create post commit dir
+    if not os.path.isdir(post_commit_dir):
+        os.makedirs(post_commit_dir)
+
+    # Symlink from helpers to post-commit
+    if not os.path.exists(post_commit_file):
+        os.symlink(post_commit_file_src, post_commit_file)
+
+    return None
+
+
+def apply(config):
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_conntrack-sync.py b/src/conf_mode/service_conntrack-sync.py
new file mode 100644
index 0000000..3a233a1
--- /dev/null
+++ b/src/conf_mode/service_conntrack-sync.py
@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from vyos.config import Config
+from vyos.configverify import verify_interface_exists
+from vyos.utils.dict import dict_search
+from vyos.utils.process import process_named_running
+from vyos.utils.file import read_file
+from vyos.utils.process import call
+from vyos.utils.process import run
+from vyos.template import render
+from vyos.template import get_ipv4
+from vyos.utils.network import is_addr_assigned
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = '/run/conntrackd/conntrackd.conf'
+
+def resync_vrrp():
+    tmp = run('/usr/libexec/vyos/conf_mode/high-availability.py')
+    if tmp > 0:
+        print('ERROR: error restarting VRRP daemon!')
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'conntrack-sync']
+    if not conf.exists(base):
+        return None
+
+    conntrack = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                     get_first_key=True, with_defaults=True)
+
+    conntrack['hash_size'] = read_file('/sys/module/nf_conntrack/parameters/hashsize')
+    conntrack['table_size'] = read_file('/proc/sys/net/netfilter/nf_conntrack_max')
+
+    conntrack['vrrp'] = conf.get_config_dict(['high-availability', 'vrrp', 'sync-group'],
+                                     get_first_key=True)
+
+    return conntrack
+
+def verify(conntrack):
+    if not conntrack:
+        return None
+
+    if 'interface' not in conntrack:
+        raise ConfigError('Interface not defined!')
+
+    has_peer = False
+    for interface, interface_config in conntrack['interface'].items():
+        verify_interface_exists(conntrack, interface)
+        # Interface must not only exist, it must also carry an IP address
+        if len(get_ipv4(interface)) < 1:
+            raise ConfigError(f'Interface {interface} requires an IP address!')
+        if 'peer' in interface_config:
+            has_peer = True
+
+    # If one interface runs in unicast mode instead of multicast, so must all the
+    # others, else conntrackd will error out with: "cannot use UDP with other
+    # dedicated link protocols"
+    if has_peer:
+        for interface, interface_config in conntrack['interface'].items():
+            if 'peer' not in interface_config:
+                raise ConfigError('Can not mix unicast and multicast mode!')
+
+    if 'expect_sync' in conntrack:
+        if len(conntrack['expect_sync']) > 1 and 'all' in conntrack['expect_sync']:
+            raise ConfigError('Can not configure expect-sync "all" with other protocols!')
+
+    if 'listen_address' in conntrack:
+        for address in conntrack['listen_address']:
+            if not is_addr_assigned(address):
+                raise ConfigError(f'Specified listen-address {address} not assigned to any interface!')
+
+    vrrp_group = dict_search('failover_mechanism.vrrp.sync_group', conntrack)
+    if vrrp_group == None:
+        raise ConfigError(f'No VRRP sync-group defined!')
+    if vrrp_group not in conntrack['vrrp']:
+        raise ConfigError(f'VRRP sync-group {vrrp_group} not configured!')
+
+    return None
+
+def generate(conntrack):
+    if not conntrack:
+        if os.path.isfile(config_file):
+            os.unlink(config_file)
+        return None
+
+    render(config_file, 'conntrackd/conntrackd.conf.j2', conntrack)
+
+    return None
+
+def apply(conntrack):
+    systemd_service = 'conntrackd.service'
+    if not conntrack:
+        # Failover mechanism daemon should be indicated that it no longer needs
+        # to execute conntrackd actions on transition. This is only required
+        # once when conntrackd is stopped and taken out of service!
+        if process_named_running('conntrackd'):
+            resync_vrrp()
+
+        call(f'systemctl stop {systemd_service}')
+        return None
+
+    # Failover mechanism daemon should be indicated that it needs to execute
+    # conntrackd actions on transition. This is only required once when conntrackd
+    # is started the first time!
+    if not process_named_running('conntrackd'):
+        resync_vrrp()
+
+    call(f'systemctl reload-or-restart {systemd_service}')
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_console-server.py b/src/conf_mode/service_console-server.py
new file mode 100644
index 0000000..b112add
--- /dev/null
+++ b/src/conf_mode/service_console-server.py
@@ -0,0 +1,128 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from psutil import process_iter
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos import ConfigError
+
+config_file = '/run/conserver/conserver.cf'
+dropbear_systemd_file = '/run/systemd/system/dropbear@{port}.service.d/override.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'console-server']
+
+    # Retrieve CLI representation as dictionary
+    proxy = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 get_first_key=True)
+    # The retrieved dictionary will look something like this:
+    #
+    # {'device': {'usb0b2.4p1.0': {'speed': '9600'},
+    #             'usb0b2.4p1.1': {'data_bits': '8',
+    #                              'parity': 'none',
+    #                              'speed': '115200',
+    #                              'stop_bits': '2'}}}
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    proxy = conf.merge_defaults(proxy, recursive=True)
+
+    return proxy
+
+def verify(proxy):
+    if not proxy:
+        return None
+
+    aliases = []
+    processes = process_iter(['name', 'cmdline'])
+    if 'device' in proxy:
+        for device, device_config in proxy['device'].items():
+            for process in processes:
+                if 'agetty' in process.name() and device in process.cmdline():
+                    raise ConfigError(f'Port "{device}" already provides a '\
+                                      'console used by "system console"!')
+
+            if 'speed' not in device_config:
+                raise ConfigError(f'Port "{device}" requires speed to be set!')
+
+            if 'ssh' in device_config and 'port' not in device_config['ssh']:
+                raise ConfigError(f'Port "{device}" requires SSH port to be set!')
+
+            if 'alias' in device_config:
+                if device_config['alias'] in aliases:
+                    raise ConfigError("Console aliases must be unique")
+                else:
+                    aliases.append(device_config['alias'])
+
+    return None
+
+def generate(proxy):
+    if not proxy:
+        return None
+
+    render(config_file, 'conserver/conserver.conf.j2', proxy)
+    if 'device' in proxy:
+        for device, device_config in proxy['device'].items():
+            if 'ssh' not in device_config:
+                continue
+
+            tmp = {
+                'device' : device,
+                'port' : device_config['ssh']['port'],
+            }
+            render(dropbear_systemd_file.format(**tmp),
+                   'conserver/dropbear@.service.j2', tmp)
+
+    return None
+
+def apply(proxy):
+    call('systemctl daemon-reload')
+    call('systemctl stop dropbear@*.service conserver-server.service')
+
+    if not proxy:
+        if os.path.isfile(config_file):
+            os.unlink(config_file)
+        return None
+
+    call('systemctl restart conserver-server.service')
+
+    if 'device' in proxy:
+        for device, device_config in proxy['device'].items():
+            if 'ssh' not in device_config:
+                continue
+            port = device_config['ssh']['port']
+            call(f'systemctl restart dropbear@{port}.service')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_dhcp-relay.py b/src/conf_mode/service_dhcp-relay.py
new file mode 100644
index 0000000..37d7088
--- /dev/null
+++ b/src/conf_mode/service_dhcp-relay.py
@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2020 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.template import render
+from vyos.base import Warning
+from vyos.utils.process import call
+from vyos.utils.dict import dict_search
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/run/dhcp-relay/dhcrelay.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'dhcp-relay']
+    if not conf.exists(base):
+        return None
+
+    relay = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 get_first_key=True,
+                                 with_recursive_defaults=True)
+
+    return relay
+
+def verify(relay):
+    # bail out early - looks like removal from running config
+    if not relay or 'disable' in relay:
+        return None
+
+    if 'lo' in (dict_search('interface', relay) or []):
+        raise ConfigError('DHCP relay does not support the loopback interface.')
+
+    if 'server' not in relay :
+        raise ConfigError('No DHCP relay server(s) configured.\n' \
+                          'At least one DHCP relay server required.')
+
+    if 'interface' in relay:
+        Warning('DHCP relay interface is DEPRECATED - please use upstream-interface and listen-interface instead!')
+        if 'upstream_interface' in relay or 'listen_interface' in relay:
+            raise ConfigError('<interface> configuration is not compatible with upstream/listen interface')
+        else:
+            Warning('<interface> is going to be deprecated.\n'  \
+                    'Please use <listen-interface> and <upstream-interface>')
+
+    if 'upstream_interface' in relay and 'listen_interface' not in relay:
+        raise ConfigError('No listen-interface configured')
+    if 'listen_interface' in relay and 'upstream_interface' not in relay:
+        raise ConfigError('No upstream-interface configured')
+
+    return None
+
+def generate(relay):
+    # bail out early - looks like removal from running config
+    if not relay or 'disable' in relay:
+        return None
+
+    render(config_file, 'dhcp-relay/dhcrelay.conf.j2', relay)
+    return None
+
+def apply(relay):
+    # bail out early - looks like removal from running config
+    service_name = 'isc-dhcp-relay.service'
+    if not relay or 'disable' in relay:
+        call(f'systemctl stop {service_name}')
+        if os.path.exists(config_file):
+            os.unlink(config_file)
+        return None
+
+    call(f'systemctl restart {service_name}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_dhcp-server.py b/src/conf_mode/service_dhcp-server.py
new file mode 100644
index 0000000..e89448e
--- /dev/null
+++ b/src/conf_mode/service_dhcp-server.py
@@ -0,0 +1,430 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from glob import glob
+from ipaddress import ip_address
+from ipaddress import ip_network
+from netaddr import IPRange
+from sys import exit
+
+from vyos.config import Config
+from vyos.pki import wrap_certificate
+from vyos.pki import wrap_private_key
+from vyos.template import render
+from vyos.utils.dict import dict_search
+from vyos.utils.dict import dict_search_args
+from vyos.utils.file import chmod_775
+from vyos.utils.file import chown
+from vyos.utils.file import makedir
+from vyos.utils.file import write_file
+from vyos.utils.process import call
+from vyos.utils.network import interface_exists
+from vyos.utils.network import is_subnet_connected
+from vyos.utils.network import is_addr_assigned
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+ctrl_config_file = '/run/kea/kea-ctrl-agent.conf'
+ctrl_socket = '/run/kea/dhcp4-ctrl-socket'
+config_file = '/run/kea/kea-dhcp4.conf'
+lease_file = '/config/dhcp/dhcp4-leases.csv'
+lease_file_glob = '/config/dhcp/dhcp4-leases*'
+systemd_override = r'/run/systemd/system/kea-ctrl-agent.service.d/10-override.conf'
+user_group = '_kea'
+
+ca_cert_file = '/run/kea/kea-failover-ca.pem'
+cert_file = '/run/kea/kea-failover.pem'
+cert_key_file = '/run/kea/kea-failover-key.pem'
+
+def dhcp_slice_range(exclude_list, range_dict):
+    """
+    This function is intended to slice a DHCP range. What does it mean?
+
+    Lets assume we have a DHCP range from '192.0.2.1' to '192.0.2.100'
+    but want to exclude address '192.0.2.74' and '192.0.2.75'. We will
+    pass an input 'range_dict' in the format:
+      {'start' : '192.0.2.1', 'stop' : '192.0.2.100' }
+    and we will receive an output list of:
+      [{'start' : '192.0.2.1' , 'stop' : '192.0.2.73'  },
+       {'start' : '192.0.2.76', 'stop' : '192.0.2.100' }]
+    The resulting list can then be used in turn to build the proper dhcpd
+    configuration file.
+    """
+    output = []
+    # exclude list must be sorted for this to work
+    exclude_list = sorted(exclude_list)
+    range_start = range_dict['start']
+    range_stop = range_dict['stop']
+    range_last_exclude = ''
+
+    for e in exclude_list:
+        if (ip_address(e) >= ip_address(range_start)) and \
+           (ip_address(e) <= ip_address(range_stop)):
+            range_last_exclude = e
+
+    for e in exclude_list:
+        if (ip_address(e) >= ip_address(range_start)) and \
+           (ip_address(e) <= ip_address(range_stop)):
+
+            # Build new address range ending one address before exclude address
+            r = {
+                'start' : range_start,
+                'stop' : str(ip_address(e) -1)
+            }
+            # On the next run our address range will start one address after
+            # the exclude address
+            range_start = str(ip_address(e) + 1)
+
+            # on subsequent exclude addresses we can not
+            # append them to our output
+            if not (ip_address(r['start']) > ip_address(r['stop'])):
+                # Everything is fine, add range to result
+                output.append(r)
+
+            # Take care of last IP address range spanning from the last exclude
+            # address (+1) to the end of the initial configured range
+            if ip_address(e) == ip_address(range_last_exclude):
+                r = {
+                  'start': str(ip_address(e) + 1),
+                  'stop': str(range_stop)
+                }
+                if not (ip_address(r['start']) > ip_address(r['stop'])):
+                    output.append(r)
+        else:
+          # if the excluded address was not part of the range, we simply return
+          # the entire ranga again
+          if not range_last_exclude:
+              if range_dict not in output:
+                  output.append(range_dict)
+
+    return output
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'dhcp-server']
+    if not conf.exists(base):
+        return None
+
+    dhcp = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                no_tag_node_value_mangle=True,
+                                get_first_key=True,
+                                with_recursive_defaults=True)
+
+    if 'shared_network_name' in dhcp:
+        for network, network_config in dhcp['shared_network_name'].items():
+            if 'subnet' in network_config:
+                for subnet, subnet_config in network_config['subnet'].items():
+                    # If exclude IP addresses are defined we need to slice them out of
+                    # the defined ranges
+                    if {'exclude', 'range'} <= set(subnet_config):
+                        new_range_id = 0
+                        new_range_dict = {}
+                        for r, r_config in subnet_config['range'].items():
+                            for slice in dhcp_slice_range(subnet_config['exclude'], r_config):
+                                new_range_dict.update({new_range_id : slice})
+                                new_range_id +=1
+
+                        dhcp['shared_network_name'][network]['subnet'][subnet].update(
+                                {'range' : new_range_dict})
+
+    if len(dhcp['high_availability']) == 1:
+        ## only default value for mode is set, need to remove ha node
+        del dhcp['high_availability']
+    else:
+        if dict_search('high_availability.certificate', dhcp):
+            dhcp['pki'] = conf.get_config_dict(['pki'], key_mangling=('-', '_'), get_first_key=True, no_tag_node_value_mangle=True)
+
+    return dhcp
+
+def verify(dhcp):
+    # bail out early - looks like removal from running config
+    if not dhcp or 'disable' in dhcp:
+        return None
+
+    # If DHCP is enabled we need one share-network
+    if 'shared_network_name' not in dhcp:
+        raise ConfigError('No DHCP shared networks configured.\n' \
+                          'At least one DHCP shared network must be configured.')
+
+    # Inspect shared-network/subnet
+    listen_ok = False
+    subnets = []
+    shared_networks =  len(dhcp['shared_network_name'])
+    disabled_shared_networks = 0
+
+    subnet_ids = []
+
+    # A shared-network requires a subnet definition
+    for network, network_config in dhcp['shared_network_name'].items():
+        if 'disable' in network_config:
+            disabled_shared_networks += 1
+
+        if 'subnet' not in network_config:
+            raise ConfigError(f'No subnets defined for {network}. At least one\n' \
+                              'lease subnet must be configured.')
+
+        for subnet, subnet_config in network_config['subnet'].items():
+            if 'subnet_id' not in subnet_config:
+                raise ConfigError(f'Unique subnet ID not specified for subnet "{subnet}"')
+
+            if subnet_config['subnet_id'] in subnet_ids:
+                raise ConfigError(f'Subnet ID for subnet "{subnet}" is not unique')
+
+            subnet_ids.append(subnet_config['subnet_id'])
+
+            # All delivered static routes require a next-hop to be set
+            if 'static_route' in subnet_config:
+                for route, route_option in subnet_config['static_route'].items():
+                    if 'next_hop' not in route_option:
+                        raise ConfigError(f'DHCP static-route "{route}" requires router to be defined!')
+
+            # Check if DHCP address range is inside configured subnet declaration
+            if 'range' in subnet_config:
+                networks = []
+                for range, range_config in subnet_config['range'].items():
+                    if not {'start', 'stop'} <= set(range_config):
+                        raise ConfigError(f'DHCP range "{range}" start and stop address must be defined!')
+
+                    # Start/Stop address must be inside network
+                    for key in ['start', 'stop']:
+                        if ip_address(range_config[key]) not in ip_network(subnet):
+                            raise ConfigError(f'DHCP range "{range}" {key} address not within shared-network "{network}, {subnet}"!')
+
+                    # Stop address must be greater or equal to start address
+                    if ip_address(range_config['stop']) < ip_address(range_config['start']):
+                        raise ConfigError(f'DHCP range "{range}" stop address must be greater or equal\n' \
+                                          'to the ranges start address!')
+
+                    for network in networks:
+                        start = range_config['start']
+                        stop = range_config['stop']
+                        if start in network:
+                            raise ConfigError(f'Range "{range}" start address "{start}" already part of another range!')
+                        if stop in network:
+                            raise ConfigError(f'Range "{range}" stop address "{stop}" already part of another range!')
+
+                    tmp = IPRange(range_config['start'], range_config['stop'])
+                    networks.append(tmp)
+
+            # Exclude addresses must be in bound
+            if 'exclude' in subnet_config:
+                for exclude in subnet_config['exclude']:
+                    if ip_address(exclude) not in ip_network(subnet):
+                        raise ConfigError(f'Excluded IP address "{exclude}" not within shared-network "{network}, {subnet}"!')
+
+            # At least one DHCP address range or static-mapping required
+            if 'range' not in subnet_config and 'static_mapping' not in subnet_config:
+                raise ConfigError(f'No DHCP address range or active static-mapping configured\n' \
+                                  f'within shared-network "{network}, {subnet}"!')
+
+            if 'static_mapping' in subnet_config:
+                # Static mappings require just a MAC address (will use an IP from the dynamic pool if IP is not set)
+                used_ips = []
+                used_mac = []
+                used_duid = []
+                for mapping, mapping_config in subnet_config['static_mapping'].items():
+                    if 'ip_address' in mapping_config:
+                        if ip_address(mapping_config['ip_address']) not in ip_network(subnet):
+                            raise ConfigError(f'Configured static lease address for mapping "{mapping}" is\n' \
+                                              f'not within shared-network "{network}, {subnet}"!')
+
+                        if ('mac' not in mapping_config and 'duid' not in mapping_config) or \
+                            ('mac' in mapping_config and 'duid' in mapping_config):
+                            raise ConfigError(f'Either MAC address or Client identifier (DUID) is required for '
+                                              f'static mapping "{mapping}" within shared-network "{network}, {subnet}"!')
+
+                        if 'disable' not in mapping_config:
+                            if mapping_config['ip_address'] in used_ips:
+                                raise ConfigError(f'Configured IP address for static mapping "{mapping}" already exists on another static mapping')
+                            used_ips.append(mapping_config['ip_address'])
+
+                    if 'disable' not in mapping_config:
+                        if 'mac' in mapping_config:
+                            if mapping_config['mac'] in used_mac:
+                                raise ConfigError(f'Configured MAC address for static mapping "{mapping}" already exists on another static mapping')
+                            used_mac.append(mapping_config['mac'])
+
+                        if 'duid' in mapping_config:
+                            if mapping_config['duid'] in used_duid:
+                                raise ConfigError(f'Configured DUID for static mapping "{mapping}" already exists on another static mapping')
+                            used_duid.append(mapping_config['duid'])
+
+            # There must be one subnet connected to a listen interface.
+            # This only counts if the network itself is not disabled!
+            if 'disable' not in network_config:
+                if is_subnet_connected(subnet, primary=False):
+                    listen_ok = True
+
+            # Subnets must be non overlapping
+            if subnet in subnets:
+                raise ConfigError(f'Configured subnets must be unique! Subnet "{subnet}"\n'
+                                   'defined multiple times!')
+            subnets.append(subnet)
+
+            # Check for overlapping subnets
+            net = ip_network(subnet)
+            for n in subnets:
+                net2 = ip_network(n)
+                if (net != net2):
+                    if net.overlaps(net2):
+                        raise ConfigError(f'Conflicting subnet ranges: "{net}" overlaps "{net2}"!')
+
+    # Prevent 'disable' for shared-network if only one network is configured
+    if (shared_networks - disabled_shared_networks) < 1:
+        raise ConfigError(f'At least one shared network must be active!')
+
+    if 'high_availability' in dhcp:
+        for key in ['name', 'remote', 'source_address', 'status']:
+            if key not in dhcp['high_availability']:
+                tmp = key.replace('_', '-')
+                raise ConfigError(f'DHCP high-availability requires "{tmp}" to be specified!')
+
+        if len({'certificate', 'ca_certificate'} & set(dhcp['high_availability'])) == 1:
+            raise ConfigError(f'DHCP secured high-availability requires both certificate and CA certificate')
+
+        if 'certificate' in dhcp['high_availability']:
+            cert_name = dhcp['high_availability']['certificate']
+
+            if cert_name not in dhcp['pki']['certificate']:
+                raise ConfigError(f'Invalid certificate specified for DHCP high-availability')
+
+            if not dict_search_args(dhcp['pki']['certificate'], cert_name, 'certificate'):
+                raise ConfigError(f'Invalid certificate specified for DHCP high-availability')
+
+            if not dict_search_args(dhcp['pki']['certificate'], cert_name, 'private', 'key'):
+                raise ConfigError(f'Missing private key on certificate specified for DHCP high-availability')
+
+        if 'ca_certificate' in dhcp['high_availability']:
+            ca_cert_name = dhcp['high_availability']['ca_certificate']
+            if ca_cert_name not in dhcp['pki']['ca']:
+                raise ConfigError(f'Invalid CA certificate specified for DHCP high-availability')
+
+            if not dict_search_args(dhcp['pki']['ca'], ca_cert_name, 'certificate'):
+                raise ConfigError(f'Invalid CA certificate specified for DHCP high-availability')
+
+    for address in (dict_search('listen_address', dhcp) or []):
+        if is_addr_assigned(address, include_vrf=True):
+            listen_ok = True
+            # no need to probe further networks, we have one that is valid
+            continue
+        else:
+            raise ConfigError(f'listen-address "{address}" not configured on any interface')
+
+    if not listen_ok:
+        raise ConfigError('None of the configured subnets have an appropriate primary IP address on any\n'
+                          'broadcast interface configured, nor was there an explicit listen-address\n'
+                          'configured for serving DHCP relay packets!')
+
+    if 'listen_address' in dhcp and 'listen_interface' in dhcp:
+        raise ConfigError(f'Cannot define listen-address and listen-interface at the same time')
+
+    for interface in (dict_search('listen_interface', dhcp) or []):
+        if not interface_exists(interface):
+            raise ConfigError(f'listen-interface "{interface}" does not exist')
+
+    return None
+
+def generate(dhcp):
+    # bail out early - looks like removal from running config
+    if not dhcp or 'disable' in dhcp:
+        return None
+
+    dhcp['lease_file'] = lease_file
+    dhcp['machine'] = os.uname().machine
+
+    # Create directory for lease file if necessary
+    lease_dir = os.path.dirname(lease_file)
+    if not os.path.isdir(lease_dir):
+        makedir(lease_dir, group='vyattacfg')
+        chmod_775(lease_dir)
+
+    # Ensure correct permissions on lease files + backups
+    for file in glob(lease_file_glob):
+        chown(file, user=user_group, group='vyattacfg')
+
+    # Create lease file if necessary and let kea own it - 'kea-lfc' expects it that way
+    if not os.path.exists(lease_file):
+        write_file(lease_file, '', user=user_group, group=user_group, mode=0o644)
+
+    for f in [cert_file, cert_key_file, ca_cert_file]:
+        if os.path.exists(f):
+            os.unlink(f)
+
+    if 'high_availability' in dhcp:
+        if 'certificate' in dhcp['high_availability']:
+            cert_name = dhcp['high_availability']['certificate']
+            cert_data = dhcp['pki']['certificate'][cert_name]['certificate']
+            key_data = dhcp['pki']['certificate'][cert_name]['private']['key']
+            write_file(cert_file, wrap_certificate(cert_data), user=user_group, mode=0o600)
+            write_file(cert_key_file, wrap_private_key(key_data), user=user_group, mode=0o600)
+
+            dhcp['high_availability']['cert_file'] = cert_file
+            dhcp['high_availability']['cert_key_file'] = cert_key_file
+
+        if 'ca_certificate' in dhcp['high_availability']:
+            ca_cert_name = dhcp['high_availability']['ca_certificate']
+            ca_cert_data = dhcp['pki']['ca'][ca_cert_name]['certificate']
+            write_file(ca_cert_file, wrap_certificate(ca_cert_data), user=user_group, mode=0o600)
+
+            dhcp['high_availability']['ca_cert_file'] = ca_cert_file
+
+        render(systemd_override, 'dhcp-server/10-override.conf.j2', dhcp)
+
+    render(ctrl_config_file, 'dhcp-server/kea-ctrl-agent.conf.j2', dhcp, user=user_group, group=user_group)
+    render(config_file, 'dhcp-server/kea-dhcp4.conf.j2', dhcp, user=user_group, group=user_group)
+
+    return None
+
+def apply(dhcp):
+    services = ['kea-ctrl-agent', 'kea-dhcp4-server', 'kea-dhcp-ddns-server']
+
+    if not dhcp or 'disable' in dhcp:
+        for service in services:
+            call(f'systemctl stop {service}.service')
+
+        if os.path.exists(config_file):
+            os.unlink(config_file)
+
+        return None
+
+    for service in services:
+        action = 'restart'
+
+        if service == 'kea-dhcp-ddns-server' and 'dynamic_dns_update' not in dhcp:
+            action = 'stop'
+
+        if service == 'kea-ctrl-agent' and 'high_availability' not in dhcp:
+            action = 'stop'
+
+        call(f'systemctl {action} {service}.service')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_dhcpv6-relay.py b/src/conf_mode/service_dhcpv6-relay.py
new file mode 100644
index 0000000..6537ca3
--- /dev/null
+++ b/src/conf_mode/service_dhcpv6-relay.py
@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2020 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.ifconfig import Interface
+from vyos.template import render
+from vyos.template import is_ipv6
+from vyos.utils.process import call
+from vyos.utils.network import is_ipv6_link_local
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = '/run/dhcp-relay/dhcrelay6.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'dhcpv6-relay']
+    if not conf.exists(base):
+        return None
+
+    relay = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 get_first_key=True,
+                                 with_recursive_defaults=True)
+
+    return relay
+
+def verify(relay):
+    # bail out early - looks like removal from running config
+    if not relay or 'disable' in relay:
+        return None
+
+    if 'upstream_interface' not in relay:
+        raise ConfigError('At least one upstream interface required!')
+    for interface, config in relay['upstream_interface'].items():
+        if 'address' not in config:
+            raise ConfigError('DHCPv6 server required for upstream ' \
+                              f'interface {interface}!')
+
+    if 'listen_interface' not in relay:
+        raise ConfigError('At least one listen interface required!')
+
+    # DHCPv6 relay requires at least one global unicat address assigned to the
+    # interface
+    for interface in relay['listen_interface']:
+        has_global = False
+        for addr in Interface(interface).get_addr():
+            if is_ipv6(addr) and not is_ipv6_link_local(addr):
+                has_global = True
+        if not has_global:
+            raise ConfigError(f'Interface {interface} does not have global '\
+                              'IPv6 address assigned!')
+
+    return None
+
+def generate(relay):
+    # bail out early - looks like removal from running config
+    if not relay or 'disable' in relay:
+        return None
+
+    render(config_file, 'dhcp-relay/dhcrelay6.conf.j2', relay)
+    return None
+
+def apply(relay):
+    # bail out early - looks like removal from running config
+    service_name = 'isc-dhcp-relay6.service'
+    if not relay or 'disable' in relay:
+        # DHCPv6 relay support is removed in the commit
+        call(f'systemctl stop {service_name}')
+        if os.path.exists(config_file):
+            os.unlink(config_file)
+        return None
+
+    call(f'systemctl restart {service_name}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_dhcpv6-server.py b/src/conf_mode/service_dhcpv6-server.py
new file mode 100644
index 0000000..7af8800
--- /dev/null
+++ b/src/conf_mode/service_dhcpv6-server.py
@@ -0,0 +1,263 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from glob import glob
+from ipaddress import ip_address
+from ipaddress import ip_network
+from sys import exit
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.file import chmod_775
+from vyos.utils.file import chown
+from vyos.utils.file import makedir
+from vyos.utils.file import write_file
+from vyos.utils.dict import dict_search
+from vyos.utils.network import is_subnet_connected
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = '/run/kea/kea-dhcp6.conf'
+ctrl_socket = '/run/kea/dhcp6-ctrl-socket'
+lease_file = '/config/dhcp/dhcp6-leases.csv'
+lease_file_glob = '/config/dhcp/dhcp6-leases*'
+user_group = '_kea'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'dhcpv6-server']
+    if not conf.exists(base):
+        return None
+
+    dhcpv6 = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                  get_first_key=True,
+                                  no_tag_node_value_mangle=True)
+    return dhcpv6
+
+def verify(dhcpv6):
+    # bail out early - looks like removal from running config
+    if not dhcpv6 or 'disable' in dhcpv6:
+        return None
+
+    # If DHCP is enabled we need one share-network
+    if 'shared_network_name' not in dhcpv6:
+        raise ConfigError('No DHCPv6 shared networks configured. At least '\
+                          'one DHCPv6 shared network must be configured.')
+
+    # Inspect shared-network/subnet
+    subnets = []
+    subnet_ids = []
+    listen_ok = False
+    for network, network_config in dhcpv6['shared_network_name'].items():
+        # A shared-network requires a subnet definition
+        if 'subnet' not in network_config:
+            raise ConfigError(f'No DHCPv6 lease subnets configured for "{network}". '\
+                              'At least one lease subnet must be configured for '\
+                              'each shared network!')
+
+        for subnet, subnet_config in network_config['subnet'].items():
+            if 'subnet_id' not in subnet_config:
+                raise ConfigError(f'Unique subnet ID not specified for subnet "{subnet}"')
+
+            if subnet_config['subnet_id'] in subnet_ids:
+                raise ConfigError(f'Subnet ID for subnet "{subnet}" is not unique')
+
+            subnet_ids.append(subnet_config['subnet_id'])
+
+            if 'range' in subnet_config:
+                range6_start = []
+                range6_stop = []
+
+                for num, range_config in subnet_config['range'].items():
+                    if 'start' in range_config:
+                        start = range_config['start']
+
+                        if 'stop' not in range_config:
+                            raise ConfigError(f'Range stop address for start "{start}" is not defined!')
+                        stop = range_config['stop']
+
+                        # Start address must be inside network
+                        if not ip_address(start) in ip_network(subnet):
+                            raise ConfigError(f'Range start address "{start}" is not in subnet "{subnet}"!')
+
+                        # Stop address must be inside network
+                        if not ip_address(stop) in ip_network(subnet):
+                             raise ConfigError(f'Range stop address "{stop}" is not in subnet "{subnet}"!')
+
+                        # Stop address must be greater or equal to start address
+                        if not ip_address(stop) >= ip_address(start):
+                            raise ConfigError(f'Range stop address "{stop}" must be greater than or equal ' \
+                                              f'to the range start address "{start}"!')
+
+                        # DHCPv6 range start address must be unique - two ranges can't
+                        # start with the same address - makes no sense
+                        if start in range6_start:
+                            raise ConfigError(f'Conflicting DHCPv6 lease range: '\
+                                              f'Pool start address "{start}" defined multiple times!')
+
+                        range6_start.append(start)
+
+                        # DHCPv6 range stop address must be unique - two ranges can't
+                        # end with the same address - makes no sense
+                        if stop in range6_stop:
+                            raise ConfigError(f'Conflicting DHCPv6 lease range: '\
+                                              f'Pool stop address "{stop}" defined multiple times!')
+
+                        range6_stop.append(stop)
+
+                    if 'prefix' in range_config:
+                        prefix = range_config['prefix']
+
+                        if not ip_network(prefix).subnet_of(ip_network(subnet)):
+                            raise ConfigError(f'Range prefix "{prefix}" is not in subnet "{subnet}"')
+
+            # Prefix delegation sanity checks
+            if 'prefix_delegation' in subnet_config:
+                if 'prefix' not in subnet_config['prefix_delegation']:
+                    raise ConfigError('prefix-delegation prefix not defined!')
+
+                for prefix, prefix_config in subnet_config['prefix_delegation']['prefix'].items():
+                    if 'delegated_length' not in prefix_config:
+                        raise ConfigError(f'Delegated IPv6 prefix length for "{prefix}" '\
+                                          f'must be configured')
+
+                    if 'prefix_length' not in prefix_config:
+                        raise ConfigError('Length of delegated IPv6 prefix must be configured')
+
+                    if prefix_config['prefix_length'] > prefix_config['delegated_length']:
+                        raise ConfigError('Length of delegated IPv6 prefix must be within parent prefix')
+
+                    if 'excluded_prefix' in prefix_config:
+                        if 'excluded_prefix_length' not in prefix_config:
+                            raise ConfigError('Length of excluded IPv6 prefix must be configured')
+
+                        prefix_len = prefix_config['prefix_length']
+                        prefix_obj = ip_network(f'{prefix}/{prefix_len}')
+
+                        excluded_prefix = prefix_config['excluded_prefix']
+                        excluded_len = prefix_config['excluded_prefix_length']
+                        excluded_obj = ip_network(f'{excluded_prefix}/{excluded_len}')
+
+                        if excluded_len <= prefix_config['delegated_length']:
+                            raise ConfigError('Excluded IPv6 prefix must be smaller than delegated prefix')
+
+                        if not excluded_obj.subnet_of(prefix_obj):
+                            raise ConfigError(f'Excluded prefix "{excluded_prefix}" does not exist in the prefix')
+
+            # Static mappings don't require anything (but check if IP is in subnet if it's set)
+            if 'static_mapping' in subnet_config:
+                for mapping, mapping_config in subnet_config['static_mapping'].items():
+                    if 'ipv6_address' in mapping_config:
+                        # Static address must be in subnet
+                        if ip_address(mapping_config['ipv6_address']) not in ip_network(subnet):
+                            raise ConfigError(f'static-mapping address for mapping "{mapping}" is not in subnet "{subnet}"!')
+
+                        if ('mac' not in mapping_config and 'duid' not in mapping_config) or \
+                            ('mac' in mapping_config and 'duid' in mapping_config):
+                            raise ConfigError(f'Either MAC address or Client identifier (DUID) is required for '
+                                              f'static mapping "{mapping}" within shared-network "{network}, {subnet}"!')
+
+            if 'option' in subnet_config:
+                if 'vendor_option' in subnet_config['option']:
+                    if len(dict_search('option.vendor_option.cisco.tftp_server', subnet_config)) > 2:
+                        raise ConfigError(f'No more than two Cisco tftp-servers should be defined for subnet "{subnet}"!')
+
+            # Subnets must be unique
+            if subnet in subnets:
+                raise ConfigError(f'DHCPv6 subnets must be unique! Subnet {subnet} defined multiple times!')
+
+            subnets.append(subnet)
+
+        # DHCPv6 requires at least one configured address range or one static mapping
+        # (FIXME: is not actually checked right now?)
+
+        # There must be one subnet connected to a listen interface if network is not disabled.
+        if 'disable' not in network_config:
+            if is_subnet_connected(subnet):
+                listen_ok = True
+
+            # DHCPv6 subnet must not overlap. ISC DHCP also complains about overlapping
+            # subnets: "Warning: subnet 2001:db8::/32 overlaps subnet 2001:db8:1::/32"
+            net = ip_network(subnet)
+            for n in subnets:
+                net2 = ip_network(n)
+                if (net != net2):
+                    if net.overlaps(net2):
+                        raise ConfigError('DHCPv6 conflicting subnet ranges: {0} overlaps {1}'.format(net, net2))
+
+    if not listen_ok:
+        raise ConfigError('None of the DHCPv6 subnets are connected to a subnet6 on '\
+                          'this machine. At least one subnet6 must be connected such that '\
+                          'DHCPv6 listens on an interface!')
+
+
+    return None
+
+def generate(dhcpv6):
+    # bail out early - looks like removal from running config
+    if not dhcpv6 or 'disable' in dhcpv6:
+        return None
+
+    dhcpv6['lease_file'] = lease_file
+    dhcpv6['machine'] = os.uname().machine
+
+    # Create directory for lease file if necessary
+    lease_dir = os.path.dirname(lease_file)
+    if not os.path.isdir(lease_dir):
+        makedir(lease_dir, group='vyattacfg')
+        chmod_775(lease_dir)
+
+    # Ensure correct permissions on lease files + backups
+    for file in glob(lease_file_glob):
+        chown(file, user=user_group, group='vyattacfg')
+
+    # Create lease file if necessary and let kea own it - 'kea-lfc' expects it that way
+    if not os.path.exists(lease_file):
+        write_file(lease_file, '', user=user_group, group=user_group, mode=0o644)
+
+    render(config_file, 'dhcp-server/kea-dhcp6.conf.j2', dhcpv6, user=user_group, group=user_group)
+    return None
+
+def apply(dhcpv6):
+    # bail out early - looks like removal from running config
+    service_name = 'kea-dhcp6-server.service'
+    if not dhcpv6 or 'disable' in dhcpv6:
+        # DHCP server is removed in the commit
+        call(f'systemctl stop {service_name}')
+        if os.path.exists(config_file):
+            os.unlink(config_file)
+        return None
+
+    call(f'systemctl restart {service_name}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_dns_dynamic.py b/src/conf_mode/service_dns_dynamic.py
new file mode 100644
index 0000000..5f53038
--- /dev/null
+++ b/src/conf_mode/service_dns_dynamic.py
@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import re
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configverify import verify_interface_exists
+from vyos.configverify import dynamic_interface_pattern
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.network import interface_exists
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/run/ddclient/ddclient.conf'
+systemd_override = r'/run/systemd/system/ddclient.service.d/override.conf'
+
+# Protocols that require zone
+zone_necessary = ['cloudflare', 'digitalocean', 'godaddy', 'hetzner', 'gandi',
+                  'nfsn', 'nsupdate']
+zone_supported = zone_necessary + ['dnsexit2', 'zoneedit1']
+
+# Protocols that do not require username
+username_unnecessary = ['1984', 'cloudflare', 'cloudns', 'digitalocean', 'dnsexit2',
+                        'duckdns', 'freemyip', 'hetzner', 'keysystems', 'njalla',
+                        'nsupdate', 'regfishde']
+
+# Protocols that support TTL
+ttl_supported = ['cloudflare', 'dnsexit2', 'gandi', 'hetzner', 'godaddy', 'nfsn',
+                 'nsupdate']
+
+# Protocols that support both IPv4 and IPv6
+dualstack_supported = ['cloudflare', 'digitalocean', 'dnsexit2', 'duckdns',
+                       'dyndns2', 'easydns', 'freedns', 'hetzner', 'infomaniak',
+                       'njalla']
+
+# dyndns2 protocol in ddclient honors dual stack for selective servers
+# because of the way it is implemented in ddclient
+dyndns_dualstack_servers = ['members.dyndns.org', 'dynv6.com']
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['service', 'dns', 'dynamic']
+    if not conf.exists(base):
+        return None
+
+    dyndns = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                  no_tag_node_value_mangle=True,
+                                  get_first_key=True,
+                                  with_recursive_defaults=True)
+
+    dyndns['config_file'] = config_file
+    return dyndns
+
+def verify(dyndns):
+    # bail out early - looks like removal from running config
+    if not dyndns or 'name' not in dyndns:
+        return None
+
+    # Dynamic DNS service provider - configuration validation
+    for service, config in dyndns['name'].items():
+        error_msg_req = f'is required for Dynamic DNS service "{service}"'
+        error_msg_uns = f'is not supported for Dynamic DNS service "{service}"'
+
+        for field in ['protocol', 'address', 'host_name']:
+            if field not in config:
+                raise ConfigError(f'"{field.replace("_", "-")}" {error_msg_req}')
+
+        if not any(x in config['address'] for x in ['interface', 'web']):
+            raise ConfigError(f'Either "interface" or "web" {error_msg_req} '
+                              f'with protocol "{config["protocol"]}"')
+        if all(x in config['address'] for x in ['interface', 'web']):
+            raise ConfigError(f'Both "interface" and "web" at the same time {error_msg_uns} '
+                              f'with protocol "{config["protocol"]}"')
+
+        # If dyndns address is an interface, ensure that the interface exists
+        # and warn if a non-active dynamic interface is used
+        if 'interface' in config['address']:
+            tmp = re.compile(dynamic_interface_pattern)
+            # exclude check interface for dynamic interfaces
+            if tmp.match(config['address']['interface']):
+                if not interface_exists(config['address']['interface']):
+                    Warning(f'Interface "{config["address"]["interface"]}" does not exist yet and '
+                            f'cannot be used for Dynamic DNS service "{service}" until it is up!')
+            else:
+                verify_interface_exists(dyndns, config['address']['interface'])
+
+        if 'web' in config['address']:
+            # If 'skip' is specified, 'url' is required as well
+            if 'skip' in config['address']['web'] and 'url' not in config['address']['web']:
+                raise ConfigError(f'"url" along with "skip" {error_msg_req} '
+                                  f'with protocol "{config["protocol"]}"')
+            if 'url' in config['address']['web']:
+                # Warn if using checkip.dyndns.org, as it does not support HTTPS
+                # See: https://github.com/ddclient/ddclient/issues/597
+                if re.search("^(https?://)?checkip\.dyndns\.org", config['address']['web']['url']):
+                    Warning(f'"checkip.dyndns.org" does not support HTTPS requests for IP address '
+                            f'lookup. Please use a different IP address lookup service.')
+
+        # RFC2136 uses 'key' instead of 'password'
+        if config['protocol'] != 'nsupdate' and 'password' not in config:
+            raise ConfigError(f'"password" {error_msg_req}')
+
+        # Other RFC2136 specific configuration validation
+        if config['protocol'] == 'nsupdate':
+            if 'password' in config:
+                raise ConfigError(f'"password" {error_msg_uns} with protocol "{config["protocol"]}"')
+            for field in ['server', 'key']:
+                if field not in config:
+                    raise ConfigError(f'"{field}" {error_msg_req} with protocol "{config["protocol"]}"')
+
+        if config['protocol'] in zone_necessary and 'zone' not in config:
+            raise ConfigError(f'"zone" {error_msg_req} with protocol "{config["protocol"]}"')
+
+        if config['protocol'] not in zone_supported and 'zone' in config:
+            raise ConfigError(f'"zone" {error_msg_uns} with protocol "{config["protocol"]}"')
+
+        if config['protocol'] not in username_unnecessary and 'username' not in config:
+            raise ConfigError(f'"username" {error_msg_req} with protocol "{config["protocol"]}"')
+
+        if config['protocol'] not in ttl_supported and 'ttl' in config:
+            raise ConfigError(f'"ttl" {error_msg_uns} with protocol "{config["protocol"]}"')
+
+        if config['ip_version'] == 'both':
+            if config['protocol'] not in dualstack_supported:
+                raise ConfigError(f'Both IPv4 and IPv6 at the same time {error_msg_uns} '
+                                  f'with protocol "{config["protocol"]}"')
+            # dyndns2 protocol in ddclient honors dual stack only for dyn.com (dyndns.org)
+            if config['protocol'] == 'dyndns2' and 'server' in config and config['server'] not in dyndns_dualstack_servers:
+                raise ConfigError(f'Both IPv4 and IPv6 at the same time {error_msg_uns} '
+                                  f'for "{config["server"]}" with protocol "{config["protocol"]}"')
+
+        if {'wait_time', 'expiry_time'} <= config.keys() and int(config['expiry_time']) < int(config['wait_time']):
+                raise ConfigError(f'"expiry-time" must be greater than "wait-time" for '
+                                  f'Dynamic DNS service "{service}"')
+
+    return None
+
+def generate(dyndns):
+    # bail out early - looks like removal from running config
+    if not dyndns or 'name' not in dyndns:
+        return None
+
+    render(config_file, 'dns-dynamic/ddclient.conf.j2', dyndns, permission=0o600)
+    render(systemd_override, 'dns-dynamic/override.conf.j2', dyndns)
+    return None
+
+def apply(dyndns):
+    systemd_service = 'ddclient.service'
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+
+    # bail out early - looks like removal from running config
+    if not dyndns or 'name' not in dyndns:
+        call(f'systemctl stop {systemd_service}')
+        if os.path.exists(config_file):
+            os.unlink(config_file)
+    else:
+        call(f'systemctl reload-or-restart {systemd_service}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_dns_forwarding.py b/src/conf_mode/service_dns_forwarding.py
new file mode 100644
index 0000000..e3bdbc9
--- /dev/null
+++ b/src/conf_mode/service_dns_forwarding.py
@@ -0,0 +1,402 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from glob import glob
+
+from vyos.config import Config
+from vyos.hostsd_client import Client as hostsd_client
+from vyos.template import render
+from vyos.template import bracketize_ipv6
+from vyos.utils.network import interface_exists
+from vyos.utils.process import call
+from vyos.utils.permission import chown
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+pdns_rec_user_group = 'pdns'
+pdns_rec_run_dir = '/run/pdns-recursor'
+pdns_rec_lua_conf_file = f'{pdns_rec_run_dir}/recursor.conf.lua'
+pdns_rec_hostsd_lua_conf_file = f'{pdns_rec_run_dir}/recursor.vyos-hostsd.conf.lua'
+pdns_rec_hostsd_zones_file = f'{pdns_rec_run_dir}/recursor.forward-zones.conf'
+pdns_rec_config_file = f'{pdns_rec_run_dir}/recursor.conf'
+pdns_rec_systemd_override = '/run/systemd/system/pdns-recursor.service.d/override.conf'
+
+hostsd_tag = 'static'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'dns', 'forwarding']
+    if not conf.exists(base):
+        return None
+
+    dns = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               no_tag_node_value_mangle=True,
+                               get_first_key=True,
+                               with_recursive_defaults=True)
+
+    dns['config_file'] = pdns_rec_config_file
+    dns['config_dir'] = os.path.dirname(pdns_rec_config_file)
+
+    # some additions to the default dictionary
+    if 'system' in dns:
+        base_nameservers = ['system', 'name-server']
+        if conf.exists(base_nameservers):
+            dns.update({'system_name_server': conf.return_values(base_nameservers)})
+
+    if 'authoritative_domain' in dns:
+        dns['authoritative_zones'] = []
+        dns['authoritative_zone_errors'] = []
+        for node in dns['authoritative_domain']:
+            zonedata = dns['authoritative_domain'][node]
+            if ('disable' in zonedata) or (not 'records' in zonedata):
+                continue
+            zone = {
+                'name': node,
+                'file': "{}/zone.{}.conf".format(pdns_rec_run_dir, node),
+                'records': [],
+            }
+
+            recorddata = zonedata['records']
+
+            for rtype in [ 'a', 'aaaa', 'cname', 'mx', 'ns', 'ptr', 'txt', 'spf', 'srv', 'naptr' ]:
+                if rtype not in recorddata:
+                    continue
+                for subnode in recorddata[rtype]:
+                    if 'disable' in recorddata[rtype][subnode]:
+                        continue
+
+                    rdata = recorddata[rtype][subnode]
+
+                    if rtype in [ 'a', 'aaaa' ]:
+                        if not 'address' in rdata:
+                            dns['authoritative_zone_errors'].append(f'{subnode}.{node}: at least one address is required')
+                            continue
+
+                        if subnode == 'any':
+                            subnode = '*'
+
+                        for address in rdata['address']:
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': address
+                            })
+                    elif rtype in ['cname', 'ptr']:
+                        if not 'target' in rdata:
+                            dns['authoritative_zone_errors'].append(f'{subnode}.{node}: target is required')
+                            continue
+
+                        zone['records'].append({
+                            'name': subnode,
+                            'type': rtype.upper(),
+                            'ttl': rdata['ttl'],
+                            'value': '{}.'.format(rdata['target'])
+                        })
+                    elif rtype == 'ns':
+                        if not 'target' in rdata:
+                            dns['authoritative_zone_errors'].append(f'{subnode}.{node}: at least one target is required')
+                            continue
+
+                        for target in rdata['target']:
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': f'{target}.'
+                            })
+
+                    elif rtype == 'mx':
+                        if not 'server' in rdata:
+                            dns['authoritative_zone_errors'].append(f'{subnode}.{node}: at least one server is required')
+                            continue
+
+                        for servername in rdata['server']:
+                            serverdata = rdata['server'][servername]
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': '{} {}.'.format(serverdata['priority'], servername)
+                            })
+                    elif rtype == 'txt':
+                        if not 'value' in rdata:
+                            dns['authoritative_zone_errors'].append(f'{subnode}.{node}: at least one value is required')
+                            continue
+
+                        for value in rdata['value']:
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': "\"{}\"".format(value.replace("\"", "\\\""))
+                            })
+                    elif rtype == 'spf':
+                        if not 'value' in rdata:
+                            dns['authoritative_zone_errors'].append(f'{subnode}.{node}: value is required')
+                            continue
+
+                        zone['records'].append({
+                            'name': subnode,
+                            'type': rtype.upper(),
+                            'ttl': rdata['ttl'],
+                            'value': '"{}"'.format(rdata['value'].replace("\"", "\\\""))
+                        })
+                    elif rtype == 'srv':
+                        if not 'entry' in rdata:
+                            dns['authoritative_zone_errors'].append(f'{subnode}.{node}: at least one entry is required')
+                            continue
+
+                        for entryno in rdata['entry']:
+                            entrydata = rdata['entry'][entryno]
+                            if not 'hostname' in entrydata:
+                                dns['authoritative_zone_errors'].append(f'{subnode}.{node}: hostname is required for entry {entryno}')
+                                continue
+
+                            if not 'port' in entrydata:
+                                dns['authoritative_zone_errors'].append(f'{subnode}.{node}: port is required for entry {entryno}')
+                                continue
+
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': '{} {} {} {}.'.format(entrydata['priority'], entrydata['weight'], entrydata['port'], entrydata['hostname'])
+                            })
+                    elif rtype == 'naptr':
+                        if not 'rule' in rdata:
+                            dns['authoritative_zone_errors'].append(f'{subnode}.{node}: at least one rule is required')
+                            continue
+
+                        for ruleno in rdata['rule']:
+                            ruledata = rdata['rule'][ruleno]
+                            flags = ""
+                            if 'lookup-srv' in ruledata:
+                                flags += "S"
+                            if 'lookup-a' in ruledata:
+                                flags += "A"
+                            if 'resolve-uri' in ruledata:
+                                flags += "U"
+                            if 'protocol-specific' in ruledata:
+                                flags += "P"
+
+                            if 'order' in ruledata:
+                                order = ruledata['order']
+                            else:
+                                order = ruleno
+
+                            if 'regexp' in ruledata:
+                                regexp= ruledata['regexp'].replace("\"", "\\\"")
+                            else:
+                                regexp = ''
+
+                            if ruledata['replacement']:
+                                replacement = '{}.'.format(ruledata['replacement'])
+                            else:
+                                replacement = ''
+
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': '{} {} "{}" "{}" "{}" {}'.format(order, ruledata['preference'], flags, ruledata['service'], regexp, replacement)
+                            })
+
+            dns['authoritative_zones'].append(zone)
+
+    if 'zone_cache' in dns:
+        # convert refresh interval to sec:
+        for _, zone_conf in dns['zone_cache'].items():
+            if 'options' in zone_conf \
+                    and 'refresh' in zone_conf['options']:
+
+                if 'on_reload' in zone_conf['options']['refresh']:
+                    interval = 0
+                else:
+                    interval = zone_conf['options']['refresh']['interval']
+                zone_conf['options']['refresh']['interval'] = interval
+
+    return dns
+
+def verify(dns):
+    # bail out early - looks like removal from running config
+    if not dns:
+        return None
+
+    if 'listen_address' not in dns:
+        raise ConfigError('DNS forwarding requires a listen-address')
+
+    if 'allow_from' not in dns:
+        raise ConfigError('DNS forwarding requires an allow-from network')
+
+    # we can not use dict_search() when testing for domain servers
+    # as a domain will contains dot's which is out dictionary delimiter.
+    if 'domain' in dns:
+        for domain in dns['domain']:
+            if 'name_server' not in dns['domain'][domain]:
+                raise ConfigError(f'No server configured for domain {domain}!')
+
+    if 'dns64_prefix' in dns:
+        dns_prefix = dns['dns64_prefix'].split('/')[1]
+        # RFC 6147 requires prefix /96
+        if int(dns_prefix) != 96:
+            raise ConfigError('DNS 6to4 prefix must be of length /96')
+
+    if ('authoritative_zone_errors' in dns) and dns['authoritative_zone_errors']:
+        for error in dns['authoritative_zone_errors']:
+            print(error)
+        raise ConfigError('Invalid authoritative records have been defined')
+
+    if 'system' in dns:
+        if not 'system_name_server' in dns:
+            print('Warning: No "system name-server" configured')
+
+    if 'zone_cache' in dns:
+        for name, conf in dns['zone_cache'].items():
+            if ('source' not in conf) \
+                    or ('url' in conf['source'] and 'axfr' in conf['source']):
+                raise ConfigError(f'Invalid configuration for zone "{name}": '
+                                  f'Please select one source type "url" or "axfr".')
+
+    return None
+
+
+def generate(dns):
+    # bail out early - looks like removal from running config
+    if not dns:
+        return None
+
+    render(pdns_rec_systemd_override, 'dns-forwarding/override.conf.j2', dns)
+
+    render(pdns_rec_config_file, 'dns-forwarding/recursor.conf.j2', dns,
+           user=pdns_rec_user_group, group=pdns_rec_user_group)
+
+    render(pdns_rec_config_file, 'dns-forwarding/recursor.conf.j2', dns,
+           user=pdns_rec_user_group, group=pdns_rec_user_group)
+
+    render(pdns_rec_lua_conf_file, 'dns-forwarding/recursor.conf.lua.j2', dns,
+           user=pdns_rec_user_group, group=pdns_rec_user_group)
+
+    for zone_filename in glob(f'{pdns_rec_run_dir}/zone.*.conf'):
+        os.unlink(zone_filename)
+
+    if 'authoritative_zones' in dns:
+        for zone in dns['authoritative_zones']:
+            render(zone['file'], 'dns-forwarding/recursor.zone.conf.j2',
+                    zone, user=pdns_rec_user_group, group=pdns_rec_user_group)
+
+
+    # if vyos-hostsd didn't create its files yet, create them (empty)
+    for file in [pdns_rec_hostsd_lua_conf_file, pdns_rec_hostsd_zones_file]:
+        with open(file, 'a'):
+            pass
+        chown(file, user=pdns_rec_user_group, group=pdns_rec_user_group)
+
+    return None
+
+def apply(dns):
+    systemd_service = 'pdns-recursor.service'
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+
+    if not dns:
+        # DNS forwarding is removed in the commit
+        call(f'systemctl stop {systemd_service}')
+
+        if os.path.isfile(pdns_rec_config_file):
+            os.unlink(pdns_rec_config_file)
+
+        for zone_filename in glob(f'{pdns_rec_run_dir}/zone.*.conf'):
+            os.unlink(zone_filename)
+    else:
+        ### first apply vyos-hostsd config
+        hc = hostsd_client()
+
+        # add static nameservers to hostsd so they can be joined with other
+        # sources
+        hc.delete_name_servers([hostsd_tag])
+        if 'name_server' in dns:
+            # 'name_server' is of the form
+            # {'192.0.2.1': {'port': 53}, '2001:db8::1': {'port': 853}, ...}
+            # canonicalize them as ['192.0.2.1:53', '[2001:db8::1]:853', ...]
+            nslist = [(lambda h, p: f"{bracketize_ipv6(h)}:{p['port']}")(h, p)
+                      for (h, p) in dns['name_server'].items()]
+            hc.add_name_servers({hostsd_tag: nslist})
+
+        # delete all nameserver tags
+        hc.delete_name_server_tags_recursor(hc.get_name_server_tags_recursor())
+
+        ## add nameserver tags - the order determines the nameserver order!
+        # our own tag (static)
+        hc.add_name_server_tags_recursor([hostsd_tag])
+
+        if 'system' in dns:
+            hc.add_name_server_tags_recursor(['system'])
+        else:
+            hc.delete_name_server_tags_recursor(['system'])
+
+        # add dhcp nameserver tags for configured interfaces
+        if 'system_name_server' in dns:
+            for interface in dns['system_name_server']:
+                # system_name_server key contains both IP addresses and interface
+                # names (DHCP) to use DNS servers. We need to check if the
+                # value is an interface name - only if this is the case, add the
+                # interface based DNS forwarder.
+                if interface_exists(interface):
+                    hc.add_name_server_tags_recursor(['dhcp-' + interface,
+                                                      'dhcpv6-' + interface ])
+
+        # hostsd will generate the forward-zones file
+        # the list and keys() are required as get returns a dict, not list
+        hc.delete_forward_zones(list(hc.get_forward_zones().keys()))
+        if 'domain' in dns:
+            zones = dns['domain']
+            for domain in zones.keys():
+                # 'name_server' is of the form
+                # {'192.0.2.1': {'port': 53}, '2001:db8::1': {'port': 853}, ...}
+                # canonicalize them as ['192.0.2.1:53', '[2001:db8::1]:853', ...]
+                zones[domain]['name_server'] = [(lambda h, p: f"{bracketize_ipv6(h)}:{p['port']}")(h, p)
+                                                for (h, p) in zones[domain]['name_server'].items()]
+            hc.add_forward_zones(zones)
+
+        # hostsd generates NTAs for the authoritative zones
+        # the list and keys() are required as get returns a dict, not list
+        hc.delete_authoritative_zones(list(hc.get_authoritative_zones()))
+        if 'authoritative_zones' in dns:
+            hc.add_authoritative_zones(list(map(lambda zone: zone['name'], dns['authoritative_zones'])))
+
+        # call hostsd to generate forward-zones and its lua-config-file
+        hc.apply()
+
+        ### finally (re)start pdns-recursor
+        call(f'systemctl reload-or-restart {systemd_service}')
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_event-handler.py b/src/conf_mode/service_event-handler.py
new file mode 100644
index 0000000..5028ef5
--- /dev/null
+++ b/src/conf_mode/service_event-handler.py
@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import json
+from pathlib import Path
+
+from vyos.config import Config
+from vyos.utils.dict import dict_search
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+
+airbag.enable()
+
+service_name = 'vyos-event-handler'
+service_conf = Path(f'/run/{service_name}.conf')
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['service', 'event-handler', 'event']
+    config = conf.get_config_dict(base,
+                                  get_first_key=True,
+                                  no_tag_node_value_mangle=True)
+
+    return config
+
+
+def verify(config):
+    # bail out early - looks like removal from running config
+    if not config:
+        return None
+
+    for name, event_config in config.items():
+        if not dict_search('filter.pattern', event_config) or not dict_search(
+                'script.path', event_config):
+            raise ConfigError(
+                'Event-handler: both pattern and script path items are mandatory'
+            )
+
+        if dict_search('script.environment.message', event_config):
+            raise ConfigError(
+                'Event-handler: "message" environment variable is reserved for log message text'
+            )
+
+
+def generate(config):
+    if not config:
+        # Remove old config and return
+        service_conf.unlink(missing_ok=True)
+        return None
+
+    # Write configuration file
+    conf_json = json.dumps(config, indent=4)
+    service_conf.write_text(conf_json)
+
+    return None
+
+
+def apply(config):
+    if config:
+        call(f'systemctl restart {service_name}.service')
+    else:
+        call(f'systemctl stop {service_name}.service')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_https.py b/src/conf_mode/service_https.py
new file mode 100644
index 0000000..9e58b4c
--- /dev/null
+++ b/src/conf_mode/service_https.py
@@ -0,0 +1,221 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import socket
+import sys
+import json
+
+from time import sleep
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_pki_certificate
+from vyos.configverify import verify_pki_ca_certificate
+from vyos.configverify import verify_pki_dh_parameters
+from vyos.defaults import api_config_state
+from vyos.pki import wrap_certificate
+from vyos.pki import wrap_private_key
+from vyos.pki import wrap_dh_parameters
+from vyos.template import render
+from vyos.utils.dict import dict_search
+from vyos.utils.process import call
+from vyos.utils.process import is_systemd_service_active
+from vyos.utils.network import check_port_availability
+from vyos.utils.network import is_listen_port_bind_service
+from vyos.utils.file import write_file
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = '/etc/nginx/sites-enabled/default'
+systemd_override = r'/run/systemd/system/nginx.service.d/override.conf'
+cert_dir = '/run/nginx/certs'
+
+user = 'www-data'
+group = 'www-data'
+
+systemd_service_api = '/run/systemd/system/vyos-http-api.service'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['service', 'https']
+    if not conf.exists(base):
+        return None
+
+    https = conf.get_config_dict(base, get_first_key=True,
+                                 key_mangling=('-', '_'),
+                                 with_pki=True)
+
+    # store path to API config file for later use in templates
+    https['api_config_state'] = api_config_state
+    # get fully qualified system hsotname
+    https['hostname'] = socket.getfqdn()
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    default_values = conf.get_config_defaults(**https.kwargs, recursive=True)
+    if 'api' not in https or 'graphql' not in https['api']:
+        del default_values['api']
+
+    # merge CLI and default dictionary
+    https = config_dict_merge(default_values, https)
+    return https
+
+def verify(https):
+    if https is None:
+        return None
+
+    if dict_search('certificates.certificate', https) != None:
+        verify_pki_certificate(https, https['certificates']['certificate'])
+
+        tmp = dict_search('certificates.ca_certificate', https)
+        if tmp != None: verify_pki_ca_certificate(https, tmp)
+
+        tmp = dict_search('certificates.dh_params', https)
+        if tmp != None: verify_pki_dh_parameters(https, tmp, 2048)
+
+    else:
+        Warning('No certificate specified, using build-in self-signed certificates. '\
+                'Do not use them in a production environment!')
+
+    # Check if server port is already in use by a different appliaction
+    listen_address = ['0.0.0.0']
+    port = int(https['port'])
+    if 'listen_address' in https:
+        listen_address = https['listen_address']
+
+    for address in listen_address:
+        if not check_port_availability(address, port, 'tcp') and not is_listen_port_bind_service(port, 'nginx'):
+            raise ConfigError(f'TCP port "{port}" is used by another service!')
+
+    verify_vrf(https)
+
+    # Verify API server settings, if present
+    if 'api' in https:
+        keys = dict_search('api.keys.id', https)
+        gql_auth_type = dict_search('api.graphql.authentication.type', https)
+
+        # If "api graphql" is not defined and `gql_auth_type` is None,
+        # there's certainly no JWT auth option, and keys are required
+        jwt_auth = (gql_auth_type == "token")
+
+        # Check for incomplete key configurations in every case
+        valid_keys_exist = False
+        if keys:
+            for k in keys:
+                if 'key' not in keys[k]:
+                    raise ConfigError(f'Missing HTTPS API key string for key id "{k}"')
+                else:
+                    valid_keys_exist = True
+
+        # If only key-based methods are enabled,
+        # fail the commit if no valid key configurations are found
+        if (not valid_keys_exist) and (not jwt_auth):
+            raise ConfigError('At least one HTTPS API key is required unless GraphQL token authentication is enabled!')
+
+        if (not valid_keys_exist) and jwt_auth:
+            Warning(f'API keys are not configured: classic (non-GraphQL) API will be unavailable!')
+
+    return None
+
+def generate(https):
+    if https is None:
+        for file in [systemd_service_api, config_file, systemd_override]:
+            if os.path.exists(file):
+                os.unlink(file)
+        return None
+
+    if 'api' in https:
+        render(systemd_service_api, 'https/vyos-http-api.service.j2', https)
+        with open(api_config_state, 'w') as f:
+            json.dump(https['api'], f, indent=2)
+    else:
+        if os.path.exists(systemd_service_api):
+            os.unlink(systemd_service_api)
+
+    # get certificate data
+    if 'certificates' in https and 'certificate' in https['certificates']:
+        cert_name = https['certificates']['certificate']
+        pki_cert = https['pki']['certificate'][cert_name]
+
+        cert_path = os.path.join(cert_dir, f'{cert_name}_cert.pem')
+        key_path = os.path.join(cert_dir, f'{cert_name}_key.pem')
+
+        server_cert = str(wrap_certificate(pki_cert['certificate']))
+
+        # Append CA certificate if specified to form a full chain
+        if 'ca_certificate' in https['certificates']:
+            ca_cert = https['certificates']['ca_certificate']
+            server_cert += '\n' + str(wrap_certificate(https['pki']['ca'][ca_cert]['certificate']))
+
+        write_file(cert_path, server_cert, user=user, group=group, mode=0o644)
+        write_file(key_path, wrap_private_key(pki_cert['private']['key']),
+                    user=user, group=group, mode=0o600)
+
+        tmp_path = {'cert_path': cert_path, 'key_path': key_path}
+
+        if 'dh_params' in https['certificates']:
+            dh_name = https['certificates']['dh_params']
+            pki_dh = https['pki']['dh'][dh_name]
+            if 'parameters' in pki_dh:
+                dh_path = os.path.join(cert_dir, f'{dh_name}_dh.pem')
+                write_file(dh_path, wrap_dh_parameters(pki_dh['parameters']),
+                           user=user, group=group, mode=0o600)
+                tmp_path.update({'dh_file' : dh_path})
+
+        https['certificates'].update(tmp_path)
+
+    render(config_file, 'https/nginx.default.j2', https)
+    render(systemd_override, 'https/override.conf.j2', https)
+    return None
+
+def apply(https):
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+    http_api_service_name = 'vyos-http-api.service'
+    https_service_name = 'nginx.service'
+
+    if https is None:
+        if is_systemd_service_active(http_api_service_name):
+            call(f'systemctl stop {http_api_service_name}')
+        call(f'systemctl stop {https_service_name}')
+        return
+
+    if 'api' in https:
+        call(f'systemctl reload-or-restart {http_api_service_name}')
+        # Let uvicorn settle before (possibly) restarting nginx
+        sleep(1)
+    elif is_systemd_service_active(http_api_service_name):
+        call(f'systemctl stop {http_api_service_name}')
+
+    call(f'systemctl reload-or-restart {https_service_name}')
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/conf_mode/service_ids_ddos-protection.py b/src/conf_mode/service_ids_ddos-protection.py
new file mode 100644
index 0000000..276a71f
--- /dev/null
+++ b/src/conf_mode/service_ids_ddos-protection.py
@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/run/fastnetmon/fastnetmon.conf'
+networks_list = r'/run/fastnetmon/networks_list'
+excluded_networks_list = r'/run/fastnetmon/excluded_networks_list'
+attack_dir = '/var/log/fastnetmon_attacks'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'ids', 'ddos-protection']
+    if not conf.exists(base):
+        return None
+
+    fastnetmon = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                      get_first_key=True,
+                                      with_recursive_defaults=True)
+
+    return fastnetmon
+
+def verify(fastnetmon):
+    if not fastnetmon:
+        return None
+
+    if 'mode' not in fastnetmon:
+        raise ConfigError('Specify operating mode!')
+
+    if fastnetmon.get('mode') == 'mirror' and 'listen_interface' not in fastnetmon:
+        raise ConfigError("Incorrect settings for 'mode mirror': must specify interface(s) for traffic mirroring")
+
+    if fastnetmon.get('mode') == 'sflow' and 'listen_address' not in fastnetmon.get('sflow', {}):
+        raise ConfigError("Incorrect settings for 'mode sflow': must specify sFlow 'listen-address'")
+
+    if 'alert_script' in fastnetmon:
+        if os.path.isfile(fastnetmon['alert_script']):
+            # Check script permissions
+            if not os.access(fastnetmon['alert_script'], os.X_OK):
+                raise ConfigError('Script "{alert_script}" is not executable!'.format(fastnetmon['alert_script']))
+        else:
+           raise ConfigError('File "{alert_script}" does not exists!'.format(fastnetmon))
+
+def generate(fastnetmon):
+    if not fastnetmon:
+        for file in [config_file, networks_list]:
+            if os.path.isfile(file):
+                os.unlink(file)
+
+        return None
+
+    # Create dir for log attack details
+    if not os.path.exists(attack_dir):
+        os.mkdir(attack_dir)
+
+    render(config_file, 'ids/fastnetmon.j2', fastnetmon)
+    render(networks_list, 'ids/fastnetmon_networks_list.j2', fastnetmon)
+    render(excluded_networks_list, 'ids/fastnetmon_excluded_networks_list.j2', fastnetmon)
+    return None
+
+def apply(fastnetmon):
+    systemd_service = 'fastnetmon.service'
+    if not fastnetmon:
+        # Stop fastnetmon service if removed
+        call(f'systemctl stop {systemd_service}')
+    else:
+        call(f'systemctl reload-or-restart {systemd_service}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_ipoe-server.py b/src/conf_mode/service_ipoe-server.py
new file mode 100644
index 0000000..c7e3ef0
--- /dev/null
+++ b/src/conf_mode/service_ipoe-server.py
@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_accel_dict
+from vyos.configverify import verify_interface_exists
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.dict import dict_search
+from vyos.accel_ppp_util import get_pools_in_order
+from vyos.accel_ppp_util import verify_accel_ppp_name_servers
+from vyos.accel_ppp_util import verify_accel_ppp_wins_servers
+from vyos.accel_ppp_util import verify_accel_ppp_ip_pool
+from vyos.accel_ppp_util import verify_accel_ppp_authentication
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+
+ipoe_conf = '/run/accel-pppd/ipoe.conf'
+ipoe_chap_secrets = '/run/accel-pppd/ipoe.chap-secrets'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'ipoe-server']
+    if not conf.exists(base):
+        return None
+
+    # retrieve common dictionary keys
+    ipoe = get_accel_dict(conf, base, ipoe_chap_secrets)
+
+    if dict_search('client_ip_pool', ipoe):
+        # Multiple named pools require ordered values T5099
+        ipoe['ordered_named_pools'] = get_pools_in_order(dict_search('client_ip_pool', ipoe))
+
+    ipoe['server_type'] = 'ipoe'
+    return ipoe
+
+
+def verify(ipoe):
+    if not ipoe:
+        return None
+
+    if 'interface' not in ipoe:
+        raise ConfigError('No IPoE interface configured')
+
+    for interface, iface_config in ipoe['interface'].items():
+        verify_interface_exists(ipoe, interface, warning_only=True)
+        if 'client_subnet' in iface_config and 'vlan' in iface_config:
+            raise ConfigError('Option "client-subnet" and "vlan" are mutually exclusive, '
+                              'use "client-ip-pool" instead!')
+        if 'vlan_mon' in iface_config and not 'vlan' in iface_config:
+            raise ConfigError('Option "vlan-mon" requires "vlan" to be set!')
+
+    verify_accel_ppp_authentication(ipoe, local_users=False)
+    verify_accel_ppp_ip_pool(ipoe)
+    verify_accel_ppp_name_servers(ipoe)
+    verify_accel_ppp_wins_servers(ipoe)
+
+    return None
+
+
+def generate(ipoe):
+    if not ipoe:
+        return None
+
+    render(ipoe_conf, 'accel-ppp/ipoe.config.j2', ipoe)
+
+    if dict_search('authentication.mode', ipoe) == 'local':
+        render(ipoe_chap_secrets, 'accel-ppp/chap-secrets.ipoe.j2',
+               ipoe, permission=0o640)
+    return None
+
+
+def apply(ipoe):
+    systemd_service = 'accel-ppp@ipoe.service'
+    if ipoe == None:
+        call(f'systemctl stop {systemd_service}')
+        for file in [ipoe_conf, ipoe_chap_secrets]:
+            if os.path.exists(file):
+                os.unlink(file)
+
+        return None
+
+    call(f'systemctl reload-or-restart {systemd_service}')
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_lldp.py b/src/conf_mode/service_lldp.py
new file mode 100644
index 0000000..04b1db8
--- /dev/null
+++ b/src/conf_mode/service_lldp.py
@@ -0,0 +1,122 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2017-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.utils.network import is_addr_assigned
+from vyos.utils.network import is_loopback_addr
+from vyos.version import get_version_data
+from vyos.utils.process import call
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = "/etc/default/lldpd"
+vyos_config_file = "/etc/lldpd.d/01-vyos.conf"
+base = ['service', 'lldp']
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    if not conf.exists(base):
+        return {}
+
+    lldp = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                no_tag_node_value_mangle=True,
+                                get_first_key=True,
+                                with_recursive_defaults=True)
+
+    if conf.exists(['service', 'snmp']):
+        lldp['system_snmp_enabled'] = ''
+
+    version_data = get_version_data()
+    lldp['version'] = version_data['version']
+
+    # prune location information if not set by user
+    for interface in lldp.get('interface', []):
+        if lldp.from_defaults(['interface', interface, 'location']):
+            del lldp['interface'][interface]['location']
+        elif lldp.from_defaults(['interface', interface, 'location','coordinate_based']):
+            del lldp['interface'][interface]['location']['coordinate_based']
+
+    return lldp
+
+def verify(lldp):
+    # bail out early - looks like removal from running config
+    if lldp is None:
+        return
+
+    if 'management_address' in lldp:
+        for address in lldp['management_address']:
+            message = f'LLDP management address "{address}" is invalid'
+            if is_loopback_addr(address):
+                Warning(f'{message} - loopback address')
+            elif not is_addr_assigned(address):
+                Warning(f'{message} - not assigned to any interface')
+
+    if 'interface' in lldp:
+        for interface, interface_config in lldp['interface'].items():
+            # bail out early if no location info present in interface config
+            if 'location' not in interface_config:
+                continue
+            if 'coordinate_based' in interface_config['location']:
+                if not {'latitude', 'latitude'} <= set(interface_config['location']['coordinate_based']):
+                    raise ConfigError(f'Must define both longitude and latitude for "{interface}" location!')
+
+    # check options
+    if 'snmp' in lldp:
+        if 'system_snmp_enabled' not in lldp:
+            raise ConfigError('SNMP must be configured to enable LLDP SNMP!')
+
+
+def generate(lldp):
+    # bail out early - looks like removal from running config
+    if lldp is None:
+        return
+
+    render(config_file, 'lldp/lldpd.j2', lldp)
+    render(vyos_config_file, 'lldp/vyos.conf.j2', lldp)
+
+def apply(lldp):
+    systemd_service = 'lldpd.service'
+    if lldp:
+        # start/restart lldp service
+        call(f'systemctl restart {systemd_service}')
+    else:
+        # LLDP service has been terminated
+        call(f'systemctl stop {systemd_service}')
+        if os.path.isfile(config_file):
+            os.unlink(config_file)
+        if os.path.isfile(vyos_config_file):
+            os.unlink(vyos_config_file)
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_mdns_repeater.py b/src/conf_mode/service_mdns_repeater.py
new file mode 100644
index 0000000..b0ece03
--- /dev/null
+++ b/src/conf_mode/service_mdns_repeater.py
@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2017-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from json import loads
+from sys import exit
+from netifaces import ifaddresses, AF_INET, AF_INET6
+
+from vyos.config import Config
+from vyos.configverify import verify_interface_exists
+from vyos.ifconfig.vrrp import VRRP
+from vyos.template import render
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = '/run/avahi-daemon/avahi-daemon.conf'
+systemd_override = r'/run/systemd/system/avahi-daemon.service.d/override.conf'
+vrrp_running_file = '/run/mdns_vrrp_active'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['service', 'mdns', 'repeater']
+    if not conf.exists(base):
+        return None
+
+    mdns = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                no_tag_node_value_mangle=True,
+                                get_first_key=True,
+                                with_recursive_defaults=True)
+
+    if mdns:
+        mdns['vrrp_exists'] = conf.exists('high-availability vrrp')
+        mdns['config_file'] = config_file
+
+    return mdns
+
+def verify(mdns):
+    if not mdns or 'disable' in mdns:
+        return None
+
+    # We need at least two interfaces to repeat mDNS advertisments
+    if 'interface' not in mdns or len(mdns['interface']) < 2:
+        raise ConfigError('mDNS repeater requires at least 2 configured interfaces!')
+
+    # For mdns-repeater to work it is essential that the interfaces has
+    # an IPv4 address assigned
+    for interface in mdns['interface']:
+        verify_interface_exists(mdns, interface)
+
+        if mdns['ip_version'] in ['ipv4', 'both'] and AF_INET not in ifaddresses(interface):
+            raise ConfigError('mDNS repeater requires an IPv4 address to be '
+                                  f'configured on interface "{interface}"')
+
+        if mdns['ip_version'] in ['ipv6', 'both'] and AF_INET6 not in ifaddresses(interface):
+            raise ConfigError('mDNS repeater requires an IPv6 address to be '
+                                  f'configured on interface "{interface}"')
+
+    return None
+
+# Get VRRP states from interfaces, returns only interfaces where state is MASTER
+def get_vrrp_master(interfaces):
+    json_data = loads(VRRP.collect('json'))
+    for group in json_data:
+        if 'data' in group:
+            if 'ifp_ifname' in group['data']:
+                iface = group['data']['ifp_ifname']
+                state = group['data']['state'] # 2 = Master
+                if iface in interfaces and state != 2:
+                    interfaces.remove(iface)
+    return interfaces
+
+def generate(mdns):
+    if not mdns:
+        return None
+
+    if 'disable' in mdns:
+        print('Warning: mDNS repeater will be deactivated because it is disabled')
+        return None
+
+    if mdns['vrrp_exists'] and 'vrrp_disable' in mdns:
+        mdns['interface'] = get_vrrp_master(mdns['interface'])
+
+        if len(mdns['interface']) < 2:
+            return None
+
+    render(config_file, 'mdns-repeater/avahi-daemon.conf.j2', mdns)
+    render(systemd_override, 'mdns-repeater/override.conf.j2', mdns)
+    return None
+
+def apply(mdns):
+    systemd_service = 'avahi-daemon.service'
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+
+    if not mdns or 'disable' in mdns:
+        call(f'systemctl stop {systemd_service}')
+        if os.path.exists(config_file):
+            os.unlink(config_file)
+
+        if os.path.exists(vrrp_running_file):
+            os.unlink(vrrp_running_file)
+    else:
+        if 'vrrp_disable' not in mdns and os.path.exists(vrrp_running_file):
+            os.unlink(vrrp_running_file)
+
+        if mdns['vrrp_exists'] and 'vrrp_disable' in mdns:
+            if not os.path.exists(vrrp_running_file):
+                os.mknod(vrrp_running_file) # vrrp script looks for this file to update mdns repeater
+
+            if len(mdns['interface']) < 2:
+                call(f'systemctl stop {systemd_service}')
+                return None
+
+        call(f'systemctl restart {systemd_service}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_monitoring_telegraf.py b/src/conf_mode/service_monitoring_telegraf.py
new file mode 100644
index 0000000..db870aa
--- /dev/null
+++ b/src/conf_mode/service_monitoring_telegraf.py
@@ -0,0 +1,238 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import socket
+import json
+
+from sys import exit
+from shutil import rmtree
+
+from vyos.config import Config
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_vrf
+from vyos.ifconfig import Section
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.permission import chown
+from vyos.utils.process import cmd
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+cache_dir = f'/etc/telegraf/.cache'
+config_telegraf = f'/run/telegraf/telegraf.conf'
+custom_scripts_dir = '/etc/telegraf/custom_scripts'
+syslog_telegraf = '/etc/rsyslog.d/50-telegraf.conf'
+systemd_override = '/run/systemd/system/telegraf.service.d/10-override.conf'
+
+def get_nft_filter_chains():
+    """ Get nft chains for table filter """
+    try:
+        nft = cmd('nft --json list table ip vyos_filter')
+    except Exception:
+        print('nft table ip vyos_filter not found')
+        return []
+    nft = json.loads(nft)
+    chain_list = []
+
+    for output in nft['nftables']:
+        if 'chain' in output:
+            chain = output['chain']['name']
+            chain_list.append(chain)
+
+    return chain_list
+
+def get_hostname() -> str:
+    try:
+        hostname = socket.getfqdn()
+    except socket.gaierror:
+        hostname = socket.gethostname()
+    return hostname
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'monitoring', 'telegraf']
+    if not conf.exists(base):
+        return None
+
+    monitoring = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                      get_first_key=True,
+                                      no_tag_node_value_mangle=True)
+
+    tmp = is_node_changed(conf, base + ['vrf'])
+    if tmp: monitoring.update({'restart_required': {}})
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    monitoring = conf.merge_defaults(monitoring, recursive=True)
+
+    monitoring['custom_scripts_dir'] = custom_scripts_dir
+    monitoring['hostname'] = get_hostname()
+    monitoring['interfaces_ethernet'] = Section.interfaces('ethernet', vlan=False)
+    if conf.exists('firewall'):
+        monitoring['nft_chains'] = get_nft_filter_chains()
+
+    # Redefine azure group-metrics 'single-table' and 'table-per-metric'
+    if 'azure_data_explorer' in monitoring:
+        if 'single-table' in monitoring['azure_data_explorer']['group_metrics']:
+            monitoring['azure_data_explorer']['group_metrics'] = 'SingleTable'
+        else:
+            monitoring['azure_data_explorer']['group_metrics'] = 'TablePerMetric'
+        # Set azure env
+        if 'authentication' in monitoring['azure_data_explorer']:
+            auth_config = monitoring['azure_data_explorer']['authentication']
+            if {'client_id', 'client_secret', 'tenant_id'} <= set(auth_config):
+                os.environ['AZURE_CLIENT_ID'] = auth_config['client_id']
+                os.environ['AZURE_CLIENT_SECRET'] = auth_config['client_secret']
+                os.environ['AZURE_TENANT_ID'] = auth_config['tenant_id']
+
+    # Ignore default XML values if config doesn't exists
+    # Delete key from dict
+    if not conf.exists(base + ['influxdb']):
+        del monitoring['influxdb']
+
+    if not conf.exists(base + ['prometheus-client']):
+        del monitoring['prometheus_client']
+
+    if not conf.exists(base + ['azure-data-explorer']):
+        del monitoring['azure_data_explorer']
+
+    if not conf.exists(base + ['loki']):
+        del monitoring['loki']
+
+    return monitoring
+
+def verify(monitoring):
+    # bail out early - looks like removal from running config
+    if not monitoring:
+        return None
+
+    verify_vrf(monitoring)
+
+    # Verify influxdb
+    if 'influxdb' in monitoring:
+        if 'authentication' not in monitoring['influxdb'] or \
+           'organization' not in monitoring['influxdb']['authentication'] or \
+           'token' not in monitoring['influxdb']['authentication']:
+            raise ConfigError(f'influxdb authentication "organization and token" are mandatory!')
+
+        if 'url' not in monitoring['influxdb']:
+            raise ConfigError(f'Monitoring influxdb "url" is mandatory!')
+
+    # Verify azure-data-explorer
+    if 'azure_data_explorer' in monitoring:
+        if 'authentication' not in monitoring['azure_data_explorer'] or \
+           'client_id' not in monitoring['azure_data_explorer']['authentication'] or \
+           'client_secret' not in monitoring['azure_data_explorer']['authentication'] or \
+           'tenant_id' not in monitoring['azure_data_explorer']['authentication']:
+            raise ConfigError(f'Authentication "client-id, client-secret and tenant-id" are mandatory!')
+
+        if 'database' not in monitoring['azure_data_explorer']:
+            raise ConfigError(f'Monitoring "database" is mandatory!')
+
+        if 'url' not in monitoring['azure_data_explorer']:
+            raise ConfigError(f'Monitoring "url" is mandatory!')
+
+        if monitoring['azure_data_explorer']['group_metrics'] == 'SingleTable' and \
+            'table' not in monitoring['azure_data_explorer']:
+             raise ConfigError(f'Monitoring "table" name for single-table mode is mandatory!')
+
+    # Verify Splunk
+    if 'splunk' in monitoring:
+        if 'authentication' not in monitoring['splunk'] or \
+           'token' not in monitoring['splunk']['authentication']:
+            raise ConfigError(f'Authentication "organization and token" are mandatory!')
+
+        if 'url' not in monitoring['splunk']:
+            raise ConfigError(f'Monitoring splunk "url" is mandatory!')
+
+    # Verify Loki
+    if 'loki' in monitoring:
+        if 'url' not in monitoring['loki']:
+            raise ConfigError(f'Monitoring loki "url" is mandatory!')
+        if 'authentication' in monitoring['loki']:
+            if (
+                'username' not in monitoring['loki']['authentication']
+                or 'password' not in monitoring['loki']['authentication']
+            ):
+                raise ConfigError(
+                    f'Authentication "username" and "password" are mandatory!'
+                )
+
+    return None
+
+def generate(monitoring):
+    if not monitoring:
+        # Delete config and systemd files
+        config_files = [config_telegraf, systemd_override, syslog_telegraf]
+        for file in config_files:
+            if os.path.isfile(file):
+                os.unlink(file)
+
+        # Delete old directories
+        if os.path.isdir(cache_dir):
+            rmtree(cache_dir, ignore_errors=True)
+
+        return None
+
+    # Create telegraf cache dir
+    if not os.path.exists(cache_dir):
+        os.makedirs(cache_dir)
+
+    chown(cache_dir, 'telegraf', 'telegraf')
+
+    # Create custome scripts dir
+    if not os.path.exists(custom_scripts_dir):
+        os.mkdir(custom_scripts_dir)
+
+    # Render telegraf configuration and systemd override
+    render(config_telegraf, 'telegraf/telegraf.j2', monitoring, user='telegraf', group='telegraf')
+    render(systemd_override, 'telegraf/override.conf.j2', monitoring)
+    render(syslog_telegraf, 'telegraf/syslog_telegraf.j2', monitoring)
+
+    return None
+
+def apply(monitoring):
+    # Reload systemd manager configuration
+    systemd_service = 'telegraf.service'
+    call('systemctl daemon-reload')
+    if not monitoring:
+        call(f'systemctl stop {systemd_service}')
+        return
+
+    # we need to restart the service if e.g. the VRF name changed
+    systemd_action = 'reload-or-restart'
+    if 'restart_required' in monitoring:
+        systemd_action = 'restart'
+
+    call(f'systemctl {systemd_action} {systemd_service}')
+
+    # Telegraf include custom rsyslog config changes
+    call('systemctl reload-or-restart rsyslog')
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_monitoring_zabbix-agent.py b/src/conf_mode/service_monitoring_zabbix-agent.py
new file mode 100644
index 0000000..98d8a32
--- /dev/null
+++ b/src/conf_mode/service_monitoring_zabbix-agent.py
@@ -0,0 +1,98 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+
+service_name = 'zabbix-agent2'
+service_conf = f'/run/zabbix/{service_name}.conf'
+systemd_override = r'/run/systemd/system/zabbix-agent2.service.d/10-override.conf'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['service', 'monitoring', 'zabbix-agent']
+
+    if not conf.exists(base):
+        return None
+
+    config = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                  get_first_key=True,
+                                  no_tag_node_value_mangle=True,
+                                  with_recursive_defaults=True)
+
+    # Cut the / from the end, /tmp/ => /tmp
+    if 'directory' in config and config['directory'].endswith('/'):
+        config['directory'] = config['directory'][:-1]
+
+    return config
+
+
+def verify(config):
+    # bail out early - looks like removal from running config
+    if config is None:
+        return
+
+    if 'server' not in config:
+        raise ConfigError('Server is required!')
+
+
+def generate(config):
+    # bail out early - looks like removal from running config
+    if config is None:
+        # Remove old config and return
+        config_files = [service_conf, systemd_override]
+        for file in config_files:
+            if os.path.isfile(file):
+                os.unlink(file)
+
+        return None
+
+    # Write configuration file
+    render(service_conf, 'zabbix-agent/zabbix-agent.conf.j2', config)
+    render(systemd_override, 'zabbix-agent/10-override.conf.j2', config)
+
+    return None
+
+
+def apply(config):
+    call('systemctl daemon-reload')
+    if config:
+        call(f'systemctl restart {service_name}.service')
+    else:
+        call(f'systemctl stop {service_name}.service')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_ndp-proxy.py b/src/conf_mode/service_ndp-proxy.py
new file mode 100644
index 0000000..024ad79
--- /dev/null
+++ b/src/conf_mode/service_ndp-proxy.py
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configverify import verify_interface_exists
+from vyos.utils.process import call
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+systemd_service = 'ndppd.service'
+ndppd_config = '/run/ndppd/ndppd.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'ndp-proxy']
+    if not conf.exists(base):
+        return None
+
+    ndpp = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                get_first_key=True,
+                                with_recursive_defaults=True)
+
+    return ndpp
+
+def verify(ndpp):
+    if not ndpp:
+        return None
+
+    if 'interface' in ndpp:
+        for interface, interface_config in ndpp['interface'].items():
+            verify_interface_exists(ndpp, interface)
+
+            if 'rule' in interface_config:
+                for rule, rule_config in interface_config['rule'].items():
+                    if rule_config['mode'] == 'interface' and 'interface' not in rule_config:
+                        raise ConfigError(f'Rule "{rule}" uses interface mode but no interface defined!')
+
+                    if rule_config['mode'] != 'interface' and 'interface' in rule_config:
+                        if interface_config['mode'] != 'interface' and 'interface' in interface_config:
+                            raise ConfigError(f'Rule "{rule}" does not use interface mode, thus interface can not be defined!')
+
+    return None
+
+def generate(ndpp):
+    if not ndpp:
+        return None
+
+    render(ndppd_config, 'ndppd/ndppd.conf.j2', ndpp)
+    return None
+
+def apply(ndpp):
+    if not ndpp:
+        call(f'systemctl stop {systemd_service}')
+        if os.path.isfile(ndppd_config):
+            os.unlink(ndppd_config)
+        return None
+
+    call(f'systemctl reload-or-restart {systemd_service}')
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_ntp.py b/src/conf_mode/service_ntp.py
new file mode 100644
index 0000000..32563aa
--- /dev/null
+++ b/src/conf_mode/service_ntp.py
@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_interface_exists
+from vyos.utils.process import call
+from vyos.utils.permission import chmod_750
+from vyos.utils.network import get_interface_config
+from vyos.template import render
+from vyos.template import is_ipv4
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/run/chrony/chrony.conf'
+systemd_override = r'/run/systemd/system/chrony.service.d/override.conf'
+user_group = '_chrony'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'ntp']
+    if not conf.exists(base):
+        return None
+
+    ntp = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+    ntp['config_file'] = config_file
+    ntp['user'] = user_group
+
+    tmp = is_node_changed(conf, base + ['vrf'])
+    if tmp: ntp.update({'restart_required': {}})
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    default_values = conf.get_config_defaults(**ntp.kwargs, recursive=True)
+    # Only defined PTP default port, if PTP feature is in use
+    if 'ptp' not in ntp:
+        del default_values['ptp']
+
+    ntp = config_dict_merge(default_values, ntp)
+    return ntp
+
+def verify(ntp):
+    # bail out early - looks like removal from running config
+    if not ntp:
+        return None
+
+    if 'server' not in ntp:
+        raise ConfigError('NTP server not configured')
+
+    verify_vrf(ntp)
+
+    if 'interface' in ntp:
+        # If ntpd should listen on a given interface, ensure it exists
+        interface = ntp['interface']
+        verify_interface_exists(ntp, interface)
+
+        # If we run in a VRF, our interface must belong to this VRF, too
+        if 'vrf' in ntp:
+            tmp = get_interface_config(interface)
+            vrf_name = ntp['vrf']
+            if 'master' not in tmp or tmp['master'] != vrf_name:
+                raise ConfigError(f'NTP runs in VRF "{vrf_name}" - "{interface}" '\
+                                  f'does not belong to this VRF!')
+
+    if 'listen_address' in ntp:
+        ipv4_addresses = 0
+        ipv6_addresses = 0
+        for address in ntp['listen_address']:
+            if is_ipv4(address):
+                ipv4_addresses += 1
+            else:
+                ipv6_addresses += 1
+        if ipv4_addresses > 1:
+            raise ConfigError(f'NTP Only admits one ipv4 value for listen-address parameter ')
+        if ipv6_addresses > 1:
+            raise ConfigError(f'NTP Only admits one ipv6 value for listen-address parameter ')
+
+    if 'server' in ntp:
+        for host, server in ntp['server'].items():
+            if 'ptp' in server:
+                if 'ptp' not in ntp:
+                    raise ConfigError('PTP must be enabled for the NTP service '\
+                                      f'before it can be used for server "{host}"')
+                else:
+                    break
+
+    return None
+
+def generate(ntp):
+    # bail out early - looks like removal from running config
+    if not ntp:
+        return None
+
+    render(config_file, 'chrony/chrony.conf.j2', ntp, user=user_group, group=user_group)
+    render(systemd_override, 'chrony/override.conf.j2', ntp, user=user_group, group=user_group)
+
+    # Ensure proper permission for chrony command socket
+    config_dir = os.path.dirname(config_file)
+    chmod_750(config_dir)
+
+    return None
+
+def apply(ntp):
+    systemd_service = 'chrony.service'
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+
+    if not ntp:
+        # NTP support is removed in the commit
+        call(f'systemctl stop {systemd_service}')
+        if os.path.exists(config_file):
+            os.unlink(config_file)
+        if os.path.isfile(systemd_override):
+            os.unlink(systemd_override)
+        return
+
+    # we need to restart the service if e.g. the VRF name changed
+    systemd_action = 'reload-or-restart'
+    if 'restart_required' in ntp:
+        systemd_action = 'restart'
+
+    call(f'systemctl {systemd_action} {systemd_service}')
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_pppoe-server.py b/src/conf_mode/service_pppoe-server.py
new file mode 100644
index 0000000..ac697c5
--- /dev/null
+++ b/src/conf_mode/service_pppoe-server.py
@@ -0,0 +1,167 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_accel_dict
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_interface_exists
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.dict import dict_search
+from vyos.accel_ppp_util import verify_accel_ppp_name_servers
+from vyos.accel_ppp_util import verify_accel_ppp_wins_servers
+from vyos.accel_ppp_util import verify_accel_ppp_authentication
+from vyos.accel_ppp_util import verify_accel_ppp_ip_pool
+from vyos.accel_ppp_util import get_pools_in_order
+from vyos import ConfigError
+from vyos import airbag
+
+airbag.enable()
+
+pppoe_conf = r'/run/accel-pppd/pppoe.conf'
+pppoe_chap_secrets = r'/run/accel-pppd/pppoe.chap-secrets'
+
+def convert_pado_delay(pado_delay):
+    new_pado_delay = {'delays_without_sessions': [],
+                      'delays_with_sessions': []}
+    for delay, sessions in pado_delay.items():
+        if not sessions:
+            new_pado_delay['delays_without_sessions'].append(delay)
+        else:
+            new_pado_delay['delays_with_sessions'].append((delay, int(sessions['sessions'])))
+    return new_pado_delay
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'pppoe-server']
+    if not conf.exists(base):
+        return None
+
+    # retrieve common dictionary keys
+    pppoe = get_accel_dict(conf, base, pppoe_chap_secrets)
+
+    if dict_search('client_ip_pool', pppoe):
+        # Multiple named pools require ordered values T5099
+        pppoe['ordered_named_pools'] = get_pools_in_order(dict_search('client_ip_pool', pppoe))
+
+    if dict_search('pado_delay', pppoe):
+        pado_delay = dict_search('pado_delay', pppoe)
+        pppoe['pado_delay'] = convert_pado_delay(pado_delay)
+
+    # reload-or-restart does not implemented in accel-ppp
+    # use this workaround until it will be implemented
+    # https://phabricator.accel-ppp.org/T3
+    conditions = [is_node_changed(conf, base + ['client-ip-pool']),
+                  is_node_changed(conf, base + ['client-ipv6-pool']),
+                  is_node_changed(conf, base + ['interface'])]
+    if any(conditions):
+        pppoe.update({'restart_required': {}})
+    pppoe['server_type'] = 'pppoe'
+    return pppoe
+
+def verify_pado_delay(pppoe):
+    if 'pado_delay' in pppoe:
+        pado_delay = pppoe['pado_delay']
+
+        delays_without_sessions = pado_delay['delays_without_sessions']
+        if 'disable' in delays_without_sessions:
+            raise ConfigError(
+                'Number of sessions must be specified for "pado-delay disable"'
+            )
+
+        if len(delays_without_sessions) > 1:
+            raise ConfigError(
+                f'Cannot add more then ONE pado-delay without sessions, '
+                f'but {len(delays_without_sessions)} were set'
+            )
+
+        if 'disable' in [delay[0] for delay in pado_delay['delays_with_sessions']]:
+            # need to sort delays by sessions to verify if there is no delay
+            # for sessions after disabling
+            sorted_pado_delay = sorted(pado_delay['delays_with_sessions'], key=lambda k_v: k_v[1])
+            last_delay = sorted_pado_delay[-1]
+
+            if last_delay[0] != 'disable':
+                raise ConfigError(
+                    f'Cannot add pado-delay after disabled sessions, but '
+                    f'"pado-delay {last_delay[0]} sessions {last_delay[1]}" was set'
+                )
+
+def verify(pppoe):
+    if not pppoe:
+        return None
+
+    verify_accel_ppp_authentication(pppoe)
+    verify_accel_ppp_ip_pool(pppoe)
+    verify_accel_ppp_name_servers(pppoe)
+    verify_accel_ppp_wins_servers(pppoe)
+    verify_pado_delay(pppoe)
+
+    if 'interface' not in pppoe:
+        raise ConfigError('At least one listen interface must be defined!')
+
+    # Check is interface exists in the system
+    for interface, interface_config in pppoe['interface'].items():
+        verify_interface_exists(pppoe, interface, warning_only=True)
+
+        if 'vlan_mon' in interface_config and not 'vlan' in interface_config:
+            raise ConfigError('Option "vlan-mon" requires "vlan" to be set!')
+
+    return None
+
+
+def generate(pppoe):
+    if not pppoe:
+        return None
+
+    render(pppoe_conf, 'accel-ppp/pppoe.config.j2', pppoe)
+
+    if dict_search('authentication.mode', pppoe) == 'local':
+        render(pppoe_chap_secrets, 'accel-ppp/chap-secrets.config_dict.j2',
+               pppoe, permission=0o640)
+    return None
+
+
+def apply(pppoe):
+    systemd_service = 'accel-ppp@pppoe.service'
+    if not pppoe:
+        call(f'systemctl stop {systemd_service}')
+        for file in [pppoe_conf, pppoe_chap_secrets]:
+            if os.path.exists(file):
+                os.unlink(file)
+        return None
+
+    if 'restart_required' in pppoe:
+        call(f'systemctl restart {systemd_service}')
+    else:
+        call(f'systemctl reload-or-restart {systemd_service}')
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_router-advert.py b/src/conf_mode/service_router-advert.py
new file mode 100644
index 0000000..88d767b
--- /dev/null
+++ b/src/conf_mode/service_router-advert.py
@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from ipaddress import IPv6Network
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/run/radvd/radvd.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'router-advert']
+    rtradv = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                  get_first_key=True,
+                                  with_recursive_defaults=True)
+
+    return rtradv
+
+def verify(rtradv):
+    if not rtradv:
+        return None
+
+    if 'interface' not in rtradv:
+        return None
+
+    for interface, interface_config in rtradv['interface'].items():
+        interval_max = int(interface_config['interval']['max'])
+
+        if 'prefix' in interface_config:
+            for prefix, prefix_config in interface_config['prefix'].items():
+                valid_lifetime = prefix_config['valid_lifetime']
+                if valid_lifetime == 'infinity':
+                    valid_lifetime = 4294967295
+
+                preferred_lifetime = prefix_config['preferred_lifetime']
+                if preferred_lifetime == 'infinity':
+                    preferred_lifetime = 4294967295
+
+                if not (int(valid_lifetime) >= int(preferred_lifetime)):
+                    raise ConfigError('Prefix valid-lifetime must be greater then or equal to preferred-lifetime')
+
+        if 'nat64prefix' in interface_config:
+            nat64_supported_lengths = [32, 40, 48, 56, 64, 96]
+            for prefix, prefix_config in interface_config['nat64prefix'].items():
+                if IPv6Network(prefix).prefixlen not in nat64_supported_lengths:
+                    raise ConfigError(f'Invalid NAT64 prefix length for "{prefix}", can only be one of: /' + ', /'.join(nat64_supported_lengths))
+
+                if int(prefix_config['valid_lifetime']) < interval_max:
+                    raise ConfigError(f'NAT64 valid-lifetime must not be smaller then "interval max" which is "{interval_max}"!')
+
+        if 'name_server' in interface_config:
+            if len(interface_config['name_server']) > 3:
+                raise ConfigError('No more then 3 IPv6 name-servers supported!')
+
+        if 'name_server_lifetime' in interface_config:
+            # man page states:
+            # The maximum duration how long the RDNSS entries are used for name
+            # resolution. A value of 0 means the nameserver must no longer be
+            # used. The value, if not 0, must be at least MaxRtrAdvInterval. To
+            # ensure stale RDNSS info gets removed in a timely fashion, this
+            # should not be greater than 2*MaxRtrAdvInterval.
+            lifetime = int(interface_config['name_server_lifetime'])
+            if lifetime > 0:
+                if lifetime < int(interval_max):
+                    raise ConfigError(f'RDNSS lifetime must be at least "{interval_max}" seconds!')
+                if lifetime > 2* interval_max:
+                    Warning(f'RDNSS lifetime should not exceed "{2 * interval_max}" which is two times "interval max"!')
+
+    return None
+
+def generate(rtradv):
+    if not rtradv:
+        return None
+
+    render(config_file, 'router-advert/radvd.conf.j2', rtradv, permission=0o644)
+    return None
+
+def apply(rtradv):
+    systemd_service = 'radvd.service'
+    if not rtradv:
+        # bail out early - looks like removal from running config
+        call(f'systemctl stop {systemd_service}')
+        if os.path.exists(config_file):
+            os.unlink(config_file)
+
+        return None
+
+    call(f'systemctl reload-or-restart {systemd_service}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_salt-minion.py b/src/conf_mode/service_salt-minion.py
new file mode 100644
index 0000000..edf74b0
--- /dev/null
+++ b/src/conf_mode/service_salt-minion.py
@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from socket import gethostname
+from sys import exit
+from urllib3 import PoolManager
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configverify import verify_interface_exists
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.permission import chown
+from vyos import ConfigError
+
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/etc/salt/minion'
+master_keyfile = r'/opt/vyatta/etc/config/salt/pki/minion/master_sign.pub'
+
+user='minion'
+group='vyattacfg'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'salt-minion']
+
+    if not conf.exists(base):
+        return None
+
+    salt = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+    # ID default is dynamic thus we can not use defaults()
+    if 'id' not in salt:
+        salt['id'] = gethostname()
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    salt = conf.merge_defaults(salt, recursive=True)
+
+    if not conf.exists(base):
+        return None
+    else:
+        conf.set_level(base)
+
+    return salt
+
+def verify(salt):
+    if not salt:
+        return None
+
+    if 'hash' in salt and salt['hash'] == 'sha1':
+        Warning('Do not use sha1 hashing algorithm, upgrade to sha256 or later!')
+
+    if 'source_interface' in salt:
+        verify_interface_exists(salt, salt['source_interface'])
+
+    return None
+
+def generate(salt):
+    if not salt:
+        return None
+
+    render(config_file, 'salt-minion/minion.j2', salt, user=user, group=group)
+
+    if not os.path.exists(master_keyfile):
+        if 'master_key' in salt:
+            req = PoolManager().request('GET', salt['master_key'], preload_content=False)
+            with open(master_keyfile, 'wb') as f:
+                while True:
+                    data = req.read(1024)
+                    if not data:
+                        break
+                    f.write(data)
+
+            req.release_conn()
+            chown(master_keyfile, user, group)
+
+    return None
+
+def apply(salt):
+    service_name = 'salt-minion.service'
+    if not salt:
+        # Salt removed from running config
+        call(f'systemctl stop {service_name}')
+        if os.path.exists(config_file):
+            os.unlink(config_file)
+    else:
+        call(f'systemctl restart {service_name}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_sla.py b/src/conf_mode/service_sla.py
new file mode 100644
index 0000000..ba5e645
--- /dev/null
+++ b/src/conf_mode/service_sla.py
@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+owamp_config_dir = '/etc/owamp-server'
+owamp_config_file = f'{owamp_config_dir}/owamp-server.conf'
+systemd_override_owamp = r'/run/systemd/system/owamp-server.d/20-override.conf'
+
+twamp_config_dir = '/etc/twamp-server'
+twamp_config_file = f'{twamp_config_dir}/twamp-server.conf'
+systemd_override_twamp = r'/run/systemd/system/twamp-server.d/20-override.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'sla']
+    if not conf.exists(base):
+        return None
+
+    sla = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True,
+                               with_recursive_defaults=True)
+
+    # Ignore default XML values if config doesn't exists
+    # Delete key from dict
+    if not conf.exists(base + ['owamp-server']):
+        del sla['owamp_server']
+    if not conf.exists(base + ['twamp-server']):
+        del sla['twamp_server']
+
+    return sla
+
+def verify(sla):
+    if not sla:
+        return None
+
+def generate(sla):
+    if not sla:
+        return None
+
+    render(owamp_config_file, 'sla/owamp-server.conf.j2', sla)
+    render(systemd_override_owamp, 'sla/owamp-override.conf.j2', sla)
+
+    render(twamp_config_file, 'sla/twamp-server.conf.j2', sla)
+    render(systemd_override_twamp, 'sla/twamp-override.conf.j2', sla)
+
+    return None
+
+def apply(sla):
+    owamp_service = 'owamp-server.service'
+    twamp_service = 'twamp-server.service'
+
+    call('systemctl daemon-reload')
+
+    if not sla or 'owamp_server' not in sla:
+        call(f'systemctl stop {owamp_service}')
+
+        if os.path.exists(owamp_config_file):
+            os.unlink(owamp_config_file)
+
+    if not sla or 'twamp_server' not in sla:
+        call(f'systemctl stop {twamp_service}')
+        if os.path.exists(twamp_config_file):
+            os.unlink(twamp_config_file)
+
+    if sla and 'owamp_server' in sla:
+        call(f'systemctl reload-or-restart {owamp_service}')
+
+    if sla and 'twamp_server' in sla:
+        call(f'systemctl reload-or-restart {twamp_service}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_snmp.py b/src/conf_mode/service_snmp.py
new file mode 100644
index 0000000..c9c0ed9
--- /dev/null
+++ b/src/conf_mode/service_snmp.py
@@ -0,0 +1,282 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configverify import verify_vrf
+from vyos.snmpv3_hashgen import plaintext_to_md5
+from vyos.snmpv3_hashgen import plaintext_to_sha1
+from vyos.snmpv3_hashgen import random
+from vyos.template import render
+from vyos.utils.configfs import delete_cli_node
+from vyos.utils.configfs import add_cli_node
+from vyos.utils.dict import dict_search
+from vyos.utils.network import is_addr_assigned
+from vyos.utils.process import call
+from vyos.utils.permission import chmod_755
+from vyos.version import get_version_data
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file_client  = r'/etc/snmp/snmp.conf'
+config_file_daemon  = r'/etc/snmp/snmpd.conf'
+config_file_access  = r'/usr/share/snmp/snmpd.conf'
+config_file_user    = r'/var/lib/snmp/snmpd.conf'
+default_script_dir  = r'/config/user-data/'
+systemd_override    = r'/run/systemd/system/snmpd.service.d/override.conf'
+systemd_service     = 'snmpd.service'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'snmp']
+
+    snmp = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                get_first_key=True, no_tag_node_value_mangle=True)
+    if not conf.exists(base):
+        snmp.update({'deleted' : ''})
+
+    if conf.exists(['service', 'lldp', 'snmp']):
+        snmp.update({'lldp_snmp' : ''})
+
+    if 'deleted' in snmp:
+        return snmp
+
+    version_data = get_version_data()
+    snmp['version'] = version_data['version']
+
+    # create an internal snmpv3 user of the form 'vyosxxxxxxxxxxxxxxxx'
+    snmp['vyos_user'] = 'vyos' + random(8)
+    snmp['vyos_user_pass'] = random(16)
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    snmp = conf.merge_defaults(snmp, recursive=True)
+
+    if 'listen_address' in snmp:
+        # Always listen on localhost if an explicit address has been configured
+        # This is a safety measure to not end up with invalid listen addresses
+        # that are not configured on this system. See https://vyos.dev/T850
+        if '127.0.0.1' not in snmp['listen_address']:
+            tmp = {'127.0.0.1': {'port': '161'}}
+            snmp['listen_address'] = dict_merge(tmp, snmp['listen_address'])
+
+        if '::1' not in snmp['listen_address']:
+            tmp = {'::1': {'port': '161'}}
+            snmp['listen_address'] = dict_merge(tmp, snmp['listen_address'])
+
+    if 'script_extensions' in snmp and 'extension_name' in snmp['script_extensions']:
+        for key, val in snmp['script_extensions']['extension_name'].items():
+            if 'script' not in val:
+                continue
+            script_path = val['script']
+            # if script has not absolute path, use pre configured path
+            if not os.path.isabs(script_path):
+                script_path = os.path.join(default_script_dir, script_path)
+
+            snmp['script_extensions']['extension_name'][key]['script'] = script_path
+
+    return snmp
+
+
+def verify(snmp):
+    if 'deleted' in snmp:
+        return None
+
+    if {'deleted', 'lldp_snmp'} <= set(snmp):
+        raise ConfigError('Can not delete SNMP service, as LLDP still uses SNMP!')
+
+    ### check if the configured script actually exist
+    if 'script_extensions' in snmp and 'extension_name' in snmp['script_extensions']:
+        for extension, extension_opt in snmp['script_extensions']['extension_name'].items():
+            if 'script' not in extension_opt:
+                raise ConfigError(f'Script extension "{extension}" requires an actual script to be configured!')
+
+            tmp = extension_opt['script']
+            if not os.path.isfile(tmp):
+                Warning(f'script "{tmp}" does not exist!')
+            else:
+                chmod_755(extension_opt['script'])
+
+    if 'listen_address' in snmp:
+        for address in snmp['listen_address']:
+            # We only wan't to configure addresses that exist on the system.
+            # Hint the user if they don't exist
+            if 'vrf' in snmp:
+                vrf_name = snmp['vrf']
+                if not is_addr_assigned(address, vrf_name) and address not in ['::1','127.0.0.1']:
+                    raise ConfigError(f'SNMP listen address "{address}" not configured in vrf "{vrf_name}"!')
+            elif not is_addr_assigned(address):
+                raise ConfigError(f'SNMP listen address "{address}" not configured in default vrf!')
+
+    if 'trap_target' in snmp:
+        for trap, trap_config in snmp['trap_target'].items():
+            if 'community' not in trap_config:
+                raise ConfigError(f'Trap target "{trap}" requires a community to be set!')
+
+    if 'oid_enable' in snmp:
+        Warning(f'Custom OIDs are enabled and may lead to system instability and high resource consumption')
+
+
+    verify_vrf(snmp)
+
+    # bail out early if SNMP v3 is not configured
+    if 'v3' not in snmp:
+        return None
+
+    if 'user' in snmp['v3']:
+        for user, user_config in snmp['v3']['user'].items():
+            if 'group' not in user_config:
+                raise ConfigError(f'Group membership required for user "{user}"!')
+
+            if 'plaintext_password' not in user_config['auth'] and 'encrypted_password' not in user_config['auth']:
+                raise ConfigError(f'Must specify authentication encrypted-password or plaintext-password for user "{user}"!')
+
+            if 'plaintext_password' not in user_config['privacy'] and 'encrypted_password' not in user_config['privacy']:
+                raise ConfigError(f'Must specify privacy encrypted-password or plaintext-password for user "{user}"!')
+
+    if 'group' in snmp['v3']:
+        for group, group_config in snmp['v3']['group'].items():
+            if 'seclevel' not in group_config:
+                raise ConfigError(f'Must configure "seclevel" for group "{group}"!')
+            if 'view' not in group_config:
+                raise ConfigError(f'Must configure "view" for group "{group}"!')
+
+            # Check if 'view' exists
+            view = group_config['view']
+            if 'view' not in snmp['v3'] or view not in snmp['v3']['view']:
+                raise ConfigError(f'You must create view "{view}" first!')
+
+    if 'view' in snmp['v3']:
+        for view, view_config in snmp['v3']['view'].items():
+            if 'oid' not in view_config:
+                raise ConfigError(f'Must configure an "oid" for view "{view}"!')
+
+    if 'trap_target' in snmp['v3']:
+        for trap, trap_config in snmp['v3']['trap_target'].items():
+            if 'plaintext_password' not in trap_config['auth'] and 'encrypted_password' not in trap_config['auth']:
+                raise ConfigError(f'Must specify one of authentication encrypted-password or plaintext-password for trap "{trap}"!')
+
+            if {'plaintext_password', 'encrypted_password'} <= set(trap_config['auth']):
+                raise ConfigError(f'Can not specify both authentication encrypted-password and plaintext-password for trap "{trap}"!')
+
+            if 'plaintext_password' not in trap_config['privacy'] and 'encrypted_password' not in trap_config['privacy']:
+                raise ConfigError(f'Must specify one of privacy encrypted-password or plaintext-password for trap "{trap}"!')
+
+            if {'plaintext_password', 'encrypted_password'} <= set(trap_config['privacy']):
+                raise ConfigError(f'Can not specify both privacy encrypted-password and plaintext-password for trap "{trap}"!')
+
+            if 'type' not in trap_config:
+                raise ConfigError('SNMP v3 trap "type" must be specified!')
+
+    return None
+
+def generate(snmp):
+    # As we are manipulating the snmpd user database we have to stop it first!
+    # This is even save if service is going to be removed
+    call(f'systemctl stop {systemd_service}')
+    # Clean config files
+    config_files = [config_file_client, config_file_daemon,
+                    config_file_access, config_file_user, systemd_override]
+    for file in config_files:
+        if os.path.isfile(file):
+            os.unlink(file)
+
+    if 'deleted' in snmp:
+        return None
+
+    if 'v3' in snmp:
+        # SNMPv3 uses a hashed password. If CLI defines a plaintext password,
+        # we will hash it in the background and replace the CLI node!
+        if 'user' in snmp['v3']:
+            for user, user_config in snmp['v3']['user'].items():
+                if dict_search('auth.type', user_config)  == 'sha':
+                    hash = plaintext_to_sha1
+                else:
+                    hash = plaintext_to_md5
+
+                if dict_search('auth.plaintext_password', user_config) is not None:
+                    tmp = hash(dict_search('auth.plaintext_password', user_config),
+                        dict_search('v3.engineid', snmp))
+
+                    snmp['v3']['user'][user]['auth']['encrypted_password'] = tmp
+                    del snmp['v3']['user'][user]['auth']['plaintext_password']
+
+                    cli_base = ['service', 'snmp', 'v3', 'user', user, 'auth']
+                    delete_cli_node(cli_base + ['plaintext-password'])
+                    add_cli_node(cli_base + ['encrypted-password'], value=tmp)
+
+                if dict_search('privacy.plaintext_password', user_config) is not None:
+                    tmp = hash(dict_search('privacy.plaintext_password', user_config),
+                        dict_search('v3.engineid', snmp))
+
+                    snmp['v3']['user'][user]['privacy']['encrypted_password'] = tmp
+                    del snmp['v3']['user'][user]['privacy']['plaintext_password']
+
+                    cli_base = ['service', 'snmp', 'v3', 'user', user, 'privacy']
+                    delete_cli_node(cli_base + ['plaintext-password'])
+                    add_cli_node(cli_base + ['encrypted-password'], value=tmp)
+
+    # Write client config file
+    render(config_file_client, 'snmp/etc.snmp.conf.j2', snmp)
+    # Write server config file
+    render(config_file_daemon, 'snmp/etc.snmpd.conf.j2', snmp)
+    # Write access rights config file
+    render(config_file_access, 'snmp/usr.snmpd.conf.j2', snmp)
+    # Write access rights config file
+    render(config_file_user, 'snmp/var.snmpd.conf.j2', snmp)
+    # Write daemon configuration file
+    render(systemd_override, 'snmp/override.conf.j2', snmp)
+
+    return None
+
+def apply(snmp):
+    # Always reload systemd manager configuration
+    call('systemctl daemon-reload')
+
+    if 'deleted' in snmp:
+        return None
+
+    # start SNMP daemon
+    call(f'systemctl reload-or-restart {systemd_service}')
+
+    # Enable AgentX in FRR
+    # This should be done for each daemon individually because common command
+    # works only if all the daemons started with SNMP support
+    # Following daemons from FRR 9.0/stable have SNMP module compiled in VyOS
+    frr_daemons_list = ['zebra', 'bgpd', 'ospf6d', 'ospfd', 'ripd', 'isisd', 'ldpd']
+    for frr_daemon in frr_daemons_list:
+        call(f'vtysh -c "configure terminal" -d {frr_daemon} -c "agentx" >/dev/null')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_ssh.py b/src/conf_mode/service_ssh.py
new file mode 100644
index 0000000..9abdd33
--- /dev/null
+++ b/src/conf_mode/service_ssh.py
@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from syslog import syslog
+from syslog import LOG_INFO
+
+from vyos.config import Config
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_vrf
+from vyos.utils.process import call
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/run/sshd/sshd_config'
+
+sshguard_config_file = '/etc/sshguard/sshguard.conf'
+sshguard_whitelist = '/etc/sshguard/whitelist'
+
+key_rsa = '/etc/ssh/ssh_host_rsa_key'
+key_dsa = '/etc/ssh/ssh_host_dsa_key'
+key_ed25519 = '/etc/ssh/ssh_host_ed25519_key'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'ssh']
+    if not conf.exists(base):
+        return None
+
+    ssh = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+    tmp = is_node_changed(conf, base + ['vrf'])
+    if tmp: ssh.update({'restart_required': {}})
+
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    ssh = conf.merge_defaults(ssh, recursive=True)
+
+    # pass config file path - used in override template
+    ssh['config_file'] = config_file
+
+    # Ignore default XML values if config doesn't exists
+    # Delete key from dict
+    if not conf.exists(base + ['dynamic-protection']):
+         del ssh['dynamic_protection']
+
+    return ssh
+
+def verify(ssh):
+    if not ssh:
+        return None
+
+    if 'rekey' in ssh and 'data' not in ssh['rekey']:
+        raise ConfigError(f'Rekey data is required!')
+
+    verify_vrf(ssh)
+    return None
+
+def generate(ssh):
+    if not ssh:
+        if os.path.isfile(config_file):
+            os.unlink(config_file)
+
+        return None
+
+    # This usually happens only once on a fresh system, SSH keys need to be
+    # freshly generted, one per every system!
+    if not os.path.isfile(key_rsa):
+        syslog(LOG_INFO, 'SSH RSA host key not found, generating new key!')
+        call(f'ssh-keygen -q -N "" -t rsa -f {key_rsa}')
+    if not os.path.isfile(key_dsa):
+        syslog(LOG_INFO, 'SSH DSA host key not found, generating new key!')
+        call(f'ssh-keygen -q -N "" -t dsa -f {key_dsa}')
+    if not os.path.isfile(key_ed25519):
+        syslog(LOG_INFO, 'SSH ed25519 host key not found, generating new key!')
+        call(f'ssh-keygen -q -N "" -t ed25519 -f {key_ed25519}')
+
+    render(config_file, 'ssh/sshd_config.j2', ssh)
+
+    if 'dynamic_protection' in ssh:
+        render(sshguard_config_file, 'ssh/sshguard_config.j2', ssh)
+        render(sshguard_whitelist, 'ssh/sshguard_whitelist.j2', ssh)
+
+    return None
+
+def apply(ssh):
+    systemd_service_ssh = 'ssh.service'
+    systemd_service_sshguard = 'sshguard.service'
+    if not ssh:
+        # SSH access is removed in the commit
+        call(f'systemctl stop ssh@*.service')
+        call(f'systemctl stop {systemd_service_sshguard}')
+        return None
+
+    if 'dynamic_protection' not in ssh:
+        call(f'systemctl stop {systemd_service_sshguard}')
+    else:
+        call(f'systemctl reload-or-restart {systemd_service_sshguard}')
+
+    # we need to restart the service if e.g. the VRF name changed
+    systemd_action = 'reload-or-restart'
+    if 'restart_required' in ssh:
+        # this is only true if something for the VRFs changed, thus we
+        # stop all VRF services and only restart then new ones
+        call(f'systemctl stop ssh@*.service')
+        systemd_action = 'restart'
+
+    for vrf in ssh['vrf']:
+        call(f'systemctl {systemd_action} ssh@{vrf}.service')
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_stunnel.py b/src/conf_mode/service_stunnel.py
new file mode 100644
index 0000000..8ec7625
--- /dev/null
+++ b/src/conf_mode/service_stunnel.py
@@ -0,0 +1,264 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+from shutil import rmtree
+
+from sys import exit
+
+from netifaces import AF_INET
+from psutil import net_if_addrs
+
+from vyos.config import Config
+from vyos.configverify import verify_pki_ca_certificate
+from vyos.configverify import verify_pki_certificate
+from vyos.pki import encode_certificate
+from vyos.pki import encode_private_key
+from vyos.pki import find_chain
+from vyos.pki import load_certificate
+from vyos.pki import load_private_key
+from vyos.utils.dict import dict_search
+from vyos.utils.file import makedir
+from vyos.utils.file import write_file
+from vyos.utils.network import check_port_availability
+from vyos.utils.network import is_listen_port_bind_service
+from vyos.utils.process import call
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+stunnel_dir = '/run/stunnel'
+config_file = f'{stunnel_dir}/stunnel.conf'
+stunnel_ca_dir = f'{stunnel_dir}/ca'
+stunnel_psk_dir = f'{stunnel_dir}/psk'
+
+# config based on
+# http://man.he.net/man8/stunnel4
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'stunnel']
+    if not conf.exists(base):
+        return None
+
+    stunnel = conf.get_config_dict(base,
+                              get_first_key=True,
+                              key_mangling=('-', '_'),
+                              no_tag_node_value_mangle=True,
+                              with_recursive_defaults=True,
+                              with_pki=True)
+    stunnel['config_file'] = config_file
+    return stunnel
+
+
+def verify(stunnel):
+    if not stunnel:
+        return None
+
+    stunnel_listen_addresses = list()
+    for mode, conf in stunnel.items():
+        if mode not in ['server', 'client']:
+            continue
+
+        for app, app_conf in conf.items():
+            # connect, listen, exec and some protocols e.g. socks on server mode are endpoints.
+            endpoints = 0
+            if 'socks' == app_conf.get('protocol') and mode == 'server':
+                if 'connect' in app_conf:
+                    raise ConfigError("The 'connect' option cannot be used with the 'socks' protocol in server mode.")
+                endpoints += 1
+
+            for item in ['connect', 'listen']:
+                if item in app_conf:
+                    endpoints += 1
+                    if 'port' not in app_conf[item]:
+                        raise ConfigError(f'{mode} [{app}]: {item} port number is required!')
+                elif item == 'listen':
+                    raise ConfigError(f'{mode} [{app}]: {item} port number is required!')
+
+            if endpoints != 2:
+                raise ConfigError(f'{mode} [{app}]: connect port number is required!')
+
+            if 'address' in app_conf['listen']:
+                laddresses = [dict_search('listen.address', app_conf)]
+            else:
+                laddresses = list()
+                ifaces = net_if_addrs()
+                for iface_name, iface_addresses in ifaces.items():
+                    for iface_addr in iface_addresses:
+                        if iface_addr.family == AF_INET:
+                            laddresses.append(iface_addr.address)
+
+            lport = int(dict_search('listen.port', app_conf))
+
+            for address in laddresses:
+                if f'{address}:{lport}' in stunnel_listen_addresses:
+                    raise ConfigError(
+                        f'{mode} [{app}]: Address {address}:{lport} already '
+                        f'in use by other stunnel service')
+
+                stunnel_listen_addresses.append(f'{address}:{lport}')
+                if not check_port_availability(address, lport, 'tcp') and \
+                not is_listen_port_bind_service(lport, 'stunnel'):
+                    raise ConfigError(
+                        f'{mode} [{app}]: Address {address}:{lport} already in use')
+
+            if 'options' in app_conf:
+                protocol = app_conf.get('protocol')
+                if protocol not in ['connect', 'smtp']:
+                    raise ConfigError("Additional option is only supported in the 'connect' and 'smtp' protocols.")
+                if protocol == 'smtp' and ('domain' in app_conf['options'] or 'host' in app_conf['options']):
+                    raise ConfigError("Protocol 'smtp' does not support options 'domain' and 'host'.")
+
+                # set default authentication option
+                if 'authentication' not in app_conf['options']:
+                    app_conf['options']['authentication'] = 'basic' if protocol == 'connect' else 'plain'
+
+                for option, option_config in app_conf['options'].items():
+                    if option == 'authentication':
+                        if protocol == 'connect' and option_config not in ['basic', 'ntlm']:
+                            raise ConfigError("Supported authentication types for the 'connect' protocol are 'basic' or 'ntlm'")
+                        elif protocol == 'smtp' and option_config not in ['plain', 'login']:
+                            raise ConfigError("Supported authentication types for the 'smtp' protocol are 'plain' or 'login'")
+                    if option == 'host':
+                        if 'address' not in option_config:
+                            raise ConfigError('Address is required for option host.')
+                        if 'port' not in option_config:
+                            raise ConfigError('Port is required for option host.')
+
+            # check pki certs
+            for key in ['ca_certificate', 'certificate']:
+                tmp = dict_search(f'ssl.{key}', app_conf)
+                if mode == 'server' and key != 'ca_certificate' and not tmp and 'psk' not in app_conf:
+                    raise ConfigError(f'{mode} [{app}]: TLS server needs a certificate or PSK')
+                if tmp:
+                    if key == 'ca_certificate':
+                        for ca_cert in tmp:
+                            verify_pki_ca_certificate(stunnel, ca_cert)
+                    else:
+                        verify_pki_certificate(stunnel, tmp)
+
+            #check psk
+            if 'psk' in app_conf:
+                for psk, psk_conf in app_conf['psk'].items():
+                    if 'id' not in psk_conf or 'secret' not in psk_conf:
+                        raise ConfigError(
+                            f'Authentication psk "{psk}" missing "id" or "secret"')
+
+
+def generate(stunnel):
+    if not stunnel or ('client' not in stunnel and 'server' not in stunnel):
+        if os.path.isdir(stunnel_dir):
+            rmtree(stunnel_dir, ignore_errors=True)
+
+        return None
+    makedir(stunnel_dir)
+
+    exist_files = list()
+    current_files = [config_file, config_file.replace('.conf', 'pid')]
+    for root, dirs, files in os.walk(stunnel_dir):
+        for file in files:
+            exist_files.append(os.path.join(root, file))
+
+    loaded_ca_certs = {load_certificate(c['certificate'])
+        for c in stunnel['pki']['ca'].values()} if 'pki' in stunnel and 'ca' in stunnel['pki'] else {}
+
+    for mode, conf in stunnel.items():
+        if mode not in ['server', 'client']:
+            continue
+
+        for app, app_conf in conf.items():
+            if 'ssl' in app_conf:
+                if 'certificate' in app_conf['ssl']:
+                    cert_name = app_conf['ssl']['certificate']
+
+                    pki_cert = stunnel['pki']['certificate'][cert_name]
+                    cert_file_path = os.path.join(stunnel_dir,
+                                                  f'{mode}-{app}-{cert_name}.pem')
+                    cert_key_path = os.path.join(stunnel_dir,
+                                                 f'{mode}-{app}-{cert_name}.pem.key')
+                    app_conf['ssl']['cert'] = cert_file_path
+
+                    loaded_pki_cert = load_certificate(pki_cert['certificate'])
+                    cert_full_chain = find_chain(loaded_pki_cert, loaded_ca_certs)
+
+                    write_file(cert_file_path,
+                       '\n'.join(encode_certificate(c) for c in cert_full_chain))
+                    current_files.append(cert_file_path)
+
+                    if 'private' in pki_cert and 'key' in pki_cert['private']:
+                        app_conf['ssl']['cert_key'] = cert_key_path
+                        loaded_key = load_private_key(pki_cert['private']['key'],
+                                                      passphrase=None, wrap_tags=True)
+                        key_pem = encode_private_key(loaded_key, passphrase=None)
+                        write_file(cert_key_path, key_pem, mode=0o600)
+                        current_files.append(cert_key_path)
+
+                if 'ca_certificate' in app_conf['ssl']:
+                    app_conf['ssl']['ca_path'] = stunnel_ca_dir
+                    app_conf['ssl']['ca_file'] = f'{mode}-{app}-ca.pem'
+                    ca_cert_file_path = os.path.join(stunnel_ca_dir, app_conf['ssl']['ca_file'])
+                    ca_chains = []
+
+                    for ca_name in app_conf['ssl']['ca_certificate']:
+                        pki_ca_cert = stunnel['pki']['ca'][ca_name]
+                        loaded_ca_cert = load_certificate(pki_ca_cert['certificate'])
+                        ca_full_chain = find_chain(loaded_ca_cert, loaded_ca_certs)
+                        ca_chains.append(
+                            '\n'.join(encode_certificate(c) for c in ca_full_chain))
+
+                    write_file(ca_cert_file_path, '\n'.join(ca_chains))
+                    current_files.append(ca_cert_file_path)
+
+            if 'psk' in app_conf:
+                psk_data = list()
+                psk_file_path = os.path.join(stunnel_psk_dir, f'{mode}_{app}.txt')
+
+                for _, psk_conf in app_conf['psk'].items():
+                    psk_data.append(f'{psk_conf["id"]}:{psk_conf["secret"]}')
+
+                write_file(psk_file_path, '\n'.join(psk_data))
+                app_conf['psk']['file'] = psk_file_path
+                current_files.append(psk_file_path)
+
+    for file in exist_files:
+        if file not in current_files:
+            os.unlink(file)
+
+    render(config_file, 'stunnel/stunnel_config.j2', stunnel)
+
+
+def apply(stunnel):
+    if not stunnel or ('client' not in stunnel and 'server' not in stunnel):
+        call('systemctl stop stunnel.service')
+    else:
+        call('systemctl restart stunnel.service')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_suricata.py b/src/conf_mode/service_suricata.py
new file mode 100644
index 0000000..1ce1701
--- /dev/null
+++ b/src/conf_mode/service_suricata.py
@@ -0,0 +1,161 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = '/run/suricata/suricata.yaml'
+rotate_file = '/etc/logrotate.d/suricata'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'suricata']
+
+    if not conf.exists(base):
+        return None
+
+    suricata = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                    get_first_key=True, with_recursive_defaults=True)
+
+    return suricata
+
+# https://en.wikipedia.org/wiki/Topological_sorting#Depth-first_search
+def topological_sort(source):
+    sorted_nodes = []
+    permanent_marks = set()
+    temporary_marks = set()
+
+    def visit(n, v):
+        if n in permanent_marks:
+            return
+        if n in temporary_marks:
+            raise ConfigError('At least one cycle exists in the referenced groups')
+
+        temporary_marks.add(n)
+
+        for m in v.get('group', []):
+            m = m.lstrip('!').replace('-', '_')
+            if m not in source:
+                raise ConfigError(f'Undefined referenced group "{m}"')
+            visit(m, source[m])
+
+        temporary_marks.remove(n)
+        permanent_marks.add(n)
+        sorted_nodes.append((n, v))
+
+    while len(permanent_marks) < len(source):
+        n = next(n for n in source.keys() if n not in permanent_marks)
+        visit(n, source[n])
+
+    return sorted_nodes
+
+def verify(suricata):
+    if not suricata:
+        return None
+
+    if 'interface' not in suricata:
+        raise ConfigError('No interfaces configured!')
+
+    if 'address_group' not in suricata:
+        raise ConfigError('No address-group configured!')
+
+    if 'port_group' not in suricata:
+        raise ConfigError('No port-group configured!')
+
+    try:
+        topological_sort(suricata['address_group'])
+    except (ConfigError,StopIteration) as e:
+        raise ConfigError(f'Invalid address-group: {e}')
+
+    try:
+        topological_sort(suricata['port_group'])
+    except (ConfigError,StopIteration) as e:
+        raise ConfigError(f'Invalid port-group: {e}')
+
+def generate(suricata):
+    if not suricata:
+        for file in [config_file, rotate_file]:
+            if os.path.isfile(file):
+                os.unlink(file)
+
+        return None
+
+    # Config-related formatters
+    def to_var(s:str):
+        return s.replace('-','_').upper()
+
+    def to_val(s:str):
+        return s.replace('-',':')
+
+    def to_ref(s:str):
+        if s[0] == '!':
+            return '!$' + to_var(s[1:])
+        return '$' + to_var(s)
+
+    def to_config(kind:str):
+        def format_group(group):
+            (name, value) = group
+            property = [to_val(property) for property in value.get(kind,[])]
+            group = [to_ref(group) for group in value.get('group',[])]
+            return (to_var(name), property + group)
+        return format_group
+
+    # Format the address group
+    suricata['address_group'] = map(to_config('address'),
+                                    topological_sort(suricata['address_group']))
+
+    # Format the port group
+    suricata['port_group'] = map(to_config('port'),
+                                    topological_sort(suricata['port_group']))
+
+    render(config_file, 'ids/suricata.j2', {'suricata': suricata})
+    render(rotate_file, 'ids/suricata_logrotate.j2', suricata)
+    return None
+
+def apply(suricata):
+    systemd_service = 'suricata.service'
+    if not suricata or 'interface' not in suricata:
+        # Stop suricata service if removed
+        call(f'systemctl stop {systemd_service}')
+    else:
+        Warning('To fetch the latest rules, use "update suricata"; '
+                'To periodically fetch the latest rules, '
+                'use the task scheduler!')
+        call(f'systemctl restart {systemd_service}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_tftp-server.py b/src/conf_mode/service_tftp-server.py
new file mode 100644
index 0000000..5b7303c
--- /dev/null
+++ b/src/conf_mode/service_tftp-server.py
@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import pwd
+
+from copy import deepcopy
+from glob import glob
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configverify import verify_vrf
+from vyos.template import render
+from vyos.template import is_ipv4
+from vyos.utils.process import call
+from vyos.utils.permission import chmod_755
+from vyos.utils.network import is_addr_assigned
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/etc/default/tftpd'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['service', 'tftp-server']
+    if not conf.exists(base):
+        return None
+
+    tftpd = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 get_first_key=True,
+                                 with_recursive_defaults=True)
+    return tftpd
+
+def verify(tftpd):
+    # bail out early - looks like removal from running config
+    if not tftpd:
+        return None
+
+    # Configuring allowed clients without a server makes no sense
+    if 'directory' not in tftpd:
+        raise ConfigError('TFTP root directory must be configured!')
+
+    if 'listen_address' not in tftpd:
+        raise ConfigError('TFTP server listen address must be configured!')
+
+    for address, address_config in tftpd['listen_address'].items():
+        if not is_addr_assigned(address):
+            Warning(f'TFTP server listen address "{address}" not ' \
+                     'assigned to any interface!')
+        verify_vrf(address_config)
+
+    return None
+
+def generate(tftpd):
+    # cleanup any available configuration file
+    # files will be recreated on demand
+    for i in glob(config_file + '*'):
+        os.unlink(i)
+
+    # bail out early - looks like removal from running config
+    if tftpd is None:
+        return None
+
+    idx = 0
+    for address, address_config in tftpd['listen_address'].items():
+        config = deepcopy(tftpd)
+        port = tftpd['port']
+        if is_ipv4(address):
+            config['listen_address'] = f'{address}:{port} -4'
+        else:
+            config['listen_address'] = f'[{address}]:{port} -6'
+
+        if 'vrf' in address_config:
+            config['vrf'] = address_config['vrf']
+
+        file = config_file + str(idx)
+        render(file, 'tftp-server/default.j2', config)
+        idx = idx + 1
+
+    return None
+
+def apply(tftpd):
+    # stop all services first - then we will decide
+    call('systemctl stop tftpd@*.service')
+
+    # bail out early - e.g. service deletion
+    if tftpd is None:
+        return None
+
+    tftp_root = tftpd['directory']
+    if not os.path.exists(tftp_root):
+        os.makedirs(tftp_root)
+        chmod_755(tftp_root)
+
+    # get UNIX uid for user 'tftp'
+    tftp_uid = pwd.getpwnam('tftp').pw_uid
+    tftp_gid = pwd.getpwnam('tftp').pw_gid
+
+    # get UNIX uid for tftproot directory
+    dir_uid = os.stat(tftp_root).st_uid
+    dir_gid = os.stat(tftp_root).st_gid
+
+    # adjust uid/gid of tftproot directory if files don't belong to user tftp
+    if (tftp_uid != dir_uid) or (tftp_gid != dir_gid):
+        os.chown(tftp_root, tftp_uid, tftp_gid)
+
+    idx = 0
+    for address in tftpd['listen_address']:
+        call(f'systemctl restart tftpd@{idx}.service')
+        idx = idx + 1
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/service_webproxy.py b/src/conf_mode/service_webproxy.py
new file mode 100644
index 0000000..12ae413
--- /dev/null
+++ b/src/conf_mode/service_webproxy.py
@@ -0,0 +1,252 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from shutil import rmtree
+from sys import exit
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.permission import chmod_755
+from vyos.utils.dict import dict_search
+from vyos.utils.file import write_file
+from vyos.utils.network import is_addr_assigned
+from vyos.base import Warning
+from vyos import ConfigError
+from vyos import airbag
+
+airbag.enable()
+
+squid_config_file = '/etc/squid/squid.conf'
+squidguard_config_file = '/etc/squidguard/squidGuard.conf'
+squidguard_db_dir = '/opt/vyatta/etc/config/url-filtering/squidguard/db'
+user_group = 'proxy'
+
+
+def check_blacklist_categorydb(config_section):
+    if 'block_category' in config_section:
+        for category in config_section['block_category']:
+            check_categorydb(category)
+    if 'allow_category' in config_section:
+        for category in config_section['allow_category']:
+            check_categorydb(category)
+
+
+def check_categorydb(category: str):
+    """
+    Check if category's db exist
+    :param category:
+    :type str:
+    """
+    path_to_cat: str = f'{squidguard_db_dir}/{category}'
+    if not os.path.exists(f'{path_to_cat}/domains.db') \
+            and not os.path.exists(f'{path_to_cat}/urls.db') \
+            and not os.path.exists(f'{path_to_cat}/expressions.db'):
+        Warning(f'DB of category {category} does not exist.\n '
+                f'Use [update webproxy blacklists] '
+                f'or delete undefined category!')
+
+
+def generate_sg_rule_localdb(category, list_type, role, proxy):
+    if not category or not list_type or not role:
+        return None
+
+    cat_ = category.replace('-', '_')
+
+    if role == 'default':
+        path_to_cat = f'{cat_}'
+    else:
+        path_to_cat = f'rule.{role}.{cat_}'
+    if isinstance(
+            dict_search(f'url_filtering.squidguard.{path_to_cat}', proxy),
+            list):
+        # local block databases must be generated "on-the-fly"
+        tmp = {
+            'squidguard_db_dir': squidguard_db_dir,
+            'category': f'{category}-{role}',
+            'list_type': list_type,
+            'rule': role
+        }
+        sg_tmp_file = '/tmp/sg.conf'
+        db_file = f'{category}-{role}/{list_type}'
+        domains = '\n'.join(
+            dict_search(f'url_filtering.squidguard.{path_to_cat}', proxy))
+        # local file
+        write_file(f'{squidguard_db_dir}/{category}-{role}/local', '',
+                   user=user_group, group=user_group)
+        # database input file
+        write_file(f'{squidguard_db_dir}/{db_file}', domains,
+                   user=user_group, group=user_group)
+
+        # temporary config file, deleted after generation
+        render(sg_tmp_file, 'squid/sg_acl.conf.j2', tmp,
+               user=user_group, group=user_group)
+
+        call(
+            f'su - {user_group} -c "squidGuard -d -c {sg_tmp_file} -C {db_file}"')
+
+        if os.path.exists(sg_tmp_file):
+            os.unlink(sg_tmp_file)
+    else:
+        # if category is not part of our configuration, clean out the
+        # squidguard lists
+        tmp = f'{squidguard_db_dir}/{category}-{role}'
+        if os.path.exists(tmp):
+            rmtree(f'{squidguard_db_dir}/{category}-{role}')
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['service', 'webproxy']
+    if not conf.exists(base):
+        return None
+
+    proxy = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 get_first_key=True)
+    # We have gathered the dict representation of the CLI, but there are default
+    # options which we need to update into the dictionary retrived.
+    default_values = conf.get_config_defaults(**proxy.kwargs,
+                                              recursive=True)
+
+    # if no authentication method is supplied, no need to add defaults
+    if not dict_search('authentication.method', proxy):
+        default_values.pop('authentication')
+    # if no url_filteringurl-filtering method is supplied, no need to add defaults
+    if 'url_filtering' not in proxy:
+        default_values.pop('url_filtering')
+    else:
+        # store path to squidGuard config, used when generating Squid config
+        proxy['squidguard_conf'] = squidguard_config_file
+        proxy['squidguard_db_dir'] = squidguard_db_dir
+
+    proxy = config_dict_merge(default_values, proxy)
+
+    return proxy
+
+
+def verify(proxy):
+    if not proxy:
+        return None
+
+    if 'listen_address' not in proxy:
+        raise ConfigError('listen-address needs to be configured!')
+
+    ldap_auth = dict_search('authentication.method', proxy) == 'ldap'
+
+    for address, config in proxy['listen_address'].items():
+        if ldap_auth and 'disable_transparent' not in config:
+            raise ConfigError('Authentication can not be configured when ' \
+                              'proxy is in transparent mode')
+
+    if 'outgoing_address' in proxy:
+        address = proxy['outgoing_address']
+        if not is_addr_assigned(address):
+            raise ConfigError(
+                f'outgoing-address "{address}" not assigned on any interface!')
+
+    if 'authentication' in proxy:
+        if 'method' not in proxy['authentication']:
+            raise ConfigError('proxy authentication method required!')
+
+        if ldap_auth:
+            ldap_config = proxy['authentication']['ldap']
+
+            if 'server' not in ldap_config:
+                raise ConfigError(
+                    'LDAP authentication enabled, but no server set')
+
+            if 'password' in ldap_config and 'bind_dn' not in ldap_config:
+                raise ConfigError(
+                    'LDAP password can not be set when base-dn is undefined!')
+
+            if 'bind_dn' in ldap_config and 'password' not in ldap_config:
+                raise ConfigError(
+                    'LDAP bind DN can not be set without password!')
+
+            if 'base_dn' not in ldap_config:
+                raise ConfigError('LDAP base-dn must be set!')
+
+    if 'cache_peer' in proxy:
+        for peer, config in proxy['cache_peer'].items():
+            if 'address' not in config:
+                raise ConfigError(f'Cache-peer "{peer}" address must be set!')
+
+
+def generate(proxy):
+    if not proxy:
+        return None
+
+    render(squid_config_file, 'squid/squid.conf.j2', proxy)
+    render(squidguard_config_file, 'squid/squidGuard.conf.j2', proxy)
+
+    cat_dict = {
+        'local-block': 'domains',
+        'local-block-keyword': 'expressions',
+        'local-block-url': 'urls',
+        'local-ok': 'domains',
+        'local-ok-url': 'urls'
+    }
+    if dict_search(f'url_filtering.squidguard', proxy) is not None:
+        squidgard_config_section = proxy['url_filtering']['squidguard']
+
+        for category, list_type in cat_dict.items():
+            generate_sg_rule_localdb(category, list_type, 'default', proxy)
+        check_blacklist_categorydb(squidgard_config_section)
+
+        if 'rule' in squidgard_config_section:
+            for rule in squidgard_config_section['rule']:
+                rule_config_section = squidgard_config_section['rule'][
+                    rule]
+                for category, list_type in cat_dict.items():
+                    generate_sg_rule_localdb(category, list_type, rule, proxy)
+                check_blacklist_categorydb(rule_config_section)
+
+    return None
+
+
+def apply(proxy):
+    if not proxy:
+        # proxy is removed in the commit
+        call('systemctl stop squid.service')
+
+        if os.path.exists(squid_config_file):
+            os.unlink(squid_config_file)
+        if os.path.exists(squidguard_config_file):
+            os.unlink(squidguard_config_file)
+
+        return None
+
+    if os.path.exists(squidguard_db_dir):
+        chmod_755(squidguard_db_dir)
+    call('systemctl reload-or-restart squid.service')
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_acceleration.py b/src/conf_mode/system_acceleration.py
new file mode 100644
index 0000000..d2cf44f
--- /dev/null
+++ b/src/conf_mode/system_acceleration.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import re
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.utils.process import popen
+from vyos.utils.process import run
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+qat_init_script = '/etc/init.d/qat_service'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    data = {}
+
+    if conf.exists(['system', 'acceleration', 'qat']):
+        data.update({'qat_enable' : ''})
+
+    if conf.exists(['vpn', 'ipsec']):
+        data.update({'ipsec' : ''})
+
+    if conf.exists(['interfaces', 'openvpn']):
+        data.update({'openvpn' : ''})
+
+    return data
+
+
+def vpn_control(action, force_ipsec=False):
+    # XXX: Should these commands report failure?
+    if action == 'restore' and force_ipsec:
+        return run('ipsec start')
+
+    return run(f'ipsec {action}')
+
+
+def verify(qat):
+    if 'qat_enable' not in qat:
+        return
+
+    # Check if QAT service installed
+    if not os.path.exists(qat_init_script):
+        raise ConfigError('QAT init script not found')
+
+    # Check if QAT device exist
+    output, err = popen('lspci -nn', decode='utf-8')
+    if not err:
+        # PCI id | Chipset
+        # 19e2 -> C3xx
+        # 37c8 -> C62x
+        # 0435 -> DH895
+        # 6f54 -> D15xx
+        # 18ee -> QAT_200XX
+        data = re.findall(
+            '(8086:19e2)|(8086:37c8)|(8086:0435)|(8086:6f54)|(8086:18ee)', output)
+        # If QAT devices found
+        if not data:
+            raise ConfigError('No QAT acceleration device found')
+
+def generate(qat):
+    return
+
+def apply(qat):
+    # Shutdown VPN service which can use QAT
+    if 'ipsec' in qat:
+        vpn_control('stop')
+
+    # Enable/Disable QAT service
+    if 'qat_enable' in qat:
+        run(f'{qat_init_script} start')
+    else:
+        run(f'{qat_init_script} stop')
+
+    # Recover VPN service
+    if 'ipsec' in qat:
+        vpn_control('start')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        vpn_control('restore', force_ipsec=('ipsec' in c))
+        exit(1)
diff --git a/src/conf_mode/system_config-management.py b/src/conf_mode/system_config-management.py
new file mode 100644
index 0000000..c681a84
--- /dev/null
+++ b/src/conf_mode/system_config-management.py
@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import sys
+
+from vyos import ConfigError
+from vyos.config import Config
+from vyos.config_mgmt import ConfigMgmt
+from vyos.config_mgmt import commit_post_hook_dir, commit_hooks
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['system', 'config-management']
+    if not conf.exists(base):
+        return None
+
+    mgmt = ConfigMgmt(config=conf)
+
+    return mgmt
+
+def verify(_mgmt):
+    return
+
+def generate(mgmt):
+    if mgmt is None:
+        return
+
+    mgmt.initialize_revision()
+
+def apply(mgmt):
+    if mgmt is None:
+        return
+
+    locations = mgmt.locations
+    archive_target = os.path.join(commit_post_hook_dir,
+                               commit_hooks['commit_archive'])
+    if locations:
+        try:
+            os.symlink('/usr/bin/config-mgmt', archive_target)
+        except FileExistsError:
+            pass
+        except OSError as exc:
+            raise ConfigError from exc
+    else:
+        try:
+            os.unlink(archive_target)
+        except FileNotFoundError:
+            pass
+        except OSError as exc:
+            raise ConfigError from exc
+
+    revisions = mgmt.max_revisions
+    revision_target = os.path.join(commit_post_hook_dir,
+                               commit_hooks['commit_revision'])
+    if revisions > 0:
+        try:
+            os.symlink('/usr/bin/config-mgmt', revision_target)
+        except FileExistsError:
+            pass
+        except OSError as exc:
+            raise ConfigError from exc
+    else:
+        try:
+            os.unlink(revision_target)
+        except FileNotFoundError:
+            pass
+        except OSError as exc:
+            raise ConfigError from exc
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/conf_mode/system_conntrack.py b/src/conf_mode/system_conntrack.py
new file mode 100644
index 0000000..2529445
--- /dev/null
+++ b/src/conf_mode/system_conntrack.py
@@ -0,0 +1,273 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+import json
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdep import set_dependents, call_dependents
+from vyos.utils.dict import dict_search
+from vyos.utils.dict import dict_search_args
+from vyos.utils.dict import dict_search_recursive
+from vyos.utils.file import write_file
+from vyos.utils.process import cmd, call
+from vyos.utils.process import rc_cmd
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+conntrack_config = r'/etc/modprobe.d/vyatta_nf_conntrack.conf'
+sysctl_file = r'/run/sysctl/10-vyos-conntrack.conf'
+nftables_ct_file = r'/run/nftables-ct.conf'
+vyos_conntrack_logger_config = r'/run/vyos-conntrack-logger.conf'
+
+# Every ALG (Application Layer Gateway) consists of either a Kernel Object
+# also called a Kernel Module/Driver or some rules present in iptables
+module_map = {
+    'ftp': {
+        'ko': ['nf_nat_ftp', 'nf_conntrack_ftp'],
+        'nftables': ['tcp dport {21} ct helper set "ftp_tcp" return']
+    },
+    'h323': {
+        'ko': ['nf_nat_h323', 'nf_conntrack_h323'],
+        'nftables': ['udp dport {1719} ct helper set "ras_udp" return',
+                     'tcp dport {1720} ct helper set "q931_tcp" return']
+    },
+    'nfs': {
+        'nftables': ['tcp dport {111} ct helper set "rpc_tcp" return',
+                     'udp dport {111} ct helper set "rpc_udp" return']
+    },
+    'pptp': {
+        'ko': ['nf_nat_pptp', 'nf_conntrack_pptp'],
+        'nftables': ['tcp dport {1723} ct helper set "pptp_tcp" return'],
+        'ipv4': True
+     },
+    'rtsp': {
+        'ko': ['nf_nat_rtsp', 'nf_conntrack_rtsp'],
+        'nftables': ['tcp dport {554} ct helper set "rtsp_tcp" return'],
+        'ipv4': True
+    },
+    'sip': {
+        'ko': ['nf_nat_sip', 'nf_conntrack_sip'],
+        'nftables': ['tcp dport {5060,5061} ct helper set "sip_tcp" return',
+                     'udp dport {5060,5061} ct helper set "sip_udp" return']
+     },
+    'sqlnet': {
+        'nftables': ['tcp dport {1521,1525,1536} ct helper set "tns_tcp" return']
+    },
+    'tftp': {
+        'ko': ['nf_nat_tftp', 'nf_conntrack_tftp'],
+        'nftables': ['udp dport {69} ct helper set "tftp_udp" return']
+     },
+}
+
+valid_groups = [
+    'address_group',
+    'domain_group',
+    'network_group',
+    'port_group'
+]
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'conntrack']
+
+    conntrack = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                     get_first_key=True,
+                                     with_recursive_defaults=True)
+
+    conntrack['firewall'] = conf.get_config_dict(['firewall'], key_mangling=('-', '_'),
+                                                 get_first_key=True,
+                                                 no_tag_node_value_mangle=True)
+
+    conntrack['ipv4_nat_action'] = 'accept' if conf.exists(['nat']) else 'return'
+    conntrack['ipv6_nat_action'] = 'accept' if conf.exists(['nat66']) else 'return'
+    conntrack['wlb_action'] = 'accept' if conf.exists(['load-balancing', 'wan']) else 'return'
+    conntrack['wlb_local_action'] = conf.exists(['load-balancing', 'wan', 'enable-local-traffic'])
+
+    conntrack['module_map'] = module_map
+
+    if conf.exists(['service', 'conntrack-sync']):
+        set_dependents('conntrack_sync', conf)
+
+    # If conntrack status changes, VRF zone rules need updating
+    if conf.exists(['vrf']):
+        set_dependents('vrf', conf)
+
+    return conntrack
+
+
+def verify(conntrack):
+    for inet in ['ipv4', 'ipv6']:
+        if dict_search_args(conntrack, 'ignore', inet, 'rule') != None:
+            for rule, rule_config in conntrack['ignore'][inet]['rule'].items():
+                if dict_search('destination.port', rule_config) or \
+                   dict_search('destination.group.port_group', rule_config) or \
+                   dict_search('source.port', rule_config) or \
+                   dict_search('source.group.port_group', rule_config):
+                   if 'protocol' not in rule_config or rule_config['protocol'] not in ['tcp', 'udp']:
+                       raise ConfigError(f'Port requires tcp or udp as protocol in rule {rule}')
+
+                tcp_flags = dict_search_args(rule_config, 'tcp', 'flags')
+                if tcp_flags:
+                    if dict_search_args(rule_config, 'protocol') != 'tcp':
+                        raise ConfigError('Protocol must be tcp when specifying tcp flags')
+
+                    not_flags = dict_search_args(rule_config, 'tcp', 'flags', 'not')
+                    if not_flags:
+                        duplicates = [flag for flag in tcp_flags if flag in not_flags]
+                        if duplicates:
+                            raise ConfigError(f'Cannot match a tcp flag as set and not set')
+
+                for side in ['destination', 'source']:
+                    if side in rule_config:
+                        side_conf = rule_config[side]
+
+                        if 'group' in side_conf:
+                            if len({'address_group', 'network_group', 'domain_group'} & set(side_conf['group'])) > 1:
+                                raise ConfigError('Only one address-group, network-group or domain-group can be specified')
+
+                            for group in valid_groups:
+                                if group in side_conf['group']:
+                                    group_name = side_conf['group'][group]
+                                    error_group = group.replace("_", "-")
+
+                                    if group in ['address_group', 'network_group', 'domain_group']:
+                                        if 'address' in side_conf:
+                                            raise ConfigError(f'{error_group} and address cannot both be defined')
+
+                                    if group_name and group_name[0] == '!':
+                                        group_name = group_name[1:]
+
+                                    if inet == 'ipv6':
+                                        group = f'ipv6_{group}'
+
+                                    group_obj = dict_search_args(conntrack['firewall'], 'group', group, group_name)
+
+                                    if group_obj is None:
+                                        raise ConfigError(f'Invalid {error_group} "{group_name}" on ignore rule')
+
+                                    if not group_obj:
+                                        Warning(f'{error_group} "{group_name}" has no members!')
+
+            Warning(f'It is prefered to define {inet} conntrack ignore rules in <firewall {inet} prerouting raw> section')
+
+        if dict_search_args(conntrack, 'timeout', 'custom', inet, 'rule') != None:
+            for rule, rule_config in conntrack['timeout']['custom'][inet]['rule'].items():
+                if 'protocol' not in rule_config:
+                    raise ConfigError(f'Conntrack custom timeout rule {rule} requires protocol tcp or udp')
+                else:
+                    if 'tcp' in rule_config['protocol'] and 'udp' in rule_config['protocol']:
+                        raise ConfigError(f'conntrack custom timeout rule {rule} - Cant use both tcp and udp protocol')
+    return None
+
+def generate(conntrack):
+    if not os.path.exists(nftables_ct_file):
+        conntrack['first_install'] = True
+
+    if 'log' not in conntrack:
+        # Remove old conntrack-logger config and return
+        if os.path.exists(vyos_conntrack_logger_config):
+            os.unlink(vyos_conntrack_logger_config)
+
+    # Determine if conntrack is needed
+    conntrack['ipv4_firewall_action'] = 'return'
+    conntrack['ipv6_firewall_action'] = 'return'
+
+    if dict_search_args(conntrack['firewall'], 'global_options', 'state_policy') != None:
+        conntrack['ipv4_firewall_action'] = 'accept'
+        conntrack['ipv6_firewall_action'] = 'accept'
+    else:
+        for rules, path in dict_search_recursive(conntrack['firewall'], 'rule'):
+            if any(('state' in rule_conf or 'connection_status' in rule_conf or 'offload_target' in rule_conf) for rule_conf in rules.values()):
+                if path[0] == 'ipv4':
+                    conntrack['ipv4_firewall_action'] = 'accept'
+                elif path[0] == 'ipv6':
+                    conntrack['ipv6_firewall_action'] = 'accept'
+
+    render(conntrack_config, 'conntrack/vyos_nf_conntrack.conf.j2', conntrack)
+    render(sysctl_file, 'conntrack/sysctl.conf.j2', conntrack)
+    render(nftables_ct_file, 'conntrack/nftables-ct.j2', conntrack)
+
+    if 'log' in conntrack:
+        log_conf_json = json.dumps(conntrack['log'], indent=4)
+        write_file(vyos_conntrack_logger_config, log_conf_json)
+
+    return None
+
+def apply(conntrack):
+    # Depending on the enable/disable state of the ALG (Application Layer Gateway)
+    # modules we need to either insmod or rmmod the helpers.
+
+    add_modules = []
+    rm_modules = []
+
+    for module, module_config in module_map.items():
+        if dict_search_args(conntrack, 'modules', module) is None:
+            if 'ko' in module_config:
+                unloaded = [mod for mod in module_config['ko'] if os.path.exists(f'/sys/module/{mod}')]
+                rm_modules.extend(unloaded)
+        else:
+            if 'ko' in module_config:
+                add_modules.extend(module_config['ko'])
+
+    # Add modules before nftables uses them
+    if add_modules:
+        module_str = ' '.join(add_modules)
+        cmd(f'modprobe -a {module_str}')
+
+    # Load new nftables ruleset
+    install_result, output = rc_cmd(f'nft --file {nftables_ct_file}')
+    if install_result == 1:
+        raise ConfigError(f'Failed to apply configuration: {output}')
+
+    # Remove modules after nftables stops using them
+    if rm_modules:
+        module_str = ' '.join(rm_modules)
+        cmd(f'rmmod {module_str}')
+
+    try:
+        call_dependents()
+    except ConfigError:
+        # Ignore config errors on dependent due to being called too early. Example:
+        # ConfigError("ConfigError('Interface ethN requires an IP address!')")
+        pass
+
+    # We silently ignore all errors
+    # See: https://bugzilla.redhat.com/show_bug.cgi?id=1264080
+    cmd(f'sysctl -f {sysctl_file}')
+
+    if 'log' in conntrack:
+        call(f'systemctl restart vyos-conntrack-logger.service')
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_console.py b/src/conf_mode/system_console.py
new file mode 100644
index 0000000..b380e05
--- /dev/null
+++ b/src/conf_mode/system_console.py
@@ -0,0 +1,147 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+from pathlib import Path
+
+from vyos.config import Config
+from vyos.utils.process import call
+from vyos.utils.serial import restart_login_consoles
+from vyos.system import grub_util
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+by_bus_dir = '/dev/serial/by-bus'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'console']
+
+    # retrieve configuration at once
+    console = conf.get_config_dict(base, get_first_key=True)
+
+    # bail out early if no serial console is configured
+    if 'device' not in console:
+        return console
+
+    for device, device_config in console['device'].items():
+        if 'speed' not in device_config and device.startswith('hvc'):
+            # XEN console has a different default console speed
+            console['device'][device]['speed'] = 38400
+
+    console = conf.merge_defaults(console, recursive=True)
+
+    return console
+
+def verify(console):
+    if not console or 'device' not in console:
+        return None
+
+    for device in console['device']:
+        if device.startswith('usb'):
+            # It is much easiert to work with the native ttyUSBn name when using
+            # getty, but that name may change across reboots - depending on the
+            # amount of connected devices. We will resolve the fixed device name
+            # to its dynamic device file - and create a new dict entry for it.
+            by_bus_device = f'{by_bus_dir}/{device}'
+            # If the device name still starts with usbXXX no matching tty was found
+            # and it can not be used as a serial interface
+            if not os.path.isdir(by_bus_dir) or not os.path.exists(by_bus_device):
+                raise ConfigError(f'Device {device} does not support beeing used as tty')
+
+    return None
+
+def generate(console):
+    base_dir = '/run/systemd/system'
+    # Remove all serial-getty configuration files in advance
+    for root, dirs, files in os.walk(base_dir):
+        for basename in files:
+            if 'serial-getty' in basename:
+                os.unlink(os.path.join(root, basename))
+
+    if not console or 'device' not in console:
+        return None
+
+    # replace keys in the config for ttyUSB items to use them in `apply()` later
+    for device in console['device'].copy():
+        if device.startswith('usb'):
+            # It is much easiert to work with the native ttyUSBn name when using
+            # getty, but that name may change across reboots - depending on the
+            # amount of connected devices. We will resolve the fixed device name
+            # to its dynamic device file - and create a new dict entry for it.
+            by_bus_device = f'{by_bus_dir}/{device}'
+            if os.path.isdir(by_bus_dir) and os.path.exists(by_bus_device):
+                device_updated = os.path.basename(os.readlink(by_bus_device))
+
+                # replace keys in the config to use them in `apply()` later
+                console['device'][device_updated] = console['device'][device]
+                del console['device'][device]
+            else:
+                raise ConfigError(f'Device {device} does not support beeing used as tty')
+
+    for device, device_config in console['device'].items():
+        config_file = base_dir + f'/serial-getty@{device}.service'
+        Path(f'{base_dir}/getty.target.wants').mkdir(exist_ok=True)
+        getty_wants_symlink = base_dir + f'/getty.target.wants/serial-getty@{device}.service'
+
+        render(config_file, 'getty/serial-getty.service.j2', device_config)
+        os.symlink(config_file, getty_wants_symlink)
+
+    # GRUB
+    # For existing serial line change speed (if necessary)
+    # Only applys to ttyS0
+    if 'ttyS0' not in console['device']:
+        return None
+
+    speed = console['device']['ttyS0']['speed']
+    grub_util.update_console_speed(speed)
+
+    return None
+
+def apply(console):
+    # Reset screen blanking
+    call('/usr/bin/setterm -blank 0 -powersave off -powerdown 0 -term linux </dev/tty1 >/dev/tty1 2>&1')
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+
+    # Service control moved to vyos.utils.serial to unify checks and prompts. 
+    # If users are connected, we want to show an informational message on completing 
+    # the process, but not halt configuration processing with an interactive prompt. 
+    restart_login_consoles(prompt_user=False, quiet=False)
+
+    if not console:
+        return None
+
+    if 'powersave' in console.keys():
+        # Configure screen blank powersaving on VGA console
+        call('/usr/bin/setterm -blank 15 -powersave powerdown -powerdown 60 -term linux </dev/tty1 >/dev/tty1 2>&1')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_flow-accounting.py b/src/conf_mode/system_flow-accounting.py
new file mode 100644
index 0000000..a12ee36
--- /dev/null
+++ b/src/conf_mode/system_flow-accounting.py
@@ -0,0 +1,316 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import re
+
+from sys import exit
+from ipaddress import ip_address
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configverify import verify_vrf
+from vyos.configverify import verify_interface_exists
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.process import cmd
+from vyos.utils.process import run
+from vyos.utils.network import is_addr_assigned
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+uacctd_conf_path = '/run/pmacct/uacctd.conf'
+systemd_service = 'uacctd.service'
+systemd_override = f'/run/systemd/system/{systemd_service}.d/override.conf'
+nftables_nflog_table = 'raw'
+nftables_nflog_chain = 'VYOS_PREROUTING_HOOK'
+egress_nftables_nflog_table = 'inet mangle'
+egress_nftables_nflog_chain = 'FORWARD'
+
+# get nftables rule dict for chain in table
+def _nftables_get_nflog(chain, table):
+    # define list with rules
+    rules = []
+
+    # prepare regex for parsing rules
+    rule_pattern = '[io]ifname "(?P<interface>[\w\.\*\-]+)".*handle (?P<handle>[\d]+)'
+    rule_re = re.compile(rule_pattern)
+
+    # run nftables, save output and split it by lines
+    nftables_command = f'nft -a list chain {table} {chain}'
+    tmp = cmd(nftables_command, message='Failed to get flows list')
+    # parse each line and add information to list
+    for current_rule in tmp.splitlines():
+        if 'FLOW_ACCOUNTING_RULE' not in current_rule:
+            continue
+        current_rule_parsed = rule_re.search(current_rule)
+        if current_rule_parsed:
+            groups = current_rule_parsed.groupdict()
+            rules.append({ 'interface': groups["interface"], 'table': table, 'handle': groups["handle"] })
+
+    # return list with rules
+    return rules
+
+def _nftables_config(configured_ifaces, direction, length=None):
+    # define list of nftables commands to modify settings
+    nftable_commands = []
+    nftables_chain = nftables_nflog_chain
+    nftables_table = nftables_nflog_table
+
+    if direction == "egress":
+        nftables_chain = egress_nftables_nflog_chain
+        nftables_table = egress_nftables_nflog_table
+
+    # prepare extended list with configured interfaces
+    configured_ifaces_extended = []
+    for iface in configured_ifaces:
+        configured_ifaces_extended.append({ 'iface': iface })
+
+    # get currently configured interfaces with nftables rules
+    active_nflog_rules = _nftables_get_nflog(nftables_chain, nftables_table)
+
+    # compare current active list with configured one and delete excessive interfaces, add missed
+    active_nflog_ifaces = []
+    for rule in active_nflog_rules:
+        interface = rule['interface']
+        if interface not in configured_ifaces:
+            table = rule['table']
+            handle = rule['handle']
+            nftable_commands.append(f'nft delete rule {table} {nftables_chain} handle {handle}')
+        else:
+            active_nflog_ifaces.append({
+                'iface': interface,
+            })
+
+    # do not create new rules for already configured interfaces
+    for iface in active_nflog_ifaces:
+        if iface in active_nflog_ifaces and iface in configured_ifaces_extended:
+            configured_ifaces_extended.remove(iface)
+
+    # create missed rules
+    for iface_extended in configured_ifaces_extended:
+        iface = iface_extended['iface']
+        iface_prefix = "o" if direction == "egress" else "i"
+        rule_definition = f'{iface_prefix}ifname "{iface}" counter log group 2 snaplen {length} queue-threshold 100 comment "FLOW_ACCOUNTING_RULE"'
+        nftable_commands.append(f'nft insert rule {nftables_table} {nftables_chain} {rule_definition}')
+        # Also add IPv6 ingres logging
+        if nftables_table == nftables_nflog_table:
+            nftable_commands.append(f'nft insert rule ip6 {nftables_table} {nftables_chain} {rule_definition}')
+
+    # change nftables
+    for command in nftable_commands:
+        cmd(command, raising=ConfigError)
+
+
+def _nftables_trigger_setup(operation: str) -> None:
+    """Add a dummy rule to unlock the main pmacct loop with a packet-trigger
+
+    Args:
+        operation (str): 'add' or 'delete' a trigger
+    """
+    # check if a chain exists
+    table_exists = False
+    if run('nft -snj list table ip pmacct') == 0:
+        table_exists = True
+
+    if operation == 'delete' and table_exists:
+        nft_cmd: str = 'nft delete table ip pmacct'
+        cmd(nft_cmd, raising=ConfigError)
+    if operation == 'add' and not table_exists:
+        nft_cmds: list[str] = [
+            'nft add table ip pmacct',
+            'nft add chain ip pmacct pmacct_out { type filter hook output priority raw - 50 \\; policy accept \\; }',
+            'nft add rule ip pmacct pmacct_out oif lo ip daddr 127.0.254.0 counter log group 2 snaplen 1 queue-threshold 0 comment NFLOG_TRIGGER'
+        ]
+        for nft_cmd in nft_cmds:
+            cmd(nft_cmd, raising=ConfigError)
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'flow-accounting']
+    if not conf.exists(base):
+        return None
+
+    flow_accounting = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+    # We have gathered the dict representation of the CLI, but there are
+    # default values which we need to conditionally update into the
+    # dictionary retrieved.
+    default_values = conf.get_config_defaults(**flow_accounting.kwargs,
+                                              recursive=True)
+
+    # delete individual flow type defaults - should only be added if user
+    # sets this feature
+    for flow_type in ['sflow', 'netflow']:
+        if flow_type not in flow_accounting and flow_type in default_values:
+            del default_values[flow_type]
+
+    flow_accounting = config_dict_merge(default_values, flow_accounting)
+
+    return flow_accounting
+
+def verify(flow_config):
+    if not flow_config:
+        return None
+
+    # check if at least one collector is enabled
+    if 'sflow' not in flow_config and 'netflow' not in flow_config and 'disable_imt' in flow_config:
+        raise ConfigError('You need to configure at least sFlow or NetFlow, ' \
+                          'or not set "disable-imt" for flow-accounting!')
+
+    # Check if at least one interface is configured
+    if 'interface' not in flow_config:
+        raise ConfigError('Flow accounting requires at least one interface to ' \
+                          'be configured!')
+
+    # check that all configured interfaces exists in the system
+    for interface in flow_config['interface']:
+        verify_interface_exists(flow_config, interface, warning_only=True)
+
+    # check sFlow configuration
+    if 'sflow' in flow_config:
+        # check if at least one sFlow collector is configured
+        if 'server' not in flow_config['sflow']:
+            raise ConfigError('You need to configure at least one sFlow server!')
+
+        # check that all sFlow collectors use the same IP protocol version
+        sflow_collector_ipver = None
+        for server in flow_config['sflow']['server']:
+            if sflow_collector_ipver:
+                if sflow_collector_ipver != ip_address(server).version:
+                    raise ConfigError("All sFlow servers must use the same IP protocol")
+            else:
+                sflow_collector_ipver = ip_address(server).version
+
+        # check if vrf is defined for Sflow
+        verify_vrf(flow_config)
+        sflow_vrf = None
+        if 'vrf' in flow_config:
+            sflow_vrf = flow_config['vrf']
+
+        # check agent-id for sFlow: we should avoid mixing IPv4 agent-id with IPv6 collectors and vice-versa
+        for server in flow_config['sflow']['server']:
+            if 'agent_address' in flow_config['sflow']:
+                if ip_address(server).version != ip_address(flow_config['sflow']['agent_address']).version:
+                    raise ConfigError('IPv4 and IPv6 addresses can not be mixed in "sflow agent-address" and "sflow '\
+                                      'server". You need to set the same IP version for both "agent-address" and '\
+                                      'all sFlow servers')
+
+        if 'agent_address' in flow_config['sflow']:
+            tmp = flow_config['sflow']['agent_address']
+            if not is_addr_assigned(tmp, sflow_vrf):
+                raise ConfigError(f'Configured "sflow agent-address {tmp}" does not exist in the system!')
+
+        # Check if configured sflow source-address exist in the system
+        if 'source_address' in flow_config['sflow']:
+            if not is_addr_assigned(flow_config['sflow']['source_address'], sflow_vrf):
+                tmp = flow_config['sflow']['source_address']
+                raise ConfigError(f'Configured "sflow source-address {tmp}" does not exist on the system!')
+
+    # check NetFlow configuration
+    if 'netflow' in flow_config:
+        # check if vrf is defined for netflow
+        netflow_vrf = None
+        if 'vrf' in flow_config:
+            netflow_vrf = flow_config['vrf']
+
+        # check if at least one NetFlow collector is configured if NetFlow configuration is presented
+        if 'server' not in flow_config['netflow']:
+            raise ConfigError('You need to configure at least one NetFlow server!')
+
+        # Check if configured netflow source-address exist in the system
+        if 'source_address' in flow_config['netflow']:
+            if not is_addr_assigned(flow_config['netflow']['source_address'], netflow_vrf):
+                tmp = flow_config['netflow']['source_address']
+                raise ConfigError(f'Configured "netflow source-address {tmp}" does not exist on the system!')
+
+        # Check if engine-id compatible with selected protocol version
+        if 'engine_id' in flow_config['netflow']:
+            v5_filter = '^(\d|[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]):(\d|[1-9]\d|1\d{2}|2[0-4]\d|25[0-5])$'
+            v9v10_filter = '^(\d|[1-9]\d{1,8}|[1-3]\d{9}|4[01]\d{8}|42[0-8]\d{7}|429[0-3]\d{6}|4294[0-8]\d{5}|42949[0-5]\d{4}|429496[0-6]\d{3}|4294967[01]\d{2}|42949672[0-8]\d|429496729[0-5])$'
+            engine_id = flow_config['netflow']['engine_id']
+            version = flow_config['netflow']['version']
+
+            if flow_config['netflow']['version'] == '5':
+                regex_filter = re.compile(v5_filter)
+                if not regex_filter.search(engine_id):
+                    raise ConfigError(f'You cannot use NetFlow engine-id "{engine_id}" '\
+                                      f'together with NetFlow protocol version "{version}"!')
+            else:
+                regex_filter = re.compile(v9v10_filter)
+                if not regex_filter.search(flow_config['netflow']['engine_id']):
+                    raise ConfigError(f'Can not use NetFlow engine-id "{engine_id}" together '\
+                                      f'with NetFlow protocol version "{version}"!')
+
+    # return True if all checks were passed
+    return True
+
+def generate(flow_config):
+    if not flow_config:
+        return None
+
+    render(uacctd_conf_path, 'pmacct/uacctd.conf.j2', flow_config)
+    render(systemd_override, 'pmacct/override.conf.j2', flow_config)
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+
+def apply(flow_config):
+    # Check if flow-accounting was removed and define command
+    if not flow_config:
+        _nftables_config([], 'ingress')
+        _nftables_config([], 'egress')
+
+        # Stop flow-accounting daemon and remove configuration file
+        call(f'systemctl stop {systemd_service}')
+        if os.path.exists(uacctd_conf_path):
+            os.unlink(uacctd_conf_path)
+
+        # must be done after systemctl
+        _nftables_trigger_setup('delete')
+
+        return
+
+    # Start/reload flow-accounting daemon
+    call(f'systemctl restart {systemd_service}')
+
+    # configure nftables rules for defined interfaces
+    if 'interface' in flow_config:
+        _nftables_config(flow_config['interface'], 'ingress', flow_config['packet_length'])
+
+        # configure egress the same way if configured otherwise remove it
+        if 'enable_egress' in flow_config:
+            _nftables_config(flow_config['interface'], 'egress', flow_config['packet_length'])
+        else:
+            _nftables_config([], 'egress')
+
+    # add a trigger for signal processing
+    _nftables_trigger_setup('add')
+
+
+if __name__ == '__main__':
+    try:
+        config = get_config()
+        verify(config)
+        generate(config)
+        apply(config)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_frr.py b/src/conf_mode/system_frr.py
new file mode 100644
index 0000000..d9ac543
--- /dev/null
+++ b/src/conf_mode/system_frr.py
@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos import ConfigError
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.logger import syslog
+from vyos.template import render_to_string
+from vyos.utils.boot import boot_configuration_complete
+from vyos.utils.file import read_file
+from vyos.utils.file import write_file
+from vyos.utils.process import call
+
+from vyos import airbag
+airbag.enable()
+
+# path to daemons config and config status files
+config_file = '/etc/frr/daemons'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['system', 'frr']
+    frr_config = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                      get_first_key=True,
+                                      with_recursive_defaults=True)
+
+    return frr_config
+
+def verify(frr_config):
+    # Nothing to verify here
+    pass
+
+def generate(frr_config):
+    # read daemons config file
+    daemons_config_current = read_file(config_file)
+    # generate new config file
+    daemons_config_new = render_to_string('frr/daemons.frr.tmpl', frr_config)
+    # update configuration file if this is necessary
+    if daemons_config_new != daemons_config_current:
+        syslog.warning('FRR daemons configuration file need to be changed')
+        write_file(config_file, daemons_config_new)
+        frr_config['config_file_changed'] = True
+
+def apply(frr_config):
+    # display warning to user
+    if boot_configuration_complete() and frr_config.get('config_file_changed'):
+        # Since FRR restart is not safe thing, better to give
+        # control over this to users
+        Warning('You need to reboot the router (preferred) or restart '\
+                'FRR to apply changes in modules settings')
+
+    # restart FRR automatically
+    # During initial boot this should be safe in most cases
+    if not boot_configuration_complete() and frr_config.get('config_file_changed'):
+        syslog.warning('Restarting FRR to apply changes in modules')
+        call(f'systemctl restart frr.service')
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_host-name.py b/src/conf_mode/system_host-name.py
new file mode 100644
index 0000000..3f245f1
--- /dev/null
+++ b/src/conf_mode/system_host-name.py
@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import re
+import sys
+import copy
+
+import vyos.hostsd_client
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import leaf_node_changed
+from vyos.ifconfig import Section
+from vyos.template import is_ip
+from vyos.utils.process import cmd
+from vyos.utils.process import call
+from vyos.utils.process import process_named_running
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+default_config_data = {
+    'hostname': 'vyos',
+    'domain_name': '',
+    'domain_search': [],
+    'nameserver': [],
+    'nameservers_dhcp_interfaces': {},
+    'snmpd_restart_reqired': False,
+    'static_host_mapping': {}
+}
+
+hostsd_tag = 'system'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    hosts = copy.deepcopy(default_config_data)
+
+    hosts['hostname'] = conf.return_value(['system', 'host-name'])
+
+    base = ['system']
+    if leaf_node_changed(conf, base + ['host-name']) or leaf_node_changed(conf, base + ['domain-name']):
+        hosts['snmpd_restart_reqired'] = True
+
+    # This may happen if the config is not loaded yet,
+    # e.g. if run by cloud-init
+    if not hosts['hostname']:
+        hosts['hostname'] = default_config_data['hostname']
+
+    if conf.exists(['system', 'domain-name']):
+        hosts['domain_name'] = conf.return_value(['system', 'domain-name'])
+        hosts['domain_search'].append(hosts['domain_name'])
+
+    if conf.exists(['system', 'domain-search']):
+        for search in conf.return_values(['system', 'domain-search']):
+            hosts['domain_search'].append(search)
+
+    if conf.exists(['system', 'name-server']):
+        for ns in conf.return_values(['system', 'name-server']):
+            if is_ip(ns):
+                hosts['nameserver'].append(ns)
+            else:
+                tmp = ''
+                config_path = Section.get_config_path(ns)
+                if conf.exists(['interfaces', config_path, 'address']):
+                    tmp = conf.return_values(['interfaces', config_path, 'address'])
+
+                hosts['nameservers_dhcp_interfaces'].update({ ns : tmp })
+
+    # system static-host-mapping
+    for hn in conf.list_nodes(['system', 'static-host-mapping', 'host-name']):
+        hosts['static_host_mapping'][hn] = {}
+        hosts['static_host_mapping'][hn]['address'] = conf.return_values(['system', 'static-host-mapping', 'host-name', hn, 'inet'])
+        hosts['static_host_mapping'][hn]['aliases'] = conf.return_values(['system', 'static-host-mapping', 'host-name', hn, 'alias'])
+
+    return hosts
+
+
+def verify(hosts):
+    if hosts is None:
+        return None
+
+    # pattern $VAR(@) "^[[:alnum:]][-.[:alnum:]]*[[:alnum:]]$" ; "invalid host name $VAR(@)"
+    hostname_regex = re.compile("^[A-Za-z0-9][-.A-Za-z0-9]*[A-Za-z0-9]$")
+    if not hostname_regex.match(hosts['hostname']):
+        raise ConfigError('Invalid host name ' + hosts["hostname"])
+
+    # pattern $VAR(@) "^.{1,63}$" ; "invalid host-name length"
+    length = len(hosts['hostname'])
+    if length < 1 or length > 63:
+        raise ConfigError(
+            'Invalid host-name length, must be less than 63 characters')
+
+    all_static_host_mapping_addresses = []
+    # static mappings alias hostname
+    for host, hostprops in hosts['static_host_mapping'].items():
+        if not hostprops['address']:
+            raise ConfigError(f'IP address required for static-host-mapping "{host}"')
+        all_static_host_mapping_addresses.append(hostprops['address'])
+        for a in hostprops['aliases']:
+            if not hostname_regex.match(a) and len(a) != 0:
+                raise ConfigError(f'Invalid alias "{a}" in static-host-mapping "{host}"')
+
+    for interface, interface_config in hosts['nameservers_dhcp_interfaces'].items():
+        # Warnin user if interface does not have DHCP or DHCPv6 configured
+        if not set(interface_config).intersection(['dhcp', 'dhcpv6']):
+            Warning(f'"{interface}" is not a DHCP interface but uses DHCP name-server option!')
+
+    return None
+
+
+def generate(config):
+    pass
+
+def apply(config):
+    if config is None:
+        return None
+
+    ## Send the updated data to vyos-hostsd
+    try:
+        hc = vyos.hostsd_client.Client()
+
+        hc.set_host_name(config['hostname'], config['domain_name'])
+
+        hc.delete_search_domains([hostsd_tag])
+        if config['domain_search']:
+            hc.add_search_domains({hostsd_tag: config['domain_search']})
+
+        hc.delete_name_servers([hostsd_tag])
+        if config['nameserver']:
+            hc.add_name_servers({hostsd_tag: config['nameserver']})
+
+        # add our own tag's (system) nameservers and search to resolv.conf
+        hc.delete_name_server_tags_system(hc.get_name_server_tags_system())
+        hc.add_name_server_tags_system([hostsd_tag])
+
+        # this will add the dhcp client nameservers to resolv.conf
+        for intf in config['nameservers_dhcp_interfaces']:
+            hc.add_name_server_tags_system([f'dhcp-{intf}', f'dhcpv6-{intf}'])
+
+        hc.delete_hosts([hostsd_tag])
+        if config['static_host_mapping']:
+            hc.add_hosts({hostsd_tag: config['static_host_mapping']})
+
+        hc.apply()
+    except vyos.hostsd_client.VyOSHostsdError as e:
+        raise ConfigError(str(e))
+
+    ## Actually update the hostname -- vyos-hostsd doesn't do that
+
+    # No domain name -- the Debian way.
+    hostname_new = config['hostname']
+
+    # rsyslog runs into a race condition at boot time with systemd
+    # restart rsyslog only if the hostname changed.
+    hostname_old = cmd('hostnamectl --static')
+    call(f'hostnamectl set-hostname --static {hostname_new}')
+
+    # Restart services that use the hostname
+    if hostname_new != hostname_old:
+        call("systemctl restart rsyslog.service")
+
+    # If SNMP is running, restart it too
+    if process_named_running('snmpd') and config['snmpd_restart_reqired']:
+        call('systemctl restart snmpd.service')
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/conf_mode/system_ip.py b/src/conf_mode/system_ip.py
new file mode 100644
index 0000000..c8a91fd
--- /dev/null
+++ b/src/conf_mode/system_ip.py
@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configverify import verify_route_map
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search
+from vyos.utils.file import write_file
+from vyos.utils.process import is_systemd_service_active
+from vyos.utils.system import sysctl_write
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'ip']
+
+    opt = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True,
+                               with_recursive_defaults=True)
+
+    # When working with FRR we need to know the corresponding address-family
+    opt['afi'] = 'ip'
+
+    # We also need the route-map information from the config
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = {'policy' : {'route-map' : conf.get_config_dict(['policy', 'route-map'],
+                                                          get_first_key=True)}}
+    # Merge policy dict into "regular" config dict
+    opt = dict_merge(tmp, opt)
+
+    # If IPv4 ARP table size is set here and also manually in sysctl, the more
+    # fine grained value from sysctl must win
+    set_dependents('sysctl', conf)
+
+    return opt
+
+def verify(opt):
+    if 'protocol' in opt:
+        for protocol, protocol_options in opt['protocol'].items():
+            if 'route_map' in protocol_options:
+                verify_route_map(protocol_options['route_map'], opt)
+    return
+
+def generate(opt):
+    opt['frr_zebra_config'] = render_to_string('frr/zebra.route-map.frr.j2', opt)
+    return
+
+def apply(opt):
+    # Apply ARP threshold values
+    # table_size has a default value - thus the key always exists
+    size = int(dict_search('arp.table_size', opt))
+    # Amount upon reaching which the records begin to be cleared immediately
+    sysctl_write('net.ipv4.neigh.default.gc_thresh3', size)
+    # Amount after which the records begin to be cleaned after 5 seconds
+    sysctl_write('net.ipv4.neigh.default.gc_thresh2', size // 2)
+    # Minimum number of stored records is indicated which is not cleared
+    sysctl_write('net.ipv4.neigh.default.gc_thresh1', size // 8)
+
+    # enable/disable IPv4 forwarding
+    tmp = dict_search('disable_forwarding', opt)
+    value = '0' if (tmp != None) else '1'
+    write_file('/proc/sys/net/ipv4/conf/all/forwarding', value)
+
+    # configure multipath
+    tmp = dict_search('multipath.ignore_unreachable_nexthops', opt)
+    value = '1' if (tmp != None) else '0'
+    sysctl_write('net.ipv4.fib_multipath_use_neigh', value)
+
+    tmp = dict_search('multipath.layer4_hashing', opt)
+    value = '1' if (tmp != None) else '0'
+    sysctl_write('net.ipv4.fib_multipath_hash_policy', value)
+
+    # configure TCP options (defaults as of Linux 6.4)
+    tmp = dict_search('tcp.mss.probing', opt)
+    if tmp is None:
+        value = 0
+    elif tmp == 'on-icmp-black-hole':
+        value = 1
+    elif tmp == 'force':
+        value = 2
+    else:
+        # Shouldn't happen
+        raise ValueError("TCP MSS probing is neither 'on-icmp-black-hole' nor 'force'!")
+    sysctl_write('net.ipv4.tcp_mtu_probing', value)
+
+    tmp = dict_search('tcp.mss.base', opt)
+    value = '1024' if (tmp is None) else tmp
+    sysctl_write('net.ipv4.tcp_base_mss', value)
+
+    tmp = dict_search('tcp.mss.floor', opt)
+    value = '48' if (tmp is None) else tmp
+    sysctl_write('net.ipv4.tcp_mtu_probe_floor', value)
+
+    # During startup of vyos-router that brings up FRR, the service is not yet
+    # running when this script is called first. Skip this part and wait for initial
+    # commit of the configuration to trigger this statement
+    if is_systemd_service_active('frr.service'):
+        zebra_daemon = 'zebra'
+        # Save original configuration prior to starting any commit actions
+        frr_cfg = frr.FRRConfig()
+
+        # The route-map used for the FIB (zebra) is part of the zebra daemon
+        frr_cfg.load_configuration(zebra_daemon)
+        frr_cfg.modify_section(r'no ip nht resolve-via-default')
+        frr_cfg.modify_section(r'ip protocol \w+ route-map [-a-zA-Z0-9.]+', stop_pattern='(\s|!)')
+        if 'frr_zebra_config' in opt:
+            frr_cfg.add_before(frr.default_add_before, opt['frr_zebra_config'])
+        frr_cfg.commit_configuration(zebra_daemon)
+
+    call_dependents()
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_ipv6.py b/src/conf_mode/system_ipv6.py
new file mode 100644
index 0000000..a2442d0
--- /dev/null
+++ b/src/conf_mode/system_ipv6.py
@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configverify import verify_route_map
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search
+from vyos.utils.file import write_file
+from vyos.utils.process import is_systemd_service_active
+from vyos.utils.system import sysctl_write
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'ipv6']
+
+    opt = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True,
+                               with_recursive_defaults=True)
+
+    # When working with FRR we need to know the corresponding address-family
+    opt['afi'] = 'ipv6'
+
+    # We also need the route-map information from the config
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = {'policy' : {'route-map' : conf.get_config_dict(['policy', 'route-map'],
+                                                          get_first_key=True)}}
+    # Merge policy dict into "regular" config dict
+    opt = dict_merge(tmp, opt)
+
+    # If IPv6 neighbor table size is set here and also manually in sysctl, the more
+    # fine grained value from sysctl must win
+    set_dependents('sysctl', conf)
+
+    return opt
+
+def verify(opt):
+    if 'protocol' in opt:
+        for protocol, protocol_options in opt['protocol'].items():
+            if 'route_map' in protocol_options:
+                verify_route_map(protocol_options['route_map'], opt)
+    return
+
+def generate(opt):
+    opt['frr_zebra_config'] = render_to_string('frr/zebra.route-map.frr.j2', opt)
+    return
+
+def apply(opt):
+    # configure multipath
+    tmp = dict_search('multipath.layer4_hashing', opt)
+    value = '1' if (tmp != None) else '0'
+    sysctl_write('net.ipv6.fib_multipath_hash_policy', value)
+
+    # Apply ND threshold values
+    # table_size has a default value - thus the key always exists
+    size = int(dict_search('neighbor.table_size', opt))
+    # Amount upon reaching which the records begin to be cleared immediately
+    sysctl_write('net.ipv6.neigh.default.gc_thresh3', size)
+    # Amount after which the records begin to be cleaned after 5 seconds
+    sysctl_write('net.ipv6.neigh.default.gc_thresh2', size // 2)
+    # Minimum number of stored records is indicated which is not cleared
+    sysctl_write('net.ipv6.neigh.default.gc_thresh1', size // 8)
+
+    # enable/disable IPv6 forwarding
+    tmp = dict_search('disable_forwarding', opt)
+    value = '0' if (tmp != None) else '1'
+    write_file('/proc/sys/net/ipv6/conf/all/forwarding', value)
+
+    # configure IPv6 strict-dad
+    tmp = dict_search('strict_dad', opt)
+    value = '2' if (tmp != None) else '1'
+    for root, dirs, files in os.walk('/proc/sys/net/ipv6/conf'):
+        for name in files:
+            if name == 'accept_dad':
+                write_file(os.path.join(root, name), value)
+
+    # During startup of vyos-router that brings up FRR, the service is not yet
+    # running when this script is called first. Skip this part and wait for initial
+    # commit of the configuration to trigger this statement
+    if is_systemd_service_active('frr.service'):
+        zebra_daemon = 'zebra'
+        # Save original configuration prior to starting any commit actions
+        frr_cfg = frr.FRRConfig()
+
+        # The route-map used for the FIB (zebra) is part of the zebra daemon
+        frr_cfg.load_configuration(zebra_daemon)
+        frr_cfg.modify_section(r'no ipv6 nht resolve-via-default')
+        frr_cfg.modify_section(r'ipv6 protocol \w+ route-map [-a-zA-Z0-9.]+', stop_pattern='(\s|!)')
+        if 'frr_zebra_config' in opt:
+            frr_cfg.add_before(frr.default_add_before, opt['frr_zebra_config'])
+        frr_cfg.commit_configuration(zebra_daemon)
+
+    call_dependents()
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_lcd.py b/src/conf_mode/system_lcd.py
new file mode 100644
index 0000000..eb88224
--- /dev/null
+++ b/src/conf_mode/system_lcd.py
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+#
+# Copyright 2020-2022 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.utils.process import call
+from vyos.utils.system import find_device_file
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+lcdd_conf = '/run/LCDd/LCDd.conf'
+lcdproc_conf = '/run/lcdproc/lcdproc.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'lcd']
+    lcd = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True)
+    # Return (possibly empty) dictionary
+    return lcd
+
+def verify(lcd):
+    if not lcd:
+        return None
+
+    if 'model' in lcd and lcd['model'] in ['sdec']:
+        # This is a fixed LCD display, no device needed - bail out early
+        return None
+
+    if not {'device', 'model'} <= set(lcd):
+        raise ConfigError('Both device and driver must be set!')
+
+    return None
+
+def generate(lcd):
+    if not lcd:
+        return None
+
+    if 'device' in lcd:
+        lcd['device'] = find_device_file(lcd['device'])
+
+    # Render config file for daemon LCDd
+    render(lcdd_conf, 'lcd/LCDd.conf.j2', lcd)
+    # Render config file for client lcdproc
+    render(lcdproc_conf, 'lcd/lcdproc.conf.j2', lcd)
+
+    return None
+
+def apply(lcd):
+    if not lcd:
+        call('systemctl stop lcdproc.service LCDd.service')
+
+        for file in [lcdd_conf, lcdproc_conf]:
+            if os.path.exists(file):
+                os.remove(file)
+    else:
+        # Restart server
+        call('systemctl restart LCDd.service lcdproc.service')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        config_dict = get_config()
+        verify(config_dict)
+        generate(config_dict)
+        apply(config_dict)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_login.py b/src/conf_mode/system_login.py
new file mode 100644
index 0000000..439fa64
--- /dev/null
+++ b/src/conf_mode/system_login.py
@@ -0,0 +1,413 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from passlib.hosts import linux_context
+from psutil import users
+from pwd import getpwall
+from pwd import getpwnam
+from pwd import getpwuid
+from sys import exit
+from time import sleep
+
+from vyos.config import Config
+from vyos.configverify import verify_vrf
+from vyos.template import render
+from vyos.template import is_ipv4
+from vyos.utils.auth import get_current_user
+from vyos.utils.configfs import delete_cli_node
+from vyos.utils.configfs import add_cli_node
+from vyos.utils.dict import dict_search
+from vyos.utils.file import chown
+from vyos.utils.process import cmd
+from vyos.utils.process import call
+from vyos.utils.process import run
+from vyos.utils.process import DEVNULL
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+autologout_file = "/etc/profile.d/autologout.sh"
+limits_file = "/etc/security/limits.d/10-vyos.conf"
+radius_config_file = "/etc/pam_radius_auth.conf"
+tacacs_pam_config_file = "/etc/tacplus_servers"
+tacacs_nss_config_file = "/etc/tacplus_nss.conf"
+nss_config_file = "/etc/nsswitch.conf"
+
+# Minimum UID used when adding system users
+MIN_USER_UID: int = 1000
+# Maximim UID used when adding system users
+MAX_USER_UID: int = 59999
+# LOGIN_TIMEOUT from /etc/loign.defs minus 10 sec
+MAX_RADIUS_TIMEOUT: int = 50
+# MAX_RADIUS_TIMEOUT divided by 2 sec (minimum recomended timeout)
+MAX_RADIUS_COUNT: int = 8
+# Maximum number of supported TACACS servers
+MAX_TACACS_COUNT: int = 8
+
+# List of local user accounts that must be preserved
+SYSTEM_USER_SKIP_LIST: list = ['radius_user', 'radius_priv_user', 'tacacs0', 'tacacs1',
+                              'tacacs2', 'tacacs3', 'tacacs4', 'tacacs5', 'tacacs6',
+                              'tacacs7', 'tacacs8', 'tacacs9', 'tacacs10',' tacacs11',
+                              'tacacs12', 'tacacs13', 'tacacs14', 'tacacs15']
+
+def get_local_users():
+    """Return list of dynamically allocated users (see Debian Policy Manual)"""
+    local_users = []
+    for s_user in getpwall():
+        if getpwnam(s_user.pw_name).pw_uid < MIN_USER_UID:
+            continue
+        if getpwnam(s_user.pw_name).pw_uid > MAX_USER_UID:
+            continue
+        if s_user.pw_name in SYSTEM_USER_SKIP_LIST:
+            continue
+        local_users.append(s_user.pw_name)
+
+    return local_users
+
+def get_shadow_password(username):
+    with open('/etc/shadow') as f:
+        for user in f.readlines():
+            items = user.split(":")
+            if username == items[0]:
+                return items[1]
+    return None
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'login']
+    login = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 no_tag_node_value_mangle=True,
+                                 get_first_key=True,
+                                 with_recursive_defaults=True)
+
+    # users no longer existing in the running configuration need to be deleted
+    local_users = get_local_users()
+    cli_users = []
+    if 'user' in login:
+        cli_users = list(login['user'])
+
+    # prune TACACS global defaults if not set by user
+    if login.from_defaults(['tacacs']):
+        del login['tacacs']
+    # same for RADIUS
+    if login.from_defaults(['radius']):
+        del login['radius']
+
+    # create a list of all users, cli and users
+    all_users = list(set(local_users + cli_users))
+    # We will remove any normal users that dos not exist in the current
+    # configuration. This can happen if user is added but configuration was not
+    # saved and system is rebooted.
+    rm_users = [tmp for tmp in all_users if tmp not in cli_users]
+    if rm_users: login.update({'rm_users' : rm_users})
+
+    return login
+
+def verify(login):
+    if 'rm_users' in login:
+        # This check is required as the script is also executed from vyos-router
+        # init script and there is no SUDO_USER environment variable available
+        # during system boot.
+        tmp = get_current_user()
+        if tmp in login['rm_users']:
+            raise ConfigError(f'Attempting to delete current user: {tmp}')
+
+    if 'user' in login:
+        system_users = getpwall()
+        for user, user_config in login['user'].items():
+            # Linux system users range up until UID 1000, we can not create a
+            # VyOS CLI user which already exists as system user
+            for s_user in system_users:
+                if s_user.pw_name == user and s_user.pw_uid < MIN_USER_UID:
+                    raise ConfigError(f'User "{user}" can not be created, conflict with local system account!')
+
+            for pubkey, pubkey_options in (dict_search('authentication.public_keys', user_config) or {}).items():
+                if 'type' not in pubkey_options:
+                    raise ConfigError(f'Missing type for public-key "{pubkey}"!')
+                if 'key' not in pubkey_options:
+                    raise ConfigError(f'Missing key for public-key "{pubkey}"!')
+
+    if {'radius', 'tacacs'} <= set(login):
+        raise ConfigError('Using both RADIUS and TACACS at the same time is not supported!')
+
+    # At lease one RADIUS server must not be disabled
+    if 'radius' in login:
+        if 'server' not in login['radius']:
+            raise ConfigError('No RADIUS server defined!')
+        sum_timeout: int = 0
+        radius_servers_count: int = 0
+        fail = True
+        for server, server_config in dict_search('radius.server', login).items():
+            if 'key' not in server_config:
+                raise ConfigError(f'RADIUS server "{server}" requires key!')
+            if 'disable' not in server_config:
+                sum_timeout += int(server_config['timeout'])
+                radius_servers_count += 1
+                fail = False
+
+        if fail:
+            raise ConfigError('All RADIUS servers are disabled')
+
+        if radius_servers_count > MAX_RADIUS_COUNT:
+            raise ConfigError(f'Number of RADIUS servers exceeded maximum of {MAX_RADIUS_COUNT}!')
+
+        if sum_timeout > MAX_RADIUS_TIMEOUT:
+            raise ConfigError('Sum of RADIUS servers timeouts '
+                              'has to be less or eq 50 sec')
+
+        verify_vrf(login['radius'])
+
+        if 'source_address' in login['radius']:
+            ipv4_count = 0
+            ipv6_count = 0
+            for address in login['radius']['source_address']:
+                if is_ipv4(address): ipv4_count += 1
+                else:                ipv6_count += 1
+
+            if ipv4_count > 1:
+                raise ConfigError('Only one IPv4 source-address can be set!')
+            if ipv6_count > 1:
+                raise ConfigError('Only one IPv6 source-address can be set!')
+
+    if 'tacacs' in login:
+        tacacs_servers_count: int = 0
+        fail = True
+        for server, server_config in dict_search('tacacs.server', login).items():
+            if 'key' not in server_config:
+                raise ConfigError(f'TACACS server "{server}" requires key!')
+            if 'disable' not in server_config:
+                tacacs_servers_count += 1
+                fail = False
+
+        if fail:
+            raise ConfigError('All RADIUS servers are disabled')
+
+        if tacacs_servers_count > MAX_TACACS_COUNT:
+            raise ConfigError(f'Number of TACACS servers exceeded maximum of {MAX_TACACS_COUNT}!')
+
+        verify_vrf(login['tacacs'])
+
+    if 'max_login_session' in login and 'timeout' not in login:
+        raise ConfigError('"login timeout" must be configured!')
+
+    return None
+
+
+def generate(login):
+    # calculate users encrypted password
+    if 'user' in login:
+        for user, user_config in login['user'].items():
+            tmp = dict_search('authentication.plaintext_password', user_config)
+            if tmp:
+                encrypted_password = linux_context.hash(tmp)
+                login['user'][user]['authentication']['encrypted_password'] = encrypted_password
+                del login['user'][user]['authentication']['plaintext_password']
+
+                # Set default commands for re-adding user with encrypted password
+                del_user_plain = ['system', 'login', 'user', user, 'authentication', 'plaintext-password']
+                add_user_encrypt = ['system', 'login', 'user', user, 'authentication', 'encrypted-password']
+
+                delete_cli_node(del_user_plain)
+                add_cli_node(add_user_encrypt, value=encrypted_password)
+
+            else:
+                try:
+                    if get_shadow_password(user) == dict_search('authentication.encrypted_password', user_config):
+                        # If the current encrypted bassword matches the encrypted password
+                        # from the config - do not update it. This will remove the encrypted
+                        # value from the system logs.
+                        #
+                        # The encrypted password will be set only once during the first boot
+                        # after an image upgrade.
+                        del login['user'][user]['authentication']['encrypted_password']
+                except:
+                    pass
+
+    ### RADIUS based user authentication
+    if 'radius' in login:
+        render(radius_config_file, 'login/pam_radius_auth.conf.j2', login,
+                   permission=0o600, user='root', group='root')
+    else:
+        if os.path.isfile(radius_config_file):
+            os.unlink(radius_config_file)
+
+    ### TACACS+ based user authentication
+    if 'tacacs' in login:
+        render(tacacs_pam_config_file, 'login/tacplus_servers.j2', login,
+                   permission=0o644, user='root', group='root')
+        render(tacacs_nss_config_file, 'login/tacplus_nss.conf.j2', login,
+                   permission=0o644, user='root', group='root')
+    else:
+        if os.path.isfile(tacacs_pam_config_file):
+            os.unlink(tacacs_pam_config_file)
+        if os.path.isfile(tacacs_nss_config_file):
+            os.unlink(tacacs_nss_config_file)
+
+    # NSS must always be present on the system
+    render(nss_config_file, 'login/nsswitch.conf.j2', login,
+               permission=0o644, user='root', group='root')
+
+    # /etc/security/limits.d/10-vyos.conf
+    if 'max_login_session' in login:
+        render(limits_file, 'login/limits.j2', login,
+                   permission=0o644, user='root', group='root')
+    else:
+        if os.path.isfile(limits_file):
+            os.unlink(limits_file)
+
+    if 'timeout' in login:
+        render(autologout_file, 'login/autologout.j2', login,
+                   permission=0o755, user='root', group='root')
+    else:
+        if os.path.isfile(autologout_file):
+            os.unlink(autologout_file)
+
+    return None
+
+
+def apply(login):
+    enable_otp = False
+    if 'user' in login:
+        for user, user_config in login['user'].items():
+            # make new user using vyatta shell and make home directory (-m),
+            # default group of 100 (users)
+            command = 'useradd --create-home --no-user-group '
+            # check if user already exists:
+            if user in get_local_users():
+                # update existing account
+                command = 'usermod'
+
+            # all accounts use /bin/vbash
+            command += ' --shell /bin/vbash'
+            # we need to use '' quotes when passing formatted data to the shell
+            # else it will not work as some data parts are lost in translation
+            tmp = dict_search('authentication.encrypted_password', user_config)
+            if tmp: command += f" --password '{tmp}'"
+
+            tmp = dict_search('full_name', user_config)
+            if tmp: command += f" --comment '{tmp}'"
+
+            tmp = dict_search('home_directory', user_config)
+            if tmp: command += f" --home '{tmp}'"
+            else: command += f" --home '/home/{user}'"
+
+            command += f' --groups frr,frrvty,vyattacfg,sudo,adm,dip,disk,_kea {user}'
+            try:
+                cmd(command)
+                # we should not rely on the value stored in user_config['home_directory'], as a
+                # crazy user will choose username root or any other system user which will fail.
+                #
+                # XXX: Should we deny using root at all?
+                home_dir = getpwnam(user).pw_dir
+                # always re-render SSH keys with appropriate permissions
+                render(f'{home_dir}/.ssh/authorized_keys', 'login/authorized_keys.j2',
+                       user_config, permission=0o600,
+                       formater=lambda _: _.replace("&quot;", '"'),
+                       user=user, group='users')
+            except Exception as e:
+                raise ConfigError(f'Adding user "{user}" raised exception: "{e}"')
+
+            # T5875: ensure UID is properly set on home directory if user is re-added
+            # the home directory will always exist, as it's created above by --create-home,
+            # retrieve current owner of home directory and adjust on demand
+            dir_owner = None
+            try:
+                dir_owner = getpwuid(os.stat(home_dir).st_uid).pw_name
+            except:
+                pass
+
+            if dir_owner != user:
+                    chown(home_dir, user=user, recursive=True)
+
+            # Generate 2FA/MFA One-Time-Pad configuration
+            if dict_search('authentication.otp.key', user_config):
+                enable_otp = True
+                render(f'{home_dir}/.google_authenticator', 'login/pam_otp_ga.conf.j2',
+                       user_config, permission=0o400, user=user, group='users')
+            else:
+                # delete configuration as it's not enabled for the user
+                if os.path.exists(f'{home_dir}/.google_authenticator'):
+                    os.remove(f'{home_dir}/.google_authenticator')
+
+            # Lock/Unlock local user account
+            lock_unlock = '--unlock'
+            if 'disable' in user_config:
+                lock_unlock = '--lock'
+            cmd(f'usermod {lock_unlock} {user}')
+
+    if 'rm_users' in login:
+        for user in login['rm_users']:
+            try:
+                # Disable user to prevent re-login
+                call(f'usermod -s /sbin/nologin {user}')
+
+                # Logout user if he is still logged in
+                if user in list(set([tmp[0] for tmp in users()])):
+                    print(f'{user} is logged in, forcing logout!')
+                    # re-run command until user is logged out
+                    while run(f'pkill -HUP -u {user}'):
+                        sleep(0.250)
+
+                # Remove user account but leave home directory in place. Re-run
+                # command until user is removed - userdel might return 8 as
+                # SSH sessions are not all yet properly cleaned away, thus we
+                # simply re-run the command until the account wen't away
+                while run(f'userdel {user}', stderr=DEVNULL):
+                    sleep(0.250)
+
+            except Exception as e:
+                raise ConfigError(f'Deleting user "{user}" raised exception: {e}')
+
+    # Enable/disable RADIUS in PAM configuration
+    cmd('pam-auth-update --disable radius-mandatory radius-optional')
+    if 'radius' in login:
+        if login['radius'].get('security_mode', '') == 'mandatory':
+            pam_profile = 'radius-mandatory'
+        else:
+            pam_profile = 'radius-optional'
+        cmd(f'pam-auth-update --enable {pam_profile}')
+
+    # Enable/disable TACACS+ in PAM configuration
+    cmd('pam-auth-update --disable tacplus-mandatory tacplus-optional')
+    if 'tacacs' in login:
+        if login['tacacs'].get('security_mode', '') == 'mandatory':
+            pam_profile = 'tacplus-mandatory'
+        else:
+            pam_profile = 'tacplus-optional'
+        cmd(f'pam-auth-update --enable {pam_profile}')
+
+    # Enable/disable Google authenticator
+    cmd('pam-auth-update --disable mfa-google-authenticator')
+    if enable_otp:
+        cmd(f'pam-auth-update --enable mfa-google-authenticator')
+
+    return None
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_login_banner.py b/src/conf_mode/system_login_banner.py
new file mode 100644
index 0000000..923e1bf
--- /dev/null
+++ b/src/conf_mode/system_login_banner.py
@@ -0,0 +1,107 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+from copy import deepcopy
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.file import write_file
+from vyos.version import get_version_data
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+PRELOGIN_FILE = r'/etc/issue'
+PRELOGIN_NET_FILE = r'/etc/issue.net'
+POSTLOGIN_FILE = r'/etc/motd'
+
+default_config_data = {
+    'issue': 'Welcome to VyOS - \\n \\l\n\n',
+    'issue_net': ''
+}
+
+def get_config(config=None):
+    banner = deepcopy(default_config_data)
+    banner['version_data'] = get_version_data()
+
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base_level = ['system', 'login', 'banner']
+
+    if not conf.exists(base_level):
+        return banner
+    else:
+        conf.set_level(base_level)
+
+    # Post-Login banner
+    if conf.exists(['post-login']):
+        tmp = conf.return_value(['post-login'])
+        # post-login banner can be empty as well
+        if tmp:
+            tmp = tmp.replace('\\n','\n')
+            tmp = tmp.replace('\\t','\t')
+            # always add newline character
+            tmp += '\n'
+        else:
+            tmp = ''
+
+        banner['motd'] = tmp
+
+    # Pre-Login banner
+    if conf.exists(['pre-login']):
+        tmp = conf.return_value(['pre-login'])
+        # pre-login banner can be empty as well
+        if tmp:
+            tmp = tmp.replace('\\n','\n')
+            tmp = tmp.replace('\\t','\t')
+            # always add newline character
+            tmp += '\n'
+        else:
+            tmp = ''
+
+        banner['issue'] = banner['issue_net'] = tmp
+
+    return banner
+
+def verify(banner):
+    pass
+
+def generate(banner):
+    pass
+
+def apply(banner):
+    write_file(PRELOGIN_FILE, banner['issue'])
+    write_file(PRELOGIN_NET_FILE, banner['issue_net'])
+    if 'motd' in banner:
+        write_file(POSTLOGIN_FILE, banner['motd'])
+    else:
+        render(POSTLOGIN_FILE, 'login/default_motd.j2', banner,
+            permission=0o644, user='root', group='root')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_logs.py b/src/conf_mode/system_logs.py
new file mode 100644
index 0000000..8ad4875
--- /dev/null
+++ b/src/conf_mode/system_logs.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos import ConfigError
+from vyos import airbag
+from vyos.config import Config
+from vyos.logger import syslog
+from vyos.template import render
+from vyos.utils.dict import dict_search
+airbag.enable()
+
+# path to logrotate configs
+logrotate_atop_file = '/etc/logrotate.d/vyos-atop'
+logrotate_rsyslog_file = '/etc/logrotate.d/vyos-rsyslog'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['system', 'logs']
+    logs_config = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                       get_first_key=True,
+                                       with_recursive_defaults=True)
+
+    return logs_config
+
+
+def verify(logs_config):
+    # Nothing to verify here
+    pass
+
+
+def generate(logs_config):
+    # get configuration for logrotate atop
+    logrotate_atop = dict_search('logrotate.atop', logs_config)
+    # generate new config file for atop
+    syslog.debug('Adding logrotate config for atop')
+    render(logrotate_atop_file, 'logs/logrotate/vyos-atop.j2', logrotate_atop)
+
+    # get configuration for logrotate rsyslog
+    logrotate_rsyslog = dict_search('logrotate.messages', logs_config)
+    # generate new config file for rsyslog
+    syslog.debug('Adding logrotate config for rsyslog')
+    render(logrotate_rsyslog_file, 'logs/logrotate/vyos-rsyslog.j2',
+           logrotate_rsyslog)
+
+
+def apply(logs_config):
+    # No further actions needed
+    pass
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_option.py b/src/conf_mode/system_option.py
new file mode 100644
index 0000000..a84572f
--- /dev/null
+++ b/src/conf_mode/system_option.py
@@ -0,0 +1,218 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from time import sleep
+
+
+from vyos.config import Config
+from vyos.configverify import verify_source_interface
+from vyos.configverify import verify_interface_exists
+from vyos.system import grub_util
+from vyos.template import render
+from vyos.utils.cpu import get_cpus
+from vyos.utils.dict import dict_search
+from vyos.utils.file import write_file
+from vyos.utils.kernel import check_kmod
+from vyos.utils.process import cmd
+from vyos.utils.process import is_systemd_service_running
+from vyos.utils.network import is_addr_assigned
+from vyos.utils.network import is_intf_addr_assigned
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
+from vyos import ConfigError
+from vyos import airbag
+
+airbag.enable()
+
+curlrc_config = r'/etc/curlrc'
+ssh_config = r'/etc/ssh/ssh_config.d/91-vyos-ssh-client-options.conf'
+systemd_action_file = '/lib/systemd/system/ctrl-alt-del.target'
+usb_autosuspend = r'/etc/udev/rules.d/40-usb-autosuspend.rules'
+kernel_dynamic_debug = r'/sys/kernel/debug/dynamic_debug/control'
+time_format_to_locale = {'12-hour': 'en_US.UTF-8', '24-hour': 'en_GB.UTF-8'}
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'option']
+    options = conf.get_config_dict(
+        base, key_mangling=('-', '_'), get_first_key=True, with_recursive_defaults=True
+    )
+
+    if 'performance' in options:
+        # Update IPv4/IPv6 and sysctl options after tuned applied it's settings
+        set_dependents('ip_ipv6', conf)
+        set_dependents('sysctl', conf)
+
+    return options
+
+
+def verify(options):
+    if 'http_client' in options:
+        config = options['http_client']
+        if 'source_interface' in config:
+            verify_interface_exists(options, config['source_interface'])
+
+        if {'source_address', 'source_interface'} <= set(config):
+            raise ConfigError(
+                'Can not define both HTTP source-interface and source-address'
+            )
+
+        if 'source_address' in config:
+            if not is_addr_assigned(config['source_address']):
+                raise ConfigError('No interface with give address specified!')
+
+    if 'ssh_client' in options:
+        config = options['ssh_client']
+        if 'source_address' in config:
+            address = config['source_address']
+            if not is_addr_assigned(config['source_address']):
+                raise ConfigError('No interface with address "{address}" configured!')
+
+        if 'source_interface' in config:
+            # verify_source_interface reuires key 'ifname'
+            config['ifname'] = config['source_interface']
+            verify_source_interface(config)
+            if 'source_address' in config:
+                address = config['source_address']
+                interface = config['source_interface']
+                if not is_intf_addr_assigned(interface, address):
+                    raise ConfigError(
+                        f'Address "{address}" not assigned on interface "{interface}"!'
+                    )
+
+    if 'kernel' in options:
+        cpu_vendor = get_cpus()[0]['vendor_id']
+        if 'amd_pstate_driver' in options['kernel'] and cpu_vendor != 'AuthenticAMD':
+            raise ConfigError(
+                f'AMD pstate driver cannot be used with "{cpu_vendor}" CPU!'
+            )
+
+    return None
+
+
+def generate(options):
+    render(curlrc_config, 'system/curlrc.j2', options)
+    render(ssh_config, 'system/ssh_config.j2', options)
+    render(usb_autosuspend, 'system/40_usb_autosuspend.j2', options)
+
+    cmdline_options = []
+    if 'kernel' in options:
+        if 'disable_mitigations' in options['kernel']:
+            cmdline_options.append('mitigations=off')
+        if 'disable_power_saving' in options['kernel']:
+            cmdline_options.append('intel_idle.max_cstate=0 processor.max_cstate=1')
+        if 'amd_pstate_driver' in options['kernel']:
+            mode = options['kernel']['amd_pstate_driver']
+            cmdline_options.append(
+                f'initcall_blacklist=acpi_cpufreq_init amd_pstate={mode}'
+            )
+    grub_util.update_kernel_cmdline_options(' '.join(cmdline_options))
+
+    return None
+
+
+def apply(options):
+    # System bootup beep
+    beep_service = 'vyos-beep.service'
+    if 'startup_beep' in options:
+        cmd(f'systemctl enable {beep_service}')
+    else:
+        cmd(f'systemctl disable {beep_service}')
+
+    # Ctrl-Alt-Delete action
+    if os.path.exists(systemd_action_file):
+        os.unlink(systemd_action_file)
+    if 'ctrl_alt_delete' in options:
+        if options['ctrl_alt_delete'] == 'reboot':
+            os.symlink('/lib/systemd/system/reboot.target', systemd_action_file)
+        elif options['ctrl_alt_delete'] == 'poweroff':
+            os.symlink('/lib/systemd/system/poweroff.target', systemd_action_file)
+
+    # Configure HTTP client
+    if 'http_client' not in options:
+        if os.path.exists(curlrc_config):
+            os.unlink(curlrc_config)
+
+    # Configure SSH client
+    if 'ssh_client' not in options:
+        if os.path.exists(ssh_config):
+            os.unlink(ssh_config)
+
+    # Reboot system on kernel panic
+    timeout = '0'
+    if 'reboot_on_panic' in options:
+        timeout = '60'
+    with open('/proc/sys/kernel/panic', 'w') as f:
+        f.write(timeout)
+
+    # tuned - performance tuning
+    if 'performance' in options:
+        cmd('systemctl restart tuned.service')
+        # wait until daemon has started before sending configuration
+        while not is_systemd_service_running('tuned.service'):
+            sleep(0.250)
+        cmd('tuned-adm profile network-{performance}'.format(**options))
+    else:
+        cmd('systemctl stop tuned.service')
+
+    call_dependents()
+
+    # Keyboard layout - there will be always the default key inside the dict
+    # but we check for key existence anyway
+    if 'keyboard_layout' in options:
+        cmd('loadkeys {keyboard_layout}'.format(**options))
+
+    # Enable/diable root-partition-auto-resize SystemD service
+    if 'root_partition_auto_resize' in options:
+        cmd('systemctl enable root-partition-auto-resize.service')
+    else:
+        cmd('systemctl disable root-partition-auto-resize.service')
+
+    # Time format 12|24-hour
+    if 'time_format' in options:
+        time_format = time_format_to_locale.get(options['time_format'])
+        cmd(f'localectl set-locale LC_TIME={time_format}')
+
+    # Reload UDEV, required for USB auto suspend
+    cmd('udevadm control --reload-rules')
+
+    # Enable/disable dynamic debugging for kernel modules
+    modules = ['wireguard']
+    modules_enabled = dict_search('kernel.debug', options) or []
+    for module in modules:
+        if module in modules_enabled:
+            check_kmod(module)
+            write_file(kernel_dynamic_debug, f'module {module} +p')
+        else:
+            write_file(kernel_dynamic_debug, f'module {module} -p')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_proxy.py b/src/conf_mode/system_proxy.py
new file mode 100644
index 0000000..079c43e
--- /dev/null
+++ b/src/conf_mode/system_proxy.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+proxy_def = r'/etc/profile.d/vyos-system-proxy.sh'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'proxy']
+    if not conf.exists(base):
+        return None
+
+    proxy = conf.get_config_dict(base, get_first_key=True)
+    return proxy
+
+def verify(proxy):
+    if not proxy:
+        return
+
+    if 'url' not in proxy or 'port' not in proxy:
+        raise ConfigError('Proxy URL and port require a value')
+
+    if ('username' in proxy and 'password' not in proxy) or \
+       ('username' not in proxy and 'password' in proxy):
+       raise ConfigError('Both username and password need to be defined!')
+
+def generate(proxy):
+    if not proxy:
+        if os.path.isfile(proxy_def):
+            os.unlink(proxy_def)
+        return
+
+    render(proxy_def, 'system/proxy.j2', proxy, permission=0o755)
+
+def apply(proxy):
+    pass
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_sflow.py b/src/conf_mode/system_sflow.py
new file mode 100644
index 0000000..41119b4
--- /dev/null
+++ b/src/conf_mode/system_sflow.py
@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configverify import verify_vrf
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.network import is_addr_assigned
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+hsflowd_conf_path = '/run/sflow/hsflowd.conf'
+systemd_service = 'hsflowd.service'
+systemd_override = f'/run/systemd/system/{systemd_service}.d/override.conf'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'sflow']
+    if not conf.exists(base):
+        return None
+
+    sflow = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 get_first_key=True,
+                                 with_recursive_defaults=True)
+
+    return sflow
+
+def verify(sflow):
+    if not sflow:
+        return None
+
+    # Check if configured sflow agent-address exist in the system
+    if 'agent_address' in sflow:
+        tmp = sflow['agent_address']
+        if not is_addr_assigned(tmp):
+            raise ConfigError(
+                f'Configured "sflow agent-address {tmp}" does not exist in the system!'
+            )
+
+    # Check if at least one interface is configured
+    if 'interface' not in sflow:
+        raise ConfigError(
+            'sFlow requires at least one interface to be configured!')
+
+    # Check if at least one server is configured
+    if 'server' not in sflow:
+        raise ConfigError('You need to configure at least one sFlow server!')
+
+    verify_vrf(sflow)
+    return None
+
+def generate(sflow):
+    if not sflow:
+        return None
+
+    render(hsflowd_conf_path, 'sflow/hsflowd.conf.j2', sflow)
+    render(systemd_override, 'sflow/override.conf.j2', sflow)
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+
+def apply(sflow):
+    if not sflow:
+        # Stop flow-accounting daemon and remove configuration file
+        call(f'systemctl stop {systemd_service}')
+        if os.path.exists(hsflowd_conf_path):
+            os.unlink(hsflowd_conf_path)
+        return
+
+    # Start/reload flow-accounting daemon
+    call(f'systemctl restart {systemd_service}')
+
+if __name__ == '__main__':
+    try:
+        config = get_config()
+        verify(config)
+        generate(config)
+        apply(config)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_sysctl.py b/src/conf_mode/system_sysctl.py
new file mode 100644
index 0000000..f6b0202
--- /dev/null
+++ b/src/conf_mode/system_sysctl.py
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import cmd
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+config_file = r'/run/sysctl/99-vyos-sysctl.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'sysctl']
+    if not conf.exists(base):
+        return None
+
+    sysctl = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True,
+                                  no_tag_node_value_mangle=True)
+
+    return sysctl
+
+def verify(sysctl):
+    return None
+
+def generate(sysctl):
+    if not sysctl:
+        if os.path.isfile(config_file):
+            os.unlink(config_file)
+        return None
+
+    render(config_file, 'system/sysctl.conf.j2', sysctl)
+    return None
+
+def apply(sysctl):
+    if not sysctl:
+        return None
+
+    # We silently ignore all errors
+    # See: https://bugzilla.redhat.com/show_bug.cgi?id=1264080
+    cmd(f'sysctl -f {config_file}')
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_syslog.py b/src/conf_mode/system_syslog.py
new file mode 100644
index 0000000..eb2f02e
--- /dev/null
+++ b/src/conf_mode/system_syslog.py
@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_vrf
+from vyos.utils.process import call
+from vyos.template import render
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+rsyslog_conf = '/etc/rsyslog.d/00-vyos.conf'
+logrotate_conf = '/etc/logrotate.d/vyos-rsyslog'
+systemd_override = r'/run/systemd/system/rsyslog.service.d/override.conf'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'syslog']
+    if not conf.exists(base):
+        return None
+
+    syslog = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                  get_first_key=True, no_tag_node_value_mangle=True)
+
+    syslog.update({ 'logrotate' : logrotate_conf })
+
+    tmp = is_node_changed(conf, base + ['vrf'])
+    if tmp: syslog.update({'restart_required': {}})
+
+    syslog = conf.merge_defaults(syslog, recursive=True)
+    if syslog.from_defaults(['global']):
+        del syslog['global']
+
+    if (
+        'global' in syslog
+        and 'preserve_fqdn' in syslog['global']
+        and conf.exists(['system', 'host-name'])
+        and conf.exists(['system', 'domain-name'])
+    ):
+        hostname = conf.return_value(['system', 'host-name'])
+        domain = conf.return_value(['system', 'domain-name'])
+        fqdn = f'{hostname}.{domain}'
+        syslog['global']['local_host_name'] = fqdn
+
+    return syslog
+
+def verify(syslog):
+    if not syslog:
+        return None
+
+    if 'host' in syslog:
+         for host, host_options in syslog['host'].items():
+             if 'protocol' in host_options and host_options['protocol'] == 'udp':
+                 if 'format' in host_options and 'octet_counted' in host_options['format']:
+                     Warning(f'Syslog UDP transport for "{host}" should not use octet-counted format!')
+
+    verify_vrf(syslog)
+
+def generate(syslog):
+    if not syslog:
+        if os.path.exists(rsyslog_conf):
+            os.unlink(rsyslog_conf)
+        if os.path.exists(logrotate_conf):
+            os.unlink(logrotate_conf)
+
+        return None
+
+    render(rsyslog_conf, 'rsyslog/rsyslog.conf.j2', syslog)
+    render(systemd_override, 'rsyslog/override.conf.j2', syslog)
+    render(logrotate_conf, 'rsyslog/logrotate.j2', syslog)
+
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+    return None
+
+def apply(syslog):
+    systemd_socket = 'syslog.socket'
+    systemd_service = 'syslog.service'
+    if not syslog:
+        call(f'systemctl stop {systemd_service} {systemd_socket}')
+        return None
+
+    # we need to restart the service if e.g. the VRF name changed
+    systemd_action = 'reload-or-restart'
+    if 'restart_required' in syslog:
+        systemd_action = 'restart'
+
+    call(f'systemctl {systemd_action} {systemd_service}')
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_task-scheduler.py b/src/conf_mode/system_task-scheduler.py
new file mode 100644
index 0000000..129be5d
--- /dev/null
+++ b/src/conf_mode/system_task-scheduler.py
@@ -0,0 +1,153 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2017 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+#
+
+import os
+import re
+import sys
+
+from vyos.config import Config
+from vyos import ConfigError
+
+from vyos import airbag
+airbag.enable()
+
+crontab_file = "/etc/cron.d/vyos-crontab"
+
+
+def format_task(minute="*", hour="*", day="*", dayofweek="*", month="*", user="root", rawspec=None, command=""):
+    fmt_full = "{minute} {hour} {day} {month} {dayofweek} {user} {command}\n"
+    fmt_raw = "{spec} {user} {command}\n"
+
+    if rawspec is None:
+        s = fmt_full.format(minute=minute, hour=hour, day=day,
+                            dayofweek=dayofweek, month=month, command=command, user=user)
+    else:
+        s = fmt_raw.format(spec=rawspec, user=user, command=command)
+
+    return s
+
+def split_interval(s):
+    result = re.search(r"(\d+)([mdh]?)", s)
+    value = int(result.group(1))
+    suffix = result.group(2)
+    return( (value, suffix) )
+
+def make_command(executable, arguments):
+    if arguments:
+        return("sg vyattacfg \"{0} {1}\"".format(executable, arguments))
+    else:
+        return("sg vyattacfg \"{0}\"".format(executable))
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    conf.set_level("system task-scheduler task")
+    task_names = conf.list_nodes("")
+    tasks = []
+
+    for name in task_names:
+        interval = conf.return_value("{0} interval".format(name))
+        spec = conf.return_value("{0} crontab-spec".format(name))
+        executable = conf.return_value("{0} executable path".format(name))
+        args = conf.return_value("{0} executable arguments".format(name))
+        task = {
+                "name": name,
+                "interval": interval,
+                "spec": spec,
+                "executable": executable,
+                "args": args
+              }
+        tasks.append(task)
+
+    return tasks
+
+def verify(tasks):
+    for task in tasks:
+        if not task["interval"] and not task["spec"]:
+            raise ConfigError("Invalid task {0}: must define either interval or crontab-spec".format(task["name"]))
+
+        if task["interval"]:
+            if task["spec"]:
+                raise ConfigError("Invalid task {0}: cannot use interval and crontab-spec at the same time".format(task["name"]))
+ 
+            if not re.match(r"^\d+[mdh]?$", task["interval"]):
+                raise(ConfigError("Invalid interval {0} in task {1}: interval should be a number optionally followed by m, h, or d".format(task["name"], task["interval"])))
+            else:
+                # Check if values are within allowed range
+                value, suffix = split_interval(task["interval"])
+
+                if not suffix or suffix == "m":
+                    if value > 60:
+                        raise ConfigError("Invalid task {0}: interval in minutes must not exceed 60".format(task["name"]))
+                elif suffix == "h":
+                    if value > 24:
+                        raise ConfigError("Invalid task {0}: interval in hours must not exceed 24".format(task["name"]))
+                elif suffix == "d":
+                    if value > 31:
+                        raise ConfigError("Invalid task {0}: interval in days must not exceed 31".format(task["name"]))
+
+        if not task["executable"]:
+            raise ConfigError("Invalid task {0}: executable is not defined".format(task["name"]))
+        else:
+            # Check if executable exists and is executable
+            if not (os.path.isfile(task["executable"]) and os.access(task["executable"], os.X_OK)):
+                raise ConfigError("Invalid task {0}: file {1} does not exist or is not executable".format(task["name"], task["executable"]))
+
+def generate(tasks):
+    crontab_header = "### Generated by vyos-update-crontab.py ###\n"
+    if len(tasks) == 0:
+        if os.path.exists(crontab_file):
+            os.remove(crontab_file)
+        else:
+            pass
+    else:
+        crontab_lines = []
+        for task in tasks:
+            command = make_command(task["executable"], task["args"])
+            if task["spec"]:
+                line = format_task(command=command, rawspec=task["spec"])
+            else:
+                value, suffix = split_interval(task["interval"])
+                if not suffix or suffix == "m":
+                    line = format_task(command=command, minute="*/{0}".format(value))
+                elif suffix == "h":
+                    line = format_task(command=command, minute="0", hour="*/{0}".format(value))
+                elif suffix == "d":
+                    line = format_task(command=command, minute="0", hour="0", day="*/{0}".format(value))
+            crontab_lines.append(line)
+
+        with open(crontab_file, 'w') as f:
+            f.write(crontab_header)
+            f.writelines(crontab_lines)
+
+def apply(config):
+    # No daemon restarts etc. needed for cron
+    pass
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/conf_mode/system_timezone.py b/src/conf_mode/system_timezone.py
new file mode 100644
index 0000000..39770fd
--- /dev/null
+++ b/src/conf_mode/system_timezone.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+
+from copy import deepcopy
+from vyos.config import Config
+from vyos import ConfigError
+from vyos.utils.process import call
+
+from vyos import airbag
+airbag.enable()
+
+default_config_data = {
+    'name': 'UTC'
+}
+
+def get_config(config=None):
+    tz = deepcopy(default_config_data)
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    if conf.exists('system time-zone'):
+        tz['name'] = conf.return_value('system time-zone')
+
+    return tz
+
+def verify(tz):
+    pass
+
+def generate(tz):
+    pass
+
+def apply(tz):
+    call('/usr/bin/timedatectl set-timezone {}'.format(tz['name']))
+    call('systemctl restart rsyslog')
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/conf_mode/system_update-check.py b/src/conf_mode/system_update-check.py
new file mode 100644
index 0000000..71ac13e
--- /dev/null
+++ b/src/conf_mode/system_update-check.py
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import json
+
+from pathlib import Path
+from sys import exit
+
+from vyos.config import Config
+from vyos.utils.process import call
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+base = ['system', 'update-check']
+service_name = 'vyos-system-update'
+service_conf = Path(f'/run/{service_name}.conf')
+motd_file = Path('/run/motd.d/10-vyos-update')
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    if not conf.exists(base):
+        return None
+
+    config = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                  get_first_key=True, no_tag_node_value_mangle=True)
+
+    return config
+
+
+def verify(config):
+    # bail out early - looks like removal from running config
+    if config is None:
+        return
+
+    if 'url' not in config:
+        raise ConfigError('URL is required!')
+
+
+def generate(config):
+    # bail out early - looks like removal from running config
+    if config is None:
+        # Remove old config and return
+        service_conf.unlink(missing_ok=True)
+        # MOTD used in /run/motd.d/10-update
+        motd_file.unlink(missing_ok=True)
+        return None
+
+    # Write configuration file
+    conf_json = json.dumps(config, indent=4)
+    service_conf.write_text(conf_json)
+
+    return None
+
+
+def apply(config):
+    if config:
+        if 'auto_check' in config:
+            call(f'systemctl restart {service_name}.service')
+    else:
+        call(f'systemctl stop {service_name}.service')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/system_wireless.py b/src/conf_mode/system_wireless.py
new file mode 100644
index 0000000..e0ca0ab
--- /dev/null
+++ b/src/conf_mode/system_wireless.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['system', 'wireless']
+    interface_base = ['interfaces', 'wireless']
+
+    wireless = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                    get_first_key=True)
+
+
+    if conf.exists(interface_base):
+        wireless['interfaces'] = conf.list_nodes(interface_base)
+        for interface in wireless['interfaces']:
+            set_dependents('wireless', conf, interface)
+
+    return wireless
+
+def verify(wireless):
+    pass
+
+def generate(wireless):
+    pass
+
+def apply(wireless):
+    if 'interfaces' in wireless:
+        call_dependents()
+    pass
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
new file mode 100644
index 0000000..ca0c365
--- /dev/null
+++ b/src/conf_mode/vpn_ipsec.py
@@ -0,0 +1,745 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import ipaddress
+import os
+import re
+import jmespath
+
+from sys import exit
+from time import sleep
+from ipaddress import ip_address
+from netaddr import IPNetwork
+from netaddr import IPRange
+
+from vyos.config import Config
+from vyos.config import config_dict_merge
+from vyos.configdep import set_dependents
+from vyos.configdep import call_dependents
+from vyos.configdict import get_interface_dict
+from vyos.configdict import leaf_node_changed
+from vyos.configverify import verify_interface_exists
+from vyos.configverify import dynamic_interface_pattern
+from vyos.defaults import directories
+from vyos.ifconfig import Interface
+from vyos.pki import encode_public_key
+from vyos.pki import load_private_key
+from vyos.pki import wrap_certificate
+from vyos.pki import wrap_crl
+from vyos.pki import wrap_public_key
+from vyos.pki import wrap_private_key
+from vyos.template import ip_from_cidr
+from vyos.template import is_ipv4
+from vyos.template import is_ipv6
+from vyos.template import render
+from vyos.utils.network import is_ipv6_link_local
+from vyos.utils.network import interface_exists
+from vyos.utils.dict import dict_search
+from vyos.utils.dict import dict_search_args
+from vyos.utils.process import call
+from vyos.utils.vti_updown_db import vti_updown_db_exists
+from vyos.utils.vti_updown_db import open_vti_updown_db_for_create_or_update
+from vyos.utils.vti_updown_db import remove_vti_updown_db
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+dhcp_wait_attempts = 2
+dhcp_wait_sleep = 1
+
+swanctl_dir        = '/etc/swanctl'
+charon_conf        = '/etc/strongswan.d/charon.conf'
+charon_dhcp_conf   = '/etc/strongswan.d/charon/dhcp.conf'
+charon_radius_conf = '/etc/strongswan.d/charon/eap-radius.conf'
+interface_conf     = '/etc/strongswan.d/interfaces_use.conf'
+swanctl_conf       = f'{swanctl_dir}/swanctl.conf'
+
+default_install_routes = 'yes'
+
+vici_socket = '/var/run/charon.vici'
+
+CERT_PATH   = f'{swanctl_dir}/x509/'
+PUBKEY_PATH = f'{swanctl_dir}/pubkey/'
+KEY_PATH    = f'{swanctl_dir}/private/'
+CA_PATH     = f'{swanctl_dir}/x509ca/'
+CRL_PATH    = f'{swanctl_dir}/x509crl/'
+
+DHCP_HOOK_IFLIST = '/tmp/ipsec_dhcp_interfaces'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['vpn', 'ipsec']
+    l2tp_base = ['vpn', 'l2tp', 'remote-access', 'ipsec-settings']
+    if not conf.exists(base):
+        return None
+
+    # retrieve common dictionary keys
+    ipsec = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                 no_tag_node_value_mangle=True,
+                                 get_first_key=True,
+                                 with_pki=True)
+
+    # We have to cleanup the default dict, as default values could
+    # enable features which are not explicitly enabled on the
+    # CLI. E.g. dead-peer-detection defaults should not be injected
+    # unless the feature is explicitly opted in to by setting the
+    # top-level node
+    default_values = conf.get_config_defaults(**ipsec.kwargs, recursive=True)
+
+    if 'ike_group' in ipsec:
+        for name, ike in ipsec['ike_group'].items():
+            if 'dead_peer_detection' not in ike:
+                del default_values['ike_group'][name]['dead_peer_detection']
+
+    ipsec = config_dict_merge(default_values, ipsec)
+
+    ipsec['dhcp_interfaces'] = set()
+    ipsec['enabled_vti_interfaces'] = set()
+    ipsec['persistent_vti_interfaces'] = set()
+    ipsec['dhcp_no_address'] = {}
+    ipsec['install_routes'] = 'no' if conf.exists(base + ["options", "disable-route-autoinstall"]) else default_install_routes
+    ipsec['interface_change'] = leaf_node_changed(conf, base + ['interface'])
+    ipsec['nhrp_exists'] = conf.exists(['protocols', 'nhrp', 'tunnel'])
+
+    if ipsec['nhrp_exists']:
+        set_dependents('nhrp', conf)
+
+    tmp = conf.get_config_dict(l2tp_base, key_mangling=('-', '_'),
+                               no_tag_node_value_mangle=True,
+                               get_first_key=True)
+    if tmp:
+        ipsec['l2tp'] = conf.merge_defaults(tmp, recursive=True)
+        ipsec['l2tp_outside_address'] = conf.return_value(['vpn', 'l2tp', 'remote-access', 'outside-address'])
+        ipsec['l2tp_ike_default'] = 'aes256-sha1-modp1024,3des-sha1-modp1024'
+        ipsec['l2tp_esp_default'] = 'aes256-sha1,3des-sha1'
+
+    # Collect the interface dicts for any refernced VTI interfaces in
+    # case we need to bring the interface up
+    ipsec['vti_interface_dicts'] = {}
+
+    if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']:
+        for peer, peer_conf in ipsec['site_to_site']['peer'].items():
+            if 'vti' in peer_conf:
+                if 'bind' in peer_conf['vti']:
+                    vti_interface = peer_conf['vti']['bind']
+                    if vti_interface not in ipsec['vti_interface_dicts']:
+                        _, vti = get_interface_dict(conf, ['interfaces', 'vti'], vti_interface)
+                        ipsec['vti_interface_dicts'][vti_interface] = vti
+
+    if 'remote_access' in ipsec:
+        if 'connection' in ipsec['remote_access']:
+            for name, ra_conf in ipsec['remote_access']['connection'].items():
+                if 'bind' in ra_conf:
+                    vti_interface = ra_conf['bind']
+                    if vti_interface not in ipsec['vti_interface_dicts']:
+                        _, vti = get_interface_dict(conf, ['interfaces', 'vti'], vti_interface)
+                        ipsec['vti_interface_dicts'][vti_interface] = vti
+
+    return ipsec
+
+def get_dhcp_address(iface):
+    addresses = Interface(iface).get_addr()
+    if not addresses:
+        return None
+    for address in addresses:
+        if not is_ipv6_link_local(address):
+            return ip_from_cidr(address)
+    return None
+
+def verify_pki_x509(pki, x509_conf):
+    if not pki or 'ca' not in pki or 'certificate' not in pki:
+        raise ConfigError(f'PKI is not configured')
+
+    cert_name = x509_conf['certificate']
+
+    for ca_cert_name in x509_conf['ca_certificate']:
+        if not dict_search_args(pki, 'ca', ca_cert_name, 'certificate'):
+            raise ConfigError(f'Missing CA certificate on specified PKI CA certificate "{ca_cert_name}"')
+
+    if not dict_search_args(pki, 'certificate', cert_name, 'certificate'):
+        raise ConfigError(f'Missing certificate on specified PKI certificate "{cert_name}"')
+
+    if not dict_search_args(pki, 'certificate', cert_name, 'private', 'key'):
+        raise ConfigError(f'Missing private key on specified PKI certificate "{cert_name}"')
+
+    return True
+
+def verify_pki_rsa(pki, rsa_conf):
+    if not pki or 'key_pair' not in pki:
+        raise ConfigError(f'PKI is not configured')
+
+    local_key = rsa_conf['local_key']
+    remote_key = rsa_conf['remote_key']
+
+    if not dict_search_args(pki, 'key_pair', local_key, 'private', 'key'):
+        raise ConfigError(f'Missing private key on specified local-key "{local_key}"')
+
+    if not dict_search_args(pki, 'key_pair', remote_key, 'public', 'key'):
+        raise ConfigError(f'Missing public key on specified remote-key "{remote_key}"')
+
+    return True
+
+def verify(ipsec):
+    if not ipsec:
+        return None
+
+    if 'authentication' in ipsec:
+        if 'psk' in ipsec['authentication']:
+            for psk, psk_config in ipsec['authentication']['psk'].items():
+                if 'id' not in psk_config or 'secret' not in psk_config:
+                    raise ConfigError(f'Authentication psk "{psk}" missing "id" or "secret"')
+
+    if 'interface' in ipsec:
+        tmp = re.compile(dynamic_interface_pattern)
+        for interface in ipsec['interface']:
+            # exclude check interface for dynamic interfaces
+            if tmp.match(interface):
+                verify_interface_exists(ipsec, interface, warning_only=True)
+            else:
+                verify_interface_exists(ipsec, interface)
+
+    if 'l2tp' in ipsec:
+        if 'esp_group' in ipsec['l2tp']:
+            if 'esp_group' not in ipsec or ipsec['l2tp']['esp_group'] not in ipsec['esp_group']:
+                raise ConfigError(f"Invalid esp-group on L2TP remote-access config")
+
+        if 'ike_group' in ipsec['l2tp']:
+            if 'ike_group' not in ipsec or ipsec['l2tp']['ike_group'] not in ipsec['ike_group']:
+                raise ConfigError(f"Invalid ike-group on L2TP remote-access config")
+
+        if 'authentication' not in ipsec['l2tp']:
+            raise ConfigError(f'Missing authentication settings on L2TP remote-access config')
+
+        if 'mode' not in ipsec['l2tp']['authentication']:
+            raise ConfigError(f'Missing authentication mode on L2TP remote-access config')
+
+        if not ipsec['l2tp_outside_address']:
+            raise ConfigError(f'Missing outside-address on L2TP remote-access config')
+
+        if ipsec['l2tp']['authentication']['mode'] == 'pre-shared-secret':
+            if 'pre_shared_secret' not in ipsec['l2tp']['authentication']:
+                raise ConfigError(f'Missing pre shared secret on L2TP remote-access config')
+
+        if ipsec['l2tp']['authentication']['mode'] == 'x509':
+            if 'x509' not in ipsec['l2tp']['authentication']:
+                raise ConfigError(f'Missing x509 settings on L2TP remote-access config')
+
+            x509 = ipsec['l2tp']['authentication']['x509']
+
+            if 'ca_certificate' not in x509 or 'certificate' not in x509:
+                raise ConfigError(f'Missing x509 certificates on L2TP remote-access config')
+
+            verify_pki_x509(ipsec['pki'], x509)
+
+    if 'profile' in ipsec:
+        for profile, profile_conf in ipsec['profile'].items():
+            if 'esp_group' in profile_conf:
+                if 'esp_group' not in ipsec or profile_conf['esp_group'] not in ipsec['esp_group']:
+                    raise ConfigError(f"Invalid esp-group on {profile} profile")
+            else:
+                raise ConfigError(f"Missing esp-group on {profile} profile")
+
+            if 'ike_group' in profile_conf:
+                if 'ike_group' not in ipsec or profile_conf['ike_group'] not in ipsec['ike_group']:
+                    raise ConfigError(f"Invalid ike-group on {profile} profile")
+            else:
+                raise ConfigError(f"Missing ike-group on {profile} profile")
+
+            if 'authentication' not in profile_conf:
+                raise ConfigError(f"Missing authentication on {profile} profile")
+
+    if 'remote_access' in ipsec:
+        if 'connection' in ipsec['remote_access']:
+            for name, ra_conf in ipsec['remote_access']['connection'].items():
+                if 'local_address' not in ra_conf and 'dhcp_interface' not in ra_conf:
+                    raise ConfigError(f"Missing local-address or dhcp-interface on remote-access connection {name}")
+
+                if 'dhcp_interface' in ra_conf:
+                    dhcp_interface = ra_conf['dhcp_interface']
+
+                    verify_interface_exists(ipsec, dhcp_interface)
+                    dhcp_base = directories['isc_dhclient_dir']
+
+                    if not os.path.exists(f'{dhcp_base}/dhclient_{dhcp_interface}.conf'):
+                        raise ConfigError(f"Invalid dhcp-interface on remote-access connection {name}")
+
+                    if 'disable' not in ra_conf:
+                        ipsec['dhcp_interfaces'].add(dhcp_interface)
+
+                    address = get_dhcp_address(dhcp_interface)
+                    count = 0
+                    while not address and count < dhcp_wait_attempts:
+                        address = get_dhcp_address(dhcp_interface)
+                        count += 1
+                        sleep(dhcp_wait_sleep)
+
+                    if not address:
+                        ipsec['dhcp_no_address'][f'ra_{name}'] = dhcp_interface
+                        print(f"Failed to get address from dhcp-interface on remote-access connection {name} -- skipped")
+                        continue
+
+                if 'esp_group' in ra_conf:
+                    if 'esp_group' not in ipsec or ra_conf['esp_group'] not in ipsec['esp_group']:
+                        raise ConfigError(f"Invalid esp-group on {name} remote-access config")
+                else:
+                    raise ConfigError(f"Missing esp-group on {name} remote-access config")
+
+                if 'ike_group' in ra_conf:
+                    if 'ike_group' not in ipsec or ra_conf['ike_group'] not in ipsec['ike_group']:
+                        raise ConfigError(f"Invalid ike-group on {name} remote-access config")
+
+                    ike = ra_conf['ike_group']
+                    if dict_search(f'ike_group.{ike}.key_exchange', ipsec) != 'ikev2':
+                        raise ConfigError('IPsec remote-access connections requires IKEv2!')
+
+                else:
+                    raise ConfigError(f"Missing ike-group on {name} remote-access config")
+
+                if 'authentication' not in ra_conf:
+                    raise ConfigError(f"Missing authentication on {name} remote-access config")
+
+                if ra_conf['authentication']['server_mode'] == 'x509':
+                    if 'x509' not in ra_conf['authentication']:
+                        raise ConfigError(f"Missing x509 settings on {name} remote-access config")
+
+                    x509 = ra_conf['authentication']['x509']
+
+                    if 'ca_certificate' not in x509 or 'certificate' not in x509:
+                        raise ConfigError(f"Missing x509 certificates on {name} remote-access config")
+
+                    verify_pki_x509(ipsec['pki'], x509)
+                elif ra_conf['authentication']['server_mode'] == 'pre-shared-secret':
+                    if 'pre_shared_secret' not in ra_conf['authentication']:
+                        raise ConfigError(f"Missing pre-shared-key on {name} remote-access config")
+
+                if 'client_mode' not in ra_conf['authentication']:
+                    raise ConfigError('Client authentication method is required!')
+
+                if dict_search('authentication.client_mode', ra_conf) == 'eap-radius':
+                    if dict_search('remote_access.radius.server', ipsec) == None:
+                        raise ConfigError('RADIUS authentication requires at least one server')
+
+                if 'bind' in ra_conf:
+                    vti_interface = ra_conf['bind']
+                    if not interface_exists(vti_interface):
+                        raise ConfigError(f'VTI interface {vti_interface} for remote-access connection {name} does not exist!')
+
+                    if 'disable' not in ra_conf:
+                        ipsec['enabled_vti_interfaces'].add(vti_interface)
+                        # remote access VPN interfaces are always up regardless of whether clients are connected
+                        ipsec['persistent_vti_interfaces'].add(vti_interface)
+
+                if 'pool' in ra_conf:
+                    if {'dhcp', 'radius'} <= set(ra_conf['pool']):
+                        raise ConfigError(f'Can not use both DHCP and RADIUS for address allocation '\
+                                          f'at the same time for "{name}"!')
+
+                    if 'dhcp' in ra_conf['pool'] and len(ra_conf['pool']) > 1:
+                        raise ConfigError(f'Can not use DHCP and a predefined address pool for "{name}"!')
+
+                    if 'radius' in ra_conf['pool'] and len(ra_conf['pool']) > 1:
+                        raise ConfigError(f'Can not use RADIUS and a predefined address pool for "{name}"!')
+
+                    for pool in ra_conf['pool']:
+                        if pool == 'dhcp':
+                            if dict_search('remote_access.dhcp.server', ipsec) == None:
+                                raise ConfigError('IPsec DHCP server is not configured!')
+                        elif pool == 'radius':
+                            if dict_search('remote_access.radius.server', ipsec) == None:
+                                raise ConfigError('IPsec RADIUS server is not configured!')
+
+                            if dict_search('authentication.client_mode', ra_conf) != 'eap-radius':
+                                raise ConfigError('RADIUS IP pool requires eap-radius client authentication!')
+
+                        elif 'pool' not in ipsec['remote_access'] or pool not in ipsec['remote_access']['pool']:
+                            raise ConfigError(f'Requested pool "{pool}" does not exist!')
+
+        if 'pool' in ipsec['remote_access']:
+            pool_networks = []
+            for pool, pool_config in ipsec['remote_access']['pool'].items():
+                if 'prefix' not in pool_config and 'range' not in pool_config:
+                    raise ConfigError(f'Mandatory prefix or range must be specified for pool "{pool}"!')
+
+                if 'prefix' in pool_config and 'range' in pool_config:
+                    raise ConfigError(f'Only one of prefix or range can be specified for pool "{pool}"!')
+
+                if 'prefix' in pool_config:
+                    range_is_ipv4 = is_ipv4(pool_config['prefix'])
+                    range_is_ipv6 = is_ipv6(pool_config['prefix'])
+
+                    net = IPNetwork(pool_config['prefix'])
+                    start = net.first
+                    stop = net.last
+                    for network in pool_networks:
+                        if start in network or stop in network:
+                            raise ConfigError(f'Prefix for pool "{pool}" is already part of another pool\'s range!')
+
+                    tmp = IPRange(start, stop)
+                    pool_networks.append(tmp)
+
+                if 'range' in pool_config:
+                    range_config = pool_config['range']
+                    if not {'start', 'stop'} <= set(range_config.keys()):
+                        raise ConfigError(f'Range start and stop address must be defined for pool "{pool}"!')
+
+                    range_both_ipv4 = is_ipv4(range_config['start']) and is_ipv4(range_config['stop'])
+                    range_both_ipv6 = is_ipv6(range_config['start']) and is_ipv6(range_config['stop'])
+
+                    if not (range_both_ipv4 or range_both_ipv6):
+                        raise ConfigError(f'Range start and stop must be of the same address family for pool "{pool}"!')
+
+                    if ip_address(range_config['stop']) < ip_address(range_config['start']):
+                        raise ConfigError(f'Range stop address must be greater or equal\n' \
+                                          'to the range\'s start address for pool "{pool}"!')
+
+                    range_is_ipv4 = is_ipv4(range_config['start'])
+                    range_is_ipv6 = is_ipv6(range_config['start'])
+
+                    start = range_config['start']
+                    stop = range_config['stop']
+                    for network in pool_networks:
+                        if start in network:
+                            raise ConfigError(f'Range "{range}" start address "{start}" already part of another pool\'s range!')
+                        if stop in network:
+                            raise ConfigError(f'Range "{range}" stop address "{stop}" already part of another pool\'s range!')
+
+                    tmp = IPRange(start, stop)
+                    pool_networks.append(tmp)
+
+                if 'name_server' in pool_config:
+                    if len(pool_config['name_server']) > 2:
+                        raise ConfigError(f'Only two name-servers are supported for remote-access pool "{pool}"!')
+
+                    for ns in pool_config['name_server']:
+                        v4_addr_and_ns = is_ipv4(ns) and not range_is_ipv4
+                        v6_addr_and_ns = is_ipv6(ns) and not range_is_ipv6
+                        if v4_addr_and_ns or v6_addr_and_ns:
+                           raise ConfigError('Must use both IPv4 or IPv6 addresses for pool prefix/range and name-server addresses!')
+
+                if 'exclude' in pool_config:
+                    for exclude in pool_config['exclude']:
+                        v4_addr_and_exclude = is_ipv4(exclude) and not range_is_ipv4
+                        v6_addr_and_exclude = is_ipv6(exclude) and not range_is_ipv6
+                        if v4_addr_and_exclude or v6_addr_and_exclude:
+                           raise ConfigError('Must use both IPv4 or IPv6 addresses for pool prefix/range and exclude prefixes!')
+
+        if 'radius' in ipsec['remote_access'] and 'server' in ipsec['remote_access']['radius']:
+            for server, server_config in ipsec['remote_access']['radius']['server'].items():
+                if 'key' not in server_config:
+                    raise ConfigError(f'Missing RADIUS secret key for server "{server}"')
+
+    if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']:
+        for peer, peer_conf in ipsec['site_to_site']['peer'].items():
+            has_default_esp = False
+            # Peer name it is swanctl connection name and shouldn't contain dots or colons, T4118
+            if bool(re.search(':|\.', peer)):
+                raise ConfigError(f'Incorrect peer name "{peer}" '
+                                  f'Peer name can contain alpha-numeric letters, hyphen and underscore')
+
+            if 'remote_address' not in peer_conf:
+                print(f'You should set correct remote-address "peer {peer} remote-address x.x.x.x"\n')
+
+            if 'default_esp_group' in peer_conf:
+                has_default_esp = True
+                if 'esp_group' not in ipsec or peer_conf['default_esp_group'] not in ipsec['esp_group']:
+                    raise ConfigError(f"Invalid esp-group on site-to-site peer {peer}")
+
+            if 'ike_group' in peer_conf:
+                if 'ike_group' not in ipsec or peer_conf['ike_group'] not in ipsec['ike_group']:
+                    raise ConfigError(f"Invalid ike-group on site-to-site peer {peer}")
+            else:
+                raise ConfigError(f"Missing ike-group on site-to-site peer {peer}")
+
+            if 'authentication' not in peer_conf or 'mode' not in peer_conf['authentication']:
+                raise ConfigError(f"Missing authentication on site-to-site peer {peer}")
+
+            if {'id', 'use_x509_id'} <= set(peer_conf['authentication']):
+                raise ConfigError(f"Manually set peer id and use-x509-id are mutually exclusive!")
+
+            if peer_conf['authentication']['mode'] == 'x509':
+                if 'x509' not in peer_conf['authentication']:
+                    raise ConfigError(f"Missing x509 settings on site-to-site peer {peer}")
+
+                x509 = peer_conf['authentication']['x509']
+
+                if 'ca_certificate' not in x509 or 'certificate' not in x509:
+                    raise ConfigError(f"Missing x509 certificates on site-to-site peer {peer}")
+
+                verify_pki_x509(ipsec['pki'], x509)
+            elif peer_conf['authentication']['mode'] == 'rsa':
+                if 'rsa' not in peer_conf['authentication']:
+                    raise ConfigError(f"Missing RSA settings on site-to-site peer {peer}")
+
+                rsa = peer_conf['authentication']['rsa']
+
+                if 'local_key' not in rsa:
+                    raise ConfigError(f"Missing RSA local-key on site-to-site peer {peer}")
+
+                if 'remote_key' not in rsa:
+                    raise ConfigError(f"Missing RSA remote-key on site-to-site peer {peer}")
+
+                verify_pki_rsa(ipsec['pki'], rsa)
+
+            if 'local_address' not in peer_conf and 'dhcp_interface' not in peer_conf:
+                raise ConfigError(f"Missing local-address or dhcp-interface on site-to-site peer {peer}")
+
+            if 'dhcp_interface' in peer_conf:
+                dhcp_interface = peer_conf['dhcp_interface']
+
+                verify_interface_exists(ipsec, dhcp_interface)
+                dhcp_base = directories['isc_dhclient_dir']
+
+                if not os.path.exists(f'{dhcp_base}/dhclient_{dhcp_interface}.conf'):
+                    raise ConfigError(f"Invalid dhcp-interface on site-to-site peer {peer}")
+
+                if 'disable' not in peer_conf:
+                    ipsec['dhcp_interfaces'].add(dhcp_interface)
+
+                address = get_dhcp_address(dhcp_interface)
+                count = 0
+                while not address and count < dhcp_wait_attempts:
+                    address = get_dhcp_address(dhcp_interface)
+                    count += 1
+                    sleep(dhcp_wait_sleep)
+
+                if not address:
+                    ipsec['dhcp_no_address'][f'peer_{peer}'] = dhcp_interface
+                    print(f"Failed to get address from dhcp-interface on site-to-site peer {peer} -- skipped")
+                    continue
+
+            if 'vti' in peer_conf:
+                if 'local_address' in peer_conf and 'dhcp_interface' in peer_conf:
+                    raise ConfigError(f"A single local-address or dhcp-interface is required when using VTI on site-to-site peer {peer}")
+
+                if 'bind' in peer_conf['vti']:
+                    vti_interface = peer_conf['vti']['bind']
+                    if not interface_exists(vti_interface):
+                        raise ConfigError(f'VTI interface {vti_interface} for site-to-site peer {peer} does not exist!')
+                    if 'disable' not in peer_conf:
+                        ipsec['enabled_vti_interfaces'].add(vti_interface)
+
+            if 'vti' not in peer_conf and 'tunnel' not in peer_conf:
+                raise ConfigError(f"No VTI or tunnel specified on site-to-site peer {peer}")
+
+            if 'tunnel' in peer_conf:
+                for tunnel, tunnel_conf in peer_conf['tunnel'].items():
+                    if 'esp_group' not in tunnel_conf and not has_default_esp:
+                        raise ConfigError(f"Missing esp-group on tunnel {tunnel} for site-to-site peer {peer}")
+
+                    esp_group_name = tunnel_conf['esp_group'] if 'esp_group' in tunnel_conf else peer_conf['default_esp_group']
+
+                    if esp_group_name not in ipsec['esp_group']:
+                        raise ConfigError(f"Invalid esp-group on tunnel {tunnel} for site-to-site peer {peer}")
+
+                    esp_group = ipsec['esp_group'][esp_group_name]
+
+                    if 'mode' in esp_group and esp_group['mode'] == 'transport':
+                        if 'protocol' in tunnel_conf and ((peer in ['any', '0.0.0.0']) or ('local_address' not in peer_conf or peer_conf['local_address'] in ['any', '0.0.0.0'])):
+                            raise ConfigError(f"Fixed local-address or peer required when a protocol is defined with ESP transport mode on tunnel {tunnel} for site-to-site peer {peer}")
+
+                        if ('local' in tunnel_conf and 'prefix' in tunnel_conf['local']) or ('remote' in tunnel_conf and 'prefix' in tunnel_conf['remote']):
+                            raise ConfigError(f"Local/remote prefix cannot be used with ESP transport mode on tunnel {tunnel} for site-to-site peer {peer}")
+
+def cleanup_pki_files():
+    for path in [CERT_PATH, CA_PATH, CRL_PATH, KEY_PATH, PUBKEY_PATH]:
+        if not os.path.exists(path):
+            continue
+        for file in os.listdir(path):
+            file_path = os.path.join(path, file)
+            if os.path.isfile(file_path):
+                os.unlink(file_path)
+
+def generate_pki_files_x509(pki, x509_conf):
+    for ca_cert_name in x509_conf['ca_certificate']:
+        ca_cert_data = dict_search_args(pki, 'ca', ca_cert_name, 'certificate')
+        ca_cert_crls = dict_search_args(pki, 'ca', ca_cert_name, 'crl') or []
+        crl_index = 1
+
+        with open(os.path.join(CA_PATH, f'{ca_cert_name}.pem'), 'w') as f:
+            f.write(wrap_certificate(ca_cert_data))
+
+        for crl in ca_cert_crls:
+            with open(os.path.join(CRL_PATH, f'{ca_cert_name}_{crl_index}.pem'), 'w') as f:
+                f.write(wrap_crl(crl))
+            crl_index += 1
+
+    cert_name = x509_conf['certificate']
+    cert_data = dict_search_args(pki, 'certificate', cert_name, 'certificate')
+    key_data = dict_search_args(pki, 'certificate', cert_name, 'private', 'key')
+    protected = 'passphrase' in x509_conf
+
+    with open(os.path.join(CERT_PATH, f'{cert_name}.pem'), 'w') as f:
+        f.write(wrap_certificate(cert_data))
+
+    with open(os.path.join(KEY_PATH, f'x509_{cert_name}.pem'), 'w') as f:
+        f.write(wrap_private_key(key_data, protected))
+
+def generate_pki_files_rsa(pki, rsa_conf):
+    local_key_name = rsa_conf['local_key']
+    local_key_data = dict_search_args(pki, 'key_pair', local_key_name, 'private', 'key')
+    protected = 'passphrase' in rsa_conf
+    remote_key_name = rsa_conf['remote_key']
+    remote_key_data = dict_search_args(pki, 'key_pair', remote_key_name, 'public', 'key')
+
+    local_key = load_private_key(local_key_data, rsa_conf['passphrase'] if protected else None)
+
+    with open(os.path.join(KEY_PATH, f'rsa_{local_key_name}.pem'), 'w') as f:
+        f.write(wrap_private_key(local_key_data, protected))
+
+    with open(os.path.join(PUBKEY_PATH, f'{local_key_name}.pem'), 'w') as f:
+        f.write(encode_public_key(local_key.public_key()))
+
+    with open(os.path.join(PUBKEY_PATH, f'{remote_key_name}.pem'), 'w') as f:
+        f.write(wrap_public_key(remote_key_data))
+
+def generate(ipsec):
+    cleanup_pki_files()
+
+    if not ipsec:
+        for config_file in [charon_dhcp_conf, charon_radius_conf, interface_conf, swanctl_conf]:
+            if os.path.isfile(config_file):
+                os.unlink(config_file)
+        render(charon_conf, 'ipsec/charon.j2', {'install_routes': default_install_routes})
+        return
+
+    if ipsec['dhcp_interfaces']:
+        with open(DHCP_HOOK_IFLIST, 'w') as f:
+            f.write(" ".join(ipsec['dhcp_interfaces']))
+    elif os.path.exists(DHCP_HOOK_IFLIST):
+        os.unlink(DHCP_HOOK_IFLIST)
+
+    for path in [swanctl_dir, CERT_PATH, CA_PATH, CRL_PATH, PUBKEY_PATH]:
+        if not os.path.exists(path):
+            os.mkdir(path, mode=0o755)
+
+    if not os.path.exists(KEY_PATH):
+        os.mkdir(KEY_PATH, mode=0o700)
+
+    if 'l2tp' in ipsec:
+        if 'authentication' in ipsec['l2tp'] and 'x509' in ipsec['l2tp']['authentication']:
+            generate_pki_files_x509(ipsec['pki'], ipsec['l2tp']['authentication']['x509'])
+
+    if 'remote_access' in ipsec and 'connection' in ipsec['remote_access']:
+        for rw, rw_conf in ipsec['remote_access']['connection'].items():
+            if f'ra_{rw}' in ipsec['dhcp_no_address']:
+                continue
+
+            local_ip = ''
+            if 'local_address' in rw_conf:
+                local_ip = rw_conf['local_address']
+            elif 'dhcp_interface' in rw_conf:
+                local_ip = get_dhcp_address(rw_conf['dhcp_interface'])
+
+            ipsec['remote_access']['connection'][rw]['local_address'] = local_ip
+
+            if 'authentication' in rw_conf and 'x509' in rw_conf['authentication']:
+                generate_pki_files_x509(ipsec['pki'], rw_conf['authentication']['x509'])
+
+    if 'site_to_site' in ipsec and 'peer' in ipsec['site_to_site']:
+        for peer, peer_conf in ipsec['site_to_site']['peer'].items():
+            if f'peer_{peer}' in ipsec['dhcp_no_address']:
+                continue
+
+            if peer_conf['authentication']['mode'] == 'x509':
+                generate_pki_files_x509(ipsec['pki'], peer_conf['authentication']['x509'])
+            elif peer_conf['authentication']['mode'] == 'rsa':
+                generate_pki_files_rsa(ipsec['pki'], peer_conf['authentication']['rsa'])
+
+            local_ip = ''
+            if 'local_address' in peer_conf:
+                local_ip = peer_conf['local_address']
+            elif 'dhcp_interface' in peer_conf:
+                local_ip = get_dhcp_address(peer_conf['dhcp_interface'])
+
+            ipsec['site_to_site']['peer'][peer]['local_address'] = local_ip
+
+            if 'tunnel' in peer_conf:
+                for tunnel, tunnel_conf in peer_conf['tunnel'].items():
+                    local_prefixes = dict_search_args(tunnel_conf, 'local', 'prefix')
+                    remote_prefixes = dict_search_args(tunnel_conf, 'remote', 'prefix')
+
+                    if not local_prefixes or not remote_prefixes:
+                        continue
+
+                    passthrough = None
+
+                    for local_prefix in local_prefixes:
+                        for remote_prefix in remote_prefixes:
+                            local_net = ipaddress.ip_network(local_prefix)
+                            remote_net = ipaddress.ip_network(remote_prefix)
+                            if local_net.overlaps(remote_net):
+                                if passthrough is None:
+                                    passthrough = []
+                                passthrough.append(local_prefix)
+
+                    ipsec['site_to_site']['peer'][peer]['tunnel'][tunnel]['passthrough'] = passthrough
+
+        # auth psk <tag> dhcp-interface <xxx>
+        if jmespath.search('authentication.psk.*.dhcp_interface', ipsec):
+            for psk, psk_config in ipsec['authentication']['psk'].items():
+                if 'dhcp_interface' in psk_config:
+                    for iface in psk_config['dhcp_interface']:
+                        id = get_dhcp_address(iface)
+                        if id:
+                            ipsec['authentication']['psk'][psk]['id'].append(id)
+
+    render(charon_conf, 'ipsec/charon.j2', ipsec)
+    render(charon_dhcp_conf, 'ipsec/charon/dhcp.conf.j2', ipsec)
+    render(charon_radius_conf, 'ipsec/charon/eap-radius.conf.j2', ipsec)
+    render(interface_conf, 'ipsec/interfaces_use.conf.j2', ipsec)
+    render(swanctl_conf, 'ipsec/swanctl.conf.j2', ipsec)
+
+
+def apply(ipsec):
+    systemd_service = 'strongswan.service'
+    if not ipsec:
+        call(f'systemctl stop {systemd_service}')
+
+        if vti_updown_db_exists():
+            remove_vti_updown_db()
+
+    else:
+        call(f'systemctl reload-or-restart {systemd_service}')
+
+        if ipsec['enabled_vti_interfaces']:
+            with open_vti_updown_db_for_create_or_update() as db:
+                db.removeAllOtherInterfaces(ipsec['enabled_vti_interfaces'])
+                db.setPersistentInterfaces(ipsec['persistent_vti_interfaces'])
+                db.commit(lambda interface: ipsec['vti_interface_dicts'][interface])
+        elif vti_updown_db_exists():
+            remove_vti_updown_db()
+
+        if ipsec.get('nhrp_exists', False):
+            try:
+                call_dependents()
+            except ConfigError:
+                # Ignore config errors on dependent due to being called too early. Example:
+                # ConfigError("ConfigError('Interface ethN requires an IP address!')")
+                pass
+
+
+if __name__ == '__main__':
+    try:
+        ipsec = get_config()
+        verify(ipsec)
+        generate(ipsec)
+        apply(ipsec)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py
new file mode 100644
index 0000000..04ccbce
--- /dev/null
+++ b/src/conf_mode/vpn_l2tp.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdep import call_dependents, set_dependents
+from vyos.configdict import get_accel_dict
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.dict import dict_search
+from vyos.accel_ppp_util import verify_accel_ppp_name_servers
+from vyos.accel_ppp_util import verify_accel_ppp_wins_servers
+from vyos.accel_ppp_util import verify_accel_ppp_authentication
+from vyos.accel_ppp_util import verify_accel_ppp_ip_pool
+from vyos.accel_ppp_util import get_pools_in_order
+from vyos import ConfigError
+
+from vyos import airbag
+airbag.enable()
+
+
+l2tp_conf = '/run/accel-pppd/l2tp.conf'
+l2tp_chap_secrets = '/run/accel-pppd/l2tp.chap-secrets'
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['vpn', 'l2tp', 'remote-access']
+
+    set_dependents('ipsec', conf)
+
+    if not conf.exists(base):
+        return None
+
+    # retrieve common dictionary keys
+    l2tp = get_accel_dict(conf, base, l2tp_chap_secrets)
+    if dict_search('client_ip_pool', l2tp):
+        # Multiple named pools require ordered values T5099
+        l2tp['ordered_named_pools'] = get_pools_in_order(
+            dict_search('client_ip_pool', l2tp))
+    l2tp['server_type'] = 'l2tp'
+    return l2tp
+
+
+def verify(l2tp):
+    if not l2tp:
+        return None
+
+    verify_accel_ppp_authentication(l2tp)
+    verify_accel_ppp_ip_pool(l2tp)
+    verify_accel_ppp_name_servers(l2tp)
+    verify_accel_ppp_wins_servers(l2tp)
+
+    return None
+
+
+def generate(l2tp):
+    if not l2tp:
+        return None
+
+    render(l2tp_conf, 'accel-ppp/l2tp.config.j2', l2tp)
+
+    if dict_search('authentication.mode', l2tp) == 'local':
+        render(l2tp_chap_secrets, 'accel-ppp/chap-secrets.config_dict.j2',
+               l2tp, permission=0o640)
+
+    return None
+
+
+def apply(l2tp):
+    if not l2tp:
+        call('systemctl stop accel-ppp@l2tp.service')
+        for file in [l2tp_chap_secrets, l2tp_conf]:
+            if os.path.exists(file):
+                os.unlink(file)
+    else:
+        call('systemctl restart accel-ppp@l2tp.service')
+
+    call_dependents()
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpn_openconnect.py b/src/conf_mode/vpn_openconnect.py
new file mode 100644
index 0000000..4278513
--- /dev/null
+++ b/src/conf_mode/vpn_openconnect.py
@@ -0,0 +1,289 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+from sys import exit
+
+from vyos.base import Warning
+from vyos.config import Config
+from vyos.configverify import verify_pki_certificate
+from vyos.configverify import verify_pki_ca_certificate
+from vyos.pki import find_chain
+from vyos.pki import encode_certificate
+from vyos.pki import load_certificate
+from vyos.pki import wrap_private_key
+from vyos.template import render
+from vyos.utils.dict import dict_search
+from vyos.utils.file import write_file
+from vyos.utils.network import check_port_availability
+from vyos.utils.network import is_listen_port_bind_service
+from vyos.utils.process import call
+from vyos.utils.process import is_systemd_service_running
+from vyos import ConfigError
+from passlib.hash import sha512_crypt
+from time import sleep
+
+from vyos import airbag
+airbag.enable()
+
+cfg_dir        = '/run/ocserv'
+ocserv_conf    = cfg_dir + '/ocserv.conf'
+ocserv_passwd  = cfg_dir + '/ocpasswd'
+ocserv_otp_usr = cfg_dir + '/users.oath'
+radius_cfg     = cfg_dir + '/radiusclient.conf'
+radius_servers = cfg_dir + '/radius_servers'
+
+# Generate hash from user cleartext password
+def get_hash(password):
+    return sha512_crypt.hash(password)
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['vpn', 'openconnect']
+    if not conf.exists(base):
+        return None
+
+    ocserv = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                  get_first_key=True,
+                                  with_recursive_defaults=True,
+                                  with_pki=True)
+
+    return ocserv
+
+def verify(ocserv):
+    if ocserv is None:
+        return None
+    # Check if listen-ports not binded other services
+    # It can be only listen by 'ocserv-main'
+    for proto, port in ocserv.get('listen_ports').items():
+        if check_port_availability(ocserv['listen_address'], int(port), proto) is not True and \
+                not is_listen_port_bind_service(int(port), 'ocserv-main'):
+            raise ConfigError(f'"{proto}" port "{port}" is used by another service')
+
+    # Check accounting
+    if "accounting" in ocserv:
+        if "mode" in ocserv["accounting"] and "radius" in ocserv["accounting"]["mode"]:
+            if not origin["accounting"]['radius']['server']:
+                raise ConfigError('OpenConnect accounting mode radius requires at least one RADIUS server')
+            if "authentication" not in ocserv or "mode" not in ocserv["authentication"]:
+                raise ConfigError('Accounting depends on OpenConnect authentication configuration')
+            elif "radius" not in ocserv["authentication"]["mode"]:
+                raise ConfigError('RADIUS accounting must be used with RADIUS authentication')
+
+    # Check authentication
+    if "authentication" in ocserv:
+        if "mode" in ocserv["authentication"]:
+            if ("local" in ocserv["authentication"]["mode"] and
+                "radius" in ocserv["authentication"]["mode"]):
+                    raise ConfigError('OpenConnect authentication modes are mutually-exclusive, remove either local or radius from your configuration')
+            if "radius" in ocserv["authentication"]["mode"]:
+                if not ocserv["authentication"]['radius']['server']:
+                    raise ConfigError('OpenConnect authentication mode radius requires at least one RADIUS server')
+            if "local" in ocserv["authentication"]["mode"]:
+                if not ocserv.get("authentication", {}).get("local_users"):
+                    raise ConfigError('OpenConnect mode local required at least one user')
+                if not ocserv["authentication"]["local_users"]["username"]:
+                    raise ConfigError('OpenConnect mode local required at least one user')
+                else:
+                    # For OTP mode: verify that each local user has an OTP key
+                    if "otp" in ocserv["authentication"]["mode"]["local"]:
+                        users_wo_key = []
+                        for user, user_config in ocserv["authentication"]["local_users"]["username"].items():
+                            # User has no OTP key defined
+                            if dict_search('otp.key', user_config) == None:
+                                users_wo_key.append(user)
+                        if users_wo_key:
+                            raise ConfigError(f'OTP enabled, but no OTP key is configured for these users:\n{users_wo_key}')
+                    # For password (and default) mode: verify that each local user has password
+                    if "password" in ocserv["authentication"]["mode"]["local"] or "otp" not in ocserv["authentication"]["mode"]["local"]:
+                        users_wo_pswd = []
+                        for user in ocserv["authentication"]["local_users"]["username"]:
+                            if not "password" in ocserv["authentication"]["local_users"]["username"][user]:
+                                users_wo_pswd.append(user)
+                        if users_wo_pswd:
+                            raise ConfigError(f'password required for users:\n{users_wo_pswd}')
+
+            # Validate that if identity-based-config is configured all child config nodes are set
+            if 'identity_based_config' in ocserv["authentication"]:
+                if 'disabled' not in ocserv["authentication"]["identity_based_config"]:
+                    Warning("Identity based configuration files is a 3rd party addition. Use at your own risk, this might break the ocserv daemon!")
+                    if 'mode' not in ocserv["authentication"]["identity_based_config"]:
+                        raise ConfigError('OpenConnect radius identity-based-config enabled but mode not selected')
+                    elif 'group' in ocserv["authentication"]["identity_based_config"]["mode"] and "radius" not in ocserv["authentication"]["mode"]:
+                        raise ConfigError('OpenConnect config-per-group must be used with radius authentication')
+                    if 'directory' not in ocserv["authentication"]["identity_based_config"]:
+                        raise ConfigError('OpenConnect identity-based-config enabled but directory not set')
+                    if 'default_config' not in ocserv["authentication"]["identity_based_config"]:
+                        raise ConfigError('OpenConnect identity-based-config enabled but default-config not set')
+        else:
+            raise ConfigError('OpenConnect authentication mode required')
+    else:
+        raise ConfigError('OpenConnect authentication credentials required')
+
+    # Check ssl
+    if 'ssl' not in ocserv:
+        raise ConfigError('SSL missing on OpenConnect config!')
+
+    if 'certificate' not in ocserv['ssl']:
+        raise ConfigError('SSL certificate missing on OpenConnect config!')
+    verify_pki_certificate(ocserv, ocserv['ssl']['certificate'])
+
+    if 'ca_certificate' in ocserv['ssl']:
+        for ca_cert in ocserv['ssl']['ca_certificate']:
+            verify_pki_ca_certificate(ocserv, ca_cert)
+
+    # Check network settings
+    if "network_settings" in ocserv:
+        if "push_route" in ocserv["network_settings"]:
+            # Replace default route
+            if "0.0.0.0/0" in ocserv["network_settings"]["push_route"]:
+                ocserv["network_settings"]["push_route"].remove("0.0.0.0/0")
+                ocserv["network_settings"]["push_route"].append("default")
+        else:
+            ocserv["network_settings"]["push_route"] = ["default"]
+    else:
+        raise ConfigError('OpenConnect network settings required!')
+
+def generate(ocserv):
+    if not ocserv:
+        return None
+
+    if "radius" in ocserv["authentication"]["mode"]:
+        if dict_search(ocserv, 'accounting.mode.radius'):
+            # Render radius client configuration
+            render(radius_cfg, 'ocserv/radius_conf.j2', ocserv)
+            merged_servers = ocserv["accounting"]["radius"]["server"] | ocserv["authentication"]["radius"]["server"]
+            # Render radius servers
+            # Merge the accounting and authentication servers into a single dictionary
+            render(radius_servers, 'ocserv/radius_servers.j2', {'server': merged_servers})
+        else:
+            # Render radius client configuration
+            render(radius_cfg, 'ocserv/radius_conf.j2', ocserv)
+            # Render radius servers
+            render(radius_servers, 'ocserv/radius_servers.j2', ocserv["authentication"]["radius"])
+    elif "local" in ocserv["authentication"]["mode"]:
+        # if mode "OTP", generate OTP users file parameters
+        if "otp" in ocserv["authentication"]["mode"]["local"]:
+            if "local_users" in ocserv["authentication"]:
+                for user in ocserv["authentication"]["local_users"]["username"]:
+                    # OTP token type from CLI parameters:
+                    otp_interval = str(ocserv["authentication"]["local_users"]["username"][user]["otp"].get("interval"))
+                    token_type = ocserv["authentication"]["local_users"]["username"][user]["otp"].get("token_type")
+                    otp_length = str(ocserv["authentication"]["local_users"]["username"][user]["otp"].get("otp_length"))
+                    if token_type == "hotp-time":
+                        otp_type = "HOTP/T" + otp_interval
+                    elif token_type == "hotp-event":
+                        otp_type = "HOTP/E"
+                    else:
+                        otp_type = "HOTP/T" + otp_interval
+                    ocserv["authentication"]["local_users"]["username"][user]["otp"]["token_tmpl"] = otp_type + "/" + otp_length
+        # if there is a password, generate hash
+        if "password" in ocserv["authentication"]["mode"]["local"] or not "otp" in ocserv["authentication"]["mode"]["local"]:
+            if "local_users" in ocserv["authentication"]:
+                for user in ocserv["authentication"]["local_users"]["username"]:
+                    ocserv["authentication"]["local_users"]["username"][user]["hash"] = get_hash(ocserv["authentication"]["local_users"]["username"][user]["password"])
+
+        if "password-otp" in ocserv["authentication"]["mode"]["local"]:
+            # Render local users ocpasswd
+            render(ocserv_passwd, 'ocserv/ocserv_passwd.j2', ocserv["authentication"]["local_users"])
+            # Render local users OTP keys
+            render(ocserv_otp_usr, 'ocserv/ocserv_otp_usr.j2', ocserv["authentication"]["local_users"])
+        elif "password" in ocserv["authentication"]["mode"]["local"]:
+            # Render local users ocpasswd
+            render(ocserv_passwd, 'ocserv/ocserv_passwd.j2', ocserv["authentication"]["local_users"])
+        elif "otp" in ocserv["authentication"]["mode"]["local"]:
+            # Render local users OTP keys
+            render(ocserv_otp_usr, 'ocserv/ocserv_otp_usr.j2', ocserv["authentication"]["local_users"])
+        else:
+            # Render local users ocpasswd
+            render(ocserv_passwd, 'ocserv/ocserv_passwd.j2', ocserv["authentication"]["local_users"])
+    else:
+        if "local_users" in ocserv["authentication"]:
+            for user in ocserv["authentication"]["local_users"]["username"]:
+                ocserv["authentication"]["local_users"]["username"][user]["hash"] = get_hash(ocserv["authentication"]["local_users"]["username"][user]["password"])
+            # Render local users
+            render(ocserv_passwd, 'ocserv/ocserv_passwd.j2', ocserv["authentication"]["local_users"])
+
+    if "ssl" in ocserv:
+        cert_file_path = os.path.join(cfg_dir, 'cert.pem')
+        cert_key_path = os.path.join(cfg_dir, 'cert.key')
+
+
+        if 'certificate' in ocserv['ssl']:
+            cert_name = ocserv['ssl']['certificate']
+            pki_cert = ocserv['pki']['certificate'][cert_name]
+
+            loaded_pki_cert = load_certificate(pki_cert['certificate'])
+            loaded_ca_certs = {load_certificate(c['certificate'])
+                for c in ocserv['pki']['ca'].values()} if 'ca' in ocserv['pki'] else {}
+
+            cert_full_chain = find_chain(loaded_pki_cert, loaded_ca_certs)
+
+            write_file(cert_file_path,
+                '\n'.join(encode_certificate(c) for c in cert_full_chain))
+
+            if 'private' in pki_cert and 'key' in pki_cert['private']:
+                write_file(cert_key_path, wrap_private_key(pki_cert['private']['key']))
+
+        if 'ca_certificate' in ocserv['ssl']:
+            ca_cert_file_path = os.path.join(cfg_dir, 'ca.pem')
+            ca_chains = []
+
+            for ca_name in ocserv['ssl']['ca_certificate']:
+                pki_ca_cert = ocserv['pki']['ca'][ca_name]
+                loaded_ca_cert = load_certificate(pki_ca_cert['certificate'])
+                ca_full_chain = find_chain(loaded_ca_cert, loaded_ca_certs)
+                ca_chains.append(
+                    '\n'.join(encode_certificate(c) for c in ca_full_chain))
+
+            write_file(ca_cert_file_path, '\n'.join(ca_chains))
+
+    # Render config
+    render(ocserv_conf, 'ocserv/ocserv_config.j2', ocserv)
+
+
+def apply(ocserv):
+    if not ocserv:
+        call('systemctl stop ocserv.service')
+        for file in [ocserv_conf, ocserv_passwd, ocserv_otp_usr]:
+            if os.path.exists(file):
+                os.unlink(file)
+    else:
+        call('systemctl reload-or-restart ocserv.service')
+        counter = 0
+        while True:
+            # exit early when service runs
+            if is_systemd_service_running("ocserv.service"):
+                break
+            sleep(0.250)
+            if counter > 5:
+                raise ConfigError('OpenConnect failed to start, check the logs for details')
+                break
+            counter += 1
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpn_pptp.py b/src/conf_mode/vpn_pptp.py
new file mode 100644
index 0000000..c0d8330
--- /dev/null
+++ b/src/conf_mode/vpn_pptp.py
@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+from sys import exit
+
+
+from vyos.config import Config
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.dict import dict_search
+from vyos.accel_ppp_util import verify_accel_ppp_name_servers
+from vyos.accel_ppp_util import verify_accel_ppp_wins_servers
+from vyos.accel_ppp_util import verify_accel_ppp_authentication
+from vyos.accel_ppp_util import verify_accel_ppp_ip_pool
+from vyos.accel_ppp_util import get_pools_in_order
+from vyos import ConfigError
+from vyos.configdict import get_accel_dict
+
+from vyos import airbag
+airbag.enable()
+
+pptp_conf = '/run/accel-pppd/pptp.conf'
+pptp_chap_secrets = '/run/accel-pppd/pptp.chap-secrets'
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['vpn', 'pptp', 'remote-access']
+    if not conf.exists(base):
+        return None
+
+    # retrieve common dictionary keys
+    pptp = get_accel_dict(conf, base, pptp_chap_secrets)
+
+    if dict_search('client_ip_pool', pptp):
+        # Multiple named pools require ordered values T5099
+        pptp['ordered_named_pools'] = get_pools_in_order(
+            dict_search('client_ip_pool', pptp))
+    pptp['chap_secrets_file'] = pptp_chap_secrets
+    pptp['server_type'] = 'pptp'
+    return pptp
+
+
+def verify(pptp):
+    if not pptp:
+        return None
+
+    verify_accel_ppp_authentication(pptp)
+    verify_accel_ppp_ip_pool(pptp)
+    verify_accel_ppp_name_servers(pptp)
+    verify_accel_ppp_wins_servers(pptp)
+
+
+def generate(pptp):
+    if not pptp:
+        return None
+
+    render(pptp_conf, 'accel-ppp/pptp.config.j2', pptp)
+
+    if dict_search('authentication.mode', pptp) == 'local':
+        render(pptp_chap_secrets, 'accel-ppp/chap-secrets.config_dict.j2',
+               pptp, permission=0o640)
+
+    return None
+
+
+def apply(pptp):
+    if not pptp:
+        call('systemctl stop accel-ppp@pptp.service')
+        for file in [pptp_conf, pptp_chap_secrets]:
+            if os.path.exists(file):
+                os.unlink(file)
+
+        return None
+
+    call('systemctl restart accel-ppp@pptp.service')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py
new file mode 100644
index 0000000..7490fd0
--- /dev/null
+++ b/src/conf_mode/vpn_sstp.py
@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_accel_dict
+from vyos.configverify import verify_pki_certificate
+from vyos.configverify import verify_pki_ca_certificate
+from vyos.pki import wrap_certificate
+from vyos.pki import wrap_private_key
+from vyos.template import render
+from vyos.utils.process import call
+from vyos.utils.network import check_port_availability
+from vyos.utils.dict import dict_search
+from vyos.accel_ppp_util import verify_accel_ppp_name_servers
+from vyos.accel_ppp_util import verify_accel_ppp_wins_servers
+from vyos.accel_ppp_util import verify_accel_ppp_authentication
+from vyos.accel_ppp_util import verify_accel_ppp_ip_pool
+from vyos.accel_ppp_util import get_pools_in_order
+from vyos.utils.network import is_listen_port_bind_service
+from vyos.utils.file import write_file
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+cfg_dir = '/run/accel-pppd'
+sstp_conf = '/run/accel-pppd/sstp.conf'
+sstp_chap_secrets = '/run/accel-pppd/sstp.chap-secrets'
+
+cert_file_path = os.path.join(cfg_dir, 'sstp-cert.pem')
+cert_key_path = os.path.join(cfg_dir, 'sstp-cert.key')
+ca_cert_file_path = os.path.join(cfg_dir, 'sstp-ca.pem')
+
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['vpn', 'sstp']
+    if not conf.exists(base):
+        return None
+
+    # retrieve common dictionary keys
+    sstp = get_accel_dict(conf, base, sstp_chap_secrets, with_pki=True)
+    if dict_search('client_ip_pool', sstp):
+        # Multiple named pools require ordered values T5099
+        sstp['ordered_named_pools'] = get_pools_in_order(dict_search('client_ip_pool', sstp))
+
+    sstp['server_type'] = 'sstp'
+    return sstp
+
+
+def verify(sstp):
+    if not sstp:
+        return None
+
+    port = sstp.get('port')
+    proto = 'tcp'
+    if check_port_availability('0.0.0.0', int(port), proto) is not True and \
+            not is_listen_port_bind_service(int(port), 'accel-pppd'):
+        raise ConfigError(f'"{proto}" port "{port}" is used by another service')
+
+    verify_accel_ppp_authentication(sstp)
+    verify_accel_ppp_ip_pool(sstp)
+    verify_accel_ppp_name_servers(sstp)
+    verify_accel_ppp_wins_servers(sstp)
+
+    if 'ssl' not in sstp:
+        raise ConfigError('SSL missing on SSTP config!')
+
+    if 'certificate' not in sstp['ssl']:
+        raise ConfigError('SSL certificate missing on SSTP config!')
+    verify_pki_certificate(sstp, sstp['ssl']['certificate'])
+
+    if 'ca_certificate' not in sstp['ssl']:
+        raise ConfigError('SSL CA certificate missing on SSTP config!')
+    verify_pki_ca_certificate(sstp, sstp['ssl']['ca_certificate'])
+
+
+def generate(sstp):
+    if not sstp:
+        return None
+
+    # accel-cmd reload doesn't work so any change results in a restart of the daemon
+    render(sstp_conf, 'accel-ppp/sstp.config.j2', sstp)
+
+    cert_name = sstp['ssl']['certificate']
+    pki_cert = sstp['pki']['certificate'][cert_name]
+
+    ca_cert_name = sstp['ssl']['ca_certificate']
+    pki_ca = sstp['pki']['ca'][ca_cert_name]
+    write_file(cert_file_path, wrap_certificate(pki_cert['certificate']))
+    write_file(cert_key_path, wrap_private_key(pki_cert['private']['key']))
+    write_file(ca_cert_file_path, wrap_certificate(pki_ca['certificate']))
+
+    if dict_search('authentication.mode', sstp) == 'local':
+        render(sstp_chap_secrets, 'accel-ppp/chap-secrets.config_dict.j2',
+               sstp, permission=0o640)
+    else:
+        if os.path.exists(sstp_chap_secrets):
+             os.unlink(sstp_chap_secrets)
+
+    return sstp
+
+
+def apply(sstp):
+    systemd_service = 'accel-ppp@sstp.service'
+    if not sstp:
+        call(f'systemctl stop {systemd_service}')
+        for file in [sstp_chap_secrets, sstp_conf]:
+            if os.path.exists(file):
+                os.unlink(file)
+        return None
+
+    call(f'systemctl reload-or-restart {systemd_service}')
+
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/vrf.py b/src/conf_mode/vrf.py
new file mode 100644
index 0000000..72b178c
--- /dev/null
+++ b/src/conf_mode/vrf.py
@@ -0,0 +1,364 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+from jmespath import search
+from json import loads
+
+from vyos.config import Config
+from vyos.configdict import dict_merge
+from vyos.configdict import node_changed
+from vyos.configverify import verify_route_map
+from vyos.firewall import conntrack_required
+from vyos.ifconfig import Interface
+from vyos.template import render
+from vyos.template import render_to_string
+from vyos.utils.dict import dict_search
+from vyos.utils.network import get_vrf_tableid
+from vyos.utils.network import get_vrf_members
+from vyos.utils.network import interface_exists
+from vyos.utils.process import call
+from vyos.utils.process import cmd
+from vyos.utils.process import popen
+from vyos.utils.system import sysctl_write
+from vyos import ConfigError
+from vyos import frr
+from vyos import airbag
+airbag.enable()
+
+config_file = '/etc/iproute2/rt_tables.d/vyos-vrf.conf'
+k_mod = ['vrf']
+
+nftables_table = 'inet vrf_zones'
+nftables_rules = {
+    'vrf_zones_ct_in': 'counter ct original zone set iifname map @ct_iface_map',
+    'vrf_zones_ct_out': 'counter ct original zone set oifname map @ct_iface_map'
+}
+
+def has_rule(af : str, priority : int, table : str=None):
+    """
+    Check if a given ip rule exists
+    $ ip --json -4 rule show
+    [{'l3mdev': None, 'priority': 1000, 'src': 'all'},
+    {'action': 'unreachable', 'l3mdev': None, 'priority': 2000, 'src': 'all'},
+    {'priority': 32765, 'src': 'all', 'table': 'local'},
+    {'priority': 32766, 'src': 'all', 'table': 'main'},
+    {'priority': 32767, 'src': 'all', 'table': 'default'}]
+    """
+    if af not in ['-4', '-6']:
+        raise ValueError()
+    command = f'ip --detail --json {af} rule show'
+    for tmp in loads(cmd(command)):
+        if 'priority' in tmp and 'table' in tmp:
+            if tmp['priority'] == priority and tmp['table'] == table:
+                return True
+        elif 'priority' in tmp and table in tmp:
+            # l3mdev table has a different layout
+            if tmp['priority'] == priority:
+                return True
+    return False
+
+def is_nft_vrf_zone_rule_setup() -> bool:
+    """
+    Check if an nftables connection tracking rule already exists
+    """
+    tmp = loads(cmd('sudo nft -j list table inet vrf_zones'))
+    num_rules = len(search("nftables[].rule[].chain", tmp))
+    return bool(num_rules)
+
+def vrf_interfaces(c, match):
+    matched = []
+    old_level = c.get_level()
+    c.set_level(['interfaces'])
+    section = c.get_config_dict([], get_first_key=True)
+    for type in section:
+        interfaces = section[type]
+        for name in interfaces:
+            interface = interfaces[name]
+            if 'vrf' in interface:
+                v = interface.get('vrf', '')
+                if v == match:
+                    matched.append(name)
+
+    c.set_level(old_level)
+    return matched
+
+def vrf_routing(c, match):
+    matched = []
+    old_level = c.get_level()
+    c.set_level(['protocols', 'vrf'])
+    if match in c.list_nodes([]):
+        matched.append(match)
+
+    c.set_level(old_level)
+    return matched
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['vrf']
+    vrf = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               no_tag_node_value_mangle=True, get_first_key=True)
+
+    # determine which VRF has been removed
+    for name in node_changed(conf, base + ['name']):
+        if 'vrf_remove' not in vrf:
+            vrf.update({'vrf_remove' : {}})
+
+        vrf['vrf_remove'][name] = {}
+        # get VRF bound interfaces
+        interfaces = vrf_interfaces(conf, name)
+        if interfaces: vrf['vrf_remove'][name]['interface'] = interfaces
+        # get VRF bound routing instances
+        routes = vrf_routing(conf, name)
+        if routes: vrf['vrf_remove'][name]['route'] = routes
+
+    if 'name' in vrf:
+        vrf['conntrack'] = conntrack_required(conf)
+
+    # We also need the route-map information from the config
+    #
+    # XXX: one MUST always call this without the key_mangling() option! See
+    # vyos.configverify.verify_common_route_maps() for more information.
+    tmp = {'policy' : {'route-map' : conf.get_config_dict(['policy', 'route-map'],
+                                                          get_first_key=True)}}
+
+    # Merge policy dict into "regular" config dict
+    vrf = dict_merge(tmp, vrf)
+    return vrf
+
+def verify(vrf):
+    # ensure VRF is not assigned to any interface
+    if 'vrf_remove' in vrf:
+        for name, config in vrf['vrf_remove'].items():
+            if 'interface' in config:
+                raise ConfigError(f'Can not remove VRF "{name}", it still has '\
+                                  f'member interfaces!')
+            if 'route' in config:
+                raise ConfigError(f'Can not remove VRF "{name}", it still has '\
+                                  f'static routes installed!')
+
+    if 'name' in vrf:
+        reserved_names = ["add", "all", "broadcast", "default", "delete", "dev",
+                          "get", "inet", "mtu", "link", "type", "vrf"]
+        table_ids = []
+        for name, vrf_config in vrf['name'].items():
+            # Reserved VRF names
+            if name in reserved_names:
+                raise ConfigError(f'VRF name "{name}" is reserved and connot be used!')
+
+            # table id is mandatory
+            if 'table' not in vrf_config:
+                raise ConfigError(f'VRF "{name}" table id is mandatory!')
+
+            # routing table id can't be changed - OS restriction
+            if interface_exists(name):
+                tmp = get_vrf_tableid(name)
+                if tmp and tmp != int(vrf_config['table']):
+                    raise ConfigError(f'VRF "{name}" table id modification not possible!')
+
+            # VRF routing table ID must be unique on the system
+            if 'table' in vrf_config and vrf_config['table'] in table_ids:
+                raise ConfigError(f'VRF "{name}" table id is not unique!')
+            table_ids.append(vrf_config['table'])
+
+            tmp = dict_search('ip.protocol', vrf_config)
+            if tmp != None:
+                for protocol, protocol_options in tmp.items():
+                    if 'route_map' in protocol_options:
+                        verify_route_map(protocol_options['route_map'], vrf)
+
+            tmp = dict_search('ipv6.protocol', vrf_config)
+            if tmp != None:
+                for protocol, protocol_options in tmp.items():
+                    if 'route_map' in protocol_options:
+                        verify_route_map(protocol_options['route_map'], vrf)
+
+    return None
+
+
+def generate(vrf):
+    # Render iproute2 VR helper names
+    render(config_file, 'iproute2/vrf.conf.j2', vrf)
+    # Render VRF Kernel/Zebra route-map filters
+    vrf['frr_zebra_config'] = render_to_string('frr/zebra.vrf.route-map.frr.j2', vrf)
+
+    return None
+
+def apply(vrf):
+    # Documentation
+    #
+    # - https://github.com/torvalds/linux/blob/master/Documentation/networking/vrf.txt
+    # - https://github.com/Mellanox/mlxsw/wiki/Virtual-Routing-and-Forwarding-(VRF)
+    # - https://github.com/Mellanox/mlxsw/wiki/L3-Tunneling
+    # - https://netdevconf.info/1.1/proceedings/slides/ahern-vrf-tutorial.pdf
+    # - https://netdevconf.info/1.2/slides/oct6/02_ahern_what_is_l3mdev_slides.pdf
+
+    # set the default VRF global behaviour
+    bind_all = '0'
+    if 'bind_to_all' in vrf:
+        bind_all = '1'
+    sysctl_write('net.ipv4.tcp_l3mdev_accept', bind_all)
+    sysctl_write('net.ipv4.udp_l3mdev_accept', bind_all)
+
+    for tmp in (dict_search('vrf_remove', vrf) or []):
+        if interface_exists(tmp):
+            # T5492: deleting a VRF instance may leafe processes running
+            # (e.g. dhclient) as there is a depedency ordering issue in the CLI.
+            # We need to ensure that we stop the dhclient processes first so
+            # a proper DHCLP RELEASE message is sent
+            for interface in get_vrf_members(tmp):
+                vrf_iface = Interface(interface)
+                vrf_iface.set_dhcp(False)
+                vrf_iface.set_dhcpv6(False)
+
+            # Remove nftables conntrack zone map item
+            nft_del_element = f'delete element inet vrf_zones ct_iface_map {{ "{tmp}" }}'
+            # Check if deleting is possible first to avoid raising errors
+            _, err = popen(f'nft --check {nft_del_element}')
+            if not err:
+                # Remove map element
+                cmd(f'nft {nft_del_element}')
+
+            # Delete the VRF Kernel interface
+            call(f'ip link delete dev {tmp}')
+
+    if 'name' in vrf:
+        # Linux routing uses rules to find tables - routing targets are then
+        # looked up in those tables. If the lookup got a matching route, the
+        # process ends.
+        #
+        # TL;DR; first table with a matching entry wins!
+        #
+        # You can see your routing table lookup rules using "ip rule", sadly the
+        # local lookup is hit before any VRF lookup. Pinging an addresses from the
+        # VRF will usually find a hit in the local table, and never reach the VRF
+        # routing table - this is usually not what you want. Thus we will
+        # re-arrange the tables and move the local lookup further down once VRFs
+        # are enabled.
+        #
+        # Thanks to https://stbuehler.de/blog/article/2020/02/29/using_vrf__virtual_routing_and_forwarding__on_linux.html
+
+        for afi in ['-4', '-6']:
+            # move lookup local to pref 32765 (from 0)
+            if not has_rule(afi, 32765, 'local'):
+                call(f'ip {afi} rule add pref 32765 table local')
+            if has_rule(afi, 0, 'local'):
+                call(f'ip {afi} rule del pref 0')
+            # make sure that in VRFs after failed lookup in the VRF specific table
+            # nothing else is reached
+            if not has_rule(afi, 1000, 'l3mdev'):
+                # this should be added by the kernel when a VRF is created
+                # add it here for completeness
+                call(f'ip {afi} rule add pref 1000 l3mdev protocol kernel')
+
+            # add another rule with an unreachable target which only triggers in VRF context
+            # if a route could not be reached
+            if not has_rule(afi, 2000, 'l3mdev'):
+                call(f'ip {afi} rule add pref 2000 l3mdev unreachable')
+
+        nft_vrf_zone_rule_setup = False
+        for name, config in vrf['name'].items():
+            table = config['table']
+            if not interface_exists(name):
+                # For each VRF apart from your default context create a VRF
+                # interface with a separate routing table
+                call(f'ip link add {name} type vrf table {table}')
+
+            # set VRF description for e.g. SNMP monitoring
+            vrf_if = Interface(name)
+            # We also should add proper loopback IP addresses to the newly added
+            # VRF for services bound to the loopback address (SNMP, NTP)
+            vrf_if.add_addr('127.0.0.1/8')
+            vrf_if.add_addr('::1/128')
+            # add VRF description if available
+            vrf_if.set_alias(config.get('description', ''))
+
+            # Enable/Disable IPv4 forwarding
+            tmp = dict_search('ip.disable_forwarding', config)
+            value = '0' if (tmp != None) else '1'
+            vrf_if.set_ipv4_forwarding(value)
+            # Enable/Disable IPv6 forwarding
+            tmp = dict_search('ipv6.disable_forwarding', config)
+            value = '0' if (tmp != None) else '1'
+            vrf_if.set_ipv6_forwarding(value)
+
+            # Enable/Disable of an interface must always be done at the end of the
+            # derived class to make use of the ref-counting set_admin_state()
+            # function. We will only enable the interface if 'up' was called as
+            # often as 'down'. This is required by some interface implementations
+            # as certain parameters can only be changed when the interface is
+            # in admin-down state. This ensures the link does not flap during
+            # reconfiguration.
+            state = 'down' if 'disable' in config else 'up'
+            vrf_if.set_admin_state(state)
+            # Add nftables conntrack zone map item
+            nft_add_element = f'add element inet vrf_zones ct_iface_map {{ "{name}" : {table} }}'
+            cmd(f'nft {nft_add_element}')
+
+        # Only call into nftables as long as there is nothing setup to avoid wasting
+        # CPU time and thus lenghten the commit process
+        if not nft_vrf_zone_rule_setup:
+            nft_vrf_zone_rule_setup = is_nft_vrf_zone_rule_setup()
+        # Install nftables conntrack rules only once
+        if vrf['conntrack'] and not nft_vrf_zone_rule_setup:
+            for chain, rule in nftables_rules.items():
+                cmd(f'nft add rule inet vrf_zones {chain} {rule}')
+
+    if 'name' not in vrf or not vrf['conntrack']:
+        for chain, rule in nftables_rules.items():
+            cmd(f'nft flush chain inet vrf_zones {chain}')
+
+    # Return default ip rule values
+    if 'name' not in vrf:
+        for afi in ['-4', '-6']:
+            # move lookup local to pref 0 (from 32765)
+            if not has_rule(afi, 0, 'local'):
+                call(f'ip {afi} rule add pref 0 from all lookup local')
+            if has_rule(afi, 32765, 'local'):
+                call(f'ip {afi} rule del pref 32765 table local')
+
+            if has_rule(afi, 1000, 'l3mdev'):
+                call(f'ip {afi} rule del pref 1000 l3mdev protocol kernel')
+            if has_rule(afi, 2000, 'l3mdev'):
+                call(f'ip {afi} rule del pref 2000 l3mdev unreachable')
+
+    # Apply FRR filters
+    zebra_daemon = 'zebra'
+    # Save original configuration prior to starting any commit actions
+    frr_cfg = frr.FRRConfig()
+
+    # The route-map used for the FIB (zebra) is part of the zebra daemon
+    frr_cfg.load_configuration(zebra_daemon)
+    frr_cfg.modify_section(f'^vrf .+', stop_pattern='^exit-vrf', remove_stop_mark=True)
+    if 'frr_zebra_config' in vrf:
+        frr_cfg.add_before(frr.default_add_before, vrf['frr_zebra_config'])
+    frr_cfg.commit_configuration(zebra_daemon)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)