docs: T8887: backfill Phase 1 commands from recent vyos-1x additions

[andamasov]

Change summary

Documents nine CLI features added to vyos-1x between Nov 2025 and May 2026 that were missing from the documentation. Phase 1 of the documentation gap audit (T8886, subtask T8887).

Feature	vyos-1x PR	Task	Docs file
system frr watchfrr-timeout	vyos-1x#5165	T8606	configuration/system/frr.md
policy route-map … match source-peer	vyos-1x#5149	T8588	configuration/policy/route-map.md
high-availability vrrp snmp trap	vyos-1x#5108	T8448	configuration/highavailability/index.md
protocols segment-routing traffic-engineering subtree	vyos-1x#4994	T6750	configuration/protocols/segment-routing.md
protocols bgp parameters as-notation	vyos-1x#5089	T7338	configuration/protocols/bgp.md
protocols bgp bmp target … monitor (incl. local-rib)	vyos-1x#4922	T8133	configuration/protocols/bgp.md
service router-advert … prefix … base-interface	vyos-1x#5007	T8302	configuration/service/router-advert.md
firewall global-options geoip … (MaxMind provider)	vyos-1x#4949	T7926/T8049	configuration/firewall/global-options.md
vpn ipsec … childless	vyos-1x#4930	T8136	configuration/vpn/ipsec/ipsec_general.md

Command syntax, help texts, value help, and defaults were extracted from the vyos-1x XML interface definitions at current (80e176461).

Notes:

• The tenth Phase-1 item (DHCPv6 option time-zone, vyos-1x#5190) is already documented on rolling and needs no change.
• IPsec PPK (same vyos-1x PR as childless) is already documented; only childless was missing.
• One pre-existing overlong line in router-advert.md was wrapped because the block was relocated.

Backport

All nine features exist on current only; docs target rolling only — no backport.

Resolves: T8887

🤖 Generated by robots

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: d3b1e6f4-345c-47e2-a8f0-19c91b202588

📥 Commits

Reviewing files that changed from the base of the PR and between ce5ba69 and 6189bfb.

📒 Files selected for processing (3)

• docs/configuration/policy/route-map.md
• docs/configuration/service/router-advert.md
• docs/configuration/vpn/ipsec/ipsec_general.md

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• ansible/ansible (manual)

✅ Files skipped from review due to trivial changes (2)

• docs/configuration/policy/route-map.md
• docs/configuration/service/router-advert.md

🚧 Files skipped from review as they are similar to previous changes (1)

• docs/configuration/vpn/ipsec/ipsec_general.md

📜 Recent review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: validate
• GitHub Check: Mergify Merge Protections
• GitHub Check: Summary

🧰 Additional context used

🔍 Remote MCP Context7

Relevant review context found:

• set system frr bmp is already documented as the prerequisite to enable BMP support, so the new BGP BMP section builds on an existing system-level toggle. The BGP docs also already cover standard neighbor address-family config for ipv4-unicast and ipv6-unicast.
• The route-map docs already include match peer <x.x.x.x> and other match selectors (rpki, source-vrf, protocol, as-path, ip nexthop address), so match source-peer is a new selector in an established match-options area.
• The segment-routing docs already document IS-IS SR features such as global-block and prefix ... index value, and describe Prefix-SID behavior as index/absolute plus flags like no-php-flag and explicit-null; this is relevant to verifying the new SR-TE examples stay aligned with existing SR command style.
• High-availability docs already use set high-availability vrrp group ... for VRRP group configuration, and the firewall docs already expose global options like source-validation; this indicates the new SNMP-trap and GeoIP additions are extending existing top-level config areas rather than introducing new subsystems.
• IPsec docs already document both site-to-site and remote-access configuration patterns, including the remote-access connection subtree; the new childless option is therefore an extension of an existing IKEv2-only IPsec area.

---

📝 Walkthrough

Summary by CodeRabbit

• Documentation
  • Added firewall global-options GeoIP configuration, including selecting the GeoIP provider (db-ip vs maxmind), configuring MaxMind account ID and license key, and enabling MaxMind Lite/GeoLite2.
  • Expanded high-availability VRRP docs with SNMP trap notifications on VRRP state changes.
  • Documented additional route-map matching for BGP source-peer, plus updated community formatting; enhanced BGP (AS-notation, BMP), SR-TE, router-advert IPv6 RA examples, FRR watchfrr-timeout, and IPsec IKEv2 “Childless IKE SA” behavior (including both site-to-site and remote-access).

Walkthrough

Docs-only PR adding new configuration command sections for firewall GeoIP, HA SNMP traps, route-map source-peer matching, BGP as-notation and BMP, SR-TE, router-advert base-interface, FRR watchfrr-timeout, and IPsec childless IKE SA.

Changes

Configuration documentation updates

Layer / File(s)	Summary
Firewall GeoIP docs docs/configuration/firewall/global-options.md:122-147	Documents firewall global-options geoip provider selection plus MaxMind account, license key, and Lite database options.
High-availability SNMP traps docs docs/configuration/highavailability/index.md:320-327	Documents set high-availability vrrp snmp trap for VRRP state-change trap emission.
BGP as-notation docs docs/configuration/protocols/bgp.md:664-674	Documents `set protocols bgp parameters as-notation <asdot
BGP BMP docs docs/configuration/protocols/bgp.md:1169-1184	Adds the BGP Monitoring Protocol section and set protocols bgp bmp target ... monitor ....
Route-map source-peer docs docs/configuration/policy/route-map.md:222-228, 436-448	Documents match source-peer <value> and reflows selected well-known community entries.
Segment routing SR-TE docs docs/configuration/protocols/segment-routing.md:359-411	Documents SR-TE, TED import, segment-list definitions, and segment-list entry forms.
Router advert base-interface docs docs/configuration/service/router-advert.md:55-70, 86-87, 98-99	Documents prefix <prefix> base-interface <interface> and adds the NAT64 linter guards.
FRR watchfrr-timeout docs docs/configuration/system/frr.md:45-51	Documents set system frr watchfrr-timeout <60-600> and its default.
IPsec childless IKE SA docs docs/configuration/vpn/ipsec/ipsec_general.md:152-172, 386-387	Documents `childless <allow

Possibly related PRs

• vyos/vyos-documentation#2104: Related Traffic Engineering documentation rewrite; this PR adds the SR-TE section in docs/configuration/protocols/segment-routing.md.
• vyos/vyos-documentation#2124: Related GeoIP documentation work; this PR adds firewall GeoIP provider and credential docs in docs/configuration/firewall/global-options.md.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	Clear, accurate summary of the doc backfill for Phase 1 vyos-1x CLI additions.
Description check	✅ Passed	The description matches the touched docs/* files and the nine CLI features documented in this PR.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch docs/t8887-phase1-batch1

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude finished @andamasov's task in 7m 54s —— View job

---

VyOS Documentation Review

• Read pass1-findings.json and gather context
• Review changed docs against vyos-1x XML definitions (branch: current)
• Verify each of the 9 new command additions
• Post inline comments for issues found
• Post final summary comment

Verified each new CLI addition against the vyos-1x XML at current and the relevant conf-mode / Jinja templates. All nine commands and their sub-paths, defaults, ranges, and option lists check out. Two minor wording concerns posted inline; the rest of the additions are accurate.

---

Issues

• INFO — docs/configuration/service/router-advert.md:62-67 — the doc says the base-interface's IPv6 address is used "to derive the advertised prefix's host bits". radvd's Base6Interface in fact uses that address to derive the network / prefix bits of the advertised prefix. With the wildcard ::/64, the base-interface effectively provides the network portion. Suggested rewording posted inline (discussion).

• INFO — docs/configuration/protocols/segment-routing.md:403 — algorithm \<spf | strict-spf\> reads as if algorithm takes a value, but spf and strict-spf are two separate <valueless/> leaf nodes under an algorithm node in the XML. The <a | b> shorthand is a common VyOS-docs convention, so this is fine as-is — flagging for future readers (discussion).

Needs Verification

• docs/configuration/protocols/bgp.md (BMP): monitor \<ipv4-unicast|ipv6-unicast\> \<pre-policy | post-policy | local-rib\> — the three pre-policy / post-policy / local-rib options are independent valueless leaves in the XML (include/bgp/bmp-monitor-afi-policy.xml.i), so they can be enabled simultaneously rather than being mutually exclusive as the <a | b | c> notation implies. Same benign convention issue as segment-routing algorithm. Not blocking.

• docs/configuration/policy/route-map.md (match source-peer \<value\>): using a generic <value> placeholder for a leaf whose XML <valueHelp> covers IPv4, IPv6, interface name, and peer-group. The following prose does list all four types, so <value> is defensible; a more specific placeholder like <peer> might be clearer. Judgment call.

Verified against vyos-1x current

Feature	Reference	Verdict
system frr watchfrr-timeout <60-600>, default 90	interface-definitions/system_frr.xml.in:38-51	✅ range and default match doc
policy route-map … match source-peer	interface-definitions/policy.xml.in:1041-1064	✅ IPv4/IPv6/interface/peer-group all match
high-availability vrrp snmp trap (valueless)	interface-definitions/high-availability.xml.in:15-27	✅
protocols segment-routing traffic-engineering … subtree	interface-definitions/protocols_segment-routing.xml.in:160-…	✅ paths, ranges (mpls label 16-1048575), NAI IPv4/IPv6 all match
`protocols bgp parameters as-notation <asdot	asdot+>`	include/bgp/protocol-common-config.xml.i:1157-1175; templates/frr/bgpd.frr.j2:267
protocols bgp bmp target … monitor …	include/bgp/protocol-common-config.xml.i:853-938 + include/bgp/bmp-monitor-afi-policy.xml.i	✅ AFI names and option leaves match; set system frr bmp prerequisite exists at system_frr.xml.in:12-17
service router-advert … prefix … base-interface \<interface\>	interface-definitions/service_router-advert.xml.in:308-322; wildcard-::/64 constraint at src/conf_mode/service_router-advert.py:67-68	✅ constraint matches (see host-bits INFO above)
firewall global-options geoip … (provider, maxmind-account-id, maxmind-license-key, maxmind-lite)	include/firewall/global-options.xml.i:133-174	✅ default db-ip matches doc; all leaves accounted for
`vpn ipsec … childless <allow	prefer	force

Notes on pass1-findings.json

58 findings on bgp.md, segment-routing.md, router-advert.md. On inspection:

• All bgp.md findings are on line ranges (219–1133) that pre-date this PR (this PR only touches new lines around 664 and 1168). Out of scope here.
• All segment-routing.md findings that overlap the new content (traffic-engineering segment-list …) are false positives — the paths do exist in protocols_segment-routing.xml.in:160-… on current. The reference DB used by Pass 1 is stale relative to the XML on current.
• The single router-advert.md finding on line 26 flags service router-advert interface ... — Pass 1 misparsed the literal ... ellipsis as a CLI path. False positive.

Backport

Doc PR targets rolling; all nine features exist only on current. The PR body's assertion that no backport is needed is consistent with what I see in the vyos-1x tree — no sagitta / equuleus branch of .vyos-1x is checked out here to double-check, but a spot-check on the file names would show the same.

Stats

• Validated 8 MyST files. Skipped 0 RST files awaiting MyST migration.
• Files reviewed: 8. Commands checked: 9 new CLI features (plus one prerequisite, system frr bmp).
• Branch reviewed: rolling against vyos-1x current.
  • Branch: docs/t8887-phase1-batch1

[github-actions]

Claude finished @andamasov's task in 1m 58s —— View job

---

VyOS Documentation Review — incremental (commit ce5ba69)

• Diff the new commit against aa88e83
• Verify linter marker placement matches project conventions
• Verify NAT64 well-known prefix claim (RFC 6052)
• Post summary

The synchronize event added a single commit that wraps the NAT64 prefix block in % stop_vyoslinter / % start_vyoslinter markers. No new CLI content, no changes to any of the other 7 files touched by this PR.

Issues

None from the incremental change.

The prior inline comments still stand:

• docs/configuration/service/router-advert.md:65 — "host bits" vs "network bits" wording (INFO). Not addressed by ce5ba69; author's call whether to reword.
• docs/configuration/protocols/segment-routing.md:411 — algorithm <spf | strict-spf> convention note (INFO). Non-blocking.

Verified

• Linter marker placement (docs/configuration/service/router-advert.md:85 and :98) — brackets exactly the NAT64 cfgcmd block containing 64:ff9b::/96; scope is minimal and does not spill into unrelated content. Same pattern as docs/configuration/protocols/openfabric.md:15-17, so blank-line handling around the markers is fine.
• Well-known NAT64 prefix 64:ff9b::/96 — factually correct per {rfc}6052 §2.1 (Well-Known Prefix). Legitimate exemption target for the documentation-address linter rule, which enforces {rfc}3849 (2001:db8::/32) / {rfc}5737 for regular examples.
• No regression in other 7 files — git diff aa88e83..ce5ba69 touches only router-advert.md.

Needs Verification

None.

Stats

• Validated 1 MyST file (incremental scope). Skipped 0 RST files awaiting MyST migration.
• Files reviewed this pass: 1. Commands checked: 0 new (marker-only change).
• Branch reviewed: rolling against vyos-1x current.
  • Branch: docs/t8887-phase1-batch1

[github-actions]

Claude finished @andamasov's task in 51s —— View job

---

VyOS Documentation Review — incremental (commit 6189bfb)

• Diff the new commit against previous head
• Verify the "host bits" → "network portion" rewording is faithful to radvd behavior
• Check for any other changes in the new commit
• Post summary

The synchronize event added one commit that (a) reworks the base-interface prose per the earlier inline suggestion and (b) wraps five pre-existing overlong lines in unrelated blocks so the whole-file line-length linter passes on the touched files. No new CLI content.

Issues

None from the incremental change.

Verified

• docs/configuration/service/router-advert.md:64-68 — matches the suggested rewording verbatim. "Network portion" is the correct description of what radvd's Base6Interface derives from the base interface's global IPv6 address (per data/templates/router-advert/radvd.conf.j2:87-88 and radvd(5) Base6Interface). The DHCPv6-PD re-advertisement use case is the primary motivating scenario for this feature, and calling it out is helpful.
• docs/configuration/policy/route-map.md:433-458 — five bullet lines in the well-known-communities block were reflowed. Content, ordering, hex values, and community names are identical; only whitespace/wrapping changed. Continuation lines are indented under the bullet marker so MyST list rendering is preserved.
• docs/configuration/vpn/ipsec/ipsec_general.md:386-387 — one sentence in the "IKEv2 Retransmission" section was wrapped. No content change.
• No regressions elsewhere — git diff ce5ba69..HEAD touches only these three files, none of which contain new CLI paths.

The prior INFO note on docs/configuration/protocols/segment-routing.md:411 (algorithm <spf | strict-spf> shorthand for two valueless leaves) was explicitly acknowledged as intentional convention and needs no follow-up.

Needs Verification

None.

Stats

• Validated 3 MyST files (incremental scope). Skipped 0 RST files awaiting MyST migration.
• Files reviewed this pass: 3. Commands checked: 0 new (rewording + linter-debt cleanup only).
• Branch reviewed: rolling against vyos-1x current.
  • Branch: docs/t8887-phase1-batch1

[andamasov]

Adversarial review — 6189bfb7 — partial coverage: Codex only (agy unavailable)

Codex (gpt-5.5, read-only): NO FINDINGS — documented command paths verified against vyos-1x XML interface definitions at current; MyST markup and behavioral claims checked.

agy (Gemini): UNAVAILABLE — timed out on both Gemini 3.1 Pro (High) and the fallback Gemini 3.5 Flash (High). Per the dual-review policy for trusted PRs, this run has single-provider coverage; an operator waiver is required before merge (or re-run the gate once agy recovers).

---

Each finding must receive a fix commit OR a pushback reply in a reply to this comment before merge. See /audit-pr-threads for resolution mechanics.

[andamasov]

Operator waiver recorded (2026-07-06): agy (Gemini) remained unavailable after three attempts (timeouts on Gemini 3.1 Pro (High) ×2 and Gemini 3.5 Flash (High) ×1). Operator waived the second-provider requirement for this PR; merging on Codex-only adversarial coverage (NO FINDINGS) per the dual-review policy's waiver path.

[sever-sever]

Add missing commands for documentation

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

@andamasov this pull request has conflicts. Please resolve them before we can evaluate the pull request.

[mergify]

Merge Protections

🔴 1 of 1 protections blocking · waiting on 🙋 you

	Protection	Waiting on
🔴	conflicts label must be absent to merge	🙋 you

🔴 conflicts label must be absent to merge

Waiting for

• label != conflicts

This rule is failing.

Block merge while the conflicts label is present. The label is auto-applied by the central Label conflicting pull requests rule (git-level merge conflicts) and by vyos/.github:scripts/check-pr-conflicts.py (committed conflict markers on non-Mergify PRs). Must be cleared by resolving the conflict.

• label != conflicts

[sever-sever]

There are 3 conflicts in the docs/configuration/service/router-advert.md file