T8321: vpn_ipsec modules (#489)

Add VPN IPsec module

32 files changed, 1236 insertions, 0 deletions

diff --git a/tests/integration/targets/vyos_vpn_ipsec/defaults/main.yaml b/tests/integration/targets/vyos_vpn_ipsec/defaults/main.yaml
new file mode 100644
index 00000000..164afead
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/defaults/main.yaml
@@ -0,0 +1,3 @@
+---
+testcase: "[^_].*"
+test_items: []
diff --git a/tests/integration/targets/vyos_vpn_ipsec/meta/main.yaml b/tests/integration/targets/vyos_vpn_ipsec/meta/main.yaml
new file mode 100644
index 00000000..ed97d539
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/meta/main.yaml
@@ -0,0 +1 @@
+---
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tasks/cli.yaml b/tests/integration/targets/vyos_vpn_ipsec/tasks/cli.yaml
new file mode 100644
index 00000000..daccf720
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tasks/cli.yaml
@@ -0,0 +1,20 @@
+---
+- name: Collect all cli test cases
+  ansible.builtin.find:
+    paths: "{{ role_path }}/tests/cli"
+    patterns: "{{ testcase }}.yaml"
+    use_regex: true
+  register: test_cases
+  delegate_to: localhost
+
+- name: Set test_items
+  ansible.builtin.set_fact:
+    test_items: "{{ test_cases.files | map(attribute='path') | list }}"
+
+- name: Run test case (connection=ansible.netcommon.network_cli)
+  ansible.builtin.include_tasks: "{{ test_case_to_run }}"
+  vars:
+    ansible_connection: ansible.netcommon.network_cli
+  with_items: "{{ test_items }}"
+  loop_control:
+    loop_var: test_case_to_run
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tasks/main.yaml b/tests/integration/targets/vyos_vpn_ipsec/tasks/main.yaml
new file mode 100644
index 00000000..e6378581
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tasks/main.yaml
@@ -0,0 +1,5 @@
+---
+- name: Run CLI tests
+  ansible.builtin.include_tasks: cli.yaml
+  tags:
+    - network_cli
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/_parsed.cfg b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/_parsed.cfg
new file mode 100644
index 00000000..85a382e7
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/_parsed.cfg
@@ -0,0 +1,3 @@
+set vpn ipsec esp-group ESP-PARSE-TEST proposal 1 encryption 'aes256'
+set vpn ipsec esp-group ESP-PARSE-TEST proposal 1 hash 'sha256'
+set vpn ipsec ike-group IKE-PARSE-TEST key-exchange 'ikev2'
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/_populate.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/_populate.yaml
new file mode 100644
index 00000000..96842807
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/_populate.yaml
@@ -0,0 +1,8 @@
+---
+- ansible.builtin.include_tasks: _remove_config.yaml
+
+- name: POPULATE Apply the provided configuration
+  register: result
+  vyos.vyos.vyos_vpn_ipsec:
+    config: "{{ populate_config }}"
+    state: merged
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/_remove_config.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/_remove_config.yaml
new file mode 100644
index 00000000..14b032e3
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/_remove_config.yaml
@@ -0,0 +1,4 @@
+---
+- name: delete the provided configuration
+  vyos.vyos.vyos_vpn_ipsec:
+    state: deleted
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/deleted.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/deleted.yaml
new file mode 100644
index 00000000..eee2c822
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/deleted.yaml
@@ -0,0 +1,69 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec deleted integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: TEST - [deleted] Remove all configuration
+      vyos.vyos.vyos_vpn_ipsec:
+        state: deleted
+      register: result
+
+    - name: TEST - [deleted] Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ deleted['commands'] | symmetric_difference(result['commands']) | length == 0 }}"
+          - result.changed == true
+          - result.after == deleted.after
+
+    - name: TEST - [deleted] Remove all configuration again (IDEMPOTENT)
+      vyos.vyos.vyos_vpn_ipsec:
+        state: deleted
+      register: result
+
+    - name: TEST - [deleted] Assert idempotent
+      assert:
+        that:
+          - result.changed == false
+          - result.commands == []
+
+  always:
+    - include_tasks: _remove_config.yaml
+
+- block:
+    - include_tasks: _populate.yaml
+
+    - name: TEST - [deleted scoped] Remove only IKE-EXTRA by name
+      vyos.vyos.vyos_vpn_ipsec:
+        config:
+          ike_group:
+            - name: IKE-EXTRA
+        state: deleted
+      register: result
+
+    - name: TEST - [deleted scoped] Assert only IKE-EXTRA was removed
+      assert:
+        that:
+          - result.commands == ["delete vpn ipsec ike-group IKE-EXTRA"]
+          - result.changed == true
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: vpn_ipsec
+
+    - name: TEST - [deleted scoped] Assert IKE-TEST and everything else survived
+      vars:
+        redacted: VALUE_SPECIFIED_IN_NO_LOG_PARAMETER
+      assert:
+        that:
+          - ansible_facts['network_resources']['vpn_ipsec']['ike_group'] == [populate_config.ike_group[0]]
+          - ansible_facts['network_resources']['vpn_ipsec']['esp_group'] == populate_config.esp_group
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['name'] == populate_config.profile[0].name
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['authentication']['mode'] == populate_config.profile[0].authentication.mode
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['authentication']['pre_shared_secret'] == redacted
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['bind_tunnel'] == populate_config.profile[0].bind_tunnel
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['esp_group'] == populate_config.profile[0].esp_group
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['ike_group'] == populate_config.profile[0].ike_group
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/empty_config.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/empty_config.yaml
new file mode 100644
index 00000000..7d0329fd
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/empty_config.yaml
@@ -0,0 +1,58 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec empty_config integration tests on connection={{ ansible_connection }}
+
+- name: Merged with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec:
+    config:
+    state: merged
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state merged'
+
+- name: Replaced with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec:
+    config:
+    state: replaced
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state replaced'
+
+- name: Overridden with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec:
+    config:
+    state: overridden
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state overridden'
+
+- name: Rendered with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec:
+    config:
+    state: rendered
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state rendered'
+
+- name: Parsed with empty running_config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec:
+    running_config:
+    state: parsed
+
+- assert:
+    that:
+      - result.msg == 'value of running_config parameter must not be empty for state parsed'
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/gathered.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/gathered.yaml
new file mode 100644
index 00000000..716bc305
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/gathered.yaml
@@ -0,0 +1,28 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec gathered integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: TEST - [gathered] Gather the existing running configuration
+      register: result
+      vyos.vyos.vyos_vpn_ipsec:
+        state: gathered
+
+    - name: TEST - [gathered] Assert
+      vars:
+        redacted: VALUE_SPECIFIED_IN_NO_LOG_PARAMETER
+      assert:
+        that:
+          - result.changed == false
+          - result.gathered.esp_group == populate_config.esp_group
+          - result.gathered.profile[0].name == populate_config.profile[0].name
+          - result.gathered.profile[0].authentication.mode == populate_config.profile[0].authentication.mode
+          - result.gathered.profile[0].authentication.pre_shared_secret == redacted
+          - result.gathered.profile[0].bind_tunnel == populate_config.profile[0].bind_tunnel
+          - result.gathered.profile[0].esp_group == populate_config.profile[0].esp_group
+          - result.gathered.profile[0].ike_group == populate_config.profile[0].ike_group
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/merged.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/merged.yaml
new file mode 100644
index 00000000..6c21d107
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/merged.yaml
@@ -0,0 +1,37 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec merged integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _remove_config.yaml
+
+- block:
+    - name: Merge the provided configuration with the existing running configuration
+      register: result
+      vyos.vyos.vyos_vpn_ipsec: &id001
+        config: "{{ merged.config }}"
+        state: merged
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: vpn_ipsec
+
+    - name: Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ merged['commands'] | symmetric_difference(result['commands']) | length == 0 }}"
+          - result.changed == true
+          - result.after == ansible_facts['network_resources']['vpn_ipsec']
+          - result.after == merged.after
+          - result.before == {}
+
+    - name: Merge the provided configuration with the existing running configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_vpn_ipsec: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+          - result['commands'] == []
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/overridden.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/overridden.yaml
new file mode 100644
index 00000000..6a8eed30
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/overridden.yaml
@@ -0,0 +1,36 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec overridden integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Override with only ESP-TEST named -- everything else must be removed
+      register: result
+      vyos.vyos.vyos_vpn_ipsec: &id001
+        config: "{{ overridden.config }}"
+        state: overridden
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: vpn_ipsec
+
+    - name: Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ overridden['commands'] | symmetric_difference(result['commands']) | length == 0 }}"
+          - result.changed == true
+          - result.after == ansible_facts['network_resources']['vpn_ipsec']
+          - result.after == overridden.after
+
+    - name: Override with the same configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_vpn_ipsec: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+          - result['commands'] == []
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/parsed.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/parsed.yaml
new file mode 100644
index 00000000..0d1197e4
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/parsed.yaml
@@ -0,0 +1,14 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec parsed integration tests on connection={{ ansible_connection }}
+
+- name: TEST - [parsed] Parse the commands for provided configuration
+  register: result
+  vyos.vyos.vyos_vpn_ipsec:
+    running_config: "{{ lookup('file', '_parsed.cfg') }}"
+    state: parsed
+
+- assert:
+    that:
+      - result.changed == false
+      - parsed['after'] == result.parsed
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/rendered.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/rendered.yaml
new file mode 100644
index 00000000..1babcc2b
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/rendered.yaml
@@ -0,0 +1,15 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec rendered integration tests on connection={{ ansible_connection }}
+
+- block:
+    - name: Structure provided configuration into device specific commands
+      register: result
+      vyos.vyos.vyos_vpn_ipsec:
+        config: "{{ rendered.config }}"
+        state: rendered
+
+    - name: Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ rendered['commands'] | symmetric_difference(result['rendered']) | length == 0 }}"
diff --git a/tests/integration/targets/vyos_vpn_ipsec/tests/cli/replaced.yaml b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/replaced.yaml
new file mode 100644
index 00000000..0714e8dc
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/tests/cli/replaced.yaml
@@ -0,0 +1,61 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec replaced integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Replace only the named esp_group -- other sections must be untouched
+      register: result
+      vyos.vyos.vyos_vpn_ipsec: &id001
+        config: "{{ replaced.config }}"
+        state: replaced
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: vpn_ipsec
+
+    - name: Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ replaced['commands'] | symmetric_difference(result['commands']) | length == 0 }}"
+          - result.changed == true
+
+    - name: Assert that ESP-TEST was correctly reconciled
+      assert:
+        that:
+          - ansible_facts['network_resources']['vpn_ipsec']['esp_group'] == replaced.after.esp_group
+
+    - name: Assert that un-named sections were left completely untouched
+      vars:
+        redacted: VALUE_SPECIFIED_IN_NO_LOG_PARAMETER
+      assert:
+        that:
+          - (ansible_facts['network_resources']['vpn_ipsec']['ike_group'] | sort(attribute='name')) == (populate_config.ike_group | sort(attribute='name'))
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['name'] == populate_config.profile[0].name
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['authentication']['mode'] == populate_config.profile[0].authentication.mode
+          # pre_shared_secret/secret carry no_log: True in the argspec --
+          # gathered facts always redact them to this literal placeholder,
+          # never the real value, so that's what must be asserted here.
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['authentication']['pre_shared_secret'] == redacted
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['bind_tunnel'] == populate_config.profile[0].bind_tunnel
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['esp_group'] == populate_config.profile[0].esp_group
+          - ansible_facts['network_resources']['vpn_ipsec']['profile'][0]['ike_group'] == populate_config.profile[0].ike_group
+          - ansible_facts['network_resources']['vpn_ipsec']['authentication']['psk'][0]['name'] == populate_config.authentication.psk[0].name
+          - ansible_facts['network_resources']['vpn_ipsec']['authentication']['psk'][0]['secret'] == redacted
+          - (ansible_facts['network_resources']['vpn_ipsec']['authentication']['psk'][0]['id'] | sort) == (populate_config.authentication.psk[0].id | sort)
+          - ansible_facts['network_resources']['vpn_ipsec']['authentication']['ppk'][0]['name'] == populate_config.authentication.ppk[0].name
+          - ansible_facts['network_resources']['vpn_ipsec']['authentication']['ppk'][0]['secret'] == redacted
+          - ansible_facts['network_resources']['vpn_ipsec']['authentication']['ppk'][0]['id'] == populate_config.authentication.ppk[0].id
+
+    - name: Replace with the same configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_vpn_ipsec: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+          - result['commands'] == []
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec/vars/main.yaml b/tests/integration/targets/vyos_vpn_ipsec/vars/main.yaml
new file mode 100644
index 00000000..b86a8d72
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec/vars/main.yaml
@@ -0,0 +1,231 @@
+---
+merged:
+  config:
+    esp_group:
+      - name: ESP-TEST
+        compression: true
+        proposal:
+          - proposal_id: 1
+            encryption: aes256
+            hash: sha256
+    ike_group:
+      - name: IKE-TEST
+        key_exchange: ikev2
+        disable_mobike: true
+        dead_peer_detection:
+          action: restart
+          interval: 15
+          timeout: 60
+        proposal:
+          - proposal_id: 1
+            encryption: aes256
+            hash: sha256
+            dh_group: 14
+  commands:
+    - set vpn ipsec esp-group ESP-TEST
+    - set vpn ipsec esp-group ESP-TEST compression
+    - set vpn ipsec esp-group ESP-TEST proposal 1
+    - set vpn ipsec esp-group ESP-TEST proposal 1 encryption aes256
+    - set vpn ipsec esp-group ESP-TEST proposal 1 hash sha256
+    - set vpn ipsec ike-group IKE-TEST
+    - set vpn ipsec ike-group IKE-TEST key-exchange ikev2
+    - set vpn ipsec ike-group IKE-TEST disable-mobike
+    - set vpn ipsec ike-group IKE-TEST dead-peer-detection action restart
+    - set vpn ipsec ike-group IKE-TEST dead-peer-detection interval 15
+    - set vpn ipsec ike-group IKE-TEST dead-peer-detection timeout 60
+    - set vpn ipsec ike-group IKE-TEST proposal 1
+    - set vpn ipsec ike-group IKE-TEST proposal 1 encryption aes256
+    - set vpn ipsec ike-group IKE-TEST proposal 1 hash sha256
+    - set vpn ipsec ike-group IKE-TEST proposal 1 dh-group 14
+  after:
+    esp_group:
+      - name: ESP-TEST
+        compression: true
+        proposal:
+          - proposal_id: 1
+            encryption: aes256
+            hash: sha256
+    ike_group:
+      - name: IKE-TEST
+        key_exchange: ikev2
+        disable_mobike: true
+        dead_peer_detection:
+          action: restart
+          interval: 15
+          timeout: 60
+        proposal:
+          - proposal_id: 1
+            encryption: aes256
+            hash: sha256
+            dh_group: 14
+
+# Full pre-populated state used by replaced/overridden/deleted/gathered --
+# matches the same shape as the unit test fixture, so expected
+# commands/after values here are grounded in what's already unit-tested,
+# not invented fresh.
+populate_config:
+  esp_group:
+    - name: ESP-TEST
+      compression: true
+      proposal:
+        - proposal_id: 1
+          encryption: aes256
+          hash: sha256
+  ike_group:
+    - name: IKE-TEST
+      key_exchange: ikev2
+      disable_mobike: true
+      dead_peer_detection:
+        action: restart
+        interval: 15
+        timeout: 60
+      proposal:
+        - proposal_id: 1
+          encryption: aes256
+          hash: sha256
+          dh_group: 14
+    - name: IKE-EXTRA
+      key_exchange: ikev1
+  authentication:
+    psk:
+      - name: PSK-TEST
+        id:
+          - local@example.com
+          - remote@example.com
+        secret: test-not-real-secret
+    ppk:
+      - name: PPK-TEST
+        id:
+          - ppk-id-1
+        secret: test-ppk-secret
+  profile:
+    - name: testprofile
+      authentication:
+        mode: pre-shared-secret
+        pre_shared_secret: test-not-real-secret
+      bind_tunnel:
+        - tun0
+      esp_group: ESP-TEST
+      ike_group: IKE-TEST
+  disable_uniqreqids: true
+  interface:
+    - eth0
+    - eth1
+  log:
+    level: 1
+    subsystem:
+      - ike
+      - chd
+  options:
+    flexvpn: true
+    retransmission:
+      attempts: 3
+
+replaced:
+  config:
+    esp_group:
+      - name: ESP-TEST
+        proposal:
+          - proposal_id: 1
+            encryption: aes128
+            hash: sha256
+  commands:
+    - delete vpn ipsec esp-group ESP-TEST compression
+    - set vpn ipsec esp-group ESP-TEST proposal 1 encryption aes128
+    - delete vpn ipsec disable-uniqreqids
+    - delete vpn ipsec interface eth0
+    - delete vpn ipsec interface eth1
+    - delete vpn ipsec log level 1
+    - delete vpn ipsec log subsystem chd
+    - delete vpn ipsec log subsystem ike
+    - delete vpn ipsec options flexvpn
+    - delete vpn ipsec options retransmission attempts 3
+  # NOTE: ike_group/profile/authentication are NOT in `after` deletions --
+  # they're left untouched since replaced only reconciles items it names.
+  # `after` below reflects only what replaced's scope actually changes;
+  # the un-named sections (ike_group, profile, authentication) remain
+  # exactly as populate_config left them and are checked separately in
+  # replaced.yaml via ansible_facts rather than duplicated here.
+  after:
+    esp_group:
+      - name: ESP-TEST
+        proposal:
+          - proposal_id: 1
+            encryption: aes128
+            hash: sha256
+
+overridden:
+  config:
+    esp_group:
+      - name: ESP-TEST
+        proposal:
+          - proposal_id: 1
+            encryption: aes128
+            hash: sha256
+  commands:
+    - delete vpn ipsec esp-group ESP-TEST compression
+    - set vpn ipsec esp-group ESP-TEST proposal 1 encryption aes128
+    - delete vpn ipsec ike-group IKE-TEST
+    - delete vpn ipsec ike-group IKE-EXTRA
+    - delete vpn ipsec profile testprofile
+    - delete vpn ipsec authentication psk PSK-TEST
+    - delete vpn ipsec authentication ppk PPK-TEST
+    - delete vpn ipsec disable-uniqreqids
+    - delete vpn ipsec interface eth0
+    - delete vpn ipsec interface eth1
+    - delete vpn ipsec log level 1
+    - delete vpn ipsec log subsystem chd
+    - delete vpn ipsec log subsystem ike
+    - delete vpn ipsec options flexvpn
+    - delete vpn ipsec options retransmission attempts 3
+  after:
+    esp_group:
+      - name: ESP-TEST
+        proposal:
+          - proposal_id: 1
+            encryption: aes128
+            hash: sha256
+
+deleted:
+  commands:
+    - delete vpn ipsec esp-group ESP-TEST
+    - delete vpn ipsec ike-group IKE-TEST
+    - delete vpn ipsec ike-group IKE-EXTRA
+    - delete vpn ipsec profile testprofile
+    - delete vpn ipsec authentication psk PSK-TEST
+    - delete vpn ipsec authentication ppk PPK-TEST
+    - delete vpn ipsec disable-uniqreqids
+    - delete vpn ipsec interface eth0
+    - delete vpn ipsec interface eth1
+    - delete vpn ipsec log level 1
+    - delete vpn ipsec log subsystem chd
+    - delete vpn ipsec log subsystem ike
+    - delete vpn ipsec options flexvpn
+    - delete vpn ipsec options retransmission attempts 3
+  after: {}
+
+rendered:
+  config:
+    esp_group:
+      - name: ESP-RENDER-TEST
+        proposal:
+          - proposal_id: 1
+            encryption: aes256
+            hash: sha256
+  commands:
+    - set vpn ipsec esp-group ESP-RENDER-TEST
+    - set vpn ipsec esp-group ESP-RENDER-TEST proposal 1
+    - set vpn ipsec esp-group ESP-RENDER-TEST proposal 1 encryption aes256
+    - set vpn ipsec esp-group ESP-RENDER-TEST proposal 1 hash sha256
+
+parsed:
+  after:
+    esp_group:
+      - name: ESP-PARSE-TEST
+        proposal:
+          - proposal_id: 1
+            encryption: aes256
+            hash: sha256
+    ike_group:
+      - name: IKE-PARSE-TEST
+        key_exchange: ikev2
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/defaults/main.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/defaults/main.yaml
new file mode 100644
index 00000000..164afead
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/defaults/main.yaml
@@ -0,0 +1,3 @@
+---
+testcase: "[^_].*"
+test_items: []
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/meta/main.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/meta/main.yaml
new file mode 100644
index 00000000..ed97d539
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/meta/main.yaml
@@ -0,0 +1 @@
+---
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tasks/cli.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tasks/cli.yaml
new file mode 100644
index 00000000..daccf720
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tasks/cli.yaml
@@ -0,0 +1,20 @@
+---
+- name: Collect all cli test cases
+  ansible.builtin.find:
+    paths: "{{ role_path }}/tests/cli"
+    patterns: "{{ testcase }}.yaml"
+    use_regex: true
+  register: test_cases
+  delegate_to: localhost
+
+- name: Set test_items
+  ansible.builtin.set_fact:
+    test_items: "{{ test_cases.files | map(attribute='path') | list }}"
+
+- name: Run test case (connection=ansible.netcommon.network_cli)
+  ansible.builtin.include_tasks: "{{ test_case_to_run }}"
+  vars:
+    ansible_connection: ansible.netcommon.network_cli
+  with_items: "{{ test_items }}"
+  loop_control:
+    loop_var: test_case_to_run
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tasks/main.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tasks/main.yaml
new file mode 100644
index 00000000..e6378581
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tasks/main.yaml
@@ -0,0 +1,5 @@
+---
+- name: Run CLI tests
+  ansible.builtin.include_tasks: cli.yaml
+  tags:
+    - network_cli
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/_parsed.cfg b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/_parsed.cfg
new file mode 100644
index 00000000..37b7fb4e
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/_parsed.cfg
@@ -0,0 +1 @@
+set vpn ipsec site-to-site peer PEER-PARSE-TEST ike-group 'IKE-TEST'
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/_populate.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/_populate.yaml
new file mode 100644
index 00000000..b196d27a
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/_populate.yaml
@@ -0,0 +1,37 @@
+---
+- ansible.builtin.include_tasks: _remove_config.yaml
+
+# Real device dependencies discovered while building this module:
+# vpn ipsec site-to-site peer references esp-group/ike-group by name
+# (from the vyos_vpn_ipsec profile-layer module), and vti.bind requires
+# the referenced interface to already exist -- neither is created by
+# this module itself. Made self-contained here rather than assuming
+# vyos_vpn_ipsec's own tests already left this state behind.
+- name: PREREQ Create the esp-group/ike-group referenced by the test peer
+  vyos.vyos.vyos_vpn_ipsec:
+    config:
+      esp_group:
+        - name: ESP-TEST
+          proposal:
+            - proposal_id: 1
+              encryption: aes256
+              hash: sha256
+      ike_group:
+        - name: IKE-TEST
+          key_exchange: ikev2
+          proposal:
+            - proposal_id: 1
+              encryption: aes256
+              hash: sha256
+    state: merged
+
+- name: PREREQ Create the vti0 interface referenced by vti.bind
+  vyos.vyos.vyos_config:
+    lines:
+      - set interfaces vti vti0
+
+- name: POPULATE Apply the provided configuration
+  register: result
+  vyos.vyos.vyos_vpn_ipsec_s2s:
+    config: "{{ populate_config }}"
+    state: merged
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/_remove_config.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/_remove_config.yaml
new file mode 100644
index 00000000..a5da6334
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/_remove_config.yaml
@@ -0,0 +1,13 @@
+---
+- name: delete the provided configuration
+  vyos.vyos.vyos_vpn_ipsec_s2s:
+    state: deleted
+
+- name: Remove the prerequisite esp-group/ike-group
+  vyos.vyos.vyos_vpn_ipsec:
+    state: deleted
+
+- name: Remove the prerequisite vti0 interface
+  vyos.vyos.vyos_config:
+    lines:
+      - delete interfaces vti vti0
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/deleted.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/deleted.yaml
new file mode 100644
index 00000000..dc870783
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/deleted.yaml
@@ -0,0 +1,60 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec_s2s deleted integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: TEST - [deleted] Remove all configuration
+      vyos.vyos.vyos_vpn_ipsec_s2s:
+        state: deleted
+      register: result
+
+    - name: TEST - [deleted] Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ deleted['commands'] | symmetric_difference(result['commands']) | length == 0 }}"
+          - result.changed == true
+          - result.after == deleted.after
+
+    - name: TEST - [deleted] Remove all configuration again (IDEMPOTENT)
+      vyos.vyos.vyos_vpn_ipsec_s2s:
+        state: deleted
+      register: result
+
+    - name: TEST - [deleted] Assert idempotent
+      assert:
+        that:
+          - result.changed == false
+          - result.commands == []
+
+  always:
+    - include_tasks: _remove_config.yaml
+
+- block:
+    - include_tasks: _populate.yaml
+
+    - name: TEST - [deleted scoped] Remove only PEER-EXTRA by name
+      vyos.vyos.vyos_vpn_ipsec_s2s:
+        config:
+          peer:
+            - name: PEER-EXTRA
+        state: deleted
+      register: result
+
+    - name: TEST - [deleted scoped] Assert only PEER-EXTRA was removed
+      assert:
+        that:
+          - result.commands == ["delete vpn ipsec site-to-site peer PEER-EXTRA"]
+          - result.changed == true
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: vpn_ipsec_s2s
+
+    - name: TEST - [deleted scoped] Assert PEER-TEST survived
+      assert:
+        that:
+          - ansible_facts['network_resources']['vpn_ipsec_s2s']['peer'] | map(attribute='name') | list == ['PEER-TEST']
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/empty_config.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/empty_config.yaml
new file mode 100644
index 00000000..026cf22c
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/empty_config.yaml
@@ -0,0 +1,58 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec_s2s empty_config integration tests on connection={{ ansible_connection }}
+
+- name: Merged with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec_s2s:
+    config:
+    state: merged
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state merged'
+
+- name: Replaced with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec_s2s:
+    config:
+    state: replaced
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state replaced'
+
+- name: Overridden with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec_s2s:
+    config:
+    state: overridden
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state overridden'
+
+- name: Rendered with empty config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec_s2s:
+    config:
+    state: rendered
+
+- assert:
+    that:
+      - result.msg == 'value of config parameter must not be empty for state rendered'
+
+- name: Parsed with empty running_config should give appropriate error message
+  register: result
+  ignore_errors: true
+  vyos.vyos.vyos_vpn_ipsec_s2s:
+    running_config:
+    state: parsed
+
+- assert:
+    that:
+      - result.msg == 'value of running_config parameter must not be empty for state parsed'
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/gathered.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/gathered.yaml
new file mode 100644
index 00000000..9b9adfd6
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/gathered.yaml
@@ -0,0 +1,20 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec_s2s gathered integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: TEST - [gathered] Gather the existing running configuration
+      register: result
+      vyos.vyos.vyos_vpn_ipsec_s2s:
+        state: gathered
+
+    - name: TEST - [gathered] Assert
+      assert:
+        that:
+          - result.changed == false
+          - result.gathered.peer | map(attribute='name') | sort | list == ['PEER-EXTRA', 'PEER-TEST']
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/merged.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/merged.yaml
new file mode 100644
index 00000000..06b528fb
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/merged.yaml
@@ -0,0 +1,58 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec_s2s merged integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _remove_config.yaml
+
+- name: PREREQ Create the esp-group/ike-group referenced by the test peer
+  vyos.vyos.vyos_vpn_ipsec:
+    config:
+      esp_group:
+        - name: ESP-TEST
+          proposal:
+            - proposal_id: 1
+              encryption: aes256
+              hash: sha256
+      ike_group:
+        - name: IKE-TEST
+          key_exchange: ikev2
+          proposal:
+            - proposal_id: 1
+              encryption: aes256
+              hash: sha256
+    state: merged
+
+- name: PREREQ Create the vti0 interface referenced by vti.bind
+  vyos.vyos.vyos_config:
+    lines:
+      - set interfaces vti vti0
+
+- block:
+    - name: Merge the provided configuration with the existing running configuration
+      register: result
+      vyos.vyos.vyos_vpn_ipsec_s2s: &id001
+        config: "{{ merged.config }}"
+        state: merged
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: vpn_ipsec_s2s
+
+    - name: Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ merged['commands'] | symmetric_difference(result['commands']) | length == 0 }}"
+          - result.changed == true
+          - result.before == {}
+
+    - name: Merge the provided configuration with the existing running configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_vpn_ipsec_s2s: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+          - result['commands'] == []
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/overridden.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/overridden.yaml
new file mode 100644
index 00000000..04a5a990
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/overridden.yaml
@@ -0,0 +1,39 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec_s2s overridden integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Override with only PEER-TEST named -- PEER-EXTRA must be removed
+      register: result
+      vyos.vyos.vyos_vpn_ipsec_s2s: &id001
+        config: "{{ overridden.config }}"
+        state: overridden
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: vpn_ipsec_s2s
+
+    - name: Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ overridden['commands'] | symmetric_difference(result['commands']) | length == 0 }}"
+          - result.changed == true
+
+    - name: Assert that only PEER-TEST remains
+      assert:
+        that:
+          - ansible_facts['network_resources']['vpn_ipsec_s2s']['peer'] | map(attribute='name') | list == ['PEER-TEST']
+
+    - name: Override with the same configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_vpn_ipsec_s2s: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+          - result['commands'] == []
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/parsed.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/parsed.yaml
new file mode 100644
index 00000000..114d19d0
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/parsed.yaml
@@ -0,0 +1,14 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec_s2s parsed integration tests on connection={{ ansible_connection }}
+
+- name: TEST - [parsed] Parse the commands for provided configuration
+  register: result
+  vyos.vyos.vyos_vpn_ipsec_s2s:
+    running_config: "{{ lookup('file', '_parsed.cfg') }}"
+    state: parsed
+
+- assert:
+    that:
+      - result.changed == false
+      - parsed['after'] == result.parsed
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/rendered.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/rendered.yaml
new file mode 100644
index 00000000..dd5a8ddf
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/rendered.yaml
@@ -0,0 +1,15 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec_s2s rendered integration tests on connection={{ ansible_connection }}
+
+- block:
+    - name: Structure provided configuration into device specific commands
+      register: result
+      vyos.vyos.vyos_vpn_ipsec_s2s:
+        config: "{{ rendered.config }}"
+        state: rendered
+
+    - name: Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ rendered['commands'] | symmetric_difference(result['rendered']) | length == 0 }}"
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/replaced.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/replaced.yaml
new file mode 100644
index 00000000..78e4158e
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/tests/cli/replaced.yaml
@@ -0,0 +1,42 @@
+---
+- debug:
+    msg: START vyos_vpn_ipsec_s2s replaced integration tests on connection={{ ansible_connection }}
+
+- include_tasks: _populate.yaml
+
+- block:
+    - name: Replace only the named peer -- other sections must be untouched
+      register: result
+      vyos.vyos.vyos_vpn_ipsec_s2s: &id001
+        config: "{{ replaced.config }}"
+        state: replaced
+
+    - vyos.vyos.vyos_facts:
+        gather_network_resources: vpn_ipsec_s2s
+
+    - name: Assert that correct set of commands were generated
+      assert:
+        that:
+          - "{{ replaced['commands'] | symmetric_difference(result['commands']) | length == 0 }}"
+          - result.changed == true
+
+    - name: Assert that PEER-EXTRA was left completely untouched
+      assert:
+        that:
+          - >-
+            (ansible_facts['network_resources']['vpn_ipsec_s2s']['peer']
+            | selectattr('name', 'equalto', 'PEER-EXTRA') | list | first)
+            == (populate_config.peer | selectattr('name', 'equalto', 'PEER-EXTRA') | list | first)
+
+    - name: Replace with the same configuration (IDEMPOTENT)
+      register: result
+      vyos.vyos.vyos_vpn_ipsec_s2s: *id001
+
+    - name: Assert that the previous task was idempotent
+      assert:
+        that:
+          - result['changed'] == false
+          - result['commands'] == []
+
+  always:
+    - include_tasks: _remove_config.yaml
diff --git a/tests/integration/targets/vyos_vpn_ipsec_s2s/vars/main.yaml b/tests/integration/targets/vyos_vpn_ipsec_s2s/vars/main.yaml
new file mode 100644
index 00000000..b592b73d
--- /dev/null
+++ b/tests/integration/targets/vyos_vpn_ipsec_s2s/vars/main.yaml
@@ -0,0 +1,257 @@
+---
+populate_config:
+  peer:
+    - name: PEER-TEST
+      authentication:
+        local_id: local@example.com
+        mode: pre-shared-secret
+        remote_id: remote@example.com
+      childless: prefer
+      connection_type: initiate
+      default_esp_group: ESP-TEST
+      description: test peer for site-to-site module
+      force_udp_encapsulation: true
+      ike_group: IKE-TEST
+      ikev2_reauth: inherit
+      local_address: any
+      remote_address:
+        - 203.0.113.1
+      replay_window: 32
+      virtual_address:
+        - 0.0.0.0
+      tunnel:
+        - tunnel_id: 1
+          esp_group: ESP-TEST
+          priority: 10
+          protocol: tcp
+          local:
+            port: 443
+            prefix:
+              - 10.0.0.0/24
+          remote:
+            port: 443
+            prefix:
+              - 10.1.0.0/24
+      vti:
+        bind: vti0
+        esp_group: ESP-TEST
+        traffic_selector:
+          local:
+            prefix:
+              - 10.2.0.0/24
+          remote:
+            prefix:
+              - 10.3.0.0/24
+    - name: PEER-EXTRA
+      # Minimal, but genuinely commit-valid -- confirmed via FOUR
+      # separate real commit failures that VyOS requires, on every
+      # site-to-site peer regardless of how minimal: authentication, a
+      # real remote-address, a local-address (or dhcp-interface), and
+      # at least one of tunnel/vti (a cross-field constraint Ansible's
+      # argspec has no clean way to express for nested list-of-dict
+      # peer items -- worth documenting in the module itself, not just
+      # here).
+      ike_group: IKE-TEST
+      authentication:
+        mode: pre-shared-secret
+        local_id: extra-local@example.com
+        remote_id: extra-remote@example.com
+      remote_address:
+        - 198.51.100.1
+      local_address: any
+      tunnel:
+        - tunnel_id: 1
+          esp_group: ESP-TEST
+
+merged:
+  config:
+    peer:
+      - name: PEER-TEST
+        authentication:
+          local_id: local@example.com
+          mode: pre-shared-secret
+          remote_id: remote@example.com
+        childless: prefer
+        connection_type: initiate
+        default_esp_group: ESP-TEST
+        description: test peer for site-to-site module
+        force_udp_encapsulation: true
+        ike_group: IKE-TEST
+        ikev2_reauth: inherit
+        local_address: any
+        remote_address:
+          - 203.0.113.1
+        replay_window: 32
+        virtual_address:
+          - 0.0.0.0
+        tunnel:
+          - tunnel_id: 1
+            esp_group: ESP-TEST
+            priority: 10
+            protocol: tcp
+            local:
+              port: 443
+              prefix:
+                - 10.0.0.0/24
+            remote:
+              port: 443
+              prefix:
+                - 10.1.0.0/24
+        vti:
+          bind: vti0
+          esp_group: ESP-TEST
+          traffic_selector:
+            local:
+              prefix:
+                - 10.2.0.0/24
+            remote:
+              prefix:
+                - 10.3.0.0/24
+  commands:
+    - set vpn ipsec site-to-site peer PEER-TEST
+    - set vpn ipsec site-to-site peer PEER-TEST authentication local-id 'local@example.com'
+    - set vpn ipsec site-to-site peer PEER-TEST authentication remote-id 'remote@example.com'
+    - set vpn ipsec site-to-site peer PEER-TEST authentication mode 'pre-shared-secret'
+    - set vpn ipsec site-to-site peer PEER-TEST childless 'prefer'
+    - set vpn ipsec site-to-site peer PEER-TEST connection-type 'initiate'
+    - set vpn ipsec site-to-site peer PEER-TEST default-esp-group 'ESP-TEST'
+    - set vpn ipsec site-to-site peer PEER-TEST description 'test peer for site-to-site module'
+    - set vpn ipsec site-to-site peer PEER-TEST ike-group 'IKE-TEST'
+    - set vpn ipsec site-to-site peer PEER-TEST ikev2-reauth 'inherit'
+    - set vpn ipsec site-to-site peer PEER-TEST local-address 'any'
+    - set vpn ipsec site-to-site peer PEER-TEST force-udp-encapsulation
+    - set vpn ipsec site-to-site peer PEER-TEST replay-window '32'
+    - set vpn ipsec site-to-site peer PEER-TEST remote-address '203.0.113.1'
+    - set vpn ipsec site-to-site peer PEER-TEST virtual-address '0.0.0.0'
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1 esp-group 'ESP-TEST'
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1 protocol 'tcp'
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1 priority '10'
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1 local port '443'
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1 local prefix '10.0.0.0/24'
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1 remote port '443'
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1 remote prefix '10.1.0.0/24'
+    - set vpn ipsec site-to-site peer PEER-TEST vti bind 'vti0'
+    - set vpn ipsec site-to-site peer PEER-TEST vti esp-group 'ESP-TEST'
+    - set vpn ipsec site-to-site peer PEER-TEST vti traffic-selector local prefix '10.2.0.0/24'
+    - set vpn ipsec site-to-site peer PEER-TEST vti traffic-selector remote prefix '10.3.0.0/24'
+
+replaced:
+  config:
+    peer:
+      - name: PEER-TEST
+        authentication:
+          local_id: local@example.com
+          mode: pre-shared-secret
+          remote_id: remote@example.com
+        childless: prefer
+        connection_type: initiate
+        default_esp_group: ESP-TEST
+        description: test peer for site-to-site module
+        force_udp_encapsulation: true
+        ike_group: IKE-TEST
+        ikev2_reauth: inherit
+        local_address: any
+        remote_address:
+          - 203.0.113.1
+        replay_window: 32
+        virtual_address:
+          - 0.0.0.0
+        tunnel:
+          - tunnel_id: 1
+            esp_group: ESP-TEST
+            priority: 99
+            protocol: tcp
+            local:
+              port: 443
+              prefix:
+                - 10.0.0.0/24
+            remote:
+              port: 443
+              prefix:
+                - 10.1.0.0/24
+        vti:
+          bind: vti0
+          esp_group: ESP-TEST
+          traffic_selector:
+            local:
+              prefix:
+                - 10.2.0.0/24
+            remote:
+              prefix:
+                - 10.3.0.0/24
+  # Only the priority differs from populate_config -- PEER-TEST is named
+  # fully/exactly otherwise, so replaced's per-item reconciliation has
+  # nothing else to change. PEER-EXTRA is not named at all and must
+  # survive untouched (checked separately in replaced.yaml).
+  commands:
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1 priority '99'
+
+overridden:
+  config:
+    peer:
+      - name: PEER-TEST
+        authentication:
+          local_id: local@example.com
+          mode: pre-shared-secret
+          remote_id: remote@example.com
+        childless: prefer
+        connection_type: initiate
+        default_esp_group: ESP-TEST
+        description: test peer for site-to-site module
+        force_udp_encapsulation: true
+        ike_group: IKE-TEST
+        ikev2_reauth: inherit
+        local_address: any
+        remote_address:
+          - 203.0.113.1
+        replay_window: 32
+        virtual_address:
+          - 0.0.0.0
+        tunnel:
+          - tunnel_id: 1
+            esp_group: ESP-TEST
+            priority: 99
+            protocol: tcp
+            local:
+              port: 443
+              prefix:
+                - 10.0.0.0/24
+            remote:
+              port: 443
+              prefix:
+                - 10.1.0.0/24
+        vti:
+          bind: vti0
+          esp_group: ESP-TEST
+          traffic_selector:
+            local:
+              prefix:
+                - 10.2.0.0/24
+            remote:
+              prefix:
+                - 10.3.0.0/24
+  commands:
+    - delete vpn ipsec site-to-site peer PEER-EXTRA
+    - set vpn ipsec site-to-site peer PEER-TEST tunnel 1 priority '99'
+
+deleted:
+  commands:
+    - delete vpn ipsec site-to-site peer PEER-TEST
+    - delete vpn ipsec site-to-site peer PEER-EXTRA
+  after: {}
+
+rendered:
+  config:
+    peer:
+      - name: PEER-RENDER-TEST
+        ike_group: IKE-TEST
+  commands:
+    - set vpn ipsec site-to-site peer PEER-RENDER-TEST
+    - set vpn ipsec site-to-site peer PEER-RENDER-TEST ike-group 'IKE-TEST'
+
+parsed:
+  after:
+    peer:
+      - name: PEER-PARSE-TEST
+        ike_group: IKE-TEST