T9393: new rolesmain

author: omnom62 <omnom62@outlook.com> 2026-10-05 20:56:05 +1000
committer: omnom62 <omnom62@outlook.com> 2026-10-05 20:56:05 +1000
commit: 8ee802e41374942965b6b93cfb4534725ef45145 (patch)
tree: ef3e5579bd767422caa6fe77cea6a7b5d2d8562c /tests
parent: 748df2bc1d35fa285dd3fe46916e1230408778c7 (diff)
download: vyos.blueprints-main.tar.gz
vyos.blueprints-main.zip
32 files changed, 1752 insertions, 4 deletions
diff --git a/tests/render/cases/bgp_unnumbered/docs_two_routers/expected/routerA.txt b/tests/render/cases/bgp_unnumbered/docs_two_routers/expected/routerA.txt
new file mode 100644
index 0000000..9e27ddc
--- /dev/null
+++ b/tests/render/cases/bgp_unnumbered/docs_two_routers/expected/routerA.txt
@@ -0,0 +1,16 @@
+set interfaces loopback lo address '192.168.0.1/32'
+set protocols bgp address-family ipv4-unicast redistribute connected
+set protocols bgp address-family ipv6-unicast redistribute connected
+set protocols bgp neighbor eth1 interface v6only
+set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
+set protocols bgp neighbor eth2 interface v6only
+set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
+set protocols bgp parameters bestpath as-path multipath-relax
+set protocols bgp parameters bestpath compare-routerid
+set protocols bgp parameters default no-ipv4-unicast
+set protocols bgp parameters router-id 192.168.0.1
+set protocols bgp peer-group fabric address-family ipv4-unicast
+set protocols bgp peer-group fabric address-family ipv6-unicast
+set protocols bgp peer-group fabric capability extended-nexthop
+set protocols bgp peer-group fabric remote-as 'external'
+set protocols bgp system-as 64496
diff --git a/tests/render/cases/bgp_unnumbered/docs_two_routers/expected/routerB.txt b/tests/render/cases/bgp_unnumbered/docs_two_routers/expected/routerB.txt
new file mode 100644
index 0000000..05ae943
--- /dev/null
+++ b/tests/render/cases/bgp_unnumbered/docs_two_routers/expected/routerB.txt
@@ -0,0 +1,16 @@
+set interfaces loopback lo address '192.168.0.2/32'
+set protocols bgp address-family ipv4-unicast redistribute connected
+set protocols bgp address-family ipv6-unicast redistribute connected
+set protocols bgp neighbor eth1 interface v6only
+set protocols bgp neighbor eth1 interface v6only peer-group 'fabric'
+set protocols bgp neighbor eth2 interface v6only
+set protocols bgp neighbor eth2 interface v6only peer-group 'fabric'
+set protocols bgp parameters bestpath as-path multipath-relax
+set protocols bgp parameters bestpath compare-routerid
+set protocols bgp parameters default no-ipv4-unicast
+set protocols bgp parameters router-id 192.168.0.2
+set protocols bgp peer-group fabric address-family ipv4-unicast
+set protocols bgp peer-group fabric address-family ipv6-unicast
+set protocols bgp peer-group fabric capability extended-nexthop
+set protocols bgp peer-group fabric remote-as 'external'
+set protocols bgp system-as 64499
diff --git a/tests/render/cases/bgp_unnumbered/docs_two_routers/inventory.yml b/tests/render/cases/bgp_unnumbered/docs_two_routers/inventory.yml
new file mode 100644
index 0000000..ee03ea7
--- /dev/null
+++ b/tests/render/cases/bgp_unnumbered/docs_two_routers/inventory.yml
@@ -0,0 +1,19 @@
+---
+all:
+  children:
+    fabric:
+      hosts:
+        routerA:
+          ansible_host: 192.0.2.1
+          bgp_unnumbered_asn: 64496
+          bgp_unnumbered_router_id: 192.168.0.1
+        routerB:
+          ansible_host: 192.0.2.2
+          bgp_unnumbered_asn: 64499
+          bgp_unnumbered_router_id: 192.168.0.2
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/bgp_unnumbered/docs_two_routers/vars.yml b/tests/render/cases/bgp_unnumbered/docs_two_routers/vars.yml
new file mode 100644
index 0000000..7b92717
--- /dev/null
+++ b/tests/render/cases/bgp_unnumbered/docs_two_routers/vars.yml
@@ -0,0 +1,3 @@
+---
+# docs.vyos.io/en/1.5/configexamples/bgp-ipv6-unnumbered.html - shared settings
+bgp_unnumbered_interfaces: [eth1, eth2]
diff --git a/tests/render/cases/blueprints/flexvpn_cisco/expected/r1.txt b/tests/render/cases/blueprints/flexvpn_cisco/expected/r1.txt
new file mode 100644
index 0000000..2dbd927
--- /dev/null
+++ b/tests/render/cases/blueprints/flexvpn_cisco/expected/r1.txt
@@ -0,0 +1,42 @@
+set interfaces tunnel tun1 encapsulation 'gre'
+set interfaces tunnel tun1 ip adjust-mss '1336'
+set interfaces tunnel tun1 mtu '1376'
+set interfaces tunnel tun1 remote '10.1.1.6'
+set interfaces tunnel tun1 source-address '198.51.100.1'
+set vpn ipsec authentication psk vyos_cisco_l
+set vpn ipsec authentication psk vyos_cisco_l ******** '********'
+set vpn ipsec authentication psk vyos_cisco_l id cisco.hub.net
+set vpn ipsec authentication psk vyos_cisco_l id vyos.net
+set vpn ipsec esp-group e1
+set vpn ipsec esp-group e1 lifetime 3600
+set vpn ipsec esp-group e1 mode tunnel
+set vpn ipsec esp-group e1 pfs disable
+set vpn ipsec esp-group e1 proposal 1
+set vpn ipsec esp-group e1 proposal 1 encryption aes128
+set vpn ipsec esp-group e1 proposal 1 hash sha256
+set vpn ipsec ike-group i1
+set vpn ipsec ike-group i1 key-exchange ikev2
+set vpn ipsec ike-group i1 lifetime 28800
+set vpn ipsec ike-group i1 proposal 1
+set vpn ipsec ike-group i1 proposal 1 dh-group 5
+set vpn ipsec ike-group i1 proposal 1 encryption aes256
+set vpn ipsec ike-group i1 proposal 1 hash sha256
+set vpn ipsec interface eth2
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec options flexvpn
+set vpn ipsec options interface tun1
+set vpn ipsec options virtual-ip
+set vpn ipsec site-to-site peer cisco_hub
+set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net'
+set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net'
+set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate'
+set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1'
+set vpn ipsec site-to-site peer cisco_hub ike-group 'i1'
+set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1'
+set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre'
+set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32'
+set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0'
diff --git a/tests/render/cases/blueprints/flexvpn_cisco/roles b/tests/render/cases/blueprints/flexvpn_cisco/roles
new file mode 100644
index 0000000..2a14e05
--- /dev/null
+++ b/tests/render/cases/blueprints/flexvpn_cisco/roles
@@ -0,0 +1 @@
+gre_tunnel,ipsec_policy_based
diff --git a/tests/render/cases/blueprints/flexvpn_cisco/vars.yml b/tests/render/cases/blueprints/flexvpn_cisco/vars.yml
new file mode 100644
index 0000000..ed7c51b
--- /dev/null
+++ b/tests/render/cases/blueprints/flexvpn_cisco/vars.yml
@@ -0,0 +1,46 @@
+---
+# docs.vyos.io/en/1.5/configexamples/site-2-site-cisco.html - VyOS side
+# The page's PSK is the word "secret". Ansible masks every occurrence of a
+# no_log value, so the golden file shows the PSK line as "******** ********".
+gre_tunnel_interfaces:
+  - name: tun1
+    encapsulation: gre
+    adjust_mss: "1336"
+    mtu: 1376
+    remote: 10.1.1.6
+    source_address: 198.51.100.1
+
+ipsec_policy_based_peers:
+  - name: cisco_hub
+    psk_name: vyos_cisco_l
+    psk: secret
+    local_address: 198.51.100.1
+    remote_address: 10.1.1.6
+    local_id: vyos.net
+    remote_id: cisco.hub.net
+    connection_type: initiate
+    virtual_address: 0.0.0.0
+    tunnels:
+      - {id: 1, local_prefix: 198.51.100.1/32, remote_prefix: 10.1.1.6/32, protocol: gre}
+ipsec_policy_based_ike_group:
+  name: i1
+  key_exchange: ikev2
+  lifetime: 28800
+  proposal_id: 1
+  dh_group: 5
+  encryption: aes256
+  hash: sha256
+ipsec_policy_based_esp_group:
+  name: e1
+  lifetime: 3600
+  mode: tunnel
+  pfs: disable
+  proposal_id: 1
+  encryption: aes128
+  hash: sha256
+ipsec_policy_based_interfaces: [eth2]
+ipsec_policy_based_options:
+  disable_route_autoinstall: true
+  flexvpn: true
+  interface: tun1
+  virtual_ip: true
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/expected/LEFT.txt b/tests/render/cases/blueprints/policy_ipsec_firewall/expected/LEFT.txt
new file mode 100644
index 0000000..0f05a70
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/expected/LEFT.txt
@@ -0,0 +1,100 @@
+set firewall group network-group LOCAL-NETS
+set firewall group network-group LOCAL-NETS network 10.1.11.0/24
+set firewall group network-group LOCAL-NETS network 10.1.12.0/24
+set firewall group network-group REMOTE-NETS
+set firewall group network-group REMOTE-NETS network 10.2.21.0/24
+set firewall group network-group REMOTE-NETS network 10.2.22.0/24
+set firewall group network-group TRUSTED
+set firewall group network-group TRUSTED network 10.1.11.0/24
+set firewall group network-group TRUSTED network 192.168.70.0/24
+set firewall group network-group TRUSTED network 198.51.100.125/32
+set firewall group network-group TRUSTED network 203.0.113.0/24
+set firewall ipv4 forward filter default-action 'drop'
+set firewall ipv4 forward filter rule 1
+set firewall ipv4 forward filter rule 1 action 'accept'
+set firewall ipv4 forward filter rule 1 state established
+set firewall ipv4 forward filter rule 1 state related
+set firewall ipv4 forward filter rule 10
+set firewall ipv4 forward filter rule 10 action 'accept'
+set firewall ipv4 forward filter rule 10 source group network-group LOCAL-NETS
+set firewall ipv4 forward filter rule 2
+set firewall ipv4 forward filter rule 2 action 'drop'
+set firewall ipv4 forward filter rule 2 state invalid
+set firewall ipv4 forward filter rule 20
+set firewall ipv4 forward filter rule 20 action 'accept'
+set firewall ipv4 forward filter rule 20 destination group network-group LOCAL-NETS
+set firewall ipv4 forward filter rule 20 source group network-group REMOTE-NETS
+set firewall ipv4 input filter default-action 'drop'
+set firewall ipv4 input filter rule 1
+set firewall ipv4 input filter rule 1 action 'accept'
+set firewall ipv4 input filter rule 1 state established
+set firewall ipv4 input filter rule 1 state related
+set firewall ipv4 input filter rule 10
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 10 destination port 500,4500
+set firewall ipv4 input filter rule 10 inbound-interface name eth0
+set firewall ipv4 input filter rule 10 protocol 'udp'
+set firewall ipv4 input filter rule 15
+set firewall ipv4 input filter rule 15 action 'accept'
+set firewall ipv4 input filter rule 15 inbound-interface name eth0
+set firewall ipv4 input filter rule 15 protocol 'esp'
+set firewall ipv4 input filter rule 2
+set firewall ipv4 input filter rule 2 action 'drop'
+set firewall ipv4 input filter rule 2 state invalid
+set firewall ipv4 input filter rule 20
+set firewall ipv4 input filter rule 20 action 'accept'
+set firewall ipv4 input filter rule 20 destination port 22
+set firewall ipv4 input filter rule 20 protocol 'tcp'
+set firewall ipv4 input filter rule 20 source group network-group TRUSTED
+set firewall ipv4 input filter rule 25
+set firewall ipv4 input filter rule 25 action 'accept'
+set firewall ipv4 input filter rule 25 destination port 53
+set firewall ipv4 input filter rule 25 protocol 'udp'
+set firewall ipv4 input filter rule 25 source group network-group LOCAL-NETS
+set firewall ipv4 input filter rule 30
+set firewall ipv4 input filter rule 30 action 'accept'
+set firewall ipv4 input filter rule 30 protocol 'icmp'
+set nat source rule 10 destination group network-group REMOTE-NETS
+set nat source rule 10 exclude
+set nat source rule 10 outbound-interface name eth0
+set nat source rule 10 source group network-group LOCAL-NETS
+set nat source rule 20 outbound-interface name eth0
+set nat source rule 20 source group network-group LOCAL-NETS
+set nat source rule 20 translation address masquerade
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '198.51.100.13'
+set vpn ipsec authentication psk RIGHT
+set vpn ipsec authentication psk RIGHT id 192.0.2.130
+set vpn ipsec authentication psk RIGHT id 198.51.100.14
+set vpn ipsec authentication psk RIGHT secret '********'
+set vpn ipsec esp-group ESP-GROUP
+set vpn ipsec esp-group ESP-GROUP mode tunnel
+set vpn ipsec esp-group ESP-GROUP proposal 1
+set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes256
+set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha256
+set vpn ipsec ike-group IKE-GROUP
+set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
+set vpn ipsec ike-group IKE-GROUP proposal 1
+set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group 14
+set vpn ipsec ike-group IKE-GROUP proposal 1 encryption aes256
+set vpn ipsec ike-group IKE-GROUP proposal 1 hash sha256
+set vpn ipsec interface eth0
+set vpn ipsec site-to-site peer RIGHT
+set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer RIGHT connection-type 'initiate'
+set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14'
+set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130'
+set vpn ipsec site-to-site peer RIGHT tunnel 0
+set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 1
+set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 2
+set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 3
+set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24'
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/expected/RIGHT.txt b/tests/render/cases/blueprints/policy_ipsec_firewall/expected/RIGHT.txt
new file mode 100644
index 0000000..547e447
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/expected/RIGHT.txt
@@ -0,0 +1,35 @@
+set vpn ipsec authentication psk LEFT
+set vpn ipsec authentication psk LEFT id 192.0.2.130
+set vpn ipsec authentication psk LEFT id 198.51.100.14
+set vpn ipsec authentication psk LEFT secret '********'
+set vpn ipsec esp-group ESP-GROUP
+set vpn ipsec esp-group ESP-GROUP mode tunnel
+set vpn ipsec esp-group ESP-GROUP proposal 1
+set vpn ipsec esp-group ESP-GROUP proposal 1 encryption aes256
+set vpn ipsec esp-group ESP-GROUP proposal 1 hash sha256
+set vpn ipsec ike-group IKE-GROUP
+set vpn ipsec ike-group IKE-GROUP key-exchange ikev2
+set vpn ipsec ike-group IKE-GROUP proposal 1
+set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group 14
+set vpn ipsec ike-group IKE-GROUP proposal 1 encryption aes256
+set vpn ipsec ike-group IKE-GROUP proposal 1 hash sha256
+set vpn ipsec interface eth0
+set vpn ipsec site-to-site peer LEFT
+set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer LEFT connection-type 'none'
+set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130'
+set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14'
+set vpn ipsec site-to-site peer LEFT tunnel 0
+set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 1
+set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 2
+set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 3
+set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24'
+set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24'
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/inventory.yml b/tests/render/cases/blueprints/policy_ipsec_firewall/inventory.yml
new file mode 100644
index 0000000..42adead
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/inventory.yml
@@ -0,0 +1,67 @@
+---
+all:
+  hosts:
+    LEFT:
+      ansible_host: 192.0.2.1
+      ipsec_policy_based_peers:
+        - name: RIGHT
+          psk_name: RIGHT
+          psk: p4ssw0rd
+          authentication_ids: false
+          local_address: 198.51.100.14
+          remote_address: 192.0.2.130
+          connection_type: initiate
+          tunnels:
+            - {id: 0, local_prefix: 10.1.11.0/24, remote_prefix: 10.2.21.0/24}
+            - {id: 1, local_prefix: 10.1.11.0/24, remote_prefix: 10.2.22.0/24}
+            - {id: 2, local_prefix: 10.1.12.0/24, remote_prefix: 10.2.21.0/24}
+            - {id: 3, local_prefix: 10.1.12.0/24, remote_prefix: 10.2.22.0/24}
+      ipsec_policy_based_default_gateway: 198.51.100.13
+      # Firewall and NAT exist only on LEFT, as on the page
+      firewall_groups:
+        network:
+          - {name: LOCAL-NETS, networks: [10.1.11.0/24, 10.1.12.0/24]}
+          - {name: REMOTE-NETS, networks: [10.2.21.0/24, 10.2.22.0/24]}
+          - {name: TRUSTED, networks: [198.51.100.125/32, 203.0.113.0/24, 10.1.11.0/24, 192.168.70.0/24]}
+      firewall_ipv4:
+        forward:
+          default_action: drop
+          rules:
+            - {number: 1, action: accept, state: {established: true, related: true}}
+            - {number: 2, action: drop, state: {invalid: true}}
+            - {number: 10, action: accept, source: {group: {network_group: LOCAL-NETS}}}
+            - {number: 20, action: accept, source: {group: {network_group: REMOTE-NETS}}, destination: {group: {network_group: LOCAL-NETS}}}
+        input:
+          default_action: drop
+          rules:
+            - {number: 1, action: accept, state: {established: true, related: true}}
+            - {number: 2, action: drop, state: {invalid: true}}
+            - {number: 10, action: accept, protocol: udp, destination: {port: "500,4500"}, inbound_interface: {name: eth0}}
+            - {number: 15, action: accept, protocol: esp, inbound_interface: {name: eth0}}
+            - {number: 20, action: accept, protocol: tcp, destination: {port: "22"}, source: {group: {network_group: TRUSTED}}}
+            - {number: 25, action: accept, protocol: udp, destination: {port: "53"}, source: {group: {network_group: LOCAL-NETS}}}
+            - {number: 30, action: accept, protocol: icmp}
+      nat_source_rules:
+        - {id: 10, exclude: true, outbound_interface: {name: eth0}, source: {network_group: LOCAL-NETS}, destination: {network_group: REMOTE-NETS}}
+        - {id: 20, outbound_interface: {name: eth0}, source: {network_group: LOCAL-NETS}, translation: {address: masquerade}}
+    RIGHT:
+      ansible_host: 192.0.2.2
+      ipsec_policy_based_peers:
+        - name: LEFT
+          psk_name: LEFT
+          psk: p4ssw0rd
+          authentication_ids: false
+          local_address: 192.0.2.130
+          remote_address: 198.51.100.14
+          connection_type: none
+          tunnels:
+            - {id: 0, local_prefix: 10.2.21.0/24, remote_prefix: 10.1.11.0/24}
+            - {id: 1, local_prefix: 10.2.22.0/24, remote_prefix: 10.1.11.0/24}
+            - {id: 2, local_prefix: 10.2.21.0/24, remote_prefix: 10.1.12.0/24}
+            - {id: 3, local_prefix: 10.2.22.0/24, remote_prefix: 10.1.12.0/24}
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/roles b/tests/render/cases/blueprints/policy_ipsec_firewall/roles
new file mode 100644
index 0000000..21fdad9
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/roles
@@ -0,0 +1 @@
+ipsec_policy_based,firewall,nat
diff --git a/tests/render/cases/blueprints/policy_ipsec_firewall/vars.yml b/tests/render/cases/blueprints/policy_ipsec_firewall/vars.yml
new file mode 100644
index 0000000..9296601
--- /dev/null
+++ b/tests/render/cases/blueprints/policy_ipsec_firewall/vars.yml
@@ -0,0 +1,17 @@
+---
+# docs.vyos.io/en/1.5/configexamples/policy-based-ipsec-and-firewall.html
+# Shared IPsec settings, as on the page (both routers)
+ipsec_policy_based_ike_group:
+  name: IKE-GROUP
+  key_exchange: ikev2
+  proposal_id: 1
+  dh_group: 14
+  encryption: aes256
+  hash: sha256
+ipsec_policy_based_esp_group:
+  name: ESP-GROUP
+  mode: tunnel
+  proposal_id: 1
+  encryption: aes256
+  hash: sha256
+ipsec_policy_based_interfaces: [eth0]
diff --git a/tests/render/cases/bridge_firewall/docs_three_bridges/expected/r1.txt b/tests/render/cases/bridge_firewall/docs_three_bridges/expected/r1.txt
new file mode 100644
index 0000000..e9b871a
--- /dev/null
+++ b/tests/render/cases/bridge_firewall/docs_three_bridges/expected/r1.txt
@@ -0,0 +1,159 @@
+set firewall bridge forward filter default-action 'drop'
+set firewall bridge forward filter rule 10 action 'drop'
+set firewall bridge forward filter rule 10 state 'invalid'
+set firewall bridge forward filter rule 110 action 'jump'
+set firewall bridge forward filter rule 110 description 'br0 traffic'
+set firewall bridge forward filter rule 110 inbound-interface group 'br0-ifaces'
+set firewall bridge forward filter rule 110 jump-target 'br0-fwd'
+set firewall bridge forward filter rule 120 action 'jump'
+set firewall bridge forward filter rule 120 description 'br1 traffic'
+set firewall bridge forward filter rule 120 inbound-interface group 'br1-ifaces'
+set firewall bridge forward filter rule 120 jump-target 'br1-fwd'
+set firewall bridge forward filter rule 130 action 'jump'
+set firewall bridge forward filter rule 130 description 'br2 traffic'
+set firewall bridge forward filter rule 130 inbound-interface group 'br2-ifaces'
+set firewall bridge forward filter rule 130 jump-target 'br2-fwd'
+set firewall bridge forward filter rule 5 action 'accept'
+set firewall bridge forward filter rule 5 state 'established'
+set firewall bridge forward filter rule 5 state 'related'
+set firewall bridge name br0-fwd default-action 'accept'
+set firewall bridge name br0-pre default-action 'drop'
+set firewall bridge name br0-pre rule 10 action 'accept'
+set firewall bridge name br0-pre rule 10 description 'Accept IPv6 traffic'
+set firewall bridge name br0-pre rule 10 ethernet-type 'ipv6'
+set firewall bridge name br1-fwd default-action 'drop'
+set firewall bridge name br1-fwd rule 10 action 'accept'
+set firewall bridge name br1-fwd rule 10 description 'Accept ARP'
+set firewall bridge name br1-fwd rule 10 ethernet-type 'arp'
+set firewall bridge name br1-fwd rule 20 action 'accept'
+set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host'
+set firewall bridge name br1-fwd rule 20 source address '10.1.1.102'
+set firewall bridge name br1-fwd rule 20 state 'new'
+set firewall bridge name br1-pre default-action 'accept'
+set firewall bridge name br1-pre rule 10 action 'drop'
+set firewall bridge name br1-pre rule 10 description 'Drop DHCP discover'
+set firewall bridge name br1-pre rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
+set firewall bridge name br1-pre rule 10 destination port '67'
+set firewall bridge name br1-pre rule 10 log
+set firewall bridge name br1-pre rule 10 protocol 'udp'
+set firewall bridge name br1-pre rule 10 source port '68'
+set firewall bridge name br1-pre rule 20 action 'drop'
+set firewall bridge name br1-pre rule 20 description 'Drop IPv6 traffic'
+set firewall bridge name br1-pre rule 20 ethernet-type 'ipv6'
+set firewall bridge name br2-fwd default-action 'drop'
+set firewall bridge name br2-fwd rule 10 action 'accept'
+set firewall bridge name br2-fwd rule 10 description 'Accept DHCP discover'
+set firewall bridge name br2-fwd rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff'
+set firewall bridge name br2-fwd rule 10 destination port '67'
+set firewall bridge name br2-fwd rule 10 protocol 'udp'
+set firewall bridge name br2-fwd rule 10 source port '68'
+set firewall bridge name br2-fwd rule 20 action 'accept'
+set firewall bridge name br2-fwd rule 20 description 'Accept DHCP offers from trusted interface'
+set firewall bridge name br2-fwd rule 20 destination port '68'
+set firewall bridge name br2-fwd rule 20 inbound-interface name 'eth6'
+set firewall bridge name br2-fwd rule 20 protocol 'udp'
+set firewall bridge name br2-fwd rule 20 source port '67'
+set firewall bridge name br2-fwd rule 22 action 'drop'
+set firewall bridge name br2-fwd rule 22 description 'Drop all other DHCP offers'
+set firewall bridge name br2-fwd rule 22 destination port '68'
+set firewall bridge name br2-fwd rule 22 log
+set firewall bridge name br2-fwd rule 22 protocol 'udp'
+set firewall bridge name br2-fwd rule 22 source port '67'
+set firewall bridge name br2-fwd rule 30 action 'accept'
+set firewall bridge name br2-fwd rule 30 description 'Accept ARP'
+set firewall bridge name br2-fwd rule 30 ethernet-type 'arp'
+set firewall bridge name br2-fwd rule 40 action 'accept'
+set firewall bridge name br2-fwd rule 40 description 'Accept ipv4'
+set firewall bridge name br2-fwd rule 40 ethernet-type 'ipv4'
+set firewall bridge name br2-pre default-action 'accept'
+set firewall bridge name br2-pre rule 10 action 'drop'
+set firewall bridge name br2-pre rule 10 description 'Drop IPv6 traffic'
+set firewall bridge name br2-pre rule 10 ethernet-type 'ipv6'
+set firewall bridge prerouting filter rule 10 action 'jump'
+set firewall bridge prerouting filter rule 10 description 'br0 traffic'
+set firewall bridge prerouting filter rule 10 inbound-interface group 'br0-ifaces'
+set firewall bridge prerouting filter rule 10 jump-target 'br0-pre'
+set firewall bridge prerouting filter rule 20 action 'jump'
+set firewall bridge prerouting filter rule 20 description 'br1 traffic'
+set firewall bridge prerouting filter rule 20 inbound-interface group 'br1-ifaces'
+set firewall bridge prerouting filter rule 20 jump-target 'br1-pre'
+set firewall bridge prerouting filter rule 30 action 'jump'
+set firewall bridge prerouting filter rule 30 description 'br2 traffic'
+set firewall bridge prerouting filter rule 30 inbound-interface group 'br2-ifaces'
+set firewall bridge prerouting filter rule 30 jump-target 'br2-pre'
+set firewall group interface-group br0-ifaces interface 'br0'
+set firewall group interface-group br0-ifaces interface 'eth1'
+set firewall group interface-group br0-ifaces interface 'eth2'
+set firewall group interface-group br1-ifaces interface 'br1'
+set firewall group interface-group br1-ifaces interface 'eth3'
+set firewall group interface-group br1-ifaces interface 'eth4'
+set firewall group interface-group br2-ifaces interface 'br2'
+set firewall group interface-group br2-ifaces interface 'eth5'
+set firewall group interface-group br2-ifaces interface 'eth6'
+set firewall group interface-group br2-ifaces interface 'eth7'
+set firewall ipv4 forward filter default-action 'drop'
+set firewall ipv4 forward filter rule 10
+set firewall ipv4 forward filter rule 10 action 'drop'
+set firewall ipv4 forward filter rule 10 state invalid
+set firewall ipv4 forward filter rule 110
+set firewall ipv4 forward filter rule 110 action 'jump'
+set firewall ipv4 forward filter rule 110 description 'br1 traffic'
+set firewall ipv4 forward filter rule 110 inbound-interface group br1-ifaces
+set firewall ipv4 forward filter rule 110 jump-target 'ip-br1-fwd'
+set firewall ipv4 forward filter rule 120
+set firewall ipv4 forward filter rule 120 action 'jump'
+set firewall ipv4 forward filter rule 120 description 'br2 traffic'
+set firewall ipv4 forward filter rule 120 inbound-interface group br2-ifaces
+set firewall ipv4 forward filter rule 120 jump-target 'ip-br2-fwd'
+set firewall ipv4 forward filter rule 5
+set firewall ipv4 forward filter rule 5 action 'accept'
+set firewall ipv4 forward filter rule 5 state established
+set firewall ipv4 forward filter rule 5 state related
+set firewall ipv4 input filter rule 10
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 10 state established
+set firewall ipv4 input filter rule 10 state related
+set firewall ipv4 input filter rule 110
+set firewall ipv4 input filter rule 110 action 'accept'
+set firewall ipv4 input filter rule 110 description 'Accept access from br1'
+set firewall ipv4 input filter rule 110 inbound-interface group br1-ifaces
+set firewall ipv4 input filter rule 120
+set firewall ipv4 input filter rule 120 action 'drop'
+set firewall ipv4 input filter rule 120 description 'Deny access from br2'
+set firewall ipv4 input filter rule 120 inbound-interface group br2-ifaces
+set firewall ipv4 input filter rule 20
+set firewall ipv4 input filter rule 20 action 'drop'
+set firewall ipv4 input filter rule 20 state invalid
+set firewall ipv4 name ip-br1-fwd default-action 'drop'
+set firewall ipv4 name ip-br1-fwd rule 10
+set firewall ipv4 name ip-br1-fwd rule 10 action 'accept'
+set firewall ipv4 name ip-br1-fwd rule 10 description 'br1 - allow internet access'
+set firewall ipv4 name ip-br1-fwd rule 10 outbound-interface name eth0
+set firewall ipv4 name ip-br2-fwd default-action 'drop'
+set firewall ipv4 name ip-br2-fwd rule 10
+set firewall ipv4 name ip-br2-fwd rule 10 action 'accept'
+set firewall ipv4 name ip-br2-fwd rule 10 description 'br2 - allow internet access'
+set firewall ipv4 name ip-br2-fwd rule 10 outbound-interface name eth0
+set firewall ipv4 name ip-br2-fwd rule 20
+set firewall ipv4 name ip-br2-fwd rule 20 action 'accept'
+set firewall ipv4 name ip-br2-fwd rule 20 description 'br2 - allow access to br1'
+set firewall ipv4 name ip-br2-fwd rule 20 outbound-interface group br1-ifaces
+set interfaces bridge br0 description 'Isolated L2 bridge'
+set interfaces bridge br0 member interface eth1
+set interfaces bridge br0 member interface eth2
+set interfaces bridge br1 address '10.1.1.1/24'
+set interfaces bridge br1 description 'L3 bridge br1'
+set interfaces bridge br1 member interface eth3
+set interfaces bridge br1 member interface eth4
+set interfaces bridge br2 address '10.2.2.1/24'
+set interfaces bridge br2 description 'L3 bridge br2'
+set interfaces bridge br2 member interface eth5
+set interfaces bridge br2 member interface eth6
+set interfaces bridge br2 member interface eth7
+set interfaces ethernet eth1 description 'br0'
+set interfaces ethernet eth2 description 'br0'
+set interfaces ethernet eth3 description 'br1'
+set interfaces ethernet eth4 description 'br1'
+set interfaces ethernet eth5 description 'br2 - Host'
+set interfaces ethernet eth6 description 'br2 - Trusted DHCP Server'
+set interfaces ethernet eth7 description 'br2'
diff --git a/tests/render/cases/bridge_firewall/docs_three_bridges/vars.yml b/tests/render/cases/bridge_firewall/docs_three_bridges/vars.yml
new file mode 100644
index 0000000..211891f
--- /dev/null
+++ b/tests/render/cases/bridge_firewall/docs_three_bridges/vars.yml
@@ -0,0 +1,81 @@
+---
+# docs.vyos.io/en/1.5/configexamples/fwall-and-bridge.html
+bridge_firewall_bridges:
+  - name: br0
+    description: Isolated L2 bridge
+    members:
+      - {interface: eth1, description: br0}
+      - {interface: eth2, description: br0}
+    prerouting:
+      default_action: drop
+      rules:
+        - {number: 10, description: Accept IPv6 traffic, ethernet_type: ipv6}
+    forward:
+      default_action: accept
+
+  - name: br1
+    description: L3 bridge br1
+    addresses: [10.1.1.1/24]
+    members:
+      - {interface: eth3, description: br1}
+      - {interface: eth4, description: br1}
+    prerouting:
+      default_action: accept
+      rules:
+        - number: 10
+          description: Drop DHCP discover
+          action: drop
+          protocol: udp
+          source: {port: "68"}
+          destination: {port: "67", mac_address: "ff:ff:ff:ff:ff:ff"}
+          log: true
+        - {number: 20, description: Drop IPv6 traffic, action: drop, ethernet_type: ipv6}
+    forward:
+      default_action: drop
+      rules:
+        - {number: 10, description: Accept ARP, ethernet_type: arp}
+        - {number: 20, description: Accept ipv4 from host, source: {address: 10.1.1.102}, state: [new]}
+    ip_forward:
+      rules:
+        - {number: 10, description: br1 - allow internet access, outbound_interface: eth0}
+    router_access: accept
+
+  - name: br2
+    description: L3 bridge br2
+    addresses: [10.2.2.1/24]
+    members:
+      - {interface: eth5, description: br2 - Host}
+      - {interface: eth6, description: br2 - Trusted DHCP Server}
+      - {interface: eth7, description: br2}
+    prerouting:
+      default_action: accept
+      rules:
+        - {number: 10, description: Drop IPv6 traffic, action: drop, ethernet_type: ipv6}
+    forward:
+      default_action: drop
+      rules:
+        - number: 10
+          description: Accept DHCP discover
+          protocol: udp
+          source: {port: "68"}
+          destination: {port: "67", mac_address: "ff:ff:ff:ff:ff:ff"}
+        - number: 20
+          description: Accept DHCP offers from trusted interface
+          protocol: udp
+          source: {port: "67"}
+          destination: {port: "68"}
+          inbound_interface: eth6
+        - number: 22
+          description: Drop all other DHCP offers
+          action: drop
+          protocol: udp
+          source: {port: "67"}
+          destination: {port: "68"}
+          log: true
+        - {number: 30, description: Accept ARP, ethernet_type: arp}
+        - {number: 40, description: Accept ipv4, ethernet_type: ipv4}
+    ip_forward:
+      rules:
+        - {number: 10, description: br2 - allow internet access, outbound_interface: eth0}
+        - {number: 20, description: br2 - allow access to br1, outbound_bridge: br1}
+    router_access: drop
diff --git a/tests/render/cases/ipsec_route_based/docs_azure/expected/r1.txt b/tests/render/cases/ipsec_route_based/docs_azure/expected/r1.txt
new file mode 100644
index 0000000..6c4fee4
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_azure/expected/r1.txt
@@ -0,0 +1,46 @@
+set interfaces vti vti1 address '10.10.1.5/32'
+set interfaces vti vti1 description 'Azure Tunnel'
+set interfaces vti vti1 ip adjust-mss '1350'
+set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration inbound
+set protocols bgp neighbor 10.0.0.4 disable-connected-check
+set protocols bgp neighbor 10.0.0.4 remote-as 65540
+set protocols bgp neighbor 10.0.0.4 timers holdtime 30
+set protocols bgp neighbor 10.0.0.4 timers keepalive 10
+set protocols bgp system-as 64499
+set protocols static route 10.0.0.4/32
+set protocols static route 10.0.0.4/32 interface 'vti1'
+set vpn ipsec authentication psk azure
+set vpn ipsec authentication psk azure id 198.51.100.3
+set vpn ipsec authentication psk azure id 203.0.113.2
+set vpn ipsec authentication psk azure secret '********'
+set vpn ipsec esp-group AZURE
+set vpn ipsec esp-group AZURE lifetime 3600
+set vpn ipsec esp-group AZURE mode tunnel
+set vpn ipsec esp-group AZURE pfs dh-group2
+set vpn ipsec esp-group AZURE proposal 1
+set vpn ipsec esp-group AZURE proposal 1 encryption aes256
+set vpn ipsec esp-group AZURE proposal 1 hash sha1
+set vpn ipsec ike-group AZURE
+set vpn ipsec ike-group AZURE dead-peer-detection action restart
+set vpn ipsec ike-group AZURE dead-peer-detection interval 15
+set vpn ipsec ike-group AZURE dead-peer-detection timeout 30
+set vpn ipsec ike-group AZURE ikev2-reauth
+set vpn ipsec ike-group AZURE key-exchange ikev2
+set vpn ipsec ike-group AZURE lifetime 28800
+set vpn ipsec ike-group AZURE proposal 1
+set vpn ipsec ike-group AZURE proposal 1 dh-group 2
+set vpn ipsec ike-group AZURE proposal 1 encryption aes256
+set vpn ipsec ike-group AZURE proposal 1 hash sha1
+set vpn ipsec interface eth0
+set vpn ipsec site-to-site peer 203.0.113.2
+set vpn ipsec site-to-site peer 203.0.113.2 authentication local-id '198.51.100.3'
+set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
+set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate'
+set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
+set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
+set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
+set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
+set vpn ipsec site-to-site peer 203.0.113.2 remote-address '203.0.113.2'
+set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
+set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
diff --git a/tests/render/cases/ipsec_route_based/docs_azure/vars.yml b/tests/render/cases/ipsec_route_based/docs_azure/vars.yml
new file mode 100644
index 0000000..0b52694
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_azure/vars.yml
@@ -0,0 +1,45 @@
+---
+# docs.vyos.io/en/1.5/configexamples/azure-vpn-bgp.html
+ipsec_route_based_peers:
+  - name: 203.0.113.2
+    description: AZURE PRIMARY TUNNEL
+    psk_name: azure
+    psk: ch00s3-4-s3cur3-psk
+    local_address: 10.10.0.5        # private IP; the device is behind NAT
+    local_id: 198.51.100.3          # public IP
+    remote_address: 203.0.113.2
+    connection_type: initiate
+    ikev2_reauth: inherit
+    esp_group_on_vti: true
+    vti: {interface: vti1, address: 10.10.1.5/32, description: Azure Tunnel, adjust_mss: "1350"}
+ipsec_route_based_ike_group:
+  name: AZURE
+  key_exchange: ikev2
+  ikev2_reauth: true
+  lifetime: 28800
+  proposal_id: 1
+  dh_group: 2
+  encryption: aes256
+  hash: sha1
+  dead_peer_detection: {action: restart, interval: 15, timeout: 30}
+ipsec_route_based_esp_group:
+  name: AZURE
+  lifetime: 3600
+  mode: tunnel
+  pfs: dh-group2
+  proposal_id: 1
+  encryption: aes256
+  hash: sha1
+ipsec_route_based_interfaces: [eth0]
+ipsec_route_based_disable_route_autoinstall: false   # the page does not set it
+ipsec_route_based_interface_routes:
+  - {dest: 10.0.0.4/32, interface: vti1}
+ipsec_route_based_bgp:
+  asn: 64499
+  neighbors:
+    - address: 10.0.0.4
+      remote_as: 65540
+      holdtime: 30
+      keepalive: 10
+      disable_connected_check: true
+      soft_reconfiguration_inbound: true
diff --git a/tests/render/cases/ipsec_route_based/docs_azure_dual/expected/r1.txt b/tests/render/cases/ipsec_route_based/docs_azure_dual/expected/r1.txt
new file mode 100644
index 0000000..d360ddf
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_azure_dual/expected/r1.txt
@@ -0,0 +1,69 @@
+set interfaces vti vti1 address '10.10.1.5/32'
+set interfaces vti vti1 description 'Azure Primary Tunnel'
+set interfaces vti vti1 ip adjust-mss '1350'
+set interfaces vti vti2 address '10.10.1.6/32'
+set interfaces vti vti2 description 'Azure Secondary Tunnel'
+set interfaces vti vti2 ip adjust-mss '1350'
+set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration inbound
+set protocols bgp neighbor 10.0.0.4 disable-connected-check
+set protocols bgp neighbor 10.0.0.4 remote-as 65540
+set protocols bgp neighbor 10.0.0.4 timers holdtime 30
+set protocols bgp neighbor 10.0.0.4 timers keepalive 10
+set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration inbound
+set protocols bgp neighbor 10.0.0.5 disable-connected-check
+set protocols bgp neighbor 10.0.0.5 remote-as 65540
+set protocols bgp neighbor 10.0.0.5 timers holdtime 30
+set protocols bgp neighbor 10.0.0.5 timers keepalive 10
+set protocols bgp system-as 64499
+set protocols static route 10.0.0.4/32
+set protocols static route 10.0.0.4/32 interface 'vti1'
+set protocols static route 10.0.0.5/32
+set protocols static route 10.0.0.5/32 interface 'vti2'
+set vpn ipsec authentication psk azure
+set vpn ipsec authentication psk azure id 198.51.100.3
+set vpn ipsec authentication psk azure id 203.0.113.2
+set vpn ipsec authentication psk azure id 203.0.113.3
+set vpn ipsec authentication psk azure secret '********'
+set vpn ipsec esp-group AZURE
+set vpn ipsec esp-group AZURE lifetime 3600
+set vpn ipsec esp-group AZURE mode tunnel
+set vpn ipsec esp-group AZURE pfs dh-group2
+set vpn ipsec esp-group AZURE proposal 1
+set vpn ipsec esp-group AZURE proposal 1 encryption aes256
+set vpn ipsec esp-group AZURE proposal 1 hash sha1
+set vpn ipsec ike-group AZURE
+set vpn ipsec ike-group AZURE dead-peer-detection action restart
+set vpn ipsec ike-group AZURE dead-peer-detection interval 15
+set vpn ipsec ike-group AZURE dead-peer-detection timeout 30
+set vpn ipsec ike-group AZURE ikev2-reauth
+set vpn ipsec ike-group AZURE key-exchange ikev2
+set vpn ipsec ike-group AZURE lifetime 28800
+set vpn ipsec ike-group AZURE proposal 1
+set vpn ipsec ike-group AZURE proposal 1 dh-group 2
+set vpn ipsec ike-group AZURE proposal 1 encryption aes256
+set vpn ipsec ike-group AZURE proposal 1 hash sha1
+set vpn ipsec interface eth0
+set vpn ipsec site-to-site peer azure-primary
+set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3'
+set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2'
+set vpn ipsec site-to-site peer azure-primary connection-type 'initiate'
+set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL'
+set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE'
+set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit'
+set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5'
+set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2'
+set vpn ipsec site-to-site peer azure-primary vti bind 'vti1'
+set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE'
+set vpn ipsec site-to-site peer azure-secondary
+set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3'
+set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3'
+set vpn ipsec site-to-site peer azure-secondary connection-type 'initiate'
+set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL'
+set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE'
+set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit'
+set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5'
+set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3'
+set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2'
+set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE'
diff --git a/tests/render/cases/ipsec_route_based/docs_azure_dual/vars.yml b/tests/render/cases/ipsec_route_based/docs_azure_dual/vars.yml
new file mode 100644
index 0000000..4054b68
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_azure_dual/vars.yml
@@ -0,0 +1,64 @@
+---
+# docs.vyos.io/en/1.5/configexamples/azure-vpn-dual-bgp.html
+# Both peers share the PSK entry "azure" (one entry, three ids), as on the page.
+ipsec_route_based_peers:
+  - name: azure-primary
+    description: AZURE PRIMARY TUNNEL
+    psk_name: azure
+    psk: ch00s3-4-s3cur3-psk
+    local_address: 10.10.0.5        # private IP; the device is behind NAT
+    local_id: 198.51.100.3          # public IP
+    remote_address: 203.0.113.2
+    connection_type: initiate
+    ikev2_reauth: inherit
+    esp_group_on_vti: true
+    vti: {interface: vti1, address: 10.10.1.5/32, description: Azure Primary Tunnel, adjust_mss: "1350"}
+  - name: azure-secondary
+    description: AZURE secondary TUNNEL
+    psk_name: azure
+    psk: ch00s3-4-s3cur3-psk
+    local_address: 10.10.0.5
+    local_id: 198.51.100.3
+    remote_address: 203.0.113.3
+    connection_type: initiate
+    ikev2_reauth: inherit
+    esp_group_on_vti: true
+    vti: {interface: vti2, address: 10.10.1.6/32, description: Azure Secondary Tunnel, adjust_mss: "1350"}
+ipsec_route_based_ike_group:
+  name: AZURE
+  key_exchange: ikev2
+  ikev2_reauth: true
+  lifetime: 28800
+  proposal_id: 1
+  dh_group: 2
+  encryption: aes256
+  hash: sha1
+  dead_peer_detection: {action: restart, interval: 15, timeout: 30}
+ipsec_route_based_esp_group:
+  name: AZURE
+  lifetime: 3600
+  mode: tunnel
+  pfs: dh-group2
+  proposal_id: 1
+  encryption: aes256
+  hash: sha1
+ipsec_route_based_interfaces: [eth0]
+ipsec_route_based_disable_route_autoinstall: false   # the page does not set it
+ipsec_route_based_interface_routes:
+  - {dest: 10.0.0.4/32, interface: vti1}
+  - {dest: 10.0.0.5/32, interface: vti2}
+ipsec_route_based_bgp:
+  asn: 64499
+  neighbors:
+    - address: 10.0.0.4
+      remote_as: 65540
+      holdtime: 30
+      keepalive: 10
+      disable_connected_check: true
+      soft_reconfiguration_inbound: true
+    - address: 10.0.0.5
+      remote_as: 65540
+      holdtime: 30
+      keepalive: 10
+      disable_connected_check: true
+      soft_reconfiguration_inbound: true
diff --git a/tests/render/cases/ipsec_route_based/docs_cisco/expected/r1.txt b/tests/render/cases/ipsec_route_based/docs_cisco/expected/r1.txt
new file mode 100644
index 0000000..aa551b3
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_cisco/expected/r1.txt
@@ -0,0 +1,45 @@
+set interfaces vti vti1 address '10.100.100.1/30'
+set interfaces vti vti1 mtu '1438'
+set protocols ospf area '0'
+set protocols ospf area 0 network 10.100.100.0/30
+set protocols ospf area 0 network 192.168.0.0/24
+set protocols ospf area 0 network 192.168.1.0/24
+set protocols ospf interface eth1 passive
+set protocols ospf interface eth2 passive
+set protocols ospf interface vti1 network point-to-point
+set protocols ospf parameters router-id '2.2.2.2'
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '10.0.1.1'
+set vpn ipsec authentication psk AUTH-PSK
+set vpn ipsec authentication psk AUTH-PSK id 10.0.1.2
+set vpn ipsec authentication psk AUTH-PSK id 10.0.2.2
+set vpn ipsec authentication psk AUTH-PSK secret '********'
+set vpn ipsec authentication psk AUTH-PSK secret-type base64
+set vpn ipsec esp-group ESP-GROUP
+set vpn ipsec esp-group ESP-GROUP lifetime 3600
+set vpn ipsec esp-group ESP-GROUP pfs disable
+set vpn ipsec esp-group ESP-GROUP proposal 10
+set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256
+set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
+set vpn ipsec ike-group IKE-GROUP
+set vpn ipsec ike-group IKE-GROUP close-action start
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection action restart
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval 10
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout 30
+set vpn ipsec ike-group IKE-GROUP key-exchange ikev1
+set vpn ipsec ike-group IKE-GROUP lifetime 28800
+set vpn ipsec ike-group IKE-GROUP proposal 10
+set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 14
+set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes128
+set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha1
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec site-to-site peer CISCO
+set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2'
+set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2'
+set vpn ipsec site-to-site peer CISCO connection-type 'initiate'
+set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2'
+set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2'
+set vpn ipsec site-to-site peer CISCO vti bind 'vti1'
diff --git a/tests/render/cases/ipsec_route_based/docs_cisco/vars.yml b/tests/render/cases/ipsec_route_based/docs_cisco/vars.yml
new file mode 100644
index 0000000..a7f5c4d
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_cisco/vars.yml
@@ -0,0 +1,33 @@
+---
+# docs.vyos.io/en/1.5/configexamples/ipsec-cisco-route-based.html - VyOS side.
+# WAN/LAN addresses (eth0-eth2) belong to the base role.
+ipsec_route_based_peers:
+  - name: CISCO
+    local_address: 10.0.1.2
+    remote_address: 10.0.2.2
+    psk: dGVzdA==
+    psk_type: base64
+    psk_name: AUTH-PSK
+    connection_type: initiate
+    vti: {interface: vti1, address: 10.100.100.1/30, mtu: 1438}
+ipsec_route_based_ike_group:
+  name: IKE-GROUP
+  key_exchange: ikev1
+  lifetime: 28800
+  dh_group: 14
+  encryption: aes128
+  hash: sha1
+  close_action: start
+  dead_peer_detection: {action: restart, interval: 10, timeout: 30}
+ipsec_route_based_esp_group:
+  name: ESP-GROUP
+  lifetime: 3600
+  pfs: disable
+  encryption: aes256
+  hash: sha256
+ipsec_route_based_ospf:
+  router_id: 2.2.2.2
+  area: "0"
+  networks: [10.100.100.0/30, 192.168.0.0/24, 192.168.1.0/24]
+  passive_interfaces: [eth1, eth2]
+ipsec_route_based_default_gateway: 10.0.1.1
diff --git a/tests/render/cases/ipsec_route_based/docs_palo_alto/expected/r1.txt b/tests/render/cases/ipsec_route_based/docs_palo_alto/expected/r1.txt
new file mode 100644
index 0000000..4c50bcd
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_palo_alto/expected/r1.txt
@@ -0,0 +1,45 @@
+set interfaces vti vti1 address '10.100.100.1/30'
+set interfaces vti vti1 mtu '1438'
+set protocols ospf area '0'
+set protocols ospf area 0 network 10.100.100.0/30
+set protocols ospf area 0 network 192.168.0.0/24
+set protocols ospf area 0 network 192.168.1.0/24
+set protocols ospf interface eth1 passive
+set protocols ospf interface eth2 passive
+set protocols ospf interface vti1 network point-to-point
+set protocols ospf parameters router-id '2.2.2.2'
+set protocols static route 0.0.0.0/0
+set protocols static route 0.0.0.0/0 next-hop '10.0.1.1'
+set vpn ipsec authentication psk AUTH-PSK
+set vpn ipsec authentication psk AUTH-PSK id 10.0.1.2
+set vpn ipsec authentication psk AUTH-PSK id 10.0.2.2
+set vpn ipsec authentication psk AUTH-PSK secret '********'
+set vpn ipsec authentication psk AUTH-PSK secret-type base64
+set vpn ipsec esp-group ESP-GROUP
+set vpn ipsec esp-group ESP-GROUP lifetime 3600
+set vpn ipsec esp-group ESP-GROUP pfs disable
+set vpn ipsec esp-group ESP-GROUP proposal 10
+set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256
+set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256
+set vpn ipsec ike-group IKE-GROUP
+set vpn ipsec ike-group IKE-GROUP close-action start
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection action restart
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval 10
+set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout 30
+set vpn ipsec ike-group IKE-GROUP key-exchange ikev1
+set vpn ipsec ike-group IKE-GROUP lifetime 28800
+set vpn ipsec ike-group IKE-GROUP proposal 10
+set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 14
+set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes128
+set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha1
+set vpn ipsec options disable-route-autoinstall
+set vpn ipsec site-to-site peer PA
+set vpn ipsec site-to-site peer PA authentication local-id '10.0.1.2'
+set vpn ipsec site-to-site peer PA authentication mode 'pre-shared-secret'
+set vpn ipsec site-to-site peer PA authentication remote-id '10.0.2.2'
+set vpn ipsec site-to-site peer PA connection-type 'initiate'
+set vpn ipsec site-to-site peer PA default-esp-group 'ESP-GROUP'
+set vpn ipsec site-to-site peer PA ike-group 'IKE-GROUP'
+set vpn ipsec site-to-site peer PA local-address '10.0.1.2'
+set vpn ipsec site-to-site peer PA remote-address '10.0.2.2'
+set vpn ipsec site-to-site peer PA vti bind 'vti1'
diff --git a/tests/render/cases/ipsec_route_based/docs_palo_alto/vars.yml b/tests/render/cases/ipsec_route_based/docs_palo_alto/vars.yml
new file mode 100644
index 0000000..9e8e814
--- /dev/null
+++ b/tests/render/cases/ipsec_route_based/docs_palo_alto/vars.yml
@@ -0,0 +1,33 @@
+---
+# docs.vyos.io/en/1.5/configexamples/ipsec-pa-route-based.html - VyOS side.
+# WAN/LAN addresses (eth0-eth2) belong to the base role.
+ipsec_route_based_peers:
+  - name: PA
+    local_address: 10.0.1.2
+    remote_address: 10.0.2.2
+    psk: dGVzdA==
+    psk_type: base64
+    psk_name: AUTH-PSK
+    connection_type: initiate
+    vti: {interface: vti1, address: 10.100.100.1/30, mtu: 1438}
+ipsec_route_based_ike_group:
+  name: IKE-GROUP
+  key_exchange: ikev1
+  lifetime: 28800
+  dh_group: 14
+  encryption: aes128
+  hash: sha1
+  close_action: start
+  dead_peer_detection: {action: restart, interval: 10, timeout: 30}
+ipsec_route_based_esp_group:
+  name: ESP-GROUP
+  lifetime: 3600
+  pfs: disable
+  encryption: aes256
+  hash: sha256
+ipsec_route_based_ospf:
+  router_id: 2.2.2.2
+  area: "0"
+  networks: [10.100.100.0/30, 192.168.0.0/24, 192.168.1.0/24]
+  passive_interfaces: [eth1, eth2]
+ipsec_route_based_default_gateway: 10.0.1.1
diff --git a/tests/render/cases/ospf_unnumbered/docs_two_routers/expected/routerA.txt b/tests/render/cases/ospf_unnumbered/docs_two_routers/expected/routerA.txt
new file mode 100644
index 0000000..0bb9bb2
--- /dev/null
+++ b/tests/render/cases/ospf_unnumbered/docs_two_routers/expected/routerA.txt
@@ -0,0 +1,12 @@
+set interfaces ethernet eth1 address '192.168.0.1/32'
+set interfaces ethernet eth2 address '192.168.0.1/32'
+set interfaces loopback lo address '192.168.0.1/32'
+set protocols ospf area '0.0.0.0'
+set protocols ospf area 0.0.0.0 authentication md5
+set protocols ospf area 0.0.0.0 network 192.168.0.1/32
+set protocols ospf interface eth1 authentication md5 key-id 1 md5-key '********'
+set protocols ospf interface eth1 network point-to-point
+set protocols ospf interface eth2 authentication md5 key-id 1 md5-key '********'
+set protocols ospf interface eth2 network point-to-point
+set protocols ospf parameters router-id '192.168.0.1'
+set protocols ospf redistribute connected
diff --git a/tests/render/cases/ospf_unnumbered/docs_two_routers/expected/routerB.txt b/tests/render/cases/ospf_unnumbered/docs_two_routers/expected/routerB.txt
new file mode 100644
index 0000000..6569ef8
--- /dev/null
+++ b/tests/render/cases/ospf_unnumbered/docs_two_routers/expected/routerB.txt
@@ -0,0 +1,12 @@
+set interfaces ethernet eth1 address '192.168.0.2/32'
+set interfaces ethernet eth2 address '192.168.0.2/32'
+set interfaces loopback lo address '192.168.0.2/32'
+set protocols ospf area '0.0.0.0'
+set protocols ospf area 0.0.0.0 authentication md5
+set protocols ospf area 0.0.0.0 network 192.168.0.2/32
+set protocols ospf interface eth1 authentication md5 key-id 1 md5-key '********'
+set protocols ospf interface eth1 network point-to-point
+set protocols ospf interface eth2 authentication md5 key-id 1 md5-key '********'
+set protocols ospf interface eth2 network point-to-point
+set protocols ospf parameters router-id '192.168.0.2'
+set protocols ospf redistribute connected
diff --git a/tests/render/cases/ospf_unnumbered/docs_two_routers/inventory.yml b/tests/render/cases/ospf_unnumbered/docs_two_routers/inventory.yml
new file mode 100644
index 0000000..e1cab44
--- /dev/null
+++ b/tests/render/cases/ospf_unnumbered/docs_two_routers/inventory.yml
@@ -0,0 +1,17 @@
+---
+all:
+  children:
+    fabric:
+      hosts:
+        routerA:
+          ansible_host: 192.0.2.1
+          ospf_unnumbered_router_id: 192.168.0.1
+        routerB:
+          ansible_host: 192.0.2.2
+          ospf_unnumbered_router_id: 192.168.0.2
+  vars:
+    ansible_network_os: vyos.vyos.vyos
+    ansible_connection: ansible.netcommon.network_cli
+    ansible_user: vyos
+    ansible_connect_timeout: 5
+    ansible_command_timeout: 5
diff --git a/tests/render/cases/ospf_unnumbered/docs_two_routers/vars.yml b/tests/render/cases/ospf_unnumbered/docs_two_routers/vars.yml
new file mode 100644
index 0000000..c1303ba
--- /dev/null
+++ b/tests/render/cases/ospf_unnumbered/docs_two_routers/vars.yml
@@ -0,0 +1,4 @@
+---
+# docs.vyos.io/en/1.5/configexamples/ospf-unnumbered.html - shared settings
+ospf_unnumbered_interfaces: [eth1, eth2]
+ospf_unnumbered_md5_key: yourpassword
diff --git a/tests/render/cases/vrf_firewall/docs_four_vrfs/expected/r1.txt b/tests/render/cases/vrf_firewall/docs_four_vrfs/expected/r1.txt
new file mode 100644
index 0000000..62951c9
--- /dev/null
+++ b/tests/render/cases/vrf_firewall/docs_four_vrfs/expected/r1.txt
@@ -0,0 +1,53 @@
+set firewall global-options state-policy established action 'accept'
+set firewall global-options state-policy invalid action 'drop'
+set firewall global-options state-policy related action 'accept'
+set firewall ipv4 forward filter default-action 'drop'
+set firewall ipv4 forward filter default-log
+set firewall ipv4 forward filter rule 10
+set firewall ipv4 forward filter rule 10 action 'accept'
+set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD'
+set firewall ipv4 forward filter rule 10 inbound-interface name MGMT
+set firewall ipv4 forward filter rule 10 outbound-interface name eth2*
+set firewall ipv4 forward filter rule 120
+set firewall ipv4 forward filter rule 120 action 'accept'
+set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD'
+set firewall ipv4 forward filter rule 120 inbound-interface name LAN
+set firewall ipv4 forward filter rule 120 outbound-interface name eth2.3500
+set firewall ipv4 forward filter rule 130
+set firewall ipv4 forward filter rule 130 action 'accept'
+set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet'
+set firewall ipv4 forward filter rule 130 inbound-interface name LAN
+set firewall ipv4 forward filter rule 130 outbound-interface name pppoe0
+set firewall ipv4 forward filter rule 99
+set firewall ipv4 forward filter rule 99 action 'drop'
+set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt'
+set firewall ipv4 forward filter rule 99 outbound-interface name eth1
+set firewall ipv4 input filter default-action 'drop'
+set firewall ipv4 input filter default-log
+set firewall ipv4 input filter rule 10
+set firewall ipv4 input filter rule 10 action 'accept'
+set firewall ipv4 input filter rule 10 description 'MGMT - Allow input'
+set firewall ipv4 input filter rule 10 inbound-interface name MGMT
+set interfaces ethernet eth1 vrf 'MGMT'
+set interfaces ethernet eth2 vif 150 vrf 'LAN'
+set interfaces ethernet eth2 vif 160 vrf 'LAN'
+set interfaces ethernet eth2 vif 3500 vrf 'PROD'
+set interfaces pppoe pppoe0 vrf 'WAN'
+set vrf bind-to-all
+set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN'
+set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT'
+set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD'
+set vrf name LAN table 103
+set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN'
+set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN'
+set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD'
+set vrf name MGMT table 102
+set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN'
+set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT'
+set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN'
+set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN'
+set vrf name PROD table 104
+set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN'
+set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN'
+set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD'
+set vrf name WAN table 101
diff --git a/tests/render/cases/vrf_firewall/docs_four_vrfs/vars.yml b/tests/render/cases/vrf_firewall/docs_four_vrfs/vars.yml
new file mode 100644
index 0000000..38626df
--- /dev/null
+++ b/tests/render/cases/vrf_firewall/docs_four_vrfs/vars.yml
@@ -0,0 +1,43 @@
+---
+# docs.vyos.io/en/1.5/configexamples/fwall-and-vrf.html
+# Interface addresses and the PPPoE interface itself are outside this role
+# (base role / a later PPPoE role); everything else is from the page.
+vrf_firewall_vrfs:
+  - name: MGMT
+    table: 102
+    interfaces: [eth1]
+    routes:
+      - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+      - {dest: 10.160.160.0/24, interface: eth2.160, vrf: LAN}
+      - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+  - name: WAN
+    table: 101
+    interfaces: [pppoe0]
+    routes:
+      - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+      - {dest: 10.160.160.0/24, interface: eth2.160, vrf: LAN}
+      - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+  - name: LAN
+    table: 103
+    interfaces: [eth2.150, eth2.160]
+    routes:
+      - {dest: 0.0.0.0/0, interface: pppoe0, vrf: WAN}
+      - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT}
+      - {dest: 172.16.20.0/24, interface: eth2.3500, vrf: PROD}
+  - name: PROD
+    table: 104
+    interfaces: [eth2.3500]
+    routes:
+      - {dest: 0.0.0.0/0, interface: pppoe0, vrf: WAN}
+      - {dest: 10.100.100.0/24, interface: eth1, vrf: MGMT}
+      - {dest: 10.150.150.0/24, interface: eth2.150, vrf: LAN}
+      - {dest: 10.160.160.0/24, interface: eth2.160, vrf: LAN}
+
+vrf_firewall_forward_rules:
+  - {number: 10, description: MGMT - Allow to LAN and PROD, inbound_interface: MGMT, outbound_interface: eth2*}
+  - {number: 99, action: drop, description: MGMT - Drop all going to mgmt, outbound_interface: eth1}
+  - {number: 120, description: LAN - Allow to PROD, inbound_interface: LAN, outbound_interface: eth2.3500}
+  - {number: 130, description: LAN - Allow internet, inbound_interface: LAN, outbound_interface: pppoe0}
+
+vrf_firewall_input_rules:
+  - {number: 10, description: MGMT - Allow input, inbound_interface: MGMT}
diff --git a/tests/render/cases/zone_firewall/docs_zone_policy/expected/r1.txt b/tests/render/cases/zone_firewall/docs_zone_policy/expected/r1.txt
new file mode 100644
index 0000000..c7c2232
--- /dev/null
+++ b/tests/render/cases/zone_firewall/docs_zone_policy/expected/r1.txt
@@ -0,0 +1,548 @@
+set firewall ipv4 name dmz-lan default-action 'drop'
+set firewall ipv4 name dmz-lan default-log
+set firewall ipv4 name dmz-lan rule 1
+set firewall ipv4 name dmz-lan rule 1 action 'accept'
+set firewall ipv4 name dmz-lan rule 1 state established
+set firewall ipv4 name dmz-lan rule 1 state related
+set firewall ipv4 name dmz-lan rule 2
+set firewall ipv4 name dmz-lan rule 2 action 'drop'
+set firewall ipv4 name dmz-lan rule 2 log
+set firewall ipv4 name dmz-lan rule 2 state invalid
+set firewall ipv4 name dmz-local default-action 'drop'
+set firewall ipv4 name dmz-local default-log
+set firewall ipv4 name dmz-local rule 1
+set firewall ipv4 name dmz-local rule 1 action 'accept'
+set firewall ipv4 name dmz-local rule 1 state established
+set firewall ipv4 name dmz-local rule 1 state related
+set firewall ipv4 name dmz-local rule 2
+set firewall ipv4 name dmz-local rule 2 action 'drop'
+set firewall ipv4 name dmz-local rule 2 log
+set firewall ipv4 name dmz-local rule 2 state invalid
+set firewall ipv4 name dmz-local rule 400
+set firewall ipv4 name dmz-local rule 400 action 'accept'
+set firewall ipv4 name dmz-local rule 400 destination port 123
+set firewall ipv4 name dmz-local rule 400 log
+set firewall ipv4 name dmz-local rule 400 protocol 'tcp'
+set firewall ipv4 name dmz-local rule 600
+set firewall ipv4 name dmz-local rule 600 action 'accept'
+set firewall ipv4 name dmz-local rule 600 destination port 53
+set firewall ipv4 name dmz-local rule 600 log
+set firewall ipv4 name dmz-local rule 600 protocol 'tcp'
+set firewall ipv4 name dmz-local rule 700
+set firewall ipv4 name dmz-local rule 700 action 'accept'
+set firewall ipv4 name dmz-local rule 700 destination port 67,68
+set firewall ipv4 name dmz-local rule 700 log
+set firewall ipv4 name dmz-local rule 700 protocol 'tcp'
+set firewall ipv4 name dmz-wan default-action 'drop'
+set firewall ipv4 name dmz-wan default-log
+set firewall ipv4 name dmz-wan rule 1
+set firewall ipv4 name dmz-wan rule 1 action 'accept'
+set firewall ipv4 name dmz-wan rule 1 state established
+set firewall ipv4 name dmz-wan rule 1 state related
+set firewall ipv4 name dmz-wan rule 2
+set firewall ipv4 name dmz-wan rule 2 action 'drop'
+set firewall ipv4 name dmz-wan rule 2 log
+set firewall ipv4 name dmz-wan rule 2 state invalid
+set firewall ipv4 name dmz-wan rule 200
+set firewall ipv4 name dmz-wan rule 200 action 'accept'
+set firewall ipv4 name dmz-wan rule 200 destination port 80,443
+set firewall ipv4 name dmz-wan rule 200 log
+set firewall ipv4 name dmz-wan rule 200 protocol 'tcp'
+set firewall ipv4 name dmz-wan rule 300
+set firewall ipv4 name dmz-wan rule 300 action 'accept'
+set firewall ipv4 name dmz-wan rule 300 destination port 20,21
+set firewall ipv4 name dmz-wan rule 300 log
+set firewall ipv4 name dmz-wan rule 300 protocol 'tcp'
+set firewall ipv4 name dmz-wan rule 600
+set firewall ipv4 name dmz-wan rule 600 action 'accept'
+set firewall ipv4 name dmz-wan rule 600 destination port 53
+set firewall ipv4 name dmz-wan rule 600 log
+set firewall ipv4 name dmz-wan rule 600 protocol 'tcp_udp'
+set firewall ipv4 name dmz-wan rule 800
+set firewall ipv4 name dmz-wan rule 800 action 'accept'
+set firewall ipv4 name dmz-wan rule 800 destination port 22
+set firewall ipv4 name dmz-wan rule 800 log
+set firewall ipv4 name dmz-wan rule 800 protocol 'tcp'
+set firewall ipv4 name lan-dmz default-action 'drop'
+set firewall ipv4 name lan-dmz default-log
+set firewall ipv4 name lan-dmz rule 1
+set firewall ipv4 name lan-dmz rule 1 action 'accept'
+set firewall ipv4 name lan-dmz rule 1 state established
+set firewall ipv4 name lan-dmz rule 1 state related
+set firewall ipv4 name lan-dmz rule 2
+set firewall ipv4 name lan-dmz rule 2 action 'drop'
+set firewall ipv4 name lan-dmz rule 2 log
+set firewall ipv4 name lan-dmz rule 2 state invalid
+set firewall ipv4 name lan-dmz rule 200
+set firewall ipv4 name lan-dmz rule 200 action 'accept'
+set firewall ipv4 name lan-dmz rule 200 destination port 80,443
+set firewall ipv4 name lan-dmz rule 200 log
+set firewall ipv4 name lan-dmz rule 200 protocol 'tcp'
+set firewall ipv4 name lan-dmz rule 800
+set firewall ipv4 name lan-dmz rule 800 action 'accept'
+set firewall ipv4 name lan-dmz rule 800 destination address 192.168.200.200
+set firewall ipv4 name lan-dmz rule 800 destination port 22
+set firewall ipv4 name lan-dmz rule 800 log
+set firewall ipv4 name lan-dmz rule 800 protocol 'tcp'
+set firewall ipv4 name lan-dmz rule 800 source address 192.168.100.10
+set firewall ipv4 name lan-dmz rule 900
+set firewall ipv4 name lan-dmz rule 900 action 'accept'
+set firewall ipv4 name lan-dmz rule 900 destination port 993
+set firewall ipv4 name lan-dmz rule 900 log
+set firewall ipv4 name lan-dmz rule 900 protocol 'tcp'
+set firewall ipv4 name lan-local default-action 'drop'
+set firewall ipv4 name lan-local default-log
+set firewall ipv4 name lan-local rule 1
+set firewall ipv4 name lan-local rule 1 action 'accept'
+set firewall ipv4 name lan-local rule 1 state established
+set firewall ipv4 name lan-local rule 1 state related
+set firewall ipv4 name lan-local rule 2
+set firewall ipv4 name lan-local rule 2 action 'drop'
+set firewall ipv4 name lan-local rule 2 log
+set firewall ipv4 name lan-local rule 2 state invalid
+set firewall ipv4 name lan-local rule 400
+set firewall ipv4 name lan-local rule 400 action 'accept'
+set firewall ipv4 name lan-local rule 400 destination port 123
+set firewall ipv4 name lan-local rule 400 log
+set firewall ipv4 name lan-local rule 400 protocol 'tcp'
+set firewall ipv4 name lan-local rule 600
+set firewall ipv4 name lan-local rule 600 action 'accept'
+set firewall ipv4 name lan-local rule 600 destination port 53
+set firewall ipv4 name lan-local rule 600 log
+set firewall ipv4 name lan-local rule 600 protocol 'tcp'
+set firewall ipv4 name lan-local rule 700
+set firewall ipv4 name lan-local rule 700 action 'accept'
+set firewall ipv4 name lan-local rule 700 destination port 67,68
+set firewall ipv4 name lan-local rule 700 log
+set firewall ipv4 name lan-local rule 700 protocol 'tcp'
+set firewall ipv4 name lan-local rule 800
+set firewall ipv4 name lan-local rule 800 action 'accept'
+set firewall ipv4 name lan-local rule 800 destination port 22
+set firewall ipv4 name lan-local rule 800 log
+set firewall ipv4 name lan-local rule 800 protocol 'tcp'
+set firewall ipv4 name lan-local rule 800 source address 192.168.100.10
+set firewall ipv4 name lan-wan default-action 'drop'
+set firewall ipv4 name lan-wan default-log
+set firewall ipv4 name lan-wan rule 1
+set firewall ipv4 name lan-wan rule 1 action 'accept'
+set firewall ipv4 name lan-wan rule 1 state established
+set firewall ipv4 name lan-wan rule 1 state related
+set firewall ipv4 name lan-wan rule 2
+set firewall ipv4 name lan-wan rule 2 action 'drop'
+set firewall ipv4 name lan-wan rule 2 log
+set firewall ipv4 name lan-wan rule 2 state invalid
+set firewall ipv4 name lan-wan rule 200
+set firewall ipv4 name lan-wan rule 200 action 'accept'
+set firewall ipv4 name lan-wan rule 200 destination port 80,443
+set firewall ipv4 name lan-wan rule 200 log
+set firewall ipv4 name lan-wan rule 200 protocol 'tcp'
+set firewall ipv4 name lan-wan rule 300
+set firewall ipv4 name lan-wan rule 300 action 'accept'
+set firewall ipv4 name lan-wan rule 300 destination port 20,21
+set firewall ipv4 name lan-wan rule 300 log
+set firewall ipv4 name lan-wan rule 300 protocol 'tcp'
+set firewall ipv4 name lan-wan rule 800
+set firewall ipv4 name lan-wan rule 800 action 'accept'
+set firewall ipv4 name lan-wan rule 800 destination port 22
+set firewall ipv4 name lan-wan rule 800 log
+set firewall ipv4 name lan-wan rule 800 protocol 'tcp'
+set firewall ipv4 name local-dmz default-action 'drop'
+set firewall ipv4 name local-dmz default-log
+set firewall ipv4 name local-dmz rule 1
+set firewall ipv4 name local-dmz rule 1 action 'accept'
+set firewall ipv4 name local-dmz rule 1 state established
+set firewall ipv4 name local-dmz rule 1 state related
+set firewall ipv4 name local-dmz rule 2
+set firewall ipv4 name local-dmz rule 2 action 'drop'
+set firewall ipv4 name local-dmz rule 2 log
+set firewall ipv4 name local-dmz rule 2 state invalid
+set firewall ipv4 name local-dmz rule 500
+set firewall ipv4 name local-dmz rule 500 action 'accept'
+set firewall ipv4 name local-dmz rule 500 destination port 25
+set firewall ipv4 name local-dmz rule 500 log
+set firewall ipv4 name local-dmz rule 500 protocol 'tcp'
+set firewall ipv4 name local-dmz rule 600
+set firewall ipv4 name local-dmz rule 600 action 'accept'
+set firewall ipv4 name local-dmz rule 600 destination port 53
+set firewall ipv4 name local-dmz rule 600 log
+set firewall ipv4 name local-dmz rule 600 protocol 'tcp_udp'
+set firewall ipv4 name local-dmz rule 700
+set firewall ipv4 name local-dmz rule 700 action 'accept'
+set firewall ipv4 name local-dmz rule 700 destination port 67,68
+set firewall ipv4 name local-dmz rule 700 log
+set firewall ipv4 name local-dmz rule 700 protocol 'tcp'
+set firewall ipv4 name local-lan default-action 'drop'
+set firewall ipv4 name local-lan default-log
+set firewall ipv4 name local-lan rule 1
+set firewall ipv4 name local-lan rule 1 action 'accept'
+set firewall ipv4 name local-lan rule 1 state established
+set firewall ipv4 name local-lan rule 1 state related
+set firewall ipv4 name local-lan rule 2
+set firewall ipv4 name local-lan rule 2 action 'drop'
+set firewall ipv4 name local-lan rule 2 log
+set firewall ipv4 name local-lan rule 2 state invalid
+set firewall ipv4 name local-lan rule 700
+set firewall ipv4 name local-lan rule 700 action 'accept'
+set firewall ipv4 name local-lan rule 700 destination port 67,68
+set firewall ipv4 name local-lan rule 700 log
+set firewall ipv4 name local-lan rule 700 protocol 'tcp'
+set firewall ipv4 name local-wan default-action 'drop'
+set firewall ipv4 name local-wan default-log
+set firewall ipv4 name local-wan rule 1
+set firewall ipv4 name local-wan rule 1 action 'accept'
+set firewall ipv4 name local-wan rule 1 state established
+set firewall ipv4 name local-wan rule 1 state related
+set firewall ipv4 name local-wan rule 2
+set firewall ipv4 name local-wan rule 2 action 'drop'
+set firewall ipv4 name local-wan rule 2 log
+set firewall ipv4 name local-wan rule 2 state invalid
+set firewall ipv4 name local-wan rule 200
+set firewall ipv4 name local-wan rule 200 action 'accept'
+set firewall ipv4 name local-wan rule 200 destination port 80,443
+set firewall ipv4 name local-wan rule 200 log
+set firewall ipv4 name local-wan rule 200 protocol 'tcp'
+set firewall ipv4 name local-wan rule 300
+set firewall ipv4 name local-wan rule 300 action 'accept'
+set firewall ipv4 name local-wan rule 300 destination port 20,21
+set firewall ipv4 name local-wan rule 300 log
+set firewall ipv4 name local-wan rule 300 protocol 'tcp'
+set firewall ipv4 name wan-dmz default-action 'drop'
+set firewall ipv4 name wan-dmz default-log
+set firewall ipv4 name wan-dmz rule 1
+set firewall ipv4 name wan-dmz rule 1 action 'accept'
+set firewall ipv4 name wan-dmz rule 1 state established
+set firewall ipv4 name wan-dmz rule 1 state related
+set firewall ipv4 name wan-dmz rule 2
+set firewall ipv4 name wan-dmz rule 2 action 'drop'
+set firewall ipv4 name wan-dmz rule 2 log
+set firewall ipv4 name wan-dmz rule 2 state invalid
+set firewall ipv4 name wan-dmz rule 200
+set firewall ipv4 name wan-dmz rule 200 action 'accept'
+set firewall ipv4 name wan-dmz rule 200 destination address 192.168.200.200
+set firewall ipv4 name wan-dmz rule 200 destination port 80,443
+set firewall ipv4 name wan-dmz rule 200 log
+set firewall ipv4 name wan-dmz rule 200 protocol 'tcp'
+set firewall ipv4 name wan-dmz rule 500
+set firewall ipv4 name wan-dmz rule 500 action 'accept'
+set firewall ipv4 name wan-dmz rule 500 destination address 192.168.200.200
+set firewall ipv4 name wan-dmz rule 500 destination port 25
+set firewall ipv4 name wan-dmz rule 500 log
+set firewall ipv4 name wan-dmz rule 500 protocol 'tcp'
+set firewall ipv4 name wan-dmz rule 600
+set firewall ipv4 name wan-dmz rule 600 action 'accept'
+set firewall ipv4 name wan-dmz rule 600 destination address 192.168.200.200
+set firewall ipv4 name wan-dmz rule 600 destination port 53
+set firewall ipv4 name wan-dmz rule 600 log
+set firewall ipv4 name wan-dmz rule 600 protocol 'tcp'
+set firewall ipv4 name wan-lan default-action 'drop'
+set firewall ipv4 name wan-lan default-log
+set firewall ipv4 name wan-lan rule 1
+set firewall ipv4 name wan-lan rule 1 action 'accept'
+set firewall ipv4 name wan-lan rule 1 state established
+set firewall ipv4 name wan-lan rule 1 state related
+set firewall ipv4 name wan-lan rule 2
+set firewall ipv4 name wan-lan rule 2 action 'drop'
+set firewall ipv4 name wan-lan rule 2 log
+set firewall ipv4 name wan-lan rule 2 state invalid
+set firewall ipv4 name wan-local default-action 'drop'
+set firewall ipv4 name wan-local default-log
+set firewall ipv4 name wan-local rule 1
+set firewall ipv4 name wan-local rule 1 action 'accept'
+set firewall ipv4 name wan-local rule 1 state established
+set firewall ipv4 name wan-local rule 1 state related
+set firewall ipv4 name wan-local rule 2
+set firewall ipv4 name wan-local rule 2 action 'drop'
+set firewall ipv4 name wan-local rule 2 log
+set firewall ipv4 name wan-local rule 2 state invalid
+set firewall ipv6 name dmz-lan-6 default-action 'drop'
+set firewall ipv6 name dmz-lan-6 default-log
+set firewall ipv6 name dmz-lan-6 rule 1
+set firewall ipv6 name dmz-lan-6 rule 1 action 'accept'
+set firewall ipv6 name dmz-lan-6 rule 1 state established
+set firewall ipv6 name dmz-lan-6 rule 1 state related
+set firewall ipv6 name dmz-lan-6 rule 2
+set firewall ipv6 name dmz-lan-6 rule 2 action 'drop'
+set firewall ipv6 name dmz-lan-6 rule 2 log
+set firewall ipv6 name dmz-lan-6 rule 2 state invalid
+set firewall ipv6 name dmz-local-6 default-action 'drop'
+set firewall ipv6 name dmz-local-6 default-log
+set firewall ipv6 name dmz-local-6 rule 1
+set firewall ipv6 name dmz-local-6 rule 1 action 'accept'
+set firewall ipv6 name dmz-local-6 rule 1 state established
+set firewall ipv6 name dmz-local-6 rule 1 state related
+set firewall ipv6 name dmz-local-6 rule 2
+set firewall ipv6 name dmz-local-6 rule 2 action 'drop'
+set firewall ipv6 name dmz-local-6 rule 2 log
+set firewall ipv6 name dmz-local-6 rule 2 state invalid
+set firewall ipv6 name dmz-local-6 rule 400
+set firewall ipv6 name dmz-local-6 rule 400 action 'accept'
+set firewall ipv6 name dmz-local-6 rule 400 destination port 123
+set firewall ipv6 name dmz-local-6 rule 400 log
+set firewall ipv6 name dmz-local-6 rule 400 protocol 'tcp'
+set firewall ipv6 name dmz-local-6 rule 600
+set firewall ipv6 name dmz-local-6 rule 600 action 'accept'
+set firewall ipv6 name dmz-local-6 rule 600 destination port 53
+set firewall ipv6 name dmz-local-6 rule 600 log
+set firewall ipv6 name dmz-local-6 rule 600 protocol 'tcp'
+set firewall ipv6 name dmz-local-6 rule 700
+set firewall ipv6 name dmz-local-6 rule 700 action 'accept'
+set firewall ipv6 name dmz-local-6 rule 700 destination port 67,68
+set firewall ipv6 name dmz-local-6 rule 700 log
+set firewall ipv6 name dmz-local-6 rule 700 protocol 'tcp'
+set firewall ipv6 name dmz-wan-6 default-action 'drop'
+set firewall ipv6 name dmz-wan-6 default-log
+set firewall ipv6 name dmz-wan-6 rule 1
+set firewall ipv6 name dmz-wan-6 rule 1 action 'accept'
+set firewall ipv6 name dmz-wan-6 rule 1 state established
+set firewall ipv6 name dmz-wan-6 rule 1 state related
+set firewall ipv6 name dmz-wan-6 rule 2
+set firewall ipv6 name dmz-wan-6 rule 2 action 'drop'
+set firewall ipv6 name dmz-wan-6 rule 2 log
+set firewall ipv6 name dmz-wan-6 rule 2 state invalid
+set firewall ipv6 name dmz-wan-6 rule 200
+set firewall ipv6 name dmz-wan-6 rule 200 action 'accept'
+set firewall ipv6 name dmz-wan-6 rule 200 destination port 80,443
+set firewall ipv6 name dmz-wan-6 rule 200 log
+set firewall ipv6 name dmz-wan-6 rule 200 protocol 'tcp'
+set firewall ipv6 name dmz-wan-6 rule 300
+set firewall ipv6 name dmz-wan-6 rule 300 action 'accept'
+set firewall ipv6 name dmz-wan-6 rule 300 destination port 20,21
+set firewall ipv6 name dmz-wan-6 rule 300 log
+set firewall ipv6 name dmz-wan-6 rule 300 protocol 'tcp'
+set firewall ipv6 name dmz-wan-6 rule 600
+set firewall ipv6 name dmz-wan-6 rule 600 action 'accept'
+set firewall ipv6 name dmz-wan-6 rule 600 destination port 53
+set firewall ipv6 name dmz-wan-6 rule 600 log
+set firewall ipv6 name dmz-wan-6 rule 600 protocol 'tcp_udp'
+set firewall ipv6 name dmz-wan-6 rule 800
+set firewall ipv6 name dmz-wan-6 rule 800 action 'accept'
+set firewall ipv6 name dmz-wan-6 rule 800 destination port 22
+set firewall ipv6 name dmz-wan-6 rule 800 log
+set firewall ipv6 name dmz-wan-6 rule 800 protocol 'tcp'
+set firewall ipv6 name lan-dmz-6 default-action 'drop'
+set firewall ipv6 name lan-dmz-6 default-log
+set firewall ipv6 name lan-dmz-6 rule 1
+set firewall ipv6 name lan-dmz-6 rule 1 action 'accept'
+set firewall ipv6 name lan-dmz-6 rule 1 state established
+set firewall ipv6 name lan-dmz-6 rule 1 state related
+set firewall ipv6 name lan-dmz-6 rule 2
+set firewall ipv6 name lan-dmz-6 rule 2 action 'drop'
+set firewall ipv6 name lan-dmz-6 rule 2 log
+set firewall ipv6 name lan-dmz-6 rule 2 state invalid
+set firewall ipv6 name lan-dmz-6 rule 200
+set firewall ipv6 name lan-dmz-6 rule 200 action 'accept'
+set firewall ipv6 name lan-dmz-6 rule 200 destination port 80,443
+set firewall ipv6 name lan-dmz-6 rule 200 log
+set firewall ipv6 name lan-dmz-6 rule 200 protocol 'tcp'
+set firewall ipv6 name lan-dmz-6 rule 800
+set firewall ipv6 name lan-dmz-6 rule 800 action 'accept'
+set firewall ipv6 name lan-dmz-6 rule 800 destination address 2001:db8:0:bbbb::200
+set firewall ipv6 name lan-dmz-6 rule 800 destination port 22
+set firewall ipv6 name lan-dmz-6 rule 800 log
+set firewall ipv6 name lan-dmz-6 rule 800 protocol 'tcp'
+set firewall ipv6 name lan-dmz-6 rule 800 source address 2001:db8:0:aaaa::10
+set firewall ipv6 name lan-dmz-6 rule 900
+set firewall ipv6 name lan-dmz-6 rule 900 action 'accept'
+set firewall ipv6 name lan-dmz-6 rule 900 destination port 993
+set firewall ipv6 name lan-dmz-6 rule 900 log
+set firewall ipv6 name lan-dmz-6 rule 900 protocol 'tcp'
+set firewall ipv6 name lan-local-6 default-action 'drop'
+set firewall ipv6 name lan-local-6 default-log
+set firewall ipv6 name lan-local-6 rule 1
+set firewall ipv6 name lan-local-6 rule 1 action 'accept'
+set firewall ipv6 name lan-local-6 rule 1 state established
+set firewall ipv6 name lan-local-6 rule 1 state related
+set firewall ipv6 name lan-local-6 rule 2
+set firewall ipv6 name lan-local-6 rule 2 action 'drop'
+set firewall ipv6 name lan-local-6 rule 2 log
+set firewall ipv6 name lan-local-6 rule 2 state invalid
+set firewall ipv6 name lan-local-6 rule 400
+set firewall ipv6 name lan-local-6 rule 400 action 'accept'
+set firewall ipv6 name lan-local-6 rule 400 destination port 123
+set firewall ipv6 name lan-local-6 rule 400 log
+set firewall ipv6 name lan-local-6 rule 400 protocol 'tcp'
+set firewall ipv6 name lan-local-6 rule 600
+set firewall ipv6 name lan-local-6 rule 600 action 'accept'
+set firewall ipv6 name lan-local-6 rule 600 destination port 53
+set firewall ipv6 name lan-local-6 rule 600 log
+set firewall ipv6 name lan-local-6 rule 600 protocol 'tcp'
+set firewall ipv6 name lan-local-6 rule 700
+set firewall ipv6 name lan-local-6 rule 700 action 'accept'
+set firewall ipv6 name lan-local-6 rule 700 destination port 67,68
+set firewall ipv6 name lan-local-6 rule 700 log
+set firewall ipv6 name lan-local-6 rule 700 protocol 'tcp'
+set firewall ipv6 name lan-local-6 rule 800
+set firewall ipv6 name lan-local-6 rule 800 action 'accept'
+set firewall ipv6 name lan-local-6 rule 800 destination port 22
+set firewall ipv6 name lan-local-6 rule 800 log
+set firewall ipv6 name lan-local-6 rule 800 protocol 'tcp'
+set firewall ipv6 name lan-local-6 rule 800 source address 2001:db8:0:aaaa::10
+set firewall ipv6 name lan-wan-6 default-action 'drop'
+set firewall ipv6 name lan-wan-6 default-log
+set firewall ipv6 name lan-wan-6 rule 1
+set firewall ipv6 name lan-wan-6 rule 1 action 'accept'
+set firewall ipv6 name lan-wan-6 rule 1 state established
+set firewall ipv6 name lan-wan-6 rule 1 state related
+set firewall ipv6 name lan-wan-6 rule 2
+set firewall ipv6 name lan-wan-6 rule 2 action 'drop'
+set firewall ipv6 name lan-wan-6 rule 2 log
+set firewall ipv6 name lan-wan-6 rule 2 state invalid
+set firewall ipv6 name lan-wan-6 rule 200
+set firewall ipv6 name lan-wan-6 rule 200 action 'accept'
+set firewall ipv6 name lan-wan-6 rule 200 destination port 80,443
+set firewall ipv6 name lan-wan-6 rule 200 log
+set firewall ipv6 name lan-wan-6 rule 200 protocol 'tcp'
+set firewall ipv6 name lan-wan-6 rule 300
+set firewall ipv6 name lan-wan-6 rule 300 action 'accept'
+set firewall ipv6 name lan-wan-6 rule 300 destination port 20,21
+set firewall ipv6 name lan-wan-6 rule 300 log
+set firewall ipv6 name lan-wan-6 rule 300 protocol 'tcp'
+set firewall ipv6 name lan-wan-6 rule 800
+set firewall ipv6 name lan-wan-6 rule 800 action 'accept'
+set firewall ipv6 name lan-wan-6 rule 800 destination port 22
+set firewall ipv6 name lan-wan-6 rule 800 log
+set firewall ipv6 name lan-wan-6 rule 800 protocol 'tcp'
+set firewall ipv6 name local-dmz-6 default-action 'drop'
+set firewall ipv6 name local-dmz-6 default-log
+set firewall ipv6 name local-dmz-6 rule 1
+set firewall ipv6 name local-dmz-6 rule 1 action 'accept'
+set firewall ipv6 name local-dmz-6 rule 1 state established
+set firewall ipv6 name local-dmz-6 rule 1 state related
+set firewall ipv6 name local-dmz-6 rule 2
+set firewall ipv6 name local-dmz-6 rule 2 action 'drop'
+set firewall ipv6 name local-dmz-6 rule 2 log
+set firewall ipv6 name local-dmz-6 rule 2 state invalid
+set firewall ipv6 name local-dmz-6 rule 500
+set firewall ipv6 name local-dmz-6 rule 500 action 'accept'
+set firewall ipv6 name local-dmz-6 rule 500 destination port 25
+set firewall ipv6 name local-dmz-6 rule 500 log
+set firewall ipv6 name local-dmz-6 rule 500 protocol 'tcp'
+set firewall ipv6 name local-dmz-6 rule 600
+set firewall ipv6 name local-dmz-6 rule 600 action 'accept'
+set firewall ipv6 name local-dmz-6 rule 600 destination port 53
+set firewall ipv6 name local-dmz-6 rule 600 log
+set firewall ipv6 name local-dmz-6 rule 600 protocol 'tcp_udp'
+set firewall ipv6 name local-dmz-6 rule 700
+set firewall ipv6 name local-dmz-6 rule 700 action 'accept'
+set firewall ipv6 name local-dmz-6 rule 700 destination port 67,68
+set firewall ipv6 name local-dmz-6 rule 700 log
+set firewall ipv6 name local-dmz-6 rule 700 protocol 'tcp'
+set firewall ipv6 name local-lan-6 default-action 'drop'
+set firewall ipv6 name local-lan-6 default-log
+set firewall ipv6 name local-lan-6 rule 1
+set firewall ipv6 name local-lan-6 rule 1 action 'accept'
+set firewall ipv6 name local-lan-6 rule 1 state established
+set firewall ipv6 name local-lan-6 rule 1 state related
+set firewall ipv6 name local-lan-6 rule 2
+set firewall ipv6 name local-lan-6 rule 2 action 'drop'
+set firewall ipv6 name local-lan-6 rule 2 log
+set firewall ipv6 name local-lan-6 rule 2 state invalid
+set firewall ipv6 name local-lan-6 rule 700
+set firewall ipv6 name local-lan-6 rule 700 action 'accept'
+set firewall ipv6 name local-lan-6 rule 700 destination port 67,68
+set firewall ipv6 name local-lan-6 rule 700 log
+set firewall ipv6 name local-lan-6 rule 700 protocol 'tcp'
+set firewall ipv6 name local-wan-6 default-action 'drop'
+set firewall ipv6 name local-wan-6 default-log
+set firewall ipv6 name local-wan-6 rule 1
+set firewall ipv6 name local-wan-6 rule 1 action 'accept'
+set firewall ipv6 name local-wan-6 rule 1 state established
+set firewall ipv6 name local-wan-6 rule 1 state related
+set firewall ipv6 name local-wan-6 rule 2
+set firewall ipv6 name local-wan-6 rule 2 action 'drop'
+set firewall ipv6 name local-wan-6 rule 2 log
+set firewall ipv6 name local-wan-6 rule 2 state invalid
+set firewall ipv6 name local-wan-6 rule 200
+set firewall ipv6 name local-wan-6 rule 200 action 'accept'
+set firewall ipv6 name local-wan-6 rule 200 destination port 80,443
+set firewall ipv6 name local-wan-6 rule 200 log
+set firewall ipv6 name local-wan-6 rule 200 protocol 'tcp'
+set firewall ipv6 name local-wan-6 rule 300
+set firewall ipv6 name local-wan-6 rule 300 action 'accept'
+set firewall ipv6 name local-wan-6 rule 300 destination port 20,21
+set firewall ipv6 name local-wan-6 rule 300 log
+set firewall ipv6 name local-wan-6 rule 300 protocol 'tcp'
+set firewall ipv6 name wan-dmz-6 default-action 'drop'
+set firewall ipv6 name wan-dmz-6 default-log
+set firewall ipv6 name wan-dmz-6 rule 1
+set firewall ipv6 name wan-dmz-6 rule 1 action 'accept'
+set firewall ipv6 name wan-dmz-6 rule 1 state established
+set firewall ipv6 name wan-dmz-6 rule 1 state related
+set firewall ipv6 name wan-dmz-6 rule 2
+set firewall ipv6 name wan-dmz-6 rule 2 action 'drop'
+set firewall ipv6 name wan-dmz-6 rule 2 log
+set firewall ipv6 name wan-dmz-6 rule 2 state invalid
+set firewall ipv6 name wan-dmz-6 rule 200
+set firewall ipv6 name wan-dmz-6 rule 200 action 'accept'
+set firewall ipv6 name wan-dmz-6 rule 200 destination address 2001:db8:0:bbbb::200
+set firewall ipv6 name wan-dmz-6 rule 200 destination port 80,443
+set firewall ipv6 name wan-dmz-6 rule 200 log
+set firewall ipv6 name wan-dmz-6 rule 200 protocol 'tcp'
+set firewall ipv6 name wan-dmz-6 rule 500
+set firewall ipv6 name wan-dmz-6 rule 500 action 'accept'
+set firewall ipv6 name wan-dmz-6 rule 500 destination address 2001:db8:0:bbbb::200
+set firewall ipv6 name wan-dmz-6 rule 500 destination port 25
+set firewall ipv6 name wan-dmz-6 rule 500 log
+set firewall ipv6 name wan-dmz-6 rule 500 protocol 'tcp'
+set firewall ipv6 name wan-dmz-6 rule 600
+set firewall ipv6 name wan-dmz-6 rule 600 action 'accept'
+set firewall ipv6 name wan-dmz-6 rule 600 destination address 2001:db8:0:bbbb::200
+set firewall ipv6 name wan-dmz-6 rule 600 destination port 53
+set firewall ipv6 name wan-dmz-6 rule 600 log
+set firewall ipv6 name wan-dmz-6 rule 600 protocol 'tcp'
+set firewall ipv6 name wan-lan-6 default-action 'drop'
+set firewall ipv6 name wan-lan-6 default-log
+set firewall ipv6 name wan-lan-6 rule 1
+set firewall ipv6 name wan-lan-6 rule 1 action 'accept'
+set firewall ipv6 name wan-lan-6 rule 1 state established
+set firewall ipv6 name wan-lan-6 rule 1 state related
+set firewall ipv6 name wan-lan-6 rule 2
+set firewall ipv6 name wan-lan-6 rule 2 action 'drop'
+set firewall ipv6 name wan-lan-6 rule 2 log
+set firewall ipv6 name wan-lan-6 rule 2 state invalid
+set firewall ipv6 name wan-local-6 default-action 'drop'
+set firewall ipv6 name wan-local-6 default-log
+set firewall ipv6 name wan-local-6 rule 1
+set firewall ipv6 name wan-local-6 rule 1 action 'accept'
+set firewall ipv6 name wan-local-6 rule 1 state established
+set firewall ipv6 name wan-local-6 rule 1 state related
+set firewall ipv6 name wan-local-6 rule 2
+set firewall ipv6 name wan-local-6 rule 2 action 'drop'
+set firewall ipv6 name wan-local-6 rule 2 log
+set firewall ipv6 name wan-local-6 rule 2 state invalid
+set firewall zone dmz default-action 'drop'
+set firewall zone dmz default-log
+set firewall zone dmz from lan firewall ipv6-name lan-dmz-6
+set firewall zone dmz from lan firewall name lan-dmz
+set firewall zone dmz from local firewall ipv6-name local-dmz-6
+set firewall zone dmz from local firewall name local-dmz
+set firewall zone dmz from wan firewall ipv6-name wan-dmz-6
+set firewall zone dmz from wan firewall name wan-dmz
+set firewall zone dmz member interface eth0.30
+set firewall zone lan default-action 'drop'
+set firewall zone lan default-log
+set firewall zone lan from dmz firewall ipv6-name dmz-lan-6
+set firewall zone lan from dmz firewall name dmz-lan
+set firewall zone lan from local firewall ipv6-name local-lan-6
+set firewall zone lan from local firewall name local-lan
+set firewall zone lan from wan firewall ipv6-name wan-lan-6
+set firewall zone lan from wan firewall name wan-lan
+set firewall zone lan member interface eth0.20
+set firewall zone local default-action 'drop'
+set firewall zone local default-log
+set firewall zone local from dmz firewall ipv6-name dmz-local-6
+set firewall zone local from dmz firewall name dmz-local
+set firewall zone local from lan firewall ipv6-name lan-local-6
+set firewall zone local from lan firewall name lan-local
+set firewall zone local from wan firewall ipv6-name wan-local-6
+set firewall zone local from wan firewall name wan-local
+set firewall zone local local-zone
+set firewall zone wan default-action 'drop'
+set firewall zone wan default-log
+set firewall zone wan from dmz firewall ipv6-name dmz-wan-6
+set firewall zone wan from dmz firewall name dmz-wan
+set firewall zone wan from lan firewall ipv6-name lan-wan-6
+set firewall zone wan from lan firewall name lan-wan
+set firewall zone wan from local firewall ipv6-name local-wan-6
+set firewall zone wan from local firewall name local-wan
+set firewall zone wan member interface eth0.10
diff --git a/tests/render/cases/zone_firewall/docs_zone_policy/vars.yml b/tests/render/cases/zone_firewall/docs_zone_policy/vars.yml
new file mode 100644
index 0000000..8450b97
--- /dev/null
+++ b/tests/render/cases/zone_firewall/docs_zone_policy/vars.yml
@@ -0,0 +1,71 @@
+---
+# docs.vyos.io/en/1.5/configexamples/zone-policy.html
+# Zones and VLANs from "Native IPv4 and IPv6"; rules from the page's rule list,
+# numbered with the page's scheme (100 ICMP, 200 Web, 300 FTP, 400 NTP,
+# 500 SMTP, 600 DNS, 700 DHCP, 800 SSH, 900 IMAPS). Protocols are as listed
+# on the page (it lists NTP and DHCP as tcp).
+zone_firewall_zones:
+  - {name: wan, interfaces: [eth0.10]}
+  - {name: lan, interfaces: [eth0.20]}
+  - {name: dmz, interfaces: [eth0.30]}
+  - {name: local, local: true}
+
+zone_firewall_policies:
+  - from: wan
+    to: dmz
+    rules:
+      - {number: 200, protocol: tcp, destination: {address: 192.168.200.200, port: "80,443"}}
+      - {number: 200, protocol: tcp, destination: {address: "2001:db8:0:bbbb::200", port: "80,443"}}
+      - {number: 500, protocol: tcp, destination: {address: 192.168.200.200, port: "25"}}
+      - {number: 500, protocol: tcp, destination: {address: "2001:db8:0:bbbb::200", port: "25"}}
+      - {number: 600, protocol: tcp, destination: {address: 192.168.200.200, port: "53"}}
+      - {number: 600, protocol: tcp, destination: {address: "2001:db8:0:bbbb::200", port: "53"}}
+  - from: dmz
+    to: local
+    rules:
+      - {number: 400, protocol: tcp, destination: {port: "123"}}
+      - {number: 600, protocol: tcp, destination: {port: "53"}}
+      - {number: 700, protocol: tcp, destination: {port: "67,68"}}
+  - from: lan
+    to: local
+    rules:
+      - {number: 400, protocol: tcp, destination: {port: "123"}}
+      - {number: 600, protocol: tcp, destination: {port: "53"}}
+      - {number: 700, protocol: tcp, destination: {port: "67,68"}}
+      - {number: 800, protocol: tcp, source: {address: 192.168.100.10}, destination: {port: "22"}}
+      - {number: 800, protocol: tcp, source: {address: "2001:db8:0:aaaa::10"}, destination: {port: "22"}}
+  - from: lan
+    to: wan
+    rules:
+      - {number: 200, protocol: tcp, destination: {port: "80,443"}}
+      - {number: 300, protocol: tcp, destination: {port: "20,21"}}
+      - {number: 800, protocol: tcp, destination: {port: "22"}}
+  - from: dmz
+    to: wan
+    rules:
+      - {number: 200, protocol: tcp, destination: {port: "80,443"}}
+      - {number: 300, protocol: tcp, destination: {port: "20,21"}}
+      - {number: 600, protocol: tcp_udp, destination: {port: "53"}}
+      - {number: 800, protocol: tcp, destination: {port: "22"}}
+  - from: local
+    to: wan
+    rules:
+      - {number: 200, protocol: tcp, destination: {port: "80,443"}}
+      - {number: 300, protocol: tcp, destination: {port: "20,21"}}
+  - from: local
+    to: dmz
+    rules:
+      - {number: 500, protocol: tcp, destination: {port: "25"}}
+      - {number: 600, protocol: tcp_udp, destination: {port: "53"}}
+      - {number: 700, protocol: tcp, destination: {port: "67,68"}}
+  - from: local
+    to: lan
+    rules:
+      - {number: 700, protocol: tcp, destination: {port: "67,68"}}
+  - from: lan
+    to: dmz
+    rules:
+      - {number: 200, protocol: tcp, destination: {port: "80,443"}}
+      - {number: 800, protocol: tcp, source: {address: 192.168.100.10}, destination: {address: 192.168.200.200, port: "22"}}
+      - {number: 800, protocol: tcp, source: {address: "2001:db8:0:aaaa::10"}, destination: {address: "2001:db8:0:bbbb::200", port: "22"}}
+      - {number: 900, protocol: tcp, destination: {port: "993"}}
diff --git a/tests/render/render.yml b/tests/render/render.yml
index 7c0f433..3c86b41 100644
--- a/tests/render/render.yml
+++ b/tests/render/render.yml
@@ -5,11 +5,12 @@
   vars:
     _expected_file: "{{ case_dir }}/expected/{{ inventory_hostname }}.txt"
   tasks:
-    - name: Render the role
+    - name: Render the role(s)
       ansible.builtin.include_role:
-        name: "vyos.blueprints.{{ role }}"
+        name: "vyos.blueprints.{{ item }}"
       vars:
         vyos_blueprints_render_only: true
+      loop: "{{ roles.split(',') if roles | default('') | length > 0 else [role] }}"
 
     - name: Normalise rendered commands
       ansible.builtin.set_fact:
diff --git a/tests/render/run.sh b/tests/render/run.sh
index 6b6fe1a..eaad5f6 100755
--- a/tests/render/run.sh
+++ b/tests/render/run.sh
@@ -6,8 +6,10 @@
 #   tests/render/run.sh ha_vrrp         # cases whose "<role>/<case>" starts with this
 #   UPDATE_GOLDEN=true tests/render/run.sh edge_nat   # regenerate golden files
 #
-# A case directory may contain vars.yml (shared inputs, passed as extra vars)
-# and inventory.yml (multi-node cases; per-host inputs live there).
+# A case directory may contain vars.yml (shared inputs, passed as extra vars),
+# inventory.yml (multi-node cases; per-host inputs live there) and roles (a
+# comma-separated role list, for blueprints that combine several roles; such
+# cases live under cases/blueprints/).
 set -euo pipefail
 here="$(cd "$(dirname "$0")" && pwd)"
 update="${UPDATE_GOLDEN:-false}"
@@ -23,6 +25,8 @@ for case_dir in "$here"/cases/*/*/; do
   args=(-i "$inventory" "$here/render.yml"
         -e "role=$role" -e "case_dir=$case_dir" -e "update_golden=$update")
   [[ -f "$case_dir/vars.yml" ]] && args+=(-e "@$case_dir/vars.yml")
+  # Blueprints that combine roles list them, comma-separated, in a "roles" file.
+  [[ -f "$case_dir/roles" ]] && args+=(-e "roles=$(tr -d '[:space:]' < "$case_dir/roles")")
   mkdir -p "$case_dir/expected"
   echo "=== $role/$name"
   if ! ansible-playbook "${args[@]}"; then
author	omnom62 <omnom62@outlook.com>	2026-10-05 20:56:05 +1000
committer	omnom62 <omnom62@outlook.com>	2026-10-05 20:56:05 +1000
commit	8ee802e41374942965b6b93cfb4534725ef45145 (patch)
tree	ef3e5579bd767422caa6fe77cea6a7b5d2d8562c /tests
parent	748df2bc1d35fa285dd3fe46916e1230408778c7 (diff)
download	vyos.blueprints-main.tar.gz vyos.blueprints-main.zip