T9393: new roles

80 files changed, 2884 insertions, 2 deletions

diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-1.txt b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-1.txt
new file mode 100644
index 0000000..09a87c7
--- /dev/null
+++ b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-1.txt
@@ -0,0 +1,46 @@
+set firewall ipv4 output filter rule 10
+set firewall ipv4 output filter rule 10 action 'drop'
+set firewall ipv4 output filter rule 10 ipsec 'match-none-out'
+set firewall ipv4 output filter rule 10 protocol 'gre'
+set interfaces ethernet eth0 address '10.0.0.2/30'
+set interfaces tunnel tun100 address '10.100.100.1/32'
+set interfaces tunnel tun100 enable-multicast
+set interfaces tunnel tun100 encapsulation 'gre'
+set interfaces tunnel tun100 ip adjust-mss '1360'
+set interfaces tunnel tun100 mtu '1436'
+set interfaces tunnel tun100 parameters ip key '42'
+set interfaces tunnel tun100 source-interface 'eth0'
+set protocols nhrp tunnel tun100 authentication '********'
+set protocols nhrp tunnel tun100 holdtime '300'
+set protocols nhrp tunnel tun100 multicast 'dynamic'
+set protocols nhrp tunnel tun100 network-id '1'
+set protocols nhrp tunnel tun100 redirect
+set protocols nhrp tunnel tun100 registration-no-unique
+set protocols ospf interface tun100 area '0'
+set protocols ospf interface tun100 network point-to-multipoint
+set protocols ospf interface tun100 passive disable
+set protocols ospf passive-interface default
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '10.0.0.1'
+set system host-name HUB-1
+set vpn ipsec esp-group ESP-HUB
+set vpn ipsec esp-group ESP-HUB lifetime 1800
+set vpn ipsec esp-group ESP-HUB mode transport
+set vpn ipsec esp-group ESP-HUB pfs disable
+set vpn ipsec esp-group ESP-HUB proposal 1
+set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256
+set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1
+set vpn ipsec ike-group IKE-HUB
+set vpn ipsec ike-group IKE-HUB key-exchange ikev1
+set vpn ipsec ike-group IKE-HUB lifetime 3600
+set vpn ipsec ike-group IKE-HUB proposal 1
+set vpn ipsec ike-group IKE-HUB proposal 1 dh-group 2
+set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256
+set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1
+set vpn ipsec interface eth0
+set vpn ipsec profile NHRPVPN
+set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
+set vpn ipsec profile NHRPVPN authentication pre-shared-secret '********'
+set vpn ipsec profile NHRPVPN bind tunnel tun100
+set vpn ipsec profile NHRPVPN esp-group ESP-HUB
+set vpn ipsec profile NHRPVPN ike-group IKE-HUB
diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-2.txt b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-2.txt
new file mode 100644
index 0000000..90fc562
--- /dev/null
+++ b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/HUB-2.txt
@@ -0,0 +1,46 @@
+set firewall ipv4 output filter rule 10
+set firewall ipv4 output filter rule 10 action 'drop'
+set firewall ipv4 output filter rule 10 ipsec 'match-none-out'
+set firewall ipv4 output filter rule 10 protocol 'gre'
+set interfaces ethernet eth0 address '10.0.1.2/30'
+set interfaces tunnel tun101 address '10.100.101.1/32'
+set interfaces tunnel tun101 enable-multicast
+set interfaces tunnel tun101 encapsulation 'gre'
+set interfaces tunnel tun101 ip adjust-mss '1360'
+set interfaces tunnel tun101 mtu '1436'
+set interfaces tunnel tun101 parameters ip key '43'
+set interfaces tunnel tun101 source-interface 'eth0'
+set protocols nhrp tunnel tun101 authentication '********'
+set protocols nhrp tunnel tun101 holdtime '300'
+set protocols nhrp tunnel tun101 multicast 'dynamic'
+set protocols nhrp tunnel tun101 network-id '2'
+set protocols nhrp tunnel tun101 redirect
+set protocols nhrp tunnel tun101 registration-no-unique
+set protocols ospf interface tun101 area '0'
+set protocols ospf interface tun101 network point-to-multipoint
+set protocols ospf interface tun101 passive disable
+set protocols ospf passive-interface default
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '10.0.1.1'
+set system host-name HUB-2
+set vpn ipsec esp-group ESP-HUB
+set vpn ipsec esp-group ESP-HUB lifetime 1800
+set vpn ipsec esp-group ESP-HUB mode transport
+set vpn ipsec esp-group ESP-HUB pfs disable
+set vpn ipsec esp-group ESP-HUB proposal 1
+set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256
+set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1
+set vpn ipsec ike-group IKE-HUB
+set vpn ipsec ike-group IKE-HUB key-exchange ikev1
+set vpn ipsec ike-group IKE-HUB lifetime 3600
+set vpn ipsec ike-group IKE-HUB proposal 1
+set vpn ipsec ike-group IKE-HUB proposal 1 dh-group 2
+set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256
+set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1
+set vpn ipsec interface eth0
+set vpn ipsec profile NHRPVPN
+set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
+set vpn ipsec profile NHRPVPN authentication pre-shared-secret '********'
+set vpn ipsec profile NHRPVPN bind tunnel tun101
+set vpn ipsec profile NHRPVPN esp-group ESP-HUB
+set vpn ipsec profile NHRPVPN ike-group IKE-HUB
diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-2.txt b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-2.txt
new file mode 100644
index 0000000..21e17b6
--- /dev/null
+++ b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-2.txt
@@ -0,0 +1,67 @@
+set firewall ipv4 output filter rule 10
+set firewall ipv4 output filter rule 10 action 'drop'
+set firewall ipv4 output filter rule 10 ipsec 'match-none-out'
+set firewall ipv4 output filter rule 10 protocol 'gre'
+set interfaces ethernet eth0 address '10.0.12.2/30'
+set interfaces ethernet eth1 address '192.168.12.1/24'
+set interfaces tunnel tun100 address '10.100.100.12/32'
+set interfaces tunnel tun100 enable-multicast
+set interfaces tunnel tun100 encapsulation 'gre'
+set interfaces tunnel tun100 ip adjust-mss '1360'
+set interfaces tunnel tun100 mtu '1436'
+set interfaces tunnel tun100 parameters ip key '42'
+set interfaces tunnel tun100 source-interface 'eth0'
+set interfaces tunnel tun101 address '10.100.101.12/32'
+set interfaces tunnel tun101 enable-multicast
+set interfaces tunnel tun101 encapsulation 'gre'
+set interfaces tunnel tun101 ip adjust-mss '1360'
+set interfaces tunnel tun101 mtu '1436'
+set interfaces tunnel tun101 parameters ip key '43'
+set interfaces tunnel tun101 source-interface 'eth0'
+set protocols nhrp tunnel tun100 authentication '********'
+set protocols nhrp tunnel tun100 holdtime '300'
+set protocols nhrp tunnel tun100 multicast '10.0.0.2'
+set protocols nhrp tunnel tun100 network-id '1'
+set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2'
+set protocols nhrp tunnel tun100 registration-no-unique
+set protocols nhrp tunnel tun100 shortcut
+set protocols nhrp tunnel tun101 authentication '********'
+set protocols nhrp tunnel tun101 holdtime '300'
+set protocols nhrp tunnel tun101 multicast '10.0.1.2'
+set protocols nhrp tunnel tun101 network-id '2'
+set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2'
+set protocols nhrp tunnel tun101 registration-no-unique
+set protocols nhrp tunnel tun101 shortcut
+set protocols ospf interface eth1 area '0'
+set protocols ospf interface tun100 area '0'
+set protocols ospf interface tun100 network point-to-multipoint
+set protocols ospf interface tun100 passive disable
+set protocols ospf interface tun101 area '0'
+set protocols ospf interface tun101 network point-to-multipoint
+set protocols ospf interface tun101 passive disable
+set protocols ospf passive-interface default
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '10.0.12.1'
+set system host-name SPOKE-2
+set vpn ipsec esp-group ESP-HUB
+set vpn ipsec esp-group ESP-HUB lifetime 1800
+set vpn ipsec esp-group ESP-HUB mode transport
+set vpn ipsec esp-group ESP-HUB pfs disable
+set vpn ipsec esp-group ESP-HUB proposal 1
+set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256
+set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1
+set vpn ipsec ike-group IKE-HUB
+set vpn ipsec ike-group IKE-HUB key-exchange ikev1
+set vpn ipsec ike-group IKE-HUB lifetime 3600
+set vpn ipsec ike-group IKE-HUB proposal 1
+set vpn ipsec ike-group IKE-HUB proposal 1 dh-group 2
+set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256
+set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1
+set vpn ipsec interface eth0
+set vpn ipsec profile NHRPVPN
+set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
+set vpn ipsec profile NHRPVPN authentication pre-shared-secret '********'
+set vpn ipsec profile NHRPVPN bind tunnel tun100
+set vpn ipsec profile NHRPVPN bind tunnel tun101
+set vpn ipsec profile NHRPVPN esp-group ESP-HUB
+set vpn ipsec profile NHRPVPN ike-group IKE-HUB
diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-3.txt b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-3.txt
new file mode 100644
index 0000000..4827566
--- /dev/null
+++ b/tests/render/cases/blueprints/dmvpn_dual_hub/expected/SPOKE-3.txt
@@ -0,0 +1,67 @@
+set firewall ipv4 output filter rule 10
+set firewall ipv4 output filter rule 10 action 'drop'
+set firewall ipv4 output filter rule 10 ipsec 'match-none-out'
+set firewall ipv4 output filter rule 10 protocol 'gre'
+set interfaces ethernet eth0 address '10.0.13.2/30'
+set interfaces ethernet eth1 address '192.168.13.1/24'
+set interfaces tunnel tun100 address '10.100.100.13/32'
+set interfaces tunnel tun100 enable-multicast
+set interfaces tunnel tun100 encapsulation 'gre'
+set interfaces tunnel tun100 ip adjust-mss '1360'
+set interfaces tunnel tun100 mtu '1436'
+set interfaces tunnel tun100 parameters ip key '42'
+set interfaces tunnel tun100 source-interface 'eth0'
+set interfaces tunnel tun101 address '10.100.101.13/32'
+set interfaces tunnel tun101 enable-multicast
+set interfaces tunnel tun101 encapsulation 'gre'
+set interfaces tunnel tun101 ip adjust-mss '1360'
+set interfaces tunnel tun101 mtu '1436'
+set interfaces tunnel tun101 parameters ip key '43'
+set interfaces tunnel tun101 source-interface 'eth0'
+set protocols nhrp tunnel tun100 authentication '********'
+set protocols nhrp tunnel tun100 holdtime '300'
+set protocols nhrp tunnel tun100 multicast '10.0.0.2'
+set protocols nhrp tunnel tun100 network-id '1'
+set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2'
+set protocols nhrp tunnel tun100 registration-no-unique
+set protocols nhrp tunnel tun100 shortcut
+set protocols nhrp tunnel tun101 authentication '********'
+set protocols nhrp tunnel tun101 holdtime '300'
+set protocols nhrp tunnel tun101 multicast '10.0.1.2'
+set protocols nhrp tunnel tun101 network-id '2'
+set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2'
+set protocols nhrp tunnel tun101 registration-no-unique
+set protocols nhrp tunnel tun101 shortcut
+set protocols ospf interface eth1 area '0'
+set protocols ospf interface tun100 area '0'
+set protocols ospf interface tun100 network point-to-multipoint
+set protocols ospf interface tun100 passive disable
+set protocols ospf interface tun101 area '0'
+set protocols ospf interface tun101 network point-to-multipoint
+set protocols ospf interface tun101 passive disable
+set protocols ospf passive-interface default
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '10.0.13.1'
+set system host-name SPOKE-3
+set vpn ipsec esp-group ESP-HUB
+set vpn ipsec esp-group ESP-HUB lifetime 1800
+set vpn ipsec esp-group ESP-HUB mode transport
+set vpn ipsec esp-group ESP-HUB pfs disable
+set vpn ipsec esp-group ESP-HUB proposal 1
+set vpn ipsec esp-group ESP-HUB proposal 1 encryption aes256
+set vpn ipsec esp-group ESP-HUB proposal 1 hash sha1
+set vpn ipsec ike-group IKE-HUB
+set vpn ipsec ike-group IKE-HUB key-exchange ikev1
+set vpn ipsec ike-group IKE-HUB lifetime 3600
+set vpn ipsec ike-group IKE-HUB proposal 1
+set vpn ipsec ike-group IKE-HUB proposal 1 dh-group 2
+set vpn ipsec ike-group IKE-HUB proposal 1 encryption aes256
+set vpn ipsec ike-group IKE-HUB proposal 1 hash sha1
+set vpn ipsec interface eth0
+set vpn ipsec profile NHRPVPN
+set vpn ipsec profile NHRPVPN authentication mode pre-shared-secret
+set vpn ipsec profile NHRPVPN authentication pre-shared-secret '********'
+set vpn ipsec profile NHRPVPN bind tunnel tun100
+set vpn ipsec profile NHRPVPN bind tunnel tun101
+set vpn ipsec profile NHRPVPN esp-group ESP-HUB
+set vpn ipsec profile NHRPVPN ike-group IKE-HUB
diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/inventory.yml b/tests/render/cases/blueprints/dmvpn_dual_hub/inventory.yml
new file mode 100644
index 0000000..a8cb78d
--- /dev/null
+++ b/tests/render/cases/blueprints/dmvpn_dual_hub/inventory.yml
@@ -0,0 +1,205 @@
+---
+# The page shows no tunnel-interface block for Spoke-3; it gets Spoke-2's
+# tunnels with .13 addresses (its NHRP block on the page matches Spoke-2's).
+all:
+  hosts:
+    HUB-1:
+      base_interfaces:
+        - name: eth0
+          addresses:
+            - 10.0.0.2/30
+      base_static_routes:
+        - dest: 0.0.0.0/0
+          next_hop: 10.0.0.1
+      gre_tunnel_interfaces:
+        - name: tun100
+          addresses:
+            - 10.100.100.1/32
+          enable_multicast: true
+          encapsulation: gre
+          adjust_mss: '1360'
+          mtu: 1436
+          key: 42
+          source_interface: eth0
+      dmvpn_nhrp_tunnels:
+        - name: tun100
+          authentication: vyos
+          holdtime: 300
+          multicast: dynamic
+          network_id: 1
+          redirect: true
+          registration_no_unique: true
+      ospf_interfaces:
+        - name: tun100
+          area: '0'
+          network: point-to-multipoint
+          passive: false
+      ansible_host: 192.0.2.1
+      base_hostname: HUB-1
+    HUB-2:
+      base_interfaces:
+        - name: eth0
+          addresses:
+            - 10.0.1.2/30
+      base_static_routes:
+        - dest: 0.0.0.0/0
+          next_hop: 10.0.1.1
+      gre_tunnel_interfaces:
+        - name: tun101
+          addresses:
+            - 10.100.101.1/32
+          enable_multicast: true
+          encapsulation: gre
+          adjust_mss: '1360'
+          mtu: 1436
+          key: 43
+          source_interface: eth0
+      dmvpn_nhrp_tunnels:
+        - name: tun101
+          authentication: vyos
+          holdtime: 300
+          multicast: dynamic
+          network_id: 2
+          redirect: true
+          registration_no_unique: true
+      ospf_interfaces:
+        - name: tun101
+          area: '0'
+          network: point-to-multipoint
+          passive: false
+      ansible_host: 192.0.2.2
+      base_hostname: HUB-2
+    SPOKE-2:
+      base_interfaces:
+        - name: eth0
+          addresses:
+            - 10.0.12.2/30
+        - name: eth1
+          addresses:
+            - 192.168.12.1/24
+      base_static_routes:
+        - dest: 0.0.0.0/0
+          next_hop: 10.0.12.1
+      gre_tunnel_interfaces:
+        - name: tun100
+          addresses:
+            - 10.100.100.12/32
+          enable_multicast: true
+          encapsulation: gre
+          adjust_mss: '1360'
+          mtu: 1436
+          key: 42
+          source_interface: eth0
+        - name: tun101
+          addresses:
+            - 10.100.101.12/32
+          enable_multicast: true
+          encapsulation: gre
+          adjust_mss: '1360'
+          mtu: 1436
+          key: 43
+          source_interface: eth0
+      dmvpn_nhrp_tunnels:
+        - name: tun100
+          authentication: vyos
+          holdtime: 300
+          multicast: 10.0.0.2
+          network_id: 1
+          nhs:
+            - tunnel_ip: dynamic
+              nbma: 10.0.0.2
+          registration_no_unique: true
+          shortcut: true
+        - name: tun101
+          authentication: vyos
+          holdtime: 300
+          multicast: 10.0.1.2
+          network_id: 2
+          nhs:
+            - tunnel_ip: dynamic
+              nbma: 10.0.1.2
+          registration_no_unique: true
+          shortcut: true
+      ospf_interfaces:
+        - name: eth1
+          area: '0'
+        - name: tun100
+          area: '0'
+          network: point-to-multipoint
+          passive: false
+        - name: tun101
+          area: '0'
+          network: point-to-multipoint
+          passive: false
+      ansible_host: 192.0.2.3
+      base_hostname: SPOKE-2
+    SPOKE-3:
+      base_interfaces:
+        - name: eth0
+          addresses:
+            - 10.0.13.2/30
+        - name: eth1
+          addresses:
+            - 192.168.13.1/24
+      base_static_routes:
+        - dest: 0.0.0.0/0
+          next_hop: 10.0.13.1
+      gre_tunnel_interfaces:
+        - name: tun100
+          addresses:
+            - 10.100.100.13/32
+          enable_multicast: true
+          encapsulation: gre
+          adjust_mss: '1360'
+          mtu: 1436
+          key: 42
+          source_interface: eth0
+        - name: tun101
+          addresses:
+            - 10.100.101.13/32
+          enable_multicast: true
+          encapsulation: gre
+          adjust_mss: '1360'
+          mtu: 1436
+          key: 43
+          source_interface: eth0
+      dmvpn_nhrp_tunnels:
+        - name: tun100
+          authentication: vyos
+          holdtime: 300
+          multicast: 10.0.0.2
+          network_id: 1
+          nhs:
+            - tunnel_ip: dynamic
+              nbma: 10.0.0.2
+          registration_no_unique: true
+          shortcut: true
+        - name: tun101
+          authentication: vyos
+          holdtime: 300
+          multicast: 10.0.1.2
+          network_id: 2
+          nhs:
+            - tunnel_ip: dynamic
+              nbma: 10.0.1.2
+          registration_no_unique: true
+          shortcut: true
+      ospf_interfaces:
+        - name: eth1
+          area: '0'
+        - name: tun100
+          area: '0'
+          network: point-to-multipoint
+          passive: false
+        - name: tun101
+          area: '0'
+          network: point-to-multipoint
+          passive: false
+      ansible_host: 192.0.2.4
+      base_hostname: SPOKE-3
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/roles b/tests/render/cases/blueprints/dmvpn_dual_hub/roles
new file mode 100644
index 0000000..09f69c9
--- /dev/null
+++ b/tests/render/cases/blueprints/dmvpn_dual_hub/roles
@@ -0,0 +1 @@
+base,gre_tunnel,dmvpn,ospf
diff --git a/tests/render/cases/blueprints/dmvpn_dual_hub/vars.yml b/tests/render/cases/blueprints/dmvpn_dual_hub/vars.yml
new file mode 100644
index 0000000..e57a5c0
--- /dev/null
+++ b/tests/render/cases/blueprints/dmvpn_dual_hub/vars.yml
@@ -0,0 +1,15 @@
+---
+# docs.vyos.io/en/1.5/configexamples/dmvpn-dualhub-dualcloud.html - VyOS nodes
+# (Spoke-1 is the Cisco router on the page). Shared IPsec settings:
+dmvpn_ipsec:
+  interfaces: [eth0]
+  ike_group: {name: IKE-HUB, key_exchange: ikev1, lifetime: 3600, proposal_id: 1, dh_group: 2, encryption: aes256, hash: sha1}
+  esp_group: {name: ESP-HUB, lifetime: 1800, mode: transport, pfs: disable, proposal_id: 1, encryption: aes256, hash: sha1}
+  profile:
+    name: NHRPVPN
+    # the page's PSK is the word "secret"; Ansible would also mask that word inside
+    # "pre-shared-secret", so another example value keeps the golden file readable
+    psk: dmvpn-example-psk
+    bind_tunnels: "{{ gre_tunnel_interfaces | map(attribute='name') | list }}"
+dmvpn_drop_unprotected_gre: {rule: 10}
+ospf_passive_interface_default: true
diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router1.txt b/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router1.txt
new file mode 100644
index 0000000..42b6436
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router1.txt
@@ -0,0 +1,32 @@
+set policy prefix-list BGPOUT
+set policy prefix-list BGPOUT description 'BGP Export List'
+set policy prefix-list BGPOUT rule 10
+set policy prefix-list BGPOUT rule 10 action 'deny'
+set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks'
+set policy prefix-list BGPOUT rule 10 ge '25'
+set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0'
+set policy prefix-list BGPOUT rule 100
+set policy prefix-list BGPOUT rule 100 action 'permit'
+set policy prefix-list BGPOUT rule 100 description 'Our network'
+set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24'
+set policy prefix-list BGPOUT rule 10000
+set policy prefix-list BGPOUT rule 10000 action 'deny'
+set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0'
+set policy route-map BGPOUT description 'BGP Export Filter'
+set policy route-map BGPOUT rule 10 action permit
+set policy route-map BGPOUT rule 10 match ip address prefix-list BGPOUT
+set policy route-map BGPOUT rule 10000 action deny
+set policy route-map BGPPREPENDOUT description 'BGP Export Filter'
+set policy route-map BGPPREPENDOUT rule 10 action permit
+set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list BGPOUT
+set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551'
+set policy route-map BGPPREPENDOUT rule 10000 action deny
+set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
+set protocols bgp address-family ipv4-unicast redistribute connected metric 50
+set protocols bgp address-family ipv4-unicast redistribute ospf metric 50
+set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export BGPOUT
+set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound
+set protocols bgp neighbor 192.0.2.11 remote-as 65550
+set protocols bgp neighbor 192.0.2.11 update-source 192.0.2.21
+set protocols bgp parameters router-id 192.0.2.21
+set protocols bgp system-as 65551
diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router2.txt b/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router2.txt
new file mode 100644
index 0000000..18e736f
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/expected/router2.txt
@@ -0,0 +1,32 @@
+set policy prefix-list BGPOUT
+set policy prefix-list BGPOUT description 'BGP Export List'
+set policy prefix-list BGPOUT rule 10
+set policy prefix-list BGPOUT rule 10 action 'deny'
+set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks'
+set policy prefix-list BGPOUT rule 10 ge '25'
+set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0'
+set policy prefix-list BGPOUT rule 100
+set policy prefix-list BGPOUT rule 100 action 'permit'
+set policy prefix-list BGPOUT rule 100 description 'Our network'
+set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24'
+set policy prefix-list BGPOUT rule 10000
+set policy prefix-list BGPOUT rule 10000 action 'deny'
+set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0'
+set policy route-map BGPOUT description 'BGP Export Filter'
+set policy route-map BGPOUT rule 10 action permit
+set policy route-map BGPOUT rule 10 match ip address prefix-list BGPOUT
+set policy route-map BGPOUT rule 10000 action deny
+set policy route-map BGPPREPENDOUT description 'BGP Export Filter'
+set policy route-map BGPPREPENDOUT rule 10 action permit
+set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list BGPOUT
+set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551'
+set policy route-map BGPPREPENDOUT rule 10000 action deny
+set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
+set protocols bgp address-family ipv4-unicast redistribute connected metric 50
+set protocols bgp address-family ipv4-unicast redistribute ospf metric 50
+set protocols bgp neighbor 192.0.2.12 address-family ipv4-unicast route-map export BGPPREPENDOUT
+set protocols bgp neighbor 192.0.2.12 address-family ipv4-unicast soft-reconfiguration inbound
+set protocols bgp neighbor 192.0.2.12 remote-as 65550
+set protocols bgp neighbor 192.0.2.12 update-source 192.0.2.22
+set protocols bgp parameters router-id 192.0.2.22
+set protocols bgp system-as 65551
diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/inventory.yml b/tests/render/cases/blueprints/ha_walkthrough_bgp/inventory.yml
new file mode 100644
index 0000000..6f01355
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/inventory.yml
@@ -0,0 +1,22 @@
+---
+# router2: the page says "identical, but use BGPPREPENDOUT". Following the
+# page's Example Network (upstream 192.0.2.11/.12, ours .21/.22), router2 peers
+# with 192.0.2.12 from 192.0.2.22.
+all:
+  hosts:
+    router1:
+      ansible_host: 192.0.2.1
+      bgp_router_id: 192.0.2.21
+      bgp_neighbors:
+        - {address: 192.0.2.11, remote_as: 65550, update_source: 192.0.2.21, soft_reconfiguration_inbound: true, route_map_export: BGPOUT}
+    router2:
+      ansible_host: 192.0.2.2
+      bgp_router_id: 192.0.2.22
+      bgp_neighbors:
+        - {address: 192.0.2.12, remote_as: 65550, update_source: 192.0.2.22, soft_reconfiguration_inbound: true, route_map_export: BGPPREPENDOUT}
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/roles b/tests/render/cases/blueprints/ha_walkthrough_bgp/roles
new file mode 100644
index 0000000..a7d2cfd
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/roles
@@ -0,0 +1 @@
+route_policy,bgp
diff --git a/tests/render/cases/blueprints/ha_walkthrough_bgp/vars.yml b/tests/render/cases/blueprints/ha_walkthrough_bgp/vars.yml
new file mode 100644
index 0000000..afda43c
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_bgp/vars.yml
@@ -0,0 +1,26 @@
+---
+# docs.vyos.io/en/1.5/configexamples/ha.html - "BGP" (part 3). Policies and
+# AS are shared; router1 exports with BGPOUT, router2 with BGPPREPENDOUT.
+route_policy_prefix_lists:
+  - name: BGPOUT
+    description: BGP Export List
+    rules:
+      - {sequence: 10, action: deny, description: Do not advertise short masks, ge: 25, prefix: 0.0.0.0/0}
+      - {sequence: 100, action: permit, description: Our network, prefix: 203.0.113.0/24}
+      - {sequence: 10000, action: deny, prefix: 0.0.0.0/0}
+route_policy_route_maps:
+  - name: BGPOUT
+    description: BGP Export Filter
+    rules:
+      - {sequence: 10, action: permit, match_prefix_list: BGPOUT}
+      - {sequence: 10000, action: deny}
+  - name: BGPPREPENDOUT
+    description: BGP Export Filter
+    rules:
+      - {sequence: 10, action: permit, set_as_path_prepend: "65551 65551 65551", match_prefix_list: BGPOUT}
+      - {sequence: 10000, action: deny}
+bgp_asn: 65551
+bgp_networks: [192.0.2.0/24]
+bgp_redistribute:
+  - {type: connected, metric: 50}
+  - {type: ospf, metric: 50}
diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router1.txt b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router1.txt
new file mode 100644
index 0000000..45b0cc8
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router1.txt
@@ -0,0 +1,34 @@
+delete system conntrack modules
+set high-availability vrrp group int address 10.200.201.1/24
+set high-availability vrrp group int hello-source-address 10.200.201.2
+set high-availability vrrp group int interface eth0.201
+set high-availability vrrp group int no-preempt
+set high-availability vrrp group int peer-address 10.200.201.3
+set high-availability vrrp group int priority 200
+set high-availability vrrp group int vrid 201
+set high-availability vrrp group public address 203.0.113.1/24
+set high-availability vrrp group public hello-source-address 203.0.113.2
+set high-availability vrrp group public interface eth0.100
+set high-availability vrrp group public no-preempt
+set high-availability vrrp group public peer-address 203.0.113.3
+set high-availability vrrp group public priority 200
+set high-availability vrrp group public vrid 113
+set high-availability vrrp sync-group sync member int
+set interfaces ethernet eth0 vif 100 address '203.0.113.2/24'
+set interfaces ethernet eth0 vif 201 address '10.200.201.2/24'
+set interfaces ethernet eth0 vif 50 address '192.0.2.21/24'
+set nat source rule 10 destination address !192.0.2.0/24
+set nat source rule 10 outbound-interface name eth0.50
+set nat source rule 10 source address 10.200.201.0/24
+set nat source rule 10 translation address 203.0.113.1
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '192.0.2.11'
+set service conntrack-sync accept-protocol 'icmp'
+set service conntrack-sync accept-protocol 'tcp'
+set service conntrack-sync accept-protocol 'udp'
+set service conntrack-sync event-listen-queue-size '8'
+set service conntrack-sync failover-mechanism vrrp sync-group 'sync'
+set service conntrack-sync interface eth0.201
+set service conntrack-sync mcast-group '224.0.0.50'
+set service conntrack-sync sync-queue-size '8'
+set system host-name router1
diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router2.txt b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router2.txt
new file mode 100644
index 0000000..79a820b
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/expected/router2.txt
@@ -0,0 +1,39 @@
+delete system conntrack modules
+set high-availability vrrp group int address 10.200.201.1/24
+set high-availability vrrp group int hello-source-address 10.200.201.3
+set high-availability vrrp group int interface bond0.201
+set high-availability vrrp group int no-preempt
+set high-availability vrrp group int peer-address 10.200.201.2
+set high-availability vrrp group int priority 100
+set high-availability vrrp group int vrid 201
+set high-availability vrrp group public address 203.0.113.1/24
+set high-availability vrrp group public hello-source-address 203.0.113.3
+set high-availability vrrp group public interface bond0.100
+set high-availability vrrp group public no-preempt
+set high-availability vrrp group public peer-address 203.0.113.2
+set high-availability vrrp group public priority 100
+set high-availability vrrp group public vrid 113
+set high-availability vrrp sync-group sync member int
+set interfaces bonding bond0 description 'Switch Port-Channel'
+set interfaces bonding bond0 hash-policy 'layer2'
+set interfaces bonding bond0 member interface 'eth0'
+set interfaces bonding bond0 member interface 'eth1'
+set interfaces bonding bond0 mode '802.3ad'
+set interfaces bonding bond0 vif 100 address '203.0.113.3/24'
+set interfaces bonding bond0 vif 201 address '10.200.201.3/24'
+set interfaces bonding bond0 vif 50 address '192.0.2.22/24'
+set nat source rule 10 destination address !192.0.2.0/24
+set nat source rule 10 outbound-interface name bond0.50
+set nat source rule 10 source address 10.200.201.0/24
+set nat source rule 10 translation address 203.0.113.1
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '192.0.2.11'
+set service conntrack-sync accept-protocol 'icmp'
+set service conntrack-sync accept-protocol 'tcp'
+set service conntrack-sync accept-protocol 'udp'
+set service conntrack-sync event-listen-queue-size '8'
+set service conntrack-sync failover-mechanism vrrp sync-group 'sync'
+set service conntrack-sync interface bond0.201
+set service conntrack-sync mcast-group '224.0.0.50'
+set service conntrack-sync sync-queue-size '8'
+set system host-name router2
diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/inventory.yml b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/inventory.yml
new file mode 100644
index 0000000..28e997d
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/inventory.yml
@@ -0,0 +1,113 @@
+---
+all:
+  children:
+    routers:
+      hosts:
+        router1:
+          ansible_host: 192.0.2.1
+          base_interfaces:
+            - name: eth0.50
+              addresses:
+                - 192.0.2.21/24
+            - name: eth0.100
+              addresses:
+                - 203.0.113.2/24
+            - name: eth0.201
+              addresses:
+                - 10.200.201.2/24
+          ha_vrrp_priority: 200
+          ha_vrrp_groups:
+            - name: int
+              vrid: 201
+              interface: eth0.201
+              address:
+                - 10.200.201.1/24
+            - name: public
+              vrid: 113
+              interface: eth0.100
+              address:
+                - 203.0.113.1/24
+          ha_vrrp_local_addresses:
+            int: 10.200.201.2
+            public: 203.0.113.2
+          ha_vrrp_conntrack_sync:
+            interface: eth0.201
+            accept_protocols:
+              - tcp
+              - udp
+              - icmp
+            event_listen_queue_size: 8
+            mcast_group: 224.0.0.50
+            sync_queue_size: 8
+            disable_helpers: true
+          nat_source_rules:
+            - id: 10
+              outbound_interface:
+                name: eth0.50
+              source:
+                address: 10.200.201.0/24
+              destination:
+                address: '!192.0.2.0/24'
+              translation:
+                address: 203.0.113.1
+        router2:
+          ansible_host: 192.0.2.2
+          base_interfaces:
+            - name: bond0.50
+              addresses:
+                - 192.0.2.22/24
+            - name: bond0.100
+              addresses:
+                - 203.0.113.3/24
+            - name: bond0.201
+              addresses:
+                - 10.200.201.3/24
+          ha_vrrp_priority: 100
+          ha_vrrp_groups:
+            - name: int
+              vrid: 201
+              interface: bond0.201
+              address:
+                - 10.200.201.1/24
+            - name: public
+              vrid: 113
+              interface: bond0.100
+              address:
+                - 203.0.113.1/24
+          ha_vrrp_local_addresses:
+            int: 10.200.201.3
+            public: 203.0.113.3
+          ha_vrrp_conntrack_sync:
+            interface: bond0.201
+            accept_protocols:
+              - tcp
+              - udp
+              - icmp
+            event_listen_queue_size: 8
+            mcast_group: 224.0.0.50
+            sync_queue_size: 8
+            disable_helpers: true
+          nat_source_rules:
+            - id: 10
+              outbound_interface:
+                name: bond0.50
+              source:
+                address: 10.200.201.0/24
+              destination:
+                address: '!192.0.2.0/24'
+              translation:
+                address: 203.0.113.1
+          bonding_interfaces:
+            - name: bond0
+              description: Switch Port-Channel
+              hash_policy: layer2
+              members:
+                - eth0
+                - eth1
+              mode: 802.3ad
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/roles b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/roles
new file mode 100644
index 0000000..2f26d06
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/roles
@@ -0,0 +1 @@
+bonding,base,ha_vrrp,nat
diff --git a/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/vars.yml b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/vars.yml
new file mode 100644
index 0000000..7e46f82
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_vrrp_nat/vars.yml
@@ -0,0 +1,9 @@
+---
+# docs.vyos.io/en/1.5/configexamples/ha.html - Basic Setup, VRRP, NAT and
+# conntrack-sync (part 1 of the page). router1 is a VM trunked on eth0,
+# router2 hardware with an LACP bond0; the page uses the same commands with
+# eth0 replaced by bond0 on router2.
+ha_vrrp_pair_group: routers
+ha_vrrp_sync_group: {name: sync, members: [int]}
+base_static_routes:
+  - {dest: 0.0.0.0/0, next_hop: 192.0.2.11}
diff --git a/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/offsite1.txt b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/offsite1.txt
new file mode 100644
index 0000000..ad16ff5
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/offsite1.txt
@@ -0,0 +1,23 @@
+set interfaces wireguard wg01 address '10.254.60.2/30'
+set interfaces wireguard wg01 description 'offsite1-to-router1'
+set interfaces wireguard wg01 peer ROUTER1 address '192.0.2.21'
+set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0'
+set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15'
+set interfaces wireguard wg01 peer ROUTER1 port '50001'
+set interfaces wireguard wg01 peer ROUTER1 public-key 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q='
+set interfaces wireguard wg01 port '50001'
+set protocols ospf area '0.0.0.0'
+set protocols ospf area 0.0.0.0 authentication md5
+set protocols ospf area 0.0.0.0 network 10.254.60.0/24
+set protocols ospf auto-cost reference-bandwidth '10000'
+set protocols ospf interface wg01 authentication md5 key-id 1 md5-key ********
+set protocols ospf interface wg01 cost 11
+set protocols ospf interface wg01 dead-interval 5
+set protocols ospf interface wg01 hello-interval 1
+set protocols ospf interface wg01 network point-to-point
+set protocols ospf interface wg01 priority 1
+set protocols ospf interface wg01 retransmit-interval 5
+set protocols ospf interface wg01 transmit-delay 1
+set protocols ospf log-adjacency-changes
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.254.60.2'
diff --git a/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/router1.txt b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/router1.txt
new file mode 100644
index 0000000..127fc7c
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/expected/router1.txt
@@ -0,0 +1,49 @@
+set interfaces wireguard wg01 address '10.254.60.1/30'
+set interfaces wireguard wg01 description 'router1-to-offsite1'
+set interfaces wireguard wg01 peer OFFSITE1 address '203.0.113.3'
+set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0'
+set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15'
+set interfaces wireguard wg01 peer OFFSITE1 port '50001'
+set interfaces wireguard wg01 peer OFFSITE1 public-key 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o='
+set interfaces wireguard wg01 port '50001'
+set policy access-list 100 description 'Inbound OSPF Routes from Peers'
+set policy access-list 100 rule 10 action 'deny'
+set policy access-list 100 rule 10 destination any
+set policy access-list 100 rule 10 source inverse-mask '0.0.255.255'
+set policy access-list 100 rule 10 source network '10.201.0.0'
+set policy access-list 100 rule 100 action 'permit'
+set policy access-list 100 rule 100 destination any
+set policy access-list 100 rule 100 source any
+set policy access-list 150 description 'Outbound OSPF Redistribution'
+set policy access-list 150 rule 10 action 'permit'
+set policy access-list 150 rule 10 destination any
+set policy access-list 150 rule 10 source inverse-mask '0.0.0.255'
+set policy access-list 150 rule 10 source network '10.200.201.0'
+set policy access-list 150 rule 100 action 'deny'
+set policy access-list 150 rule 100 destination any
+set policy access-list 150 rule 100 source any
+set policy access-list 150 rule 20 action 'permit'
+set policy access-list 150 rule 20 destination any
+set policy access-list 150 rule 20 source inverse-mask '0.0.0.255'
+set policy access-list 150 rule 20 source network '203.0.113.0'
+set policy route-map PUBOSPF rule 100 action deny
+set policy route-map PUBOSPF rule 100 match ip address access-list 100
+set policy route-map PUBOSPF rule 500 action permit
+set protocols ospf access-list 150 export 'connected'
+set protocols ospf area '0.0.0.0'
+set protocols ospf area 0.0.0.0 authentication md5
+set protocols ospf area 0.0.0.0 network 10.254.60.0/24
+set protocols ospf auto-cost reference-bandwidth '10000'
+set protocols ospf interface wg01 authentication md5 key-id 1 md5-key ********
+set protocols ospf interface wg01 cost 11
+set protocols ospf interface wg01 dead-interval 5
+set protocols ospf interface wg01 hello-interval 1
+set protocols ospf interface wg01 network point-to-point
+set protocols ospf interface wg01 priority 1
+set protocols ospf interface wg01 retransmit-interval 5
+set protocols ospf interface wg01 transmit-delay 1
+set protocols ospf log-adjacency-changes
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.254.60.1'
+set protocols ospf redistribute connected
+set system ip protocol ospf route-map 'PUBOSPF'
diff --git a/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/inventory.yml b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/inventory.yml
new file mode 100644
index 0000000..503f210
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/inventory.yml
@@ -0,0 +1,135 @@
+---
+# docs.vyos.io/en/1.5/configexamples/ha.html - "OSPF Over WireGuard" and
+# "Advertise connected routes" (part 2), for router1 and the remote offsite1.
+# The page's "Enable OSPF" block shows router-id 10.254.60.2 (offsite1's
+# tunnel address); router1 uses 10.254.60.1, since every router needs a unique id.
+# The route filters are applied on router1, as the page describes for "our" routers.
+all:
+  hosts:
+    router1:
+      ansible_host: 192.0.2.1
+      wireguard_interfaces:
+        - name: wg01
+          addresses:
+            - 10.254.60.1/30
+          description: router1-to-offsite1
+          port: 50001
+          peers:
+            - name: OFFSITE1
+              allowed_ips:
+                - 0.0.0.0/0
+              address: 203.0.113.3
+              port: 50001
+              persistent_keepalive: 15
+              public_key: GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=
+      route_policy_access_lists:
+        - number: 150
+          description: Outbound OSPF Redistribution
+          rules:
+            - number: 10
+              action: permit
+              destination:
+                any: true
+              source:
+                network: 10.200.201.0
+                inverse_mask: 0.0.0.255
+            - number: 20
+              action: permit
+              destination:
+                any: true
+              source:
+                network: 203.0.113.0
+                inverse_mask: 0.0.0.255
+            - number: 100
+              action: deny
+              destination:
+                any: true
+              source:
+                any: true
+        - number: 100
+          description: Inbound OSPF Routes from Peers
+          rules:
+            - number: 10
+              action: deny
+              destination:
+                any: true
+              source:
+                network: 10.201.0.0
+                inverse_mask: 0.0.255.255
+            - number: 100
+              action: permit
+              destination:
+                any: true
+              source:
+                any: true
+      route_policy_route_maps:
+        - name: PUBOSPF
+          rules:
+            - sequence: 100
+              action: deny
+              match_access_list: '100'
+            - sequence: 500
+              action: permit
+      ospf_router_id: 10.254.60.1
+      ospf_interfaces:
+        - name: wg01
+          md5_key: i360KoCwUGZvPq7e
+          md5_key_id: 1
+          cost: 11
+          dead_interval: 5
+          hello_interval: 1
+          network: point-to-point
+          priority: 1
+          retransmit_interval: 5
+          transmit_delay: 1
+      ospf_redistribute:
+        - type: connected
+      ospf_redistribute_access_lists:
+        connected: 150
+      ospf_import_route_map: PUBOSPF
+      ospf_areas: &id001
+        - id: 0.0.0.0
+          authentication: md5
+          networks:
+            - 10.254.60.0/24
+      ospf_reference_bandwidth: 10000
+      ospf_log_adjacency_changes: true
+      ospf_abr_type: cisco
+    offsite1:
+      ansible_host: 192.0.2.2
+      wireguard_interfaces:
+        - name: wg01
+          addresses:
+            - 10.254.60.2/30
+          description: offsite1-to-router1
+          port: 50001
+          peers:
+            - name: ROUTER1
+              allowed_ips:
+                - 0.0.0.0/0
+              address: 192.0.2.21
+              port: 50001
+              persistent_keepalive: 15
+              public_key: CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=
+      ospf_router_id: 10.254.60.2
+      ospf_interfaces:
+        - name: wg01
+          md5_key: i360KoCwUGZvPq7e
+          md5_key_id: 1
+          cost: 11
+          dead_interval: 5
+          hello_interval: 1
+          network: point-to-point
+          priority: 1
+          retransmit_interval: 5
+          transmit_delay: 1
+      ospf_areas: *id001
+      ospf_reference_bandwidth: 10000
+      ospf_log_adjacency_changes: true
+      ospf_abr_type: cisco
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/roles b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/roles
new file mode 100644
index 0000000..95db747
--- /dev/null
+++ b/tests/render/cases/blueprints/ha_walkthrough_wireguard_ospf/roles
@@ -0,0 +1 @@
+wireguard,route_policy,ospf
diff --git a/tests/render/cases/blueprints/inter_vrf_core/expected/r1.txt b/tests/render/cases/blueprints/inter_vrf_core/expected/r1.txt
new file mode 100644
index 0000000..c77a6cc
--- /dev/null
+++ b/tests/render/cases/blueprints/inter_vrf_core/expected/r1.txt
@@ -0,0 +1,82 @@
+delete vrf bind-to-all
+set interfaces ethernet eth0 address '10.1.1.1/30'
+set interfaces ethernet eth0 address '2001:db8::/127'
+set interfaces ethernet eth0 vrf 'LAN1'
+set interfaces ethernet eth1 address '172.16.2.1/30'
+set interfaces ethernet eth1 address '2001:db8::2/127'
+set interfaces ethernet eth1 vrf 'LAN2'
+set interfaces ethernet eth2 address '192.168.3.1/30'
+set interfaces ethernet eth2 address '2001:db8::4/127'
+set interfaces ethernet eth2 vrf 'Management'
+set interfaces ethernet eth3 address '10.2.2.1/30'
+set interfaces ethernet eth3 address '2001:db8::6/127'
+set interfaces ethernet eth3 vrf 'Internet'
+set protocols bgp system-as 64496
+set system host-name r1
+set vrf name Internet protocols bgp address-family ipv4-unicast export vpn
+set vrf name Internet protocols bgp address-family ipv4-unicast import vpn
+set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Internet protocols bgp address-family ipv6-unicast export vpn
+set vrf name Internet protocols bgp address-family ipv6-unicast import vpn
+set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast
+set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as 64497
+set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast
+set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as 64497
+set vrf name Internet protocols bgp system-as 64496
+set vrf name Internet table 104
+set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn
+set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn
+set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static
+set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2'
+set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn
+set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn
+set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static
+set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2'
+set vrf name LAN1 protocols static route 10.0.0.0/24
+set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop '10.1.1.2'
+set vrf name LAN1 protocols static route6 2001:db8:0:1::/64
+set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop '2001:db8::1'
+set vrf name LAN1 table 101
+set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn
+set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn
+set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static
+set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn
+set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn
+set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static
+set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1'
+set vrf name LAN2 protocols static route 172.16.0.0/24
+set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop '172.16.2.2'
+set vrf name LAN2 protocols static route6 2001:db8:0:2::/64
+set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop '2001:db8::3'
+set vrf name LAN2 table 102
+set vrf name Management protocols bgp address-family ipv4-unicast export vpn
+set vrf name Management protocols bgp address-family ipv4-unicast import vpn
+set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv4-unicast redistribute static
+set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Management protocols bgp address-family ipv6-unicast export vpn
+set vrf name Management protocols bgp address-family ipv6-unicast import vpn
+set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv6-unicast redistribute static
+set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Management protocols static route 192.168.0.0/24
+set vrf name Management protocols static route 192.168.0.0/24 next-hop '192.168.3.2'
+set vrf name Management protocols static route6 2001:db8:0:3::/64
+set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop '2001:db8::5'
+set vrf name Management table 103
diff --git a/tests/render/cases/blueprints/inter_vrf_core/roles b/tests/render/cases/blueprints/inter_vrf_core/roles
new file mode 100644
index 0000000..83026c0
--- /dev/null
+++ b/tests/render/cases/blueprints/inter_vrf_core/roles
@@ -0,0 +1 @@
+base,vrf_lite
diff --git a/tests/render/cases/blueprints/inter_vrf_core/vars.yml b/tests/render/cases/blueprints/inter_vrf_core/vars.yml
new file mode 100644
index 0000000..71a83d9
--- /dev/null
+++ b/tests/render/cases/blueprints/inter_vrf_core/vars.yml
@@ -0,0 +1,52 @@
+---
+# docs.vyos.io/en/1.5/configexamples/inter-vrf-routing-vrf-lite.html - Core router, Appendix-A
+base_interfaces:
+  - name: eth0
+    addresses: [10.1.1.1/30, '2001:db8::/127']
+  - name: eth1
+    addresses: [172.16.2.1/30, '2001:db8::2/127']
+  - name: eth2
+    addresses: [192.168.3.1/30, '2001:db8::4/127']
+  - name: eth3
+    addresses: [10.2.2.1/30, '2001:db8::6/127']
+vrf_lite_asn: 64496
+vrf_lite_vrfs:
+  - name: Internet
+    table: 104
+    interfaces: [eth3]
+    rd: 64496:100
+    route_targets_export: ['64496:100']
+    route_targets_import: ['64496:1', '64496:2']
+    neighbors:
+      - {address: 10.2.2.2, remote_as: 64497}
+      - {address: '2001:db8::7', remote_as: 64497}
+  - name: LAN1
+    table: 101
+    interfaces: [eth0]
+    routes:
+      - {dest: 10.0.0.0/24, next_hop: 10.1.1.2}
+      - {dest: '2001:db8:0:1::/64', next_hop: '2001:db8::1'}
+    rd: '64496:1'
+    route_targets_export: ['64496:1']
+    route_targets_import: ['64496:100', '64496:50', '64496:2']
+    redistribute: [static]
+  - name: LAN2
+    table: 102
+    interfaces: [eth1]
+    routes:
+      - {dest: 172.16.0.0/24, next_hop: 172.16.2.2}
+      - {dest: '2001:db8:0:2::/64', next_hop: '2001:db8::3'}
+    rd: '64496:2'
+    route_targets_export: ['64496:2']
+    route_targets_import: ['64496:100', '64496:50', '64496:1']
+    redistribute: [static]
+  - name: Management
+    table: 103
+    interfaces: [eth2]
+    routes:
+      - {dest: 192.168.0.0/24, next_hop: 192.168.3.2}
+      - {dest: '2001:db8:0:3::/64', next_hop: '2001:db8::5'}
+    rd: '64496:50'
+    route_targets_export: ['64496:50']
+    route_targets_import: ['64496:1', '64496:2']
+    redistribute: [static]
diff --git a/tests/render/cases/blueprints/inter_vrf_core_filtering/expected/r1.txt b/tests/render/cases/blueprints/inter_vrf_core_filtering/expected/r1.txt
new file mode 100644
index 0000000..8c00913
--- /dev/null
+++ b/tests/render/cases/blueprints/inter_vrf_core_filtering/expected/r1.txt
@@ -0,0 +1,115 @@
+delete vrf bind-to-all
+set interfaces ethernet eth0 address '10.1.1.1/30'
+set interfaces ethernet eth0 address '2001:db8::/127'
+set interfaces ethernet eth0 vrf 'LAN1'
+set interfaces ethernet eth1 address '172.16.2.1/30'
+set interfaces ethernet eth1 address '2001:db8::2/127'
+set interfaces ethernet eth1 vrf 'LAN2'
+set interfaces ethernet eth2 address '192.168.3.1/30'
+set interfaces ethernet eth2 address '2001:db8::4/127'
+set interfaces ethernet eth2 vrf 'Management'
+set interfaces ethernet eth3 address '10.2.2.1/30'
+set interfaces ethernet eth3 address '2001:db8::6/127'
+set interfaces ethernet eth3 vrf 'Internet'
+set policy prefix-list LAN2-Internet
+set policy prefix-list LAN2-Internet rule 1
+set policy prefix-list LAN2-Internet rule 1 action 'permit'
+set policy prefix-list LAN2-Internet rule 1 le '24'
+set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16'
+set policy prefix-list LAN2-Internet rule 2
+set policy prefix-list LAN2-Internet rule 2 action 'permit'
+set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24'
+set policy prefix-list LAN2-Internet rule 3
+set policy prefix-list LAN2-Internet rule 3 action 'permit'
+set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24'
+set policy prefix-list LAN2-Internet rule 4
+set policy prefix-list LAN2-Internet rule 4 action 'permit'
+set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24'
+set policy prefix-list6 LAN2-Internet-v6
+set policy prefix-list6 LAN2-Internet-v6 rule 1
+set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit'
+set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48'
+set policy prefix-list6 LAN2-Internet-v6 rule 2
+set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit'
+set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48'
+set policy prefix-list6 LAN2-Internet-v6 rule 3
+set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit'
+set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64'
+set policy prefix-list6 LAN2-Internet-v6 rule 4
+set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit'
+set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64'
+set policy route-map LAN2-Internet rule 1 action permit
+set policy route-map LAN2-Internet rule 1 match ip address prefix-list LAN2-Internet
+set policy route-map LAN2-Internet-v6 rule 1 action permit
+set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list LAN2-Internet-v6
+set protocols bgp system-as 64496
+set system host-name r1
+set vrf name Internet protocols bgp address-family ipv4-unicast export vpn
+set vrf name Internet protocols bgp address-family ipv4-unicast import vpn
+set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Internet protocols bgp address-family ipv6-unicast export vpn
+set vrf name Internet protocols bgp address-family ipv6-unicast import vpn
+set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100'
+set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast
+set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as 64497
+set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast
+set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as 64497
+set vrf name Internet protocols bgp system-as 64496
+set vrf name Internet table 104
+set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn
+set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn
+set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static
+set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2'
+set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn
+set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn
+set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static
+set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1'
+set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2'
+set vrf name LAN1 protocols static route 10.0.0.0/24
+set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop '10.1.1.2'
+set vrf name LAN1 protocols static route6 2001:db8:0:1::/64
+set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop '2001:db8::1'
+set vrf name LAN1 table 101
+set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn
+set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn
+set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static
+set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet'
+set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn
+set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn
+set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static
+set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2'
+set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1'
+set vrf name LAN2 protocols static route 172.16.0.0/24
+set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop '172.16.2.2'
+set vrf name LAN2 protocols static route6 2001:db8:0:2::/64
+set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop '2001:db8::3'
+set vrf name LAN2 table 102
+set vrf name Management protocols bgp address-family ipv4-unicast export vpn
+set vrf name Management protocols bgp address-family ipv4-unicast import vpn
+set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv4-unicast redistribute static
+set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Management protocols bgp address-family ipv6-unicast export vpn
+set vrf name Management protocols bgp address-family ipv6-unicast import vpn
+set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv6-unicast redistribute static
+set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50'
+set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2'
+set vrf name Management protocols static route 192.168.0.0/24
+set vrf name Management protocols static route 192.168.0.0/24 next-hop '192.168.3.2'
+set vrf name Management protocols static route6 2001:db8:0:3::/64
+set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop '2001:db8::5'
+set vrf name Management table 103
diff --git a/tests/render/cases/blueprints/inter_vrf_core_filtering/roles b/tests/render/cases/blueprints/inter_vrf_core_filtering/roles
new file mode 100644
index 0000000..e7486ab
--- /dev/null
+++ b/tests/render/cases/blueprints/inter_vrf_core_filtering/roles
@@ -0,0 +1 @@
+base,route_policy,vrf_lite
diff --git a/tests/render/cases/blueprints/inter_vrf_core_filtering/vars.yml b/tests/render/cases/blueprints/inter_vrf_core_filtering/vars.yml
new file mode 100644
index 0000000..dc3b396
--- /dev/null
+++ b/tests/render/cases/blueprints/inter_vrf_core_filtering/vars.yml
@@ -0,0 +1,74 @@
+---
+# docs.vyos.io/en/1.5/configexamples/inter-vrf-routing-vrf-lite.html - Core router, Appendix-A plus Appendix-B route filtering
+base_interfaces:
+  - name: eth0
+    addresses: [10.1.1.1/30, '2001:db8::/127']
+  - name: eth1
+    addresses: [172.16.2.1/30, '2001:db8::2/127']
+  - name: eth2
+    addresses: [192.168.3.1/30, '2001:db8::4/127']
+  - name: eth3
+    addresses: [10.2.2.1/30, '2001:db8::6/127']
+vrf_lite_asn: 64496
+vrf_lite_vrfs:
+  - name: Internet
+    table: 104
+    interfaces: [eth3]
+    rd: 64496:100
+    route_targets_export: ['64496:100']
+    route_targets_import: ['64496:1', '64496:2']
+    neighbors:
+      - {address: 10.2.2.2, remote_as: 64497}
+      - {address: '2001:db8::7', remote_as: 64497}
+  - name: LAN1
+    table: 101
+    interfaces: [eth0]
+    routes:
+      - {dest: 10.0.0.0/24, next_hop: 10.1.1.2}
+      - {dest: '2001:db8:0:1::/64', next_hop: '2001:db8::1'}
+    rd: '64496:1'
+    route_targets_export: ['64496:1']
+    route_targets_import: ['64496:100', '64496:50', '64496:2']
+    redistribute: [static]
+  - name: LAN2
+    table: 102
+    interfaces: [eth1]
+    routes:
+      - {dest: 172.16.0.0/24, next_hop: 172.16.2.2}
+      - {dest: '2001:db8:0:2::/64', next_hop: '2001:db8::3'}
+    rd: '64496:2'
+    route_targets_export: ['64496:2']
+    route_targets_import: ['64496:100', '64496:50', '64496:1']
+    redistribute: [static]
+    import_route_map: {ipv4: LAN2-Internet, ipv6: LAN2-Internet-v6}
+  - name: Management
+    table: 103
+    interfaces: [eth2]
+    routes:
+      - {dest: 192.168.0.0/24, next_hop: 192.168.3.2}
+      - {dest: '2001:db8:0:3::/64', next_hop: '2001:db8::5'}
+    rd: '64496:50'
+    route_targets_export: ['64496:50']
+    route_targets_import: ['64496:1', '64496:2']
+    redistribute: [static]
+route_policy_prefix_lists:
+  - name: LAN2-Internet
+    rules:
+      - {sequence: 1, action: permit, le: 24, prefix: 198.51.0.0/16}
+      - {sequence: 2, action: permit, prefix: 192.0.2.0/24}
+      - {sequence: 3, action: permit, prefix: 192.168.0.0/24}
+      - {sequence: 4, action: permit, prefix: 10.0.0.0/24}
+  - name: LAN2-Internet-v6
+    afi: ipv6
+    rules:
+      - {sequence: 1, action: permit, prefix: '2001:db8:1::/48'}
+      - {sequence: 2, action: permit, prefix: '2001:db8:2::/48'}
+      - {sequence: 3, action: permit, prefix: '2001:db8:0:3::/64'}
+      - {sequence: 4, action: permit, prefix: '2001:db8:0:1::/64'}
+route_policy_route_maps:
+  - name: LAN2-Internet
+    rules:
+      - {sequence: 1, action: permit, match_prefix_list: LAN2-Internet}
+  - name: LAN2-Internet-v6
+    rules:
+      - {sequence: 1, action: permit, match_prefix_list6: LAN2-Internet-v6}
diff --git a/tests/render/cases/blueprints/isis_segment_routing/expected/P1-VyOS.txt b/tests/render/cases/blueprints/isis_segment_routing/expected/P1-VyOS.txt
new file mode 100644
index 0000000..ffe017d
--- /dev/null
+++ b/tests/render/cases/blueprints/isis_segment_routing/expected/P1-VyOS.txt
@@ -0,0 +1,17 @@
+set interfaces dummy dum0 address '192.0.2.1/32'
+set interfaces ethernet eth1 address '192.0.2.5/30'
+set interfaces ethernet eth1 mtu '8000'
+set interfaces ethernet eth3 address '192.0.2.21/30'
+set interfaces ethernet eth3 mtu '8000'
+set protocols isis interface dum0 passive
+set protocols isis interface eth1 network point-to-point
+set protocols isis interface eth3 network point-to-point
+set protocols isis level 'level-2'
+set protocols isis log-adjacency-changes
+set protocols isis metric-style 'wide'
+set protocols isis net '49.0000.0000.0000.0001.00'
+set protocols isis segment-routing maximum-label-depth '8'
+set protocols isis segment-routing prefix 192.0.2.1/32 index value '1'
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth3'
+set system host-name P1-VyOS
diff --git a/tests/render/cases/blueprints/isis_segment_routing/expected/P2-VyOS.txt b/tests/render/cases/blueprints/isis_segment_routing/expected/P2-VyOS.txt
new file mode 100644
index 0000000..8eb49d3
--- /dev/null
+++ b/tests/render/cases/blueprints/isis_segment_routing/expected/P2-VyOS.txt
@@ -0,0 +1,17 @@
+set interfaces dummy dum0 address '192.0.2.2/32'
+set interfaces ethernet eth2 address '192.0.2.17/30'
+set interfaces ethernet eth2 mtu '8000'
+set interfaces ethernet eth3 address '192.0.2.26/30'
+set interfaces ethernet eth3 mtu '8000'
+set protocols isis interface dum0 passive
+set protocols isis interface eth2 network point-to-point
+set protocols isis interface eth3 network point-to-point
+set protocols isis level 'level-2'
+set protocols isis log-adjacency-changes
+set protocols isis metric-style 'wide'
+set protocols isis net '49.0000.0000.0000.0002.00'
+set protocols isis segment-routing maximum-label-depth '8'
+set protocols isis segment-routing prefix 192.0.2.2/32 index value '2'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set system host-name P2-VyOS
diff --git a/tests/render/cases/blueprints/isis_segment_routing/inventory.yml b/tests/render/cases/blueprints/isis_segment_routing/inventory.yml
new file mode 100644
index 0000000..8367320
--- /dev/null
+++ b/tests/render/cases/blueprints/isis_segment_routing/inventory.yml
@@ -0,0 +1,41 @@
+---
+all:
+  hosts:
+    P1-VyOS:
+      ansible_host: 192.0.2.1
+      base_hostname: P1-VyOS
+      base_interfaces:
+        - {name: dum0, addresses: [192.0.2.1/32]}
+        - {name: eth1, mtu: 8000, addresses: [192.0.2.5/30]}
+        - {name: eth3, mtu: 8000, addresses: [192.0.2.21/30]}
+      isis_net: 49.0000.0000.0000.0001.00
+      isis_interfaces:
+        - {name: dum0, passive: true}
+        - {name: eth1, network: point-to-point}
+        - {name: eth3, network: point-to-point}
+      isis_segment_routing:
+        maximum_label_depth: 8
+        prefixes: [{prefix: 192.0.2.1/32, index: 1}]
+      isis_mpls_interfaces: [eth1, eth3]
+    P2-VyOS:
+      ansible_host: 192.0.2.2
+      base_hostname: P2-VyOS
+      base_interfaces:
+        - {name: dum0, addresses: [192.0.2.2/32]}
+        - {name: eth2, mtu: 8000, addresses: [192.0.2.17/30]}
+        - {name: eth3, mtu: 8000, addresses: [192.0.2.26/30]}
+      isis_net: 49.0000.0000.0000.0002.00
+      isis_interfaces:
+        - {name: dum0, passive: true}
+        - {name: eth2, network: point-to-point}
+        - {name: eth3, network: point-to-point}
+      isis_segment_routing:
+        maximum_label_depth: 8
+        prefixes: [{prefix: 192.0.2.2/32, index: 2}]
+      isis_mpls_interfaces: [eth2, eth3]
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/blueprints/isis_segment_routing/roles b/tests/render/cases/blueprints/isis_segment_routing/roles
new file mode 100644
index 0000000..0fe18c3
--- /dev/null
+++ b/tests/render/cases/blueprints/isis_segment_routing/roles
@@ -0,0 +1 @@
+base,isis
diff --git a/tests/render/cases/blueprints/isis_segment_routing/vars.yml b/tests/render/cases/blueprints/isis_segment_routing/vars.yml
new file mode 100644
index 0000000..2913e17
--- /dev/null
+++ b/tests/render/cases/blueprints/isis_segment_routing/vars.yml
@@ -0,0 +1,6 @@
+---
+# docs.vyos.io/en/1.5/configexamples/segment-routing-isis.html - shared by
+# VyOS-P1 and VyOS-P2 (XRv-P3 is the Cisco side of the page)
+isis_level: level-2
+isis_log_adjacency_changes: true
+isis_metric_style: wide
diff --git a/tests/render/cases/blueprints/l2tp_lns/expected/r1.txt b/tests/render/cases/blueprints/l2tp_lns/expected/r1.txt
new file mode 100644
index 0000000..5aedf43
--- /dev/null
+++ b/tests/render/cases/blueprints/l2tp_lns/expected/r1.txt
@@ -0,0 +1,16 @@
+set interfaces ethernet eth0 address '192.168.139.100/24'
+set nat source rule 100 outbound-interface name eth0
+set nat source rule 100 source address 10.0.0.0/24
+set nat source rule 100 translation address masquerade
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '192.168.139.2'
+set system host-name vyos
+set vpn l2tp remote-access authentication mode 'radius'
+set vpn l2tp remote-access authentication radius server 192.168.139.110 key '********'
+set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100'
+set vpn l2tp remote-access default-pool 'TEST-POOL'
+set vpn l2tp remote-access gateway-address '10.0.0.1'
+set vpn l2tp remote-access lns host-name 'LAC'
+set vpn l2tp remote-access lns shared-secret '********'
+set vpn l2tp remote-access name-server '8.8.8.8'
+set vpn l2tp remote-access ppp-options disable-ccp
diff --git a/tests/render/cases/blueprints/l2tp_lns/roles b/tests/render/cases/blueprints/l2tp_lns/roles
new file mode 100644
index 0000000..2f7f1f2
--- /dev/null
+++ b/tests/render/cases/blueprints/l2tp_lns/roles
@@ -0,0 +1 @@
+base,nat,l2tp_lns
diff --git a/tests/render/cases/blueprints/l2tp_lns/vars.yml b/tests/render/cases/blueprints/l2tp_lns/vars.yml
new file mode 100644
index 0000000..fcc984d
--- /dev/null
+++ b/tests/render/cases/blueprints/l2tp_lns/vars.yml
@@ -0,0 +1,23 @@
+---
+# docs.vyos.io/en/1.5/configexamples/lac-lns.html - the VyOS LNS (the LAC is
+# the Cisco router on the page)
+base_hostname: vyos
+base_interfaces:
+  - {name: eth0, addresses: [192.168.139.100/24]}
+base_static_routes:
+  - {dest: 0.0.0.0/0, next_hop: 192.168.139.2}
+nat_source_rules:
+  - {id: 100, outbound_interface: {name: eth0}, source: {address: 10.0.0.0/24}, translation: {address: masquerade}}
+l2tp_lns_authentication:
+  mode: radius
+  radius_servers:
+    - {address: 192.168.139.110, key: radiustest}
+l2tp_lns_pools:
+  - {name: TEST-POOL, range: 10.0.0.2-10.0.0.100}
+l2tp_lns_default_pool: TEST-POOL
+l2tp_lns_gateway_address: 10.0.0.1
+l2tp_lns_lac_host_name: LAC
+l2tp_lns_shared_secret: test123
+l2tp_lns_name_servers: [8.8.8.8]
+l2tp_lns_ppp_options:
+  disable_ccp: true
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-HUB.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-HUB.txt
new file mode 100644
index 0000000..327aeef
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-HUB.txt
@@ -0,0 +1,11 @@
+set interfaces dummy dum20 address '10.0.0.100/32'
+set interfaces ethernet eth0 address '10.80.80.2/24'
+set protocols bgp address-family ipv4-unicast network 10.0.0.100/32
+set protocols bgp address-family ipv4-unicast redistribute connected
+set protocols bgp neighbor 10.80.80.1 ebgp-multihop 2
+set protocols bgp neighbor 10.80.80.1 remote-as 65001
+set protocols bgp neighbor 10.80.80.1 update-source eth0
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id 10.80.80.2
+set protocols bgp system-as 65035
+set system host-name VyOS-CE1-HUB
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-SPOKE.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-SPOKE.txt
new file mode 100644
index 0000000..9d1ccf8
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE1-SPOKE.txt
@@ -0,0 +1,10 @@
+set interfaces dummy dum20 address '10.0.0.80/32'
+set interfaces ethernet eth0 address '10.50.50.2/24'
+set protocols bgp address-family ipv4-unicast network 10.0.0.80/32
+set protocols bgp neighbor 10.50.50.1 ebgp-multihop 2
+set protocols bgp neighbor 10.50.50.1 remote-as 65001
+set protocols bgp neighbor 10.50.50.1 update-source eth0
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id 10.50.50.2
+set protocols bgp system-as 65035
+set system host-name VyOS-CE1-SPOKE
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE2-SPOKE.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE2-SPOKE.txt
new file mode 100644
index 0000000..02c87d4
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-CE2-SPOKE.txt
@@ -0,0 +1,10 @@
+set interfaces dummy dum20 address '10.0.0.90/32'
+set interfaces ethernet eth0 address '10.60.60.2/24'
+set protocols bgp address-family ipv4-unicast network 10.0.0.90/32
+set protocols bgp neighbor 10.60.60.1 ebgp-multihop 2
+set protocols bgp neighbor 10.60.60.1 remote-as 65001
+set protocols bgp neighbor 10.60.60.1 update-source eth0
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id 10.60.60.2
+set protocols bgp system-as 65035
+set system host-name VyOS-CE2-SPOKE
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P1.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P1.txt
new file mode 100644
index 0000000..aaec548
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P1.txt
@@ -0,0 +1,23 @@
+set interfaces dummy dum10 address '10.0.0.3/32'
+set interfaces ethernet eth0 address '172.16.30.1/24'
+set interfaces ethernet eth1 address '172.16.40.1/24'
+set interfaces ethernet eth2 address '172.16.90.1/24'
+set interfaces ethernet eth3 address '172.16.10.1/24'
+set interfaces ethernet eth5 address '172.16.100.1/24'
+set protocols mpls interface 'eth0'
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set protocols mpls interface 'eth5'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp interface 'eth3'
+set protocols mpls ldp interface 'eth5'
+set protocols mpls ldp router-id '10.0.0.3'
+set protocols ospf area '0'
+set protocols ospf area 0 network 0.0.0.0/0
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.3'
+set system host-name VyOS-P1
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P2.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P2.txt
new file mode 100644
index 0000000..e2cf3cb
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P2.txt
@@ -0,0 +1,20 @@
+set interfaces dummy dum10 address '10.0.0.4/32'
+set interfaces ethernet eth0 address '172.16.30.2/24'
+set interfaces ethernet eth1 address '172.16.20.1/24'
+set interfaces ethernet eth2 address '172.16.120.1/24'
+set interfaces ethernet eth3 address '172.16.60.1/24'
+set protocols mpls interface 'eth0'
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp interface 'eth3'
+set protocols mpls ldp router-id '10.0.0.4'
+set protocols ospf area '0'
+set protocols ospf area 0 network 0.0.0.0/0
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.4'
+set system host-name VyOS-P2
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P3.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P3.txt
new file mode 100644
index 0000000..7b4001d
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P3.txt
@@ -0,0 +1,20 @@
+set interfaces dummy dum10 address '10.0.0.5/32'
+set interfaces ethernet eth0 address '172.16.110.1/24'
+set interfaces ethernet eth1 address '172.16.40.2/24'
+set interfaces ethernet eth2 address '172.16.50.1/24'
+set interfaces ethernet eth3 address '172.16.70.1/24'
+set protocols mpls interface 'eth0'
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp interface 'eth3'
+set protocols mpls ldp router-id '10.0.0.5'
+set protocols ospf area '0'
+set protocols ospf area 0 network 0.0.0.0/0
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.5'
+set system host-name VyOS-P3
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P4.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P4.txt
new file mode 100644
index 0000000..096e395
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-P4.txt
@@ -0,0 +1,23 @@
+set interfaces dummy dum10 address '10.0.0.6/32'
+set interfaces ethernet eth0 address '172.16.80.2/24'
+set interfaces ethernet eth1 address '172.16.130.1/24'
+set interfaces ethernet eth2 address '172.16.50.2/24'
+set interfaces ethernet eth3 address '172.16.60.2/24'
+set interfaces ethernet eth5 address '172.16.140.1/24'
+set protocols mpls interface 'eth0'
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls interface 'eth3'
+set protocols mpls interface 'eth5'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp interface 'eth3'
+set protocols mpls ldp interface 'eth5'
+set protocols mpls ldp router-id '10.0.0.6'
+set protocols ospf area '0'
+set protocols ospf area 0 network 0.0.0.0/0
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.6'
+set system host-name VyOS-P4
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE1.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE1.txt
new file mode 100644
index 0000000..49f81fb
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE1.txt
@@ -0,0 +1,36 @@
+delete vrf bind-to-all
+set interfaces dummy dum10 address '10.0.0.7/32'
+set interfaces ethernet eth0 address '172.16.90.2/24'
+set interfaces ethernet eth3 address '10.50.50.1/24'
+set interfaces ethernet eth3 vrf 'BLUE_SPOKE'
+set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id 10.0.0.7
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+set protocols bgp system-as 65001
+set protocols bgp system-as 65001
+set protocols mpls interface 'eth0'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp router-id '10.0.0.7'
+set protocols ospf area '0'
+set protocols ospf area 0 network 0.0.0.0/0
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.7'
+set system host-name VyOS-PE1
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030'
+set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override
+set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as 65035
+set vrf name BLUE_SPOKE protocols bgp system-as 65001
+set vrf name BLUE_SPOKE table 200
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE2.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE2.txt
new file mode 100644
index 0000000..529108b
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE2.txt
@@ -0,0 +1,40 @@
+delete vrf bind-to-all
+set interfaces dummy dum10 address '10.0.0.8/32'
+set interfaces ethernet eth0 address '172.16.110.2/24'
+set interfaces ethernet eth1 address '172.16.100.2/24'
+set interfaces ethernet eth2 address '172.16.80.1/24'
+set interfaces ethernet eth3 address '10.80.80.1/24'
+set interfaces ethernet eth3 vrf 'BLUE_HUB'
+set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id 10.0.0.8
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+set protocols bgp system-as 65001
+set protocols bgp system-as 65001
+set protocols mpls interface 'eth0'
+set protocols mpls interface 'eth1'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp router-id '10.0.0.8'
+set protocols ospf area '0'
+set protocols ospf area 0 network 0.0.0.0/0
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.8'
+set system host-name VyOS-PE2
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto'
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011'
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030'
+set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030'
+set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override
+set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as 65035
+set vrf name BLUE_HUB protocols bgp system-as 65001
+set vrf name BLUE_HUB table 400
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE3.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE3.txt
new file mode 100644
index 0000000..0ff62b4
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-PE3.txt
@@ -0,0 +1,36 @@
+delete vrf bind-to-all
+set interfaces dummy dum10 address '10.0.0.10/32'
+set interfaces ethernet eth0 address '172.16.140.2/24'
+set interfaces ethernet eth3 address '10.60.60.1/24'
+set interfaces ethernet eth3 vrf 'BLUE_SPOKE'
+set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self
+set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4'
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id 10.0.0.10
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+set protocols bgp system-as 65001
+set protocols bgp system-as 65001
+set protocols mpls interface 'eth0'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp router-id '10.0.0.10'
+set protocols ospf area '0'
+set protocols ospf area 0 network 0.0.0.0/0
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.10'
+set system host-name VyOS-PE3
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011'
+set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030'
+set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override
+set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as 65035
+set vrf name BLUE_SPOKE protocols bgp system-as 65001
+set vrf name BLUE_SPOKE table 200
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR1.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR1.txt
new file mode 100644
index 0000000..20336f8
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR1.txt
@@ -0,0 +1,26 @@
+set interfaces dummy dum10 address '10.0.0.1/32'
+set interfaces ethernet eth1 address '172.16.20.2/24'
+set interfaces ethernet eth2 address '172.16.10.2/24'
+set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4'
+set protocols bgp parameters cluster-id 10.0.0.1
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id 10.0.0.1
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+set protocols bgp system-as 65001
+set protocols mpls interface 'eth1'
+set protocols mpls interface 'eth2'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp interface 'eth2'
+set protocols mpls ldp router-id '10.0.0.1'
+set protocols ospf area '0'
+set protocols ospf area 0 network 0.0.0.0/0
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.1'
+set system host-name VyOS-RR1
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR2.txt b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR2.txt
new file mode 100644
index 0000000..ad065f7
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/expected/VyOS-RR2.txt
@@ -0,0 +1,26 @@
+set interfaces dummy dum10 address '10.0.0.2/32'
+set interfaces ethernet eth0 address '172.16.80.1/24'
+set interfaces ethernet eth1 address '172.16.70.2/24'
+set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4'
+set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client
+set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4'
+set protocols bgp parameters cluster-id 10.0.0.1
+set protocols bgp parameters log-neighbor-changes
+set protocols bgp parameters router-id 10.0.0.2
+set protocols bgp peer-group RR_VPNv4 remote-as '65001'
+set protocols bgp peer-group RR_VPNv4 update-source 'dum10'
+set protocols bgp system-as 65001
+set protocols mpls interface 'eth0'
+set protocols mpls interface 'eth1'
+set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2'
+set protocols mpls ldp interface 'eth0'
+set protocols mpls ldp interface 'eth1'
+set protocols mpls ldp router-id '10.0.0.2'
+set protocols ospf area '0'
+set protocols ospf area 0 network 0.0.0.0/0
+set protocols ospf parameters abr-type 'cisco'
+set protocols ospf parameters router-id '10.0.0.2'
+set system host-name VyOS-RR2
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/inventory.yml b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/inventory.yml
new file mode 100644
index 0000000..e1c1157
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/inventory.yml
@@ -0,0 +1,442 @@
+---
+# docs.vyos.io/en/1.5/configexamples/l3vpn-hub-and-spoke.html - all twelve
+# routers (steps 1-4). The page's configs carry no host-name; base sets one per
+# inventory name.
+all:
+  hosts:
+    VyOS-P1:
+      base_interfaces:
+        - name: dum10
+          addresses:
+            - 10.0.0.3/32
+        - name: eth0
+          addresses:
+            - 172.16.30.1/24
+        - name: eth1
+          addresses:
+            - 172.16.40.1/24
+        - name: eth2
+          addresses:
+            - 172.16.90.1/24
+        - name: eth3
+          addresses:
+            - 172.16.10.1/24
+        - name: eth5
+          addresses:
+            - 172.16.100.1/24
+      ospf_router_id: 10.0.0.3
+      ospf_areas:
+        - id: '0'
+          networks:
+            - 0.0.0.0/0
+      ospf_abr_type: cisco
+      mpls_ldp_router_id: 10.0.0.3
+      mpls_ldp_interfaces:
+        - eth0
+        - eth1
+        - eth2
+        - eth3
+        - eth5
+      ansible_host: 192.0.2.1
+      base_hostname: VyOS-P1
+    VyOS-P2:
+      base_interfaces:
+        - name: dum10
+          addresses:
+            - 10.0.0.4/32
+        - name: eth0
+          addresses:
+            - 172.16.30.2/24
+        - name: eth1
+          addresses:
+            - 172.16.20.1/24
+        - name: eth2
+          addresses:
+            - 172.16.120.1/24
+        - name: eth3
+          addresses:
+            - 172.16.60.1/24
+      ospf_router_id: 10.0.0.4
+      ospf_areas:
+        - id: '0'
+          networks:
+            - 0.0.0.0/0
+      ospf_abr_type: cisco
+      mpls_ldp_router_id: 10.0.0.4
+      mpls_ldp_interfaces:
+        - eth0
+        - eth1
+        - eth2
+        - eth3
+      ansible_host: 192.0.2.2
+      base_hostname: VyOS-P2
+    VyOS-P3:
+      base_interfaces:
+        - name: dum10
+          addresses:
+            - 10.0.0.5/32
+        - name: eth0
+          addresses:
+            - 172.16.110.1/24
+        - name: eth1
+          addresses:
+            - 172.16.40.2/24
+        - name: eth2
+          addresses:
+            - 172.16.50.1/24
+        - name: eth3
+          addresses:
+            - 172.16.70.1/24
+      ospf_router_id: 10.0.0.5
+      ospf_areas:
+        - id: '0'
+          networks:
+            - 0.0.0.0/0
+      ospf_abr_type: cisco
+      mpls_ldp_router_id: 10.0.0.5
+      mpls_ldp_interfaces:
+        - eth0
+        - eth1
+        - eth2
+        - eth3
+      ansible_host: 192.0.2.3
+      base_hostname: VyOS-P3
+    VyOS-P4:
+      base_interfaces:
+        - name: dum10
+          addresses:
+            - 10.0.0.6/32
+        - name: eth0
+          addresses:
+            - 172.16.80.2/24
+        - name: eth1
+          addresses:
+            - 172.16.130.1/24
+        - name: eth2
+          addresses:
+            - 172.16.50.2/24
+        - name: eth3
+          addresses:
+            - 172.16.60.2/24
+        - name: eth5
+          addresses:
+            - 172.16.140.1/24
+      ospf_router_id: 10.0.0.6
+      ospf_areas:
+        - id: '0'
+          networks:
+            - 0.0.0.0/0
+      ospf_abr_type: cisco
+      mpls_ldp_router_id: 10.0.0.6
+      mpls_ldp_interfaces:
+        - eth0
+        - eth1
+        - eth2
+        - eth3
+        - eth5
+      ansible_host: 192.0.2.4
+      base_hostname: VyOS-P4
+    VyOS-PE1:
+      base_interfaces:
+        - name: dum10
+          addresses:
+            - 10.0.0.7/32
+        - name: eth0
+          addresses:
+            - 172.16.90.2/24
+        - name: eth3
+          addresses:
+            - 10.50.50.1/24
+      ospf_router_id: 10.0.0.7
+      ospf_areas:
+        - id: '0'
+          networks:
+            - 0.0.0.0/0
+      ospf_abr_type: cisco
+      mpls_ldp_router_id: 10.0.0.7
+      mpls_ldp_interfaces:
+        - eth0
+      l3vpn_asn: 65001
+      l3vpn_router_id: 10.0.0.7
+      l3vpn_peer_group: &id001
+        name: RR_VPNv4
+        remote_as: 65001
+        update_source: dum10
+      l3vpn_neighbors:
+        - address: 10.0.0.1
+          nexthop_self: true
+        - address: 10.0.0.2
+          nexthop_self: true
+      vrf_lite_asn: 65001
+      vrf_lite_vrfs:
+        - name: BLUE_SPOKE
+          table: 200
+          interfaces:
+            - eth3
+          families:
+            - ipv4
+          label_vpn_export: auto
+          networks:
+            - 10.50.50.0/24
+          rd: 10.50.50.1:1011
+          route_targets_export:
+            - 65035:1011
+          route_targets_import:
+            - 65035:1030
+          redistribute:
+            - connected
+          neighbors:
+            - address: 10.50.50.2
+              remote_as: 65035
+              as_override: true
+      ansible_host: 192.0.2.5
+      base_hostname: VyOS-PE1
+    VyOS-PE2:
+      base_interfaces:
+        - name: dum10
+          addresses:
+            - 10.0.0.8/32
+        - name: eth0
+          addresses:
+            - 172.16.110.2/24
+        - name: eth1
+          addresses:
+            - 172.16.100.2/24
+        - name: eth2
+          addresses:
+            - 172.16.80.1/24
+        - name: eth3
+          addresses:
+            - 10.80.80.1/24
+      ospf_router_id: 10.0.0.8
+      ospf_areas:
+        - id: '0'
+          networks:
+            - 0.0.0.0/0
+      ospf_abr_type: cisco
+      mpls_ldp_router_id: 10.0.0.8
+      mpls_ldp_interfaces:
+        - eth0
+        - eth1
+      l3vpn_asn: 65001
+      l3vpn_router_id: 10.0.0.8
+      l3vpn_peer_group: *id001
+      l3vpn_neighbors:
+        - address: 10.0.0.1
+          nexthop_self: true
+        - address: 10.0.0.2
+          nexthop_self: true
+      vrf_lite_asn: 65001
+      vrf_lite_vrfs:
+        - name: BLUE_HUB
+          table: 400
+          interfaces:
+            - eth3
+          families:
+            - ipv4
+          label_vpn_export: auto
+          networks:
+            - 10.80.80.0/24
+          rd: 10.80.80.1:1011
+          route_targets_export:
+            - 65035:1030
+          route_targets_import:
+            - 65035:1011
+            - 65050:2011
+            - 65035:1030
+          redistribute:
+            - connected
+          neighbors:
+            - address: 10.80.80.2
+              remote_as: 65035
+              as_override: true
+      ansible_host: 192.0.2.6
+      base_hostname: VyOS-PE2
+    VyOS-PE3:
+      base_interfaces:
+        - name: dum10
+          addresses:
+            - 10.0.0.10/32
+        - name: eth0
+          addresses:
+            - 172.16.140.2/24
+        - name: eth3
+          addresses:
+            - 10.60.60.1/24
+      ospf_router_id: 10.0.0.10
+      ospf_areas:
+        - id: '0'
+          networks:
+            - 0.0.0.0/0
+      ospf_abr_type: cisco
+      mpls_ldp_router_id: 10.0.0.10
+      mpls_ldp_interfaces:
+        - eth0
+      l3vpn_asn: 65001
+      l3vpn_router_id: 10.0.0.10
+      l3vpn_peer_group: *id001
+      l3vpn_neighbors:
+        - address: 10.0.0.1
+          nexthop_self: true
+        - address: 10.0.0.2
+          nexthop_self: true
+      vrf_lite_asn: 65001
+      vrf_lite_vrfs:
+        - name: BLUE_SPOKE
+          table: 200
+          interfaces:
+            - eth3
+          families:
+            - ipv4
+          label_vpn_export: auto
+          networks:
+            - 10.60.60.0/24
+          rd: 10.60.60.1:1011
+          route_targets_export:
+            - 65035:1011
+          route_targets_import:
+            - 65035:1030
+          redistribute:
+            - connected
+          neighbors:
+            - address: 10.60.60.2
+              remote_as: 65035
+              as_override: true
+      ansible_host: 192.0.2.7
+      base_hostname: VyOS-PE3
+    VyOS-RR1:
+      base_interfaces:
+        - name: dum10
+          addresses:
+            - 10.0.0.1/32
+        - name: eth1
+          addresses:
+            - 172.16.20.2/24
+        - name: eth2
+          addresses:
+            - 172.16.10.2/24
+      ospf_router_id: 10.0.0.1
+      ospf_areas:
+        - id: '0'
+          networks:
+            - 0.0.0.0/0
+      ospf_abr_type: cisco
+      mpls_ldp_router_id: 10.0.0.1
+      mpls_ldp_interfaces:
+        - eth1
+        - eth2
+      l3vpn_asn: 65001
+      l3vpn_router_id: 10.0.0.1
+      l3vpn_cluster_id: 10.0.0.1
+      l3vpn_peer_group: *id001
+      l3vpn_neighbors:
+        - address: 10.0.0.7
+          route_reflector_client: true
+        - address: 10.0.0.8
+          route_reflector_client: true
+        - address: 10.0.0.10
+          route_reflector_client: true
+      ansible_host: 192.0.2.8
+      base_hostname: VyOS-RR1
+    VyOS-RR2:
+      base_interfaces:
+        - name: dum10
+          addresses:
+            - 10.0.0.2/32
+        - name: eth0
+          addresses:
+            - 172.16.80.1/24
+        - name: eth1
+          addresses:
+            - 172.16.70.2/24
+      ospf_router_id: 10.0.0.2
+      ospf_areas:
+        - id: '0'
+          networks:
+            - 0.0.0.0/0
+      ospf_abr_type: cisco
+      mpls_ldp_router_id: 10.0.0.2
+      mpls_ldp_interfaces:
+        - eth0
+        - eth1
+      l3vpn_asn: 65001
+      l3vpn_router_id: 10.0.0.2
+      l3vpn_cluster_id: 10.0.0.1
+      l3vpn_peer_group: *id001
+      l3vpn_neighbors:
+        - address: 10.0.0.7
+          route_reflector_client: true
+        - address: 10.0.0.8
+          route_reflector_client: true
+        - address: 10.0.0.10
+          route_reflector_client: true
+      ansible_host: 192.0.2.9
+      base_hostname: VyOS-RR2
+    VyOS-CE1-SPOKE:
+      base_interfaces:
+        - name: dum20
+          addresses:
+            - 10.0.0.80/32
+        - name: eth0
+          addresses:
+            - 10.50.50.2/24
+      bgp_asn: 65035
+      bgp_router_id: 10.50.50.2
+      bgp_networks:
+        - 10.0.0.80/32
+      bgp_log_neighbor_changes: true
+      bgp_neighbors:
+        - address: 10.50.50.1
+          remote_as: 65001
+          ebgp_multihop: 2
+          update_source: eth0
+      ansible_host: 192.0.2.10
+      base_hostname: VyOS-CE1-SPOKE
+    VyOS-CE1-HUB:
+      base_interfaces:
+        - name: dum20
+          addresses:
+            - 10.0.0.100/32
+        - name: eth0
+          addresses:
+            - 10.80.80.2/24
+      bgp_asn: 65035
+      bgp_router_id: 10.80.80.2
+      bgp_networks:
+        - 10.0.0.100/32
+      bgp_log_neighbor_changes: true
+      bgp_neighbors:
+        - address: 10.80.80.1
+          remote_as: 65001
+          ebgp_multihop: 2
+          update_source: eth0
+      bgp_redistribute:
+        - type: connected
+      ansible_host: 192.0.2.11
+      base_hostname: VyOS-CE1-HUB
+    VyOS-CE2-SPOKE:
+      base_interfaces:
+        - name: dum20
+          addresses:
+            - 10.0.0.90/32
+        - name: eth0
+          addresses:
+            - 10.60.60.2/24
+      bgp_asn: 65035
+      bgp_router_id: 10.60.60.2
+      bgp_networks:
+        - 10.0.0.90/32
+      bgp_log_neighbor_changes: true
+      bgp_neighbors:
+        - address: 10.60.60.1
+          remote_as: 65001
+          ebgp_multihop: 2
+          update_source: eth0
+      ansible_host: 192.0.2.12
+      base_hostname: VyOS-CE2-SPOKE
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/blueprints/l3vpn_hub_and_spoke/roles b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/roles
new file mode 100644
index 0000000..4ccd8a2
--- /dev/null
+++ b/tests/render/cases/blueprints/l3vpn_hub_and_spoke/roles
@@ -0,0 +1 @@
+base,ospf,mpls_ldp,l3vpn,vrf_lite,bgp
diff --git a/tests/render/cases/blueprints/pppoe_ipv6_home/expected/r1.txt b/tests/render/cases/blueprints/pppoe_ipv6_home/expected/r1.txt
new file mode 100644
index 0000000..2ea973f
--- /dev/null
+++ b/tests/render/cases/blueprints/pppoe_ipv6_home/expected/r1.txt
@@ -0,0 +1,38 @@
+set firewall ipv6 forward filter rule 10
+set firewall ipv6 forward filter rule 10 action 'jump'
+set firewall ipv6 forward filter rule 10 inbound-interface name pppoe0
+set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN'
+set firewall ipv6 input filter rule 10
+set firewall ipv6 input filter rule 10 action 'jump'
+set firewall ipv6 input filter rule 10 inbound-interface name pppoe0
+set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL'
+set firewall ipv6 name WAN_IN default-action 'drop'
+set firewall ipv6 name WAN_IN rule 10
+set firewall ipv6 name WAN_IN rule 10 action 'accept'
+set firewall ipv6 name WAN_IN rule 10 state established
+set firewall ipv6 name WAN_IN rule 10 state related
+set firewall ipv6 name WAN_IN rule 20
+set firewall ipv6 name WAN_IN rule 20 action 'accept'
+set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6'
+set firewall ipv6 name WAN_LOCAL default-action 'drop'
+set firewall ipv6 name WAN_LOCAL rule 10
+set firewall ipv6 name WAN_LOCAL rule 10 action 'accept'
+set firewall ipv6 name WAN_LOCAL rule 10 state established
+set firewall ipv6 name WAN_LOCAL rule 10 state related
+set firewall ipv6 name WAN_LOCAL rule 20
+set firewall ipv6 name WAN_LOCAL rule 20 action 'accept'
+set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6'
+set firewall ipv6 name WAN_LOCAL rule 30
+set firewall ipv6 name WAN_LOCAL rule 30 action 'accept'
+set firewall ipv6 name WAN_LOCAL rule 30 destination port 546
+set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp'
+set firewall ipv6 name WAN_LOCAL rule 30 source port 547
+set interfaces pppoe pppoe0 authentication password '********'
+set interfaces pppoe pppoe0 authentication username 'example-user'
+set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100'
+set interfaces pppoe pppoe0 ipv6 address autoconf
+set interfaces pppoe pppoe0 service-name 'example-isp'
+set interfaces pppoe pppoe0 source-interface 'eth0'
+set service router-advert interface eth1 link-mtu '1492'
+set service router-advert interface eth1 name-server '2001:db8::53'
+set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800'
diff --git a/tests/render/cases/blueprints/pppoe_ipv6_home/roles b/tests/render/cases/blueprints/pppoe_ipv6_home/roles
new file mode 100644
index 0000000..e52bef3
--- /dev/null
+++ b/tests/render/cases/blueprints/pppoe_ipv6_home/roles
@@ -0,0 +1 @@
+pppoe,router_advert,firewall
diff --git a/tests/render/cases/blueprints/pppoe_ipv6_home/vars.yml b/tests/render/cases/blueprints/pppoe_ipv6_home/vars.yml
new file mode 100644
index 0000000..8b5e06b
--- /dev/null
+++ b/tests/render/cases/blueprints/pppoe_ipv6_home/vars.yml
@@ -0,0 +1,40 @@
+---
+# docs.vyos.io/en/1.5/configexamples/pppoe-ipv6-basic.html
+# The page's placeholders are filled with example values: <YOUR USERNAME>,
+# <YOUR PASSWORD>, <YOUR SERVICENAME> and <NAME SERVER>.
+pppoe_interfaces:
+  - name: pppoe0
+    source_interface: eth0
+    username: example-user
+    password: example-password
+    service_name: example-isp
+    ipv6_autoconf: true
+    prefix_delegation:
+      - id: 0
+        interfaces:
+          - {name: eth1, address: "100"}
+router_advert_interfaces:
+  - name: eth1
+    link_mtu: 1492
+    name_servers: ["2001:db8::53"]
+    prefixes:
+      - {prefix: "::/64", valid_lifetime: 172800}
+firewall_ipv6:
+  names:
+    WAN_IN:
+      default_action: drop
+      rules:
+        - {number: 10, action: accept, state: {established: true, related: true}}
+        - {number: 20, action: accept, protocol: icmpv6}
+    WAN_LOCAL:
+      default_action: drop
+      rules:
+        - {number: 10, action: accept, state: {established: true, related: true}}
+        - {number: 20, action: accept, protocol: icmpv6}
+        - {number: 30, action: accept, protocol: udp, source: {port: "547"}, destination: {port: "546"}}
+  forward:
+    rules:
+      - {number: 10, action: jump, jump_target: WAN_IN, inbound_interface: {name: pppoe0}}
+  input:
+    rules:
+      - {number: 10, action: jump, jump_target: WAN_LOCAL, inbound_interface: {name: pppoe0}}
diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos2.txt b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos2.txt
new file mode 100644
index 0000000..8373e9a
--- /dev/null
+++ b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos2.txt
@@ -0,0 +1,20 @@
+set interfaces ethernet eth0 address '10.1.1.1/24'
+set interfaces ethernet eth1 address '10.2.1.1/24'
+set interfaces ethernet eth2 address '10.9.9.1/24'
+set protocols static route 172.17.1.0/24
+set protocols static route 172.17.1.0/24 next-hop '10.1.1.100'
+set qos interface eth2 egress 'vyos2'
+set qos policy shaper vyos2 class 10 bandwidth '100%'
+set qos policy shaper vyos2 class 10 burst '15k'
+set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4'
+set qos policy shaper vyos2 class 10 queue-type 'fair-queue'
+set qos policy shaper vyos2 class 10 set-dscp 'CS5'
+set qos policy shaper vyos2 class 20 bandwidth '5mbit'
+set qos policy shaper vyos2 class 20 description 'for VyOS3 eth0'
+set qos policy shaper vyos2 class 20 match VyOS3 ip source address '10.1.1.100/32'
+set qos policy shaper vyos2 default bandwidth '100%'
+set qos policy shaper vyos2 default burst '15k'
+set qos policy shaper vyos2 default ceiling '100%'
+set qos policy shaper vyos2 default priority '7'
+set qos policy shaper vyos2 default queue-type 'fair-queue'
+set system host-name vyos2
diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos3.txt b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos3.txt
new file mode 100644
index 0000000..2274b1d
--- /dev/null
+++ b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos3.txt
@@ -0,0 +1,16 @@
+set interfaces ethernet eth0 address '10.1.1.100/24'
+set interfaces ethernet eth1 address '172.17.1.1/24'
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '10.1.1.1'
+set qos interface eth0 egress 'vyos3'
+set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32'
+set qos policy shaper vyos3 class 10 set-dscp 'CS4'
+set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32'
+set qos policy shaper vyos3 class 20 set-dscp 'CS5'
+set qos policy shaper vyos3 class 30 match ADDRESS30 ip source address '172.17.1.4/32'
+set qos policy shaper vyos3 class 30 set-dscp 'CS6'
+set qos policy shaper vyos3 default bandwidth '10%'
+set qos policy shaper vyos3 default ceiling '100%'
+set qos policy shaper vyos3 default priority '7'
+set qos policy shaper vyos3 default queue-type 'fair-queue'
+set system host-name vyos3
diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos4.txt b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos4.txt
new file mode 100644
index 0000000..e55343f
--- /dev/null
+++ b/tests/render/cases/blueprints/qos_dscp_shaper/expected/vyos4.txt
@@ -0,0 +1,15 @@
+set interfaces ethernet eth0 address '10.2.1.100/24'
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '10.2.1.1'
+set qos interface eth0 egress 'vyos4'
+set qos policy shaper vyos4 class 10 bandwidth '100%'
+set qos policy shaper vyos4 class 10 burst '15k'
+set qos policy shaper vyos4 class 10 match ALL ether protocol 'all'
+set qos policy shaper vyos4 class 10 queue-type 'fair-queue'
+set qos policy shaper vyos4 class 10 set-dscp 'CS4'
+set qos policy shaper vyos4 default bandwidth '10%'
+set qos policy shaper vyos4 default burst '15k'
+set qos policy shaper vyos4 default ceiling '100%'
+set qos policy shaper vyos4 default priority '7'
+set qos policy shaper vyos4 default queue-type 'fair-queue'
+set system host-name vyos4
diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/inventory.yml b/tests/render/cases/blueprints/qos_dscp_shaper/inventory.yml
new file mode 100644
index 0000000..e4617d4
--- /dev/null
+++ b/tests/render/cases/blueprints/qos_dscp_shaper/inventory.yml
@@ -0,0 +1,62 @@
+---
+# docs.vyos.io/en/1.5/configexamples/qos.html
+# vyos2's class 20 (5 Mbit/s for 10.1.1.100) is shown on the page as "show"
+# output; it is translated to the equivalent settings here. The page's text
+# says vyos2 re-marks "CS4 -> CS6" once, but its configuration sets CS5 (as the
+# introduction says); the configuration is followed.
+all:
+  hosts:
+    vyos3:
+      ansible_host: 192.0.2.3
+      base_hostname: vyos3
+      base_interfaces:
+        - {name: eth0, addresses: [10.1.1.100/24]}
+        - {name: eth1, addresses: [172.17.1.1/24]}
+      base_static_routes:
+        - {dest: 0.0.0.0/0, next_hop: 10.1.1.1}
+      qos_shapers:
+        - name: vyos3
+          classes:
+            - {id: 10, set_dscp: CS4, matches: [{name: ADDRESS10, ip: {source: {address: 172.17.1.2/32}}}]}
+            - {id: 20, set_dscp: CS5, matches: [{name: ADDRESS20, ip: {source: {address: 172.17.1.3/32}}}]}
+            - {id: 30, set_dscp: CS6, matches: [{name: ADDRESS30, ip: {source: {address: 172.17.1.4/32}}}]}
+          default: {bandwidth: 10%, ceiling: 100%, priority: 7, queue_type: fair-queue}
+      qos_interfaces:
+        - {name: eth0, egress: vyos3}
+    vyos4:
+      ansible_host: 192.0.2.4
+      base_hostname: vyos4
+      base_interfaces:
+        - {name: eth0, addresses: [10.2.1.100/24]}
+      base_static_routes:
+        - {dest: 0.0.0.0/0, next_hop: 10.2.1.1}
+      qos_shapers:
+        - name: vyos4
+          classes:
+            - {id: 10, bandwidth: 100%, burst: 15k, queue_type: fair-queue, set_dscp: CS4, matches: [{name: ALL, ether: {protocol: all}}]}
+          default: {bandwidth: 10%, burst: 15k, ceiling: 100%, priority: 7, queue_type: fair-queue}
+      qos_interfaces:
+        - {name: eth0, egress: vyos4}
+    vyos2:
+      ansible_host: 192.0.2.2
+      base_hostname: vyos2
+      base_interfaces:
+        - {name: eth0, addresses: [10.1.1.1/24]}
+        - {name: eth1, addresses: [10.2.1.1/24]}
+        - {name: eth2, addresses: [10.9.9.1/24]}
+      base_static_routes:
+        - {dest: 172.17.1.0/24, next_hop: 10.1.1.100}
+      qos_shapers:
+        - name: vyos2
+          classes:
+            - {id: 10, bandwidth: 100%, burst: 15k, queue_type: fair-queue, set_dscp: CS5, matches: [{name: VYOS2, ip: {dscp: CS4}}]}
+            - {id: 20, bandwidth: 5mbit, description: for VyOS3 eth0, matches: [{name: VyOS3, ip: {source: {address: 10.1.1.100/32}}}]}
+          default: {bandwidth: 100%, burst: 15k, ceiling: 100%, priority: 7, queue_type: fair-queue}
+      qos_interfaces:
+        - {name: eth2, egress: vyos2}
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/blueprints/qos_dscp_shaper/roles b/tests/render/cases/blueprints/qos_dscp_shaper/roles
new file mode 100644
index 0000000..e9825df
--- /dev/null
+++ b/tests/render/cases/blueprints/qos_dscp_shaper/roles
@@ -0,0 +1 @@
+base,qos
diff --git a/tests/render/cases/blueprints/wan_lb_example1_balance/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example1_balance/expected/r1.txt
new file mode 100644
index 0000000..bd4bd98
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example1_balance/expected/r1.txt
@@ -0,0 +1,24 @@
+set load-balancing wan interface-health eth0 failure-count '5'
+set load-balancing wan interface-health eth0 nexthop '11.22.33.1'
+set load-balancing wan interface-health eth0 test 10 target '33.44.55.66'
+set load-balancing wan interface-health eth0 test 10 type 'ping'
+set load-balancing wan interface-health eth0 test 20 target '44.55.66.77'
+set load-balancing wan interface-health eth0 test 20 type 'ping'
+set load-balancing wan interface-health eth1 failure-count '4'
+set load-balancing wan interface-health eth1 nexthop '22.33.44.1'
+set load-balancing wan interface-health eth1 test 10 target '55.66.77.88'
+set load-balancing wan interface-health eth1 test 10 type 'ping'
+set load-balancing wan interface-health eth1 test 20 target '66.77.88.99'
+set load-balancing wan interface-health eth1 test 20 type 'ping'
+set load-balancing wan rule 10 inbound-interface 'eth2'
+set load-balancing wan rule 10 interface eth0
+set load-balancing wan rule 10 interface eth1
+set protocols static route 33.44.55.66/32
+set protocols static route 33.44.55.66/32 next-hop '11.22.33.1'
+set protocols static route 44.55.66.77/32
+set protocols static route 44.55.66.77/32 next-hop '11.22.33.1'
+set protocols static route 55.66.77.88/32
+set protocols static route 55.66.77.88/32 next-hop '22.33.44.1'
+set protocols static route 66.77.88.99/32
+set protocols static route 66.77.88.99/32 next-hop '22.33.44.1'
+set system host-name r1
diff --git a/tests/render/cases/blueprints/wan_lb_example1_balance/roles b/tests/render/cases/blueprints/wan_lb_example1_balance/roles
new file mode 100644
index 0000000..c9221fb
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example1_balance/roles
@@ -0,0 +1 @@
+base,wan_load_balance
diff --git a/tests/render/cases/blueprints/wan_lb_example1_balance/vars.yml b/tests/render/cases/blueprints/wan_lb_example1_balance/vars.yml
new file mode 100644
index 0000000..7baacf4
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example1_balance/vars.yml
@@ -0,0 +1,28 @@
+---
+# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 1: Distributing load evenly
+# (the end state after applying the page's steps up to this example)
+base_hostname: r1
+base_static_routes:
+  - {dest: 33.44.55.66/32, next_hop: 11.22.33.1}
+  - {dest: 44.55.66.77/32, next_hop: 11.22.33.1}
+  - {dest: 55.66.77.88/32, next_hop: 22.33.44.1}
+  - {dest: 66.77.88.99/32, next_hop: 22.33.44.1}
+wan_load_balance_interfaces:
+  - name: eth0
+    failure_count: 5
+    nexthop: 11.22.33.1
+    tests:
+      - {id: 10, type: ping, target: 33.44.55.66}
+      - {id: 20, type: ping, target: 44.55.66.77}
+  - name: eth1
+    failure_count: 4
+    nexthop: 22.33.44.1
+    tests:
+      - {id: 10, type: ping, target: 55.66.77.88}
+      - {id: 20, type: ping, target: 66.77.88.99}
+wan_load_balance_rules:
+  - number: 10
+    inbound_interface: eth2
+    interfaces:
+      - {name: eth0}
+      - {name: eth1}
diff --git a/tests/render/cases/blueprints/wan_lb_example2_failover_weights/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/expected/r1.txt
new file mode 100644
index 0000000..f9b1689
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/expected/r1.txt
@@ -0,0 +1,25 @@
+set load-balancing wan interface-health eth0 failure-count '5'
+set load-balancing wan interface-health eth0 nexthop '11.22.33.1'
+set load-balancing wan interface-health eth0 test 10 target '33.44.55.66'
+set load-balancing wan interface-health eth0 test 10 type 'ping'
+set load-balancing wan interface-health eth0 test 20 target '44.55.66.77'
+set load-balancing wan interface-health eth0 test 20 type 'ping'
+set load-balancing wan interface-health eth1 failure-count '4'
+set load-balancing wan interface-health eth1 nexthop '22.33.44.1'
+set load-balancing wan interface-health eth1 test 10 target '55.66.77.88'
+set load-balancing wan interface-health eth1 test 10 type 'ping'
+set load-balancing wan interface-health eth1 test 20 target '66.77.88.99'
+set load-balancing wan interface-health eth1 test 20 type 'ping'
+set load-balancing wan rule 10 failover
+set load-balancing wan rule 10 inbound-interface 'eth2'
+set load-balancing wan rule 10 interface eth0 weight '10'
+set load-balancing wan rule 10 interface eth1 weight '1'
+set protocols static route 33.44.55.66/32
+set protocols static route 33.44.55.66/32 next-hop '11.22.33.1'
+set protocols static route 44.55.66.77/32
+set protocols static route 44.55.66.77/32 next-hop '11.22.33.1'
+set protocols static route 55.66.77.88/32
+set protocols static route 55.66.77.88/32 next-hop '22.33.44.1'
+set protocols static route 66.77.88.99/32
+set protocols static route 66.77.88.99/32 next-hop '22.33.44.1'
+set system host-name r1
diff --git a/tests/render/cases/blueprints/wan_lb_example2_failover_weights/roles b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/roles
new file mode 100644
index 0000000..c9221fb
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/roles
@@ -0,0 +1 @@
+base,wan_load_balance
diff --git a/tests/render/cases/blueprints/wan_lb_example2_failover_weights/vars.yml b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/vars.yml
new file mode 100644
index 0000000..6b89539
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example2_failover_weights/vars.yml
@@ -0,0 +1,29 @@
+---
+# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 2: Failover based on interface weights
+# (the end state after applying the page's steps up to this example)
+base_hostname: r1
+base_static_routes:
+  - {dest: 33.44.55.66/32, next_hop: 11.22.33.1}
+  - {dest: 44.55.66.77/32, next_hop: 11.22.33.1}
+  - {dest: 55.66.77.88/32, next_hop: 22.33.44.1}
+  - {dest: 66.77.88.99/32, next_hop: 22.33.44.1}
+wan_load_balance_interfaces:
+  - name: eth0
+    failure_count: 5
+    nexthop: 11.22.33.1
+    tests:
+      - {id: 10, type: ping, target: 33.44.55.66}
+      - {id: 20, type: ping, target: 44.55.66.77}
+  - name: eth1
+    failure_count: 4
+    nexthop: 22.33.44.1
+    tests:
+      - {id: 10, type: ping, target: 55.66.77.88}
+      - {id: 20, type: ping, target: 66.77.88.99}
+wan_load_balance_rules:
+  - number: 10
+    failover: true
+    inbound_interface: eth2
+    interfaces:
+      - {name: eth0, weight: 10}
+      - {name: eth1, weight: 1}
diff --git a/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/expected/r1.txt
new file mode 100644
index 0000000..a291c08
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/expected/r1.txt
@@ -0,0 +1,25 @@
+set load-balancing wan interface-health eth0 failure-count '5'
+set load-balancing wan interface-health eth0 nexthop '11.22.33.1'
+set load-balancing wan interface-health eth0 test 10 target '33.44.55.66'
+set load-balancing wan interface-health eth0 test 10 type 'ping'
+set load-balancing wan interface-health eth0 test 20 target '44.55.66.77'
+set load-balancing wan interface-health eth0 test 20 type 'ping'
+set load-balancing wan interface-health eth1 failure-count '4'
+set load-balancing wan interface-health eth1 nexthop '22.33.44.1'
+set load-balancing wan interface-health eth1 test 10 target '55.66.77.88'
+set load-balancing wan interface-health eth1 test 10 type 'ping'
+set load-balancing wan interface-health eth1 test 20 target '66.77.88.99'
+set load-balancing wan interface-health eth1 test 20 type 'ping'
+set load-balancing wan rule 10 inbound-interface 'eth2'
+set load-balancing wan rule 10 interface eth0
+set load-balancing wan rule 20 inbound-interface 'eth2'
+set load-balancing wan rule 20 interface eth1
+set protocols static route 33.44.55.66/32
+set protocols static route 33.44.55.66/32 next-hop '11.22.33.1'
+set protocols static route 44.55.66.77/32
+set protocols static route 44.55.66.77/32 next-hop '11.22.33.1'
+set protocols static route 55.66.77.88/32
+set protocols static route 55.66.77.88/32 next-hop '22.33.44.1'
+set protocols static route 66.77.88.99/32
+set protocols static route 66.77.88.99/32 next-hop '22.33.44.1'
+set system host-name r1
diff --git a/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/roles b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/roles
new file mode 100644
index 0000000..c9221fb
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/roles
@@ -0,0 +1 @@
+base,wan_load_balance
diff --git a/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/vars.yml b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/vars.yml
new file mode 100644
index 0000000..f646e74
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example3_failover_rule_order/vars.yml
@@ -0,0 +1,31 @@
+---
+# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 3: Failover based on rule order
+# (the end state after applying the page's steps up to this example)
+base_hostname: r1
+base_static_routes:
+  - {dest: 33.44.55.66/32, next_hop: 11.22.33.1}
+  - {dest: 44.55.66.77/32, next_hop: 11.22.33.1}
+  - {dest: 55.66.77.88/32, next_hop: 22.33.44.1}
+  - {dest: 66.77.88.99/32, next_hop: 22.33.44.1}
+wan_load_balance_interfaces:
+  - name: eth0
+    failure_count: 5
+    nexthop: 11.22.33.1
+    tests:
+      - {id: 10, type: ping, target: 33.44.55.66}
+      - {id: 20, type: ping, target: 44.55.66.77}
+  - name: eth1
+    failure_count: 4
+    nexthop: 22.33.44.1
+    tests:
+      - {id: 10, type: ping, target: 55.66.77.88}
+      - {id: 20, type: ping, target: 66.77.88.99}
+wan_load_balance_rules:
+  - number: 10
+    inbound_interface: eth2
+    interfaces:
+      - {name: eth0}
+  - number: 20
+    inbound_interface: eth2
+    interfaces:
+      - {name: eth1}
diff --git a/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/expected/r1.txt
new file mode 100644
index 0000000..2f4b9f2
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/expected/r1.txt
@@ -0,0 +1,29 @@
+set load-balancing wan interface-health eth0 failure-count '5'
+set load-balancing wan interface-health eth0 nexthop '11.22.33.1'
+set load-balancing wan interface-health eth0 test 10 target '33.44.55.66'
+set load-balancing wan interface-health eth0 test 10 type 'ping'
+set load-balancing wan interface-health eth0 test 20 target '44.55.66.77'
+set load-balancing wan interface-health eth0 test 20 type 'ping'
+set load-balancing wan interface-health eth1 failure-count '4'
+set load-balancing wan interface-health eth1 nexthop '22.33.44.1'
+set load-balancing wan interface-health eth1 test 10 target '55.66.77.88'
+set load-balancing wan interface-health eth1 test 10 type 'ping'
+set load-balancing wan interface-health eth1 test 20 target '66.77.88.99'
+set load-balancing wan interface-health eth1 test 20 type 'ping'
+set load-balancing wan rule 10 inbound-interface 'eth2'
+set load-balancing wan rule 10 interface eth0
+set load-balancing wan rule 20 destination port 'sip'
+set load-balancing wan rule 20 inbound-interface 'eth2'
+set load-balancing wan rule 20 interface eth1
+set load-balancing wan rule 20 protocol 'tcp'
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '11.22.33.1'
+set protocols static route 33.44.55.66/32
+set protocols static route 33.44.55.66/32 next-hop '11.22.33.1'
+set protocols static route 44.55.66.77/32
+set protocols static route 44.55.66.77/32 next-hop '11.22.33.1'
+set protocols static route 55.66.77.88/32
+set protocols static route 55.66.77.88/32 next-hop '22.33.44.1'
+set protocols static route 66.77.88.99/32
+set protocols static route 66.77.88.99/32 next-hop '22.33.44.1'
+set system host-name r1
diff --git a/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/roles b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/roles
new file mode 100644
index 0000000..c9221fb
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/roles
@@ -0,0 +1 @@
+base,wan_load_balance
diff --git a/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/vars.yml b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/vars.yml
new file mode 100644
index 0000000..ac14a1d
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example4_priority_traffic/vars.yml
@@ -0,0 +1,34 @@
+---
+# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 4: Failover based on rule order - priority traffic
+# (the end state after applying the page's steps up to this example)
+base_hostname: r1
+base_static_routes:
+  - {dest: 33.44.55.66/32, next_hop: 11.22.33.1}
+  - {dest: 44.55.66.77/32, next_hop: 11.22.33.1}
+  - {dest: 55.66.77.88/32, next_hop: 22.33.44.1}
+  - {dest: 66.77.88.99/32, next_hop: 22.33.44.1}
+  - {dest: 0.0.0.0/0, next_hop: 11.22.33.1}
+wan_load_balance_interfaces:
+  - name: eth0
+    failure_count: 5
+    nexthop: 11.22.33.1
+    tests:
+      - {id: 10, type: ping, target: 33.44.55.66}
+      - {id: 20, type: ping, target: 44.55.66.77}
+  - name: eth1
+    failure_count: 4
+    nexthop: 22.33.44.1
+    tests:
+      - {id: 10, type: ping, target: 55.66.77.88}
+      - {id: 20, type: ping, target: 66.77.88.99}
+wan_load_balance_rules:
+  - number: 10
+    inbound_interface: eth2
+    interfaces:
+      - {name: eth0}
+  - number: 20
+    inbound_interface: eth2
+    interfaces:
+      - {name: eth1}
+    destination: {port: sip}
+    protocol: tcp
diff --git a/tests/render/cases/blueprints/wan_lb_example5_exclude/expected/r1.txt b/tests/render/cases/blueprints/wan_lb_example5_exclude/expected/r1.txt
new file mode 100644
index 0000000..0fb7e5b
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example5_exclude/expected/r1.txt
@@ -0,0 +1,32 @@
+set load-balancing wan interface-health eth0 failure-count '5'
+set load-balancing wan interface-health eth0 nexthop '11.22.33.1'
+set load-balancing wan interface-health eth0 test 10 target '33.44.55.66'
+set load-balancing wan interface-health eth0 test 10 type 'ping'
+set load-balancing wan interface-health eth0 test 20 target '44.55.66.77'
+set load-balancing wan interface-health eth0 test 20 type 'ping'
+set load-balancing wan interface-health eth1 failure-count '4'
+set load-balancing wan interface-health eth1 nexthop '22.33.44.1'
+set load-balancing wan interface-health eth1 test 10 target '55.66.77.88'
+set load-balancing wan interface-health eth1 test 10 type 'ping'
+set load-balancing wan interface-health eth1 test 20 target '66.77.88.99'
+set load-balancing wan interface-health eth1 test 20 type 'ping'
+set load-balancing wan rule 10 inbound-interface 'eth2'
+set load-balancing wan rule 10 interface eth0
+set load-balancing wan rule 20 destination port 'sip'
+set load-balancing wan rule 20 inbound-interface 'eth2'
+set load-balancing wan rule 20 interface eth1
+set load-balancing wan rule 20 protocol 'tcp'
+set load-balancing wan rule 5 destination address '10.0.0.0/8'
+set load-balancing wan rule 5 exclude
+set load-balancing wan rule 5 inbound-interface 'eth+'
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '11.22.33.1'
+set protocols static route 33.44.55.66/32
+set protocols static route 33.44.55.66/32 next-hop '11.22.33.1'
+set protocols static route 44.55.66.77/32
+set protocols static route 44.55.66.77/32 next-hop '11.22.33.1'
+set protocols static route 55.66.77.88/32
+set protocols static route 55.66.77.88/32 next-hop '22.33.44.1'
+set protocols static route 66.77.88.99/32
+set protocols static route 66.77.88.99/32 next-hop '22.33.44.1'
+set system host-name r1
diff --git a/tests/render/cases/blueprints/wan_lb_example5_exclude/roles b/tests/render/cases/blueprints/wan_lb_example5_exclude/roles
new file mode 100644
index 0000000..c9221fb
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example5_exclude/roles
@@ -0,0 +1 @@
+base,wan_load_balance
diff --git a/tests/render/cases/blueprints/wan_lb_example5_exclude/vars.yml b/tests/render/cases/blueprints/wan_lb_example5_exclude/vars.yml
new file mode 100644
index 0000000..06ac0ea
--- /dev/null
+++ b/tests/render/cases/blueprints/wan_lb_example5_exclude/vars.yml
@@ -0,0 +1,38 @@
+---
+# docs.vyos.io/en/1.5/configexamples/wan-load-balancing.html - Example 5: Exclude traffic from load balancing
+# (the end state after applying the page's steps up to this example)
+base_hostname: r1
+base_static_routes:
+  - {dest: 33.44.55.66/32, next_hop: 11.22.33.1}
+  - {dest: 44.55.66.77/32, next_hop: 11.22.33.1}
+  - {dest: 55.66.77.88/32, next_hop: 22.33.44.1}
+  - {dest: 66.77.88.99/32, next_hop: 22.33.44.1}
+  - {dest: 0.0.0.0/0, next_hop: 11.22.33.1}
+wan_load_balance_interfaces:
+  - name: eth0
+    failure_count: 5
+    nexthop: 11.22.33.1
+    tests:
+      - {id: 10, type: ping, target: 33.44.55.66}
+      - {id: 20, type: ping, target: 44.55.66.77}
+  - name: eth1
+    failure_count: 4
+    nexthop: 22.33.44.1
+    tests:
+      - {id: 10, type: ping, target: 55.66.77.88}
+      - {id: 20, type: ping, target: 66.77.88.99}
+wan_load_balance_rules:
+  - number: 5
+    exclude: true
+    inbound_interface: eth+
+    destination: {address: 10.0.0.0/8}
+  - number: 10
+    inbound_interface: eth2
+    interfaces:
+      - {name: eth0}
+  - number: 20
+    inbound_interface: eth2
+    interfaces:
+      - {name: eth1}
+    destination: {port: sip}
+    protocol: tcp
diff --git a/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge1.txt b/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge1.txt
new file mode 100644
index 0000000..b30e862
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge1.txt
@@ -0,0 +1,63 @@
+set interfaces vti vti10 address '169.254.10.1/30'
+set interfaces vti vti10 description 'Google Cloud HA VPN tunnel 0'
+set interfaces vti vti10 ip adjust-mss '1350'
+set policy prefix-list GCP-IN
+set policy prefix-list GCP-IN rule 10
+set policy prefix-list GCP-IN rule 10 action 'permit'
+set policy prefix-list GCP-IN rule 10 prefix '10.70.0.0/20'
+set policy prefix-list GCP-OUT
+set policy prefix-list GCP-OUT rule 10
+set policy prefix-list GCP-OUT rule 10 action 'permit'
+set policy prefix-list GCP-OUT rule 10 prefix '10.80.0.0/24'
+set policy route-map GCP-IN rule 10 action permit
+set policy route-map GCP-IN rule 10 match ip address prefix-list GCP-IN
+set policy route-map GCP-IN rule 20 action deny
+set policy route-map GCP-OUT rule 10 action permit
+set policy route-map GCP-OUT rule 10 match ip address prefix-list GCP-OUT
+set policy route-map GCP-OUT rule 20 action deny
+set protocols bgp address-family ipv4-unicast network 10.80.0.0/24
+set protocols bgp neighbor 169.254.10.2 address-family ipv4-unicast route-map export GCP-OUT
+set protocols bgp neighbor 169.254.10.2 address-family ipv4-unicast route-map import GCP-IN
+set protocols bgp neighbor 169.254.10.2 address-family ipv4-unicast soft-reconfiguration inbound
+set protocols bgp neighbor 169.254.10.2 disable-connected-check
+set protocols bgp neighbor 169.254.10.2 remote-as 64514
+set protocols bgp neighbor 169.254.10.2 timers holdtime 30
+set protocols bgp neighbor 169.254.10.2 timers keepalive 10
+set protocols bgp parameters router-id 10.80.0.11
+set protocols bgp system-as 65010
+set protocols static route 169.254.10.2/32
+set protocols static route 169.254.10.2/32 interface 'vti10'
+set vpn ipsec authentication psk gcp-ha-vpn-0
+set vpn ipsec authentication psk gcp-ha-vpn-0 id 198.51.100.10
+set vpn ipsec authentication psk gcp-ha-vpn-0 id 203.0.113.10
+set vpn ipsec authentication psk gcp-ha-vpn-0 secret '********'
+set vpn ipsec esp-group GCP-ESP
+set vpn ipsec esp-group GCP-ESP lifetime 10800
+set vpn ipsec esp-group GCP-ESP mode tunnel
+set vpn ipsec esp-group GCP-ESP pfs dh-group14
+set vpn ipsec esp-group GCP-ESP proposal 10
+set vpn ipsec esp-group GCP-ESP proposal 10 encryption aes256
+set vpn ipsec esp-group GCP-ESP proposal 10 hash sha256
+set vpn ipsec ike-group GCP-IKE
+set vpn ipsec ike-group GCP-IKE dead-peer-detection action restart
+set vpn ipsec ike-group GCP-IKE dead-peer-detection interval 30
+set vpn ipsec ike-group GCP-IKE key-exchange ikev2
+set vpn ipsec ike-group GCP-IKE lifetime 36000
+set vpn ipsec ike-group GCP-IKE proposal 10
+set vpn ipsec ike-group GCP-IKE proposal 10 dh-group 14
+set vpn ipsec ike-group GCP-IKE proposal 10 encryption aes256
+set vpn ipsec ike-group GCP-IKE proposal 10 hash sha256
+set vpn ipsec ike-group GCP-IKE proposal 10 prf 'prfsha256'
+set vpn ipsec interface eth0
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec site-to-site peer gcp-ha-vpn-0
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 authentication local-id '198.51.100.10'
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 authentication remote-id '203.0.113.10'
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 connection-type 'initiate'
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 description 'Google Cloud HA VPN tunnel 0'
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 ike-group 'GCP-IKE'
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 local-address '198.51.100.10'
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 remote-address '203.0.113.10'
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 vti bind 'vti10'
+set vpn ipsec site-to-site peer gcp-ha-vpn-0 vti esp-group 'GCP-ESP'
diff --git a/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge2.txt b/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge2.txt
new file mode 100644
index 0000000..746a937
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_gcp_ha/expected/edge2.txt
@@ -0,0 +1,63 @@
+set interfaces vti vti11 address '169.254.10.5/30'
+set interfaces vti vti11 description 'Google Cloud HA VPN tunnel 1'
+set interfaces vti vti11 ip adjust-mss '1350'
+set policy prefix-list GCP-IN
+set policy prefix-list GCP-IN rule 10
+set policy prefix-list GCP-IN rule 10 action 'permit'
+set policy prefix-list GCP-IN rule 10 prefix '10.70.0.0/20'
+set policy prefix-list GCP-OUT
+set policy prefix-list GCP-OUT rule 10
+set policy prefix-list GCP-OUT rule 10 action 'permit'
+set policy prefix-list GCP-OUT rule 10 prefix '10.80.0.0/24'
+set policy route-map GCP-IN rule 10 action permit
+set policy route-map GCP-IN rule 10 match ip address prefix-list GCP-IN
+set policy route-map GCP-IN rule 20 action deny
+set policy route-map GCP-OUT rule 10 action permit
+set policy route-map GCP-OUT rule 10 match ip address prefix-list GCP-OUT
+set policy route-map GCP-OUT rule 20 action deny
+set protocols bgp address-family ipv4-unicast network 10.80.0.0/24
+set protocols bgp neighbor 169.254.10.6 address-family ipv4-unicast route-map export GCP-OUT
+set protocols bgp neighbor 169.254.10.6 address-family ipv4-unicast route-map import GCP-IN
+set protocols bgp neighbor 169.254.10.6 address-family ipv4-unicast soft-reconfiguration inbound
+set protocols bgp neighbor 169.254.10.6 disable-connected-check
+set protocols bgp neighbor 169.254.10.6 remote-as 64514
+set protocols bgp neighbor 169.254.10.6 timers holdtime 30
+set protocols bgp neighbor 169.254.10.6 timers keepalive 10
+set protocols bgp parameters router-id 10.80.0.12
+set protocols bgp system-as 65010
+set protocols static route 169.254.10.6/32
+set protocols static route 169.254.10.6/32 interface 'vti11'
+set vpn ipsec authentication psk gcp-ha-vpn-1
+set vpn ipsec authentication psk gcp-ha-vpn-1 id 198.51.100.11
+set vpn ipsec authentication psk gcp-ha-vpn-1 id 203.0.113.11
+set vpn ipsec authentication psk gcp-ha-vpn-1 secret '********'
+set vpn ipsec esp-group GCP-ESP
+set vpn ipsec esp-group GCP-ESP lifetime 10800
+set vpn ipsec esp-group GCP-ESP mode tunnel
+set vpn ipsec esp-group GCP-ESP pfs dh-group14
+set vpn ipsec esp-group GCP-ESP proposal 10
+set vpn ipsec esp-group GCP-ESP proposal 10 encryption aes256
+set vpn ipsec esp-group GCP-ESP proposal 10 hash sha256
+set vpn ipsec ike-group GCP-IKE
+set vpn ipsec ike-group GCP-IKE dead-peer-detection action restart
+set vpn ipsec ike-group GCP-IKE dead-peer-detection interval 30
+set vpn ipsec ike-group GCP-IKE key-exchange ikev2
+set vpn ipsec ike-group GCP-IKE lifetime 36000
+set vpn ipsec ike-group GCP-IKE proposal 10
+set vpn ipsec ike-group GCP-IKE proposal 10 dh-group 14
+set vpn ipsec ike-group GCP-IKE proposal 10 encryption aes256
+set vpn ipsec ike-group GCP-IKE proposal 10 hash sha256
+set vpn ipsec ike-group GCP-IKE proposal 10 prf 'prfsha256'
+set vpn ipsec interface eth0
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec site-to-site peer gcp-ha-vpn-1
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 authentication local-id '198.51.100.11'
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 authentication remote-id '203.0.113.11'
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 connection-type 'initiate'
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 description 'Google Cloud HA VPN tunnel 1'
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 ike-group 'GCP-IKE'
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 local-address '198.51.100.11'
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 remote-address '203.0.113.11'
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 vti bind 'vti11'
+set vpn ipsec site-to-site peer gcp-ha-vpn-1 vti esp-group 'GCP-ESP'
diff --git a/tests/render/cases/ipsec_route_based/docs_gcp_ha/inventory.yml b/tests/render/cases/ipsec_route_based/docs_gcp_ha/inventory.yml
new file mode 100644
index 0000000..fd64fa2
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_gcp_ha/inventory.yml
@@ -0,0 +1,75 @@
+---
+all:
+  hosts:
+    edge1:
+      ansible_host: 192.0.2.1
+      ipsec_route_based_peers:
+        - name: gcp-ha-vpn-0
+          description: Google Cloud HA VPN tunnel 0
+          psk_name: gcp-ha-vpn-0
+          psk: example-gcp-ha-vpn-psk-0
+          local_address: 198.51.100.10
+          remote_address: 203.0.113.10
+          connection_type: initiate
+          esp_group_on_vti: true
+          vti:
+            interface: vti10
+            address: 169.254.10.1/30
+            description: Google Cloud HA VPN tunnel 0
+            adjust_mss: '1350'
+      ipsec_route_based_interface_routes:
+        - dest: 169.254.10.2/32
+          interface: vti10
+      ipsec_route_based_bgp:
+        asn: 65010
+        router_id: 10.80.0.11
+        networks:
+          - 10.80.0.0/24
+        neighbors:
+          - address: 169.254.10.2
+            remote_as: 64514
+            holdtime: 30
+            keepalive: 10
+            disable_connected_check: true
+            soft_reconfiguration_inbound: true
+            route_map_import: GCP-IN
+            route_map_export: GCP-OUT
+    edge2:
+      ansible_host: 192.0.2.2
+      ipsec_route_based_peers:
+        - name: gcp-ha-vpn-1
+          description: Google Cloud HA VPN tunnel 1
+          psk_name: gcp-ha-vpn-1
+          psk: example-gcp-ha-vpn-psk-1
+          local_address: 198.51.100.11
+          remote_address: 203.0.113.11
+          connection_type: initiate
+          esp_group_on_vti: true
+          vti:
+            interface: vti11
+            address: 169.254.10.5/30
+            description: Google Cloud HA VPN tunnel 1
+            adjust_mss: '1350'
+      ipsec_route_based_interface_routes:
+        - dest: 169.254.10.6/32
+          interface: vti11
+      ipsec_route_based_bgp:
+        asn: 65010
+        router_id: 10.80.0.12
+        networks:
+          - 10.80.0.0/24
+        neighbors:
+          - address: 169.254.10.6
+            remote_as: 64514
+            holdtime: 30
+            keepalive: 10
+            disable_connected_check: true
+            soft_reconfiguration_inbound: true
+            route_map_import: GCP-IN
+            route_map_export: GCP-OUT
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/ipsec_route_based/docs_gcp_ha/vars.yml b/tests/render/cases/ipsec_route_based/docs_gcp_ha/vars.yml
new file mode 100644
index 0000000..d84ed63
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_gcp_ha/vars.yml
@@ -0,0 +1,29 @@
+---
+# docs.vyos.io/en/1.5/configexamples/gcp-ha-vpn-bgp.html - shared by both edges
+ipsec_route_based_ike_group:
+  name: GCP-IKE
+  key_exchange: ikev2
+  lifetime: 36000
+  proposal_id: 10
+  dh_group: 14
+  encryption: aes256
+  hash: sha256
+  prf: prfsha256
+  dead_peer_detection: {action: restart, interval: 30}
+ipsec_route_based_esp_group:
+  name: GCP-ESP
+  lifetime: 10800
+  mode: tunnel
+  pfs: dh-group14
+  proposal_id: 10
+  encryption: aes256
+  hash: sha256
+ipsec_route_based_interfaces: [eth0]
+ipsec_route_based_disable_route_autoinstall: true
+ipsec_route_based_policy:
+  prefix_lists:
+    - {name: GCP-IN, rules: [{sequence: 10, action: permit, prefix: 10.70.0.0/20}]}
+    - {name: GCP-OUT, rules: [{sequence: 10, action: permit, prefix: 10.80.0.0/24}]}
+  route_maps:
+    - {name: GCP-IN, rules: [{sequence: 10, action: permit, prefix_list: GCP-IN}, {sequence: 20, action: deny}]}
+    - {name: GCP-OUT, rules: [{sequence: 10, action: permit, prefix_list: GCP-OUT}, {sequence: 20, action: deny}]}
diff --git a/tests/render/cases/wireguard/keys_masked/expected/r1.txt b/tests/render/cases/wireguard/keys_masked/expected/r1.txt
new file mode 100644
index 0000000..12418d7
--- /dev/null
+++ b/tests/render/cases/wireguard/keys_masked/expected/r1.txt
@@ -0,0 +1,9 @@
+set interfaces wireguard wg01 address '10.254.60.1/30'
+set interfaces wireguard wg01 peer OFFSITE1 address '203.0.113.3'
+set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0'
+set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15'
+set interfaces wireguard wg01 peer OFFSITE1 port '50001'
+set interfaces wireguard wg01 peer OFFSITE1 preshared-key '********'
+set interfaces wireguard wg01 peer OFFSITE1 public-key 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o='
+set interfaces wireguard wg01 port '50001'
+set interfaces wireguard wg01 private-key '********'
diff --git a/tests/render/cases/wireguard/keys_masked/vars.yml b/tests/render/cases/wireguard/keys_masked/vars.yml
new file mode 100644
index 0000000..03b0277
--- /dev/null
+++ b/tests/render/cases/wireguard/keys_masked/vars.yml
@@ -0,0 +1,15 @@
+---
+# Guards key masking: private and preshared keys must render as '********'.
+wireguard_interfaces:
+  - name: wg01
+    addresses: [10.254.60.1/30]
+    port: 50001
+    private_key: LAB-ONLY-NOT-A-REAL-PRIVATE-KEY
+    peers:
+      - name: OFFSITE1
+        public_key: GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=
+        allowed_ips: [0.0.0.0/0]
+        address: 203.0.113.3
+        port: 50001
+        persistent_keepalive: 15
+        preshared_key: LAB-ONLY-NOT-A-REAL-PSK
diff --git a/tests/render/render.yml b/tests/render/render.yml
index 3c86b41..1e0bd21 100644
--- a/tests/render/render.yml
+++ b/tests/render/render.yml
@@ -10,7 +10,7 @@
         name: "vyos.blueprints.{{ item }}"
       vars:
         vyos_blueprints_render_only: true
-      loop: "{{ roles.split(',') if roles | default('') | length > 0 else [role] }}"
+      loop: "{{ render_roles.split(',') if render_roles | default('') | length > 0 else [role] }}"
 
     - name: Normalise rendered commands
       ansible.builtin.set_fact:
diff --git a/tests/render/run.sh b/tests/render/run.sh
index eaad5f6..ed8af74 100755
--- a/tests/render/run.sh
+++ b/tests/render/run.sh
@@ -26,7 +26,7 @@ for case_dir in "$here"/cases/*/*/; do
         -e "role=$role" -e "case_dir=$case_dir" -e "update_golden=$update")
   [[ -f "$case_dir/vars.yml" ]] && args+=(-e "@$case_dir/vars.yml")
   # Blueprints that combine roles list them, comma-separated, in a "roles" file.
-  [[ -f "$case_dir/roles" ]] && args+=(-e "roles=$(tr -d '[:space:]' < "$case_dir/roles")")
+  [[ -f "$case_dir/roles" ]] && args+=(-e "render_roles=$(tr -d '[:space:]' < "$case_dir/roles")")
   mkdir -p "$case_dir/expected"
   echo "=== $role/$name"
   if ! ansible-playbook "${args[@]}"; then