diff --git a/data/templates/firewall/nftables-vrf-zones.tmpl b/data/templates/firewall/nftables-vrf-zones.tmpl
new file mode 100644
index 000000000..eecf47b78
--- /dev/null
+++ b/data/templates/firewall/nftables-vrf-zones.tmpl
@@ -0,0 +1,17 @@
+table inet vrf_zones {
+  # Map of interfaces and connections tracking zones
+  map ct_iface_map {
+    typeof iifname : ct zone
+  }
+  # Assign unique zones for each VRF
+  # Chain for inbound traffic
+  chain vrf_zones_ct_in {
+    type filter hook prerouting priority raw; policy accept;
+    counter ct zone set iifname map @ct_iface_map
+  }
+  # Chain for locally-generated traffic
+  chain vrf_zones_ct_out {
+    type filter hook output priority raw; policy accept;
+    counter ct zone set oifname map @ct_iface_map
+  }
+}
diff --git a/interface-definitions/vrf.xml.in b/interface-definitions/vrf.xml.in
index 426884a11..9d513945c 100644
--- a/interface-definitions/vrf.xml.in
+++ b/interface-definitions/vrf.xml.in
@@ -1,93 +1,93 @@
 <?xml version="1.0"?>
 <interfaceDefinition>
   <node name="vrf" owner="${vyos_conf_scripts_dir}/vrf.py">
     <properties>
       <help>Virtual Routing and Forwarding</help>
       <!-- must be before any interface, check /opt/vyatta/sbin/priority.pl -->
       <priority>299</priority>
     </properties>
     <children>
       <leafNode name="bind-to-all">
         <properties>
           <help>Enable binding services to all VRFs</help>
           <valueless/>
         </properties>
       </leafNode>
       <tagNode name="name">
         <properties>
           <help>Virtual Routing and Forwarding instance</help>
           <constraint>
             <validator name="vrf-name"/>
           </constraint>
-          <constraintErrorMessage>VRF instance name must be 15 characters or less and can not\nbe named as regular network interfaces.\n</constraintErrorMessage>
+          <constraintErrorMessage>VRF instance name must be 15 characters or less and can not\nbe named as regular network interfaces.\nA name must starts from a letter.\n</constraintErrorMessage>
           <valueHelp>
             <format>txt</format>
             <description>VRF instance name</description>
           </valueHelp>
         </properties>
         <children>
           #include <include/interface/interface-description.xml.i>
           #include <include/interface/interface-disable.xml.i>
           <node name="protocols">
             <properties>
               <help>Routing protocol parameters</help>
             </properties>
             <children>
               <node name="bgp" owner="${vyos_conf_scripts_dir}/protocols_bgp.py $VAR(../../@)">
                 <properties>
                   <help>Border Gateway Protocol (BGP)</help>
                   <priority>821</priority>
                 </properties>
                 <children>
                   #include <include/bgp/protocol-common-config.xml.i>
                 </children>
               </node>
               <node name="isis" owner="${vyos_conf_scripts_dir}/protocols_isis.py $VAR(../../@)">
                 <properties>
                   <help>Intermediate System to Intermediate System (IS-IS)</help>
                   <priority>611</priority>
                 </properties>
                 <children>
                   #include <include/isis/protocol-common-config.xml.i>
                 </children>
               </node>
               <node name="ospf" owner="${vyos_conf_scripts_dir}/protocols_ospf.py $VAR(../../@)">
                 <properties>
                   <help>Open Shortest Path First (OSPF)</help>
                   <priority>621</priority>
                 </properties>
                 <children>
                   #include <include/ospf/protocol-common-config.xml.i>
                 </children>
               </node>
               <node name="static" owner="${vyos_conf_scripts_dir}/protocols_static.py $VAR(../../@)">
                 <properties>
                   <help>Static route parameters</help>
                   <priority>481</priority>
                 </properties>
                 <children>
                   #include <include/static/static-route.xml.i>
                   #include <include/static/static-route6.xml.i>
                 </children>
               </node>
             </children>
           </node>
           <leafNode name="table">
             <properties>
               <help>Routing table associated with this instance</help>
               <valueHelp>
-                <format>100-2147483647</format>
+                <format>100-65535</format>
                 <description>Routing table ID</description>
               </valueHelp>
               <constraint>
-                <validator name="numeric" argument="--range 100-2147483647"/>
+                <validator name="numeric" argument="--range 100-65535"/>
               </constraint>
-              <constraintErrorMessage>VRF routing table must be in range from 100 to 2147483647</constraintErrorMessage>
+              <constraintErrorMessage>VRF routing table must be in range from 100 to 65535</constraintErrorMessage>
             </properties>
           </leafNode>
           #include <include/vni.xml.i>
         </children>
       </tagNode>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/python/vyos/ifconfig/interface.py b/python/vyos/ifconfig/interface.py
old mode 100644
new mode 100755
index 08b7af90b..a1928ba51
--- a/python/vyos/ifconfig/interface.py
+++ b/python/vyos/ifconfig/interface.py
@@ -1,1444 +1,1467 @@
 # Copyright 2019-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
 # License as published by the Free Software Foundation; either
 # version 2.1 of the License, or (at your option) any later version.
 #
 # This library is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # Lesser General Public License for more details.
 #
 # You should have received a copy of the GNU Lesser General Public
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from netifaces import interfaces
 import os
 import re
 import json
 import jmespath
 
 from copy import deepcopy
 from glob import glob
 
 from ipaddress import IPv4Network
 from netifaces import ifaddresses
 # this is not the same as socket.AF_INET/INET6
 from netifaces import AF_INET
 from netifaces import AF_INET6
 
 from vyos import ConfigError
 from vyos.configdict import list_diff
 from vyos.configdict import dict_merge
 from vyos.configdict import get_vlan_ids
 from vyos.template import render
 from vyos.util import mac2eui64
 from vyos.util import dict_search
 from vyos.util import read_file
 from vyos.util import get_interface_config
 from vyos.template import is_ipv4
 from vyos.validate import is_intf_addr_assigned
 from vyos.validate import is_ipv6_link_local
 from vyos.validate import assert_boolean
 from vyos.validate import assert_list
 from vyos.validate import assert_mac
 from vyos.validate import assert_mtu
 from vyos.validate import assert_positive
 from vyos.validate import assert_range
 
 from vyos.ifconfig.control import Control
 from vyos.ifconfig.vrrp import VRRP
 from vyos.ifconfig.operational import Operational
 from vyos.ifconfig import Section
 
 class Interface(Control):
     # This is the class which will be used to create
     # self.operational, it allows subclasses, such as
     # WireGuard to modify their display behaviour
     OperationalClass = Operational
 
     options = ['debug', 'create']
     required = []
     default = {
         'debug': True,
         'create': True,
     }
     definition = {
         'section': '',
         'prefixes': [],
         'vlan': False,
         'bondable': False,
         'broadcast': False,
         'bridgeable':  False,
         'eternal': '',
     }
 
     _command_get = {
         'admin_state': {
             'shellcmd': 'ip -json link show dev {ifname}',
             'format': lambda j: 'up' if 'UP' in jmespath.search('[*].flags | [0]', json.loads(j)) else 'down',
         },
         'alias': {
             'shellcmd': 'ip -json -detail link list dev {ifname}',
             'format': lambda j: jmespath.search('[*].ifalias | [0]', json.loads(j)) or '',
         },
         'mac': {
             'shellcmd': 'ip -json -detail link list dev {ifname}',
             'format': lambda j: jmespath.search('[*].address | [0]', json.loads(j)),
         },
         'min_mtu': {
             'shellcmd': 'ip -json -detail link list dev {ifname}',
             'format': lambda j: jmespath.search('[*].min_mtu | [0]', json.loads(j)),
         },
         'max_mtu': {
             'shellcmd': 'ip -json -detail link list dev {ifname}',
             'format': lambda j: jmespath.search('[*].max_mtu | [0]', json.loads(j)),
         },
         'mtu': {
             'shellcmd': 'ip -json -detail link list dev {ifname}',
             'format': lambda j: jmespath.search('[*].mtu | [0]', json.loads(j)),
         },
         'oper_state': {
             'shellcmd': 'ip -json -detail link list dev {ifname}',
             'format': lambda j: jmespath.search('[*].operstate | [0]', json.loads(j)),
         },
     }
 
     _command_set = {
         'admin_state': {
             'validate': lambda v: assert_list(v, ['up', 'down']),
             'shellcmd': 'ip link set dev {ifname} {value}',
         },
         'alias': {
             'convert': lambda name: name if name else '',
             'shellcmd': 'ip link set dev {ifname} alias "{value}"',
         },
         'bridge_port_isolation': {
             'validate': lambda v: assert_list(v, ['on', 'off']),
             'shellcmd': 'bridge link set dev {ifname} isolated {value}',
         },
         'mac': {
             'validate': assert_mac,
             'shellcmd': 'ip link set dev {ifname} address {value}',
         },
         'mtu': {
             'validate': assert_mtu,
             'shellcmd': 'ip link set dev {ifname} mtu {value}',
         },
         'vrf': {
             'convert': lambda v: f'master {v}' if v else 'nomaster',
             'shellcmd': 'ip link set dev {ifname} {value}',
         },
     }
 
     _sysfs_set = {
         'arp_cache_tmo': {
             'convert': lambda tmo: (int(tmo) * 1000),
             'location': '/proc/sys/net/ipv4/neigh/{ifname}/base_reachable_time_ms',
         },
         'arp_filter': {
             'validate': assert_boolean,
             'location': '/proc/sys/net/ipv4/conf/{ifname}/arp_filter',
         },
         'arp_accept': {
             'validate': lambda arp: assert_range(arp,0,2),
             'location': '/proc/sys/net/ipv4/conf/{ifname}/arp_accept',
         },
         'arp_announce': {
             'validate': assert_boolean,
             'location': '/proc/sys/net/ipv4/conf/{ifname}/arp_announce',
         },
         'arp_ignore': {
             'validate': assert_boolean,
             'location': '/proc/sys/net/ipv4/conf/{ifname}/arp_ignore',
         },
         'ipv4_forwarding': {
             'validate': assert_boolean,
             'location': '/proc/sys/net/ipv4/conf/{ifname}/forwarding',
         },
         'rp_filter': {
             'validate': lambda flt: assert_range(flt,0,3),
             'location': '/proc/sys/net/ipv4/conf/{ifname}/rp_filter',
         },
         'ipv6_accept_ra': {
             'validate': lambda ara: assert_range(ara,0,3),
             'location': '/proc/sys/net/ipv6/conf/{ifname}/accept_ra',
         },
         'ipv6_autoconf': {
             'validate': lambda aco: assert_range(aco,0,2),
             'location': '/proc/sys/net/ipv6/conf/{ifname}/autoconf',
         },
         'ipv6_forwarding': {
             'validate': lambda fwd: assert_range(fwd,0,2),
             'location': '/proc/sys/net/ipv6/conf/{ifname}/forwarding',
         },
         'ipv6_dad_transmits': {
             'validate': assert_positive,
             'location': '/proc/sys/net/ipv6/conf/{ifname}/dad_transmits',
         },
         'path_cost': {
             # XXX: we should set a maximum
             'validate': assert_positive,
             'location': '/sys/class/net/{ifname}/brport/path_cost',
             'errormsg': '{ifname} is not a bridge port member'
         },
         'path_priority': {
             # XXX: we should set a maximum
             'validate': assert_positive,
             'location': '/sys/class/net/{ifname}/brport/priority',
             'errormsg': '{ifname} is not a bridge port member'
         },
         'proxy_arp': {
             'validate': assert_boolean,
             'location': '/proc/sys/net/ipv4/conf/{ifname}/proxy_arp',
         },
         'proxy_arp_pvlan': {
             'validate': assert_boolean,
             'location': '/proc/sys/net/ipv4/conf/{ifname}/proxy_arp_pvlan',
         },
         # link_detect vs link_filter name weirdness
         'link_detect': {
             'validate': lambda link: assert_range(link,0,3),
             'location': '/proc/sys/net/ipv4/conf/{ifname}/link_filter',
         },
     }
 
     @classmethod
     def exists(cls, ifname):
         return os.path.exists(f'/sys/class/net/{ifname}')
 
     @classmethod
     def get_config(cls):
         """
         Some but not all interfaces require a configuration when they are added
         using iproute2. This method will provide the configuration dictionary
         used by this class.
         """
         return deepcopy(cls.default)
 
     def __init__(self, ifname, **kargs):
         """
         This is the base interface class which supports basic IP/MAC address
         operations as well as DHCP(v6). Other interface which represent e.g.
         and ethernet bridge are implemented as derived classes adding all
         additional functionality.
 
         For creation you will need to provide the interface type, otherwise
         the existing interface is used
 
         DEBUG:
         This class has embedded debugging (print) which can be enabled by
         creating the following file:
         vyos@vyos# touch /tmp/vyos.ifconfig.debug
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> i = Interface('eth0')
         """
         self.config = deepcopy(kargs)
         self.config['ifname'] = self.ifname = ifname
 
         self._admin_state_down_cnt = 0
 
         # we must have updated config before initialising the Interface
         super().__init__(**kargs)
 
         if not self.exists(ifname):
             # Any instance of Interface, such as Interface('eth0') can be used
             # safely to access the generic function in this class as 'type' is
             # unset, the class can not be created
             if not self.iftype:
                 raise Exception(f'interface "{ifname}" not found')
             self.config['type'] = self.iftype
 
             # Should an Instance of a child class (EthernetIf, DummyIf, ..)
             # be required, then create should be set to False to not accidentally create it.
             # In case a subclass does not define it, we use get to set the default to True
             if self.config.get('create',True):
                 for k in self.required:
                     if k not in kargs:
                         name = self.default['type']
                         raise ConfigError(f'missing required option {k} for {name} {ifname} creation')
 
                 self._create()
             # If we can not connect to the interface then let the caller know
             # as the class could not be correctly initialised
             else:
                 raise Exception(f'interface "{ifname}" not found!')
 
         # temporary list of assigned IP addresses
         self._addr = []
 
         self.operational = self.OperationalClass(ifname)
         self.vrrp = VRRP(ifname)
 
     def _create(self):
         cmd = 'ip link add dev {ifname} type {type}'.format(**self.config)
         self._cmd(cmd)
 
     def remove(self):
         """
         Remove interface from operating system. Removing the interface
         deconfigures all assigned IP addresses and clear possible DHCP(v6)
         client processes.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> i = Interface('eth0')
         >>> i.remove()
         """
 
         # remove all assigned IP addresses from interface - this is a bit redundant
         # as the kernel will remove all addresses on interface deletion, but we
         # can not delete ALL interfaces, see below
         self.flush_addrs()
 
         # ---------------------------------------------------------------------
         # Any class can define an eternal regex in its definition
         # interface matching the regex will not be deleted
 
         eternal = self.definition['eternal']
         if not eternal:
             self._delete()
         elif not re.match(eternal, self.ifname):
             self._delete()
 
     def _delete(self):
         # NOTE (Improvement):
         # after interface removal no other commands should be allowed
         # to be called and instead should raise an Exception:
         cmd = 'ip link del dev {ifname}'.format(**self.config)
         return self._cmd(cmd)
 
+    def _set_vrf_ct_zone(self, vrf):
+        """
+        Add/Remove rules in nftables to associate traffic in VRF to an
+        individual conntack zone
+        """
+        if vrf:
+            # Get routing table ID for VRF
+            vrf_table_id = get_interface_config(vrf).get('linkinfo', {}).get(
+                'info_data', {}).get('table')
+            # Add map element with interface and zone ID
+            if vrf_table_id:
+                self._cmd(
+                    f'nft add element inet vrf_zones ct_iface_map {{ "{self.ifname}" : {vrf_table_id} }}'
+                )
+        else:
+            nft_del_element = f'delete element inet vrf_zones ct_iface_map {{ "{self.ifname}" }}'
+            # Check if deleting is possible first to avoid raising errors
+            _, err = self._popen(f'nft -c {nft_del_element}')
+            if not err:
+                # Remove map element
+                self._cmd(f'nft {nft_del_element}')
+
     def get_min_mtu(self):
         """
         Get hardware minimum supported MTU
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_min_mtu()
         '60'
         """
         return int(self.get_interface('min_mtu'))
 
     def get_max_mtu(self):
         """
         Get hardware maximum supported MTU
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_max_mtu()
         '9000'
         """
         return int(self.get_interface('max_mtu'))
 
     def get_mtu(self):
         """
         Get/set interface mtu in bytes.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_mtu()
         '1500'
         """
         return int(self.get_interface('mtu'))
 
     def set_mtu(self, mtu):
         """
         Get/set interface mtu in bytes.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_mtu(1400)
         >>> Interface('eth0').get_mtu()
         '1400'
         """
         return self.set_interface('mtu', mtu)
 
     def get_mac(self):
         """
         Get current interface MAC (Media Access Contrl) address used.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_mac()
         '00:50:ab:cd:ef:00'
         """
         return self.get_interface('mac')
 
     def set_mac(self, mac):
         """
         Set interface MAC (Media Access Contrl) address to given value.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_mac('00:50:ab:cd:ef:01')
         """
 
         # If MAC is unchanged, bail out early
         if mac == self.get_mac():
             return None
 
         # MAC address can only be changed if interface is in 'down' state
         prev_state = self.get_admin_state()
         if prev_state == 'up':
             self.set_admin_state('down')
 
         self.set_interface('mac', mac)
 
         # Turn an interface to the 'up' state if it was changed to 'down' by this fucntion
         if prev_state == 'up':
             self.set_admin_state('up')
 
     def set_vrf(self, vrf=''):
         """
         Add/Remove interface from given VRF instance.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_vrf('foo')
         >>> Interface('eth0').set_vrf()
         """
         self.set_interface('vrf', vrf)
+        self._set_vrf_ct_zone(vrf)
 
     def set_arp_cache_tmo(self, tmo):
         """
         Set ARP cache timeout value in seconds. Internal Kernel representation
         is in milliseconds.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_arp_cache_tmo(40)
         """
         return self.set_interface('arp_cache_tmo', tmo)
 
     def set_arp_filter(self, arp_filter):
         """
         Filter ARP requests
 
         1 - Allows you to have multiple network interfaces on the same
             subnet, and have the ARPs for each interface be answered
             based on whether or not the kernel would route a packet from
             the ARP'd IP out that interface (therefore you must use source
             based routing for this to work). In other words it allows control
             of which cards (usually 1) will respond to an arp request.
 
         0 - (default) The kernel can respond to arp requests with addresses
             from other interfaces. This may seem wrong but it usually makes
             sense, because it increases the chance of successful communication.
             IP addresses are owned by the complete host on Linux, not by
             particular interfaces. Only for more complex setups like load-
             balancing, does this behaviour cause problems.
         """
         return self.set_interface('arp_filter', arp_filter)
 
     def set_arp_accept(self, arp_accept):
         """
         Define behavior for gratuitous ARP frames who's IP is not
         already present in the ARP table:
         0 - don't create new entries in the ARP table
         1 - create new entries in the ARP table
 
         Both replies and requests type gratuitous arp will trigger the
         ARP table to be updated, if this setting is on.
 
         If the ARP table already contains the IP address of the
         gratuitous arp frame, the arp table will be updated regardless
         if this setting is on or off.
         """
         return self.set_interface('arp_accept', arp_accept)
 
     def set_arp_announce(self, arp_announce):
         """
         Define different restriction levels for announcing the local
         source IP address from IP packets in ARP requests sent on
         interface:
         0 - (default) Use any local address, configured on any interface
         1 - Try to avoid local addresses that are not in the target's
             subnet for this interface. This mode is useful when target
             hosts reachable via this interface require the source IP
             address in ARP requests to be part of their logical network
             configured on the receiving interface. When we generate the
             request we will check all our subnets that include the
             target IP and will preserve the source address if it is from
             such subnet.
 
         Increasing the restriction level gives more chance for
         receiving answer from the resolved target while decreasing
         the level announces more valid sender's information.
         """
         return self.set_interface('arp_announce', arp_announce)
 
     def set_arp_ignore(self, arp_ignore):
         """
         Define different modes for sending replies in response to received ARP
         requests that resolve local target IP addresses:
 
         0 - (default): reply for any local target IP address, configured
             on any interface
         1 - reply only if the target IP address is local address
             configured on the incoming interface
         """
         return self.set_interface('arp_ignore', arp_ignore)
 
     def set_ipv4_forwarding(self, forwarding):
         """
         Configure IPv4 forwarding.
         """
         return self.set_interface('ipv4_forwarding', forwarding)
 
     def set_ipv4_source_validation(self, value):
         """
         Help prevent attacks used by Spoofing IP Addresses. Reverse path
         filtering is a Kernel feature that, when enabled, is designed to ensure
         packets that are not routable to be dropped. The easiest example of this
         would be and IP Address of the range 10.0.0.0/8, a private IP Address,
         being received on the Internet facing interface of the router.
 
         As per RFC3074.
         """
         if value == 'strict':
             value = 1
         elif value == 'loose':
             value = 2
         else:
             value = 0
 
         all_rp_filter = int(read_file('/proc/sys/net/ipv4/conf/all/rp_filter'))
         if all_rp_filter > value:
             global_setting = 'disable'
             if   all_rp_filter == 1: global_setting = 'strict'
             elif all_rp_filter == 2: global_setting = 'loose'
 
             print(f'WARNING: Global source-validation is set to "{global_setting}\n"' \
                    'this overrides per interface setting!')
 
         return self.set_interface('rp_filter', value)
 
     def set_ipv6_accept_ra(self, accept_ra):
         """
         Accept Router Advertisements; autoconfigure using them.
 
         It also determines whether or not to transmit Router Solicitations.
         If and only if the functional setting is to accept Router
         Advertisements, Router Solicitations will be transmitted.
 
         0 - Do not accept Router Advertisements.
         1 - (default) Accept Router Advertisements if forwarding is disabled.
         2 - Overrule forwarding behaviour. Accept Router Advertisements even if
             forwarding is enabled.
         """
         return self.set_interface('ipv6_accept_ra', accept_ra)
 
     def set_ipv6_autoconf(self, autoconf):
         """
         Autoconfigure addresses using Prefix Information in Router
         Advertisements.
         """
         return self.set_interface('ipv6_autoconf', autoconf)
 
     def add_ipv6_eui64_address(self, prefix):
         """
         Extended Unique Identifier (EUI), as per RFC2373, allows a host to
         assign itself a unique IPv6 address based on a given IPv6 prefix.
 
         Calculate the EUI64 from the interface's MAC, then assign it
         with the given prefix to the interface.
         """
         # T2863: only add a link-local IPv6 address if the interface returns
         # a MAC address. This is not the case on e.g. WireGuard interfaces.
         mac = self.get_mac()
         if mac:
             eui64 = mac2eui64(mac, prefix)
             prefixlen = prefix.split('/')[1]
             self.add_addr(f'{eui64}/{prefixlen}')
 
     def del_ipv6_eui64_address(self, prefix):
         """
         Delete the address based on the interface's MAC-based EUI64
         combined with the prefix address.
         """
         eui64 = mac2eui64(self.get_mac(), prefix)
         prefixlen = prefix.split('/')[1]
         self.del_addr(f'{eui64}/{prefixlen}')
 
     def set_ipv6_forwarding(self, forwarding):
         """
         Configure IPv6 interface-specific Host/Router behaviour.
 
         False:
 
         By default, Host behaviour is assumed.  This means:
 
         1. IsRouter flag is not set in Neighbour Advertisements.
         2. If accept_ra is TRUE (default), transmit Router
            Solicitations.
         3. If accept_ra is TRUE (default), accept Router
            Advertisements (and do autoconfiguration).
         4. If accept_redirects is TRUE (default), accept Redirects.
 
         True:
 
         If local forwarding is enabled, Router behaviour is assumed.
         This means exactly the reverse from the above:
 
         1. IsRouter flag is set in Neighbour Advertisements.
         2. Router Solicitations are not sent unless accept_ra is 2.
         3. Router Advertisements are ignored unless accept_ra is 2.
         4. Redirects are ignored.
         """
         return self.set_interface('ipv6_forwarding', forwarding)
 
     def set_ipv6_dad_messages(self, dad):
         """
         The amount of Duplicate Address Detection probes to send.
         Default: 1
         """
         return self.set_interface('ipv6_dad_transmits', dad)
 
     def set_link_detect(self, link_filter):
         """
         Configure kernel response in packets received on interfaces that are 'down'
 
         0 - Allow packets to be received for the address on this interface
             even if interface is disabled or no carrier.
 
         1 - Ignore packets received if interface associated with the incoming
             address is down.
 
         2 - Ignore packets received if interface associated with the incoming
             address is down or has no carrier.
 
         Default value is 0. Note that some distributions enable it in startup
         scripts.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_link_detect(1)
         """
         return self.set_interface('link_detect', link_filter)
 
     def get_alias(self):
         """
         Get interface alias name used by e.g. SNMP
 
         Example:
         >>> Interface('eth0').get_alias()
         'interface description as set by user'
         """
         return self.get_interface('alias')
 
     def set_alias(self, ifalias=''):
         """
         Set interface alias name used by e.g. SNMP
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_alias('VyOS upstream interface')
 
         to clear alias e.g. delete it use:
 
         >>> Interface('eth0').set_ifalias('')
         """
         self.set_interface('alias', ifalias)
 
     def get_admin_state(self):
         """
         Get interface administrative state. Function will return 'up' or 'down'
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_admin_state()
         'up'
         """
         return self.get_interface('admin_state')
 
     def set_admin_state(self, state):
         """
         Set interface administrative state to be 'up' or 'down'
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_admin_state('down')
         >>> Interface('eth0').get_admin_state()
         'down'
         """
         if state == 'up':
             self._admin_state_down_cnt -= 1
             if self._admin_state_down_cnt < 1:
                 return self.set_interface('admin_state', state)
         else:
             self._admin_state_down_cnt += 1
             return self.set_interface('admin_state', state)
 
     def set_path_cost(self, cost):
         """
         Set interface path cost, only relevant for STP enabled interfaces
 
         Example:
 
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_path_cost(4)
         """
         self.set_interface('path_cost', cost)
 
     def set_path_priority(self, priority):
         """
         Set interface path priority, only relevant for STP enabled interfaces
 
         Example:
 
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_path_priority(4)
         """
         self.set_interface('path_priority', priority)
 
     def set_port_isolation(self, on_or_off):
         """
         Controls whether a given port will be isolated, which means it will be
         able to communicate with non-isolated ports only. By default this flag
         is off.
 
         Use enable=1 to enable or enable=0 to disable
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth1').set_port_isolation('on')
         """
         self.set_interface('bridge_port_isolation', on_or_off)
 
     def set_proxy_arp(self, enable):
         """
         Set per interface proxy ARP configuration
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_proxy_arp(1)
         """
         self.set_interface('proxy_arp', enable)
 
     def set_proxy_arp_pvlan(self, enable):
         """
         Private VLAN proxy arp.
         Basically allow proxy arp replies back to the same interface
         (from which the ARP request/solicitation was received).
 
         This is done to support (ethernet) switch features, like RFC
         3069, where the individual ports are NOT allowed to
         communicate with each other, but they are allowed to talk to
         the upstream router.  As described in RFC 3069, it is possible
         to allow these hosts to communicate through the upstream
         router by proxy_arp'ing. Don't need to be used together with
         proxy_arp.
 
         This technology is known by different names:
         In RFC 3069 it is called VLAN Aggregation.
         Cisco and Allied Telesyn call it Private VLAN.
         Hewlett-Packard call it Source-Port filtering or port-isolation.
         Ericsson call it MAC-Forced Forwarding (RFC Draft).
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').set_proxy_arp_pvlan(1)
         """
         self.set_interface('proxy_arp_pvlan', enable)
 
     def get_addr_v4(self):
         """
         Retrieve assigned IPv4 addresses from given interface.
         This is done using the netifaces and ipaddress python modules.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_addr_v4()
         ['172.16.33.30/24']
         """
         ipv4 = []
         if AF_INET in ifaddresses(self.config['ifname']):
             for v4_addr in ifaddresses(self.config['ifname'])[AF_INET]:
                 # we need to manually assemble a list of IPv4 address/prefix
                 prefix = '/' + \
                     str(IPv4Network('0.0.0.0/' + v4_addr['netmask']).prefixlen)
                 ipv4.append(v4_addr['addr'] + prefix)
         return ipv4
 
     def get_addr_v6(self):
         """
         Retrieve assigned IPv6 addresses from given interface.
         This is done using the netifaces and ipaddress python modules.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_addr_v6()
         ['fe80::20c:29ff:fe11:a174/64']
         """
         ipv6 = []
         if AF_INET6 in ifaddresses(self.config['ifname']):
             for v6_addr in ifaddresses(self.config['ifname'])[AF_INET6]:
                 # Note that currently expanded netmasks are not supported. That means
                 # 2001:db00::0/24 is a valid argument while 2001:db00::0/ffff:ff00:: not.
                 # see https://docs.python.org/3/library/ipaddress.html
                 prefix = '/' + v6_addr['netmask'].split('/')[-1]
 
                 # we alsoneed to remove the interface suffix on link local
                 # addresses
                 v6_addr['addr'] = v6_addr['addr'].split('%')[0]
                 ipv6.append(v6_addr['addr'] + prefix)
         return ipv6
 
     def get_addr(self):
         """
         Retrieve assigned IPv4 and IPv6 addresses from given interface.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_addr()
         ['172.16.33.30/24', 'fe80::20c:29ff:fe11:a174/64']
         """
         return self.get_addr_v4() + self.get_addr_v6()
 
     def add_addr(self, addr):
         """
         Add IP(v6) address to interface. Address is only added if it is not
         already assigned to that interface. Address format must be validated
         and compressed/normalized before calling this function.
 
         addr: can be an IPv4 address, IPv6 address, dhcp or dhcpv6!
               IPv4: add IPv4 address to interface
               IPv6: add IPv6 address to interface
               dhcp: start dhclient (IPv4) on interface
               dhcpv6: start WIDE DHCPv6 (IPv6) on interface
 
         Returns False if address is already assigned and wasn't re-added.
         Example:
         >>> from vyos.ifconfig import Interface
         >>> j = Interface('eth0')
         >>> j.add_addr('192.0.2.1/24')
         >>> j.add_addr('2001:db8::ffff/64')
         >>> j.get_addr()
         ['192.0.2.1/24', '2001:db8::ffff/64']
         """
         # XXX: normalize/compress with ipaddress if calling functions don't?
         # is subnet mask always passed, and in the same way?
 
         # do not add same address twice
         if addr in self._addr:
             return False
 
         addr_is_v4 = is_ipv4(addr)
 
         # we can't have both DHCP and static IPv4 addresses assigned
         for a in self._addr:
             if ( ( addr == 'dhcp' and a != 'dhcpv6' and is_ipv4(a) ) or
                     ( a == 'dhcp' and addr != 'dhcpv6' and addr_is_v4 ) ):
                 raise ConfigError((
                     "Can't configure both static IPv4 and DHCP address "
                     "on the same interface"))
 
         # add to interface
         if addr == 'dhcp':
             self.set_dhcp(True)
         elif addr == 'dhcpv6':
             self.set_dhcpv6(True)
         elif not is_intf_addr_assigned(self.ifname, addr):
             self._cmd(f'ip addr add "{addr}" '
                     f'{"brd + " if addr_is_v4 else ""}dev "{self.ifname}"')
         else:
             return False
 
         # add to cache
         self._addr.append(addr)
 
         return True
 
     def del_addr(self, addr):
         """
         Delete IP(v6) address from interface. Address is only deleted if it is
         assigned to that interface. Address format must be exactly the same as
         was used when adding the address.
 
         addr: can be an IPv4 address, IPv6 address, dhcp or dhcpv6!
               IPv4: delete IPv4 address from interface
               IPv6: delete IPv6 address from interface
               dhcp: stop dhclient (IPv4) on interface
               dhcpv6: stop dhclient (IPv6) on interface
 
         Returns False if address isn't already assigned and wasn't deleted.
         Example:
         >>> from vyos.ifconfig import Interface
         >>> j = Interface('eth0')
         >>> j.add_addr('2001:db8::ffff/64')
         >>> j.add_addr('192.0.2.1/24')
         >>> j.get_addr()
         ['192.0.2.1/24', '2001:db8::ffff/64']
         >>> j.del_addr('192.0.2.1/24')
         >>> j.get_addr()
         ['2001:db8::ffff/64']
         """
 
         # remove from interface
         if addr == 'dhcp':
             self.set_dhcp(False)
         elif addr == 'dhcpv6':
             self.set_dhcpv6(False)
         elif is_intf_addr_assigned(self.ifname, addr):
             self._cmd(f'ip addr del "{addr}" dev "{self.ifname}"')
         else:
             return False
 
         # remove from cache
         if addr in self._addr:
             self._addr.remove(addr)
 
         return True
 
     def flush_addrs(self):
         """
         Flush all addresses from an interface, including DHCP.
 
         Will raise an exception on error.
         """
         # stop DHCP(v6) if running
         self.set_dhcp(False)
         self.set_dhcpv6(False)
 
         # flush all addresses
         self._cmd(f'ip addr flush dev "{self.ifname}"')
 
     def add_to_bridge(self, bridge_dict):
         """
         Adds the interface to the bridge with the passed port config.
 
         Returns False if bridge doesn't exist.
         """
 
         # drop all interface addresses first
         self.flush_addrs()
 
         ifname = self.ifname
 
         for bridge, bridge_config in bridge_dict.items():
             # add interface to bridge - use Section.klass to get BridgeIf class
             Section.klass(bridge)(bridge, create=True).add_port(self.ifname)
 
             # set bridge port path cost
             if 'cost' in bridge_config:
                 self.set_path_cost(bridge_config['cost'])
 
             # set bridge port path priority
             if 'priority' in bridge_config:
                 self.set_path_cost(bridge_config['priority'])
 
             bridge_vlan_filter = Section.klass(bridge)(bridge, create=True).get_vlan_filter()
 
             if int(bridge_vlan_filter):
                 cur_vlan_ids = get_vlan_ids(ifname)
                 add_vlan = []
                 native_vlan_id = None
                 allowed_vlan_ids= []
 
                 if 'native_vlan' in bridge_config:
                     vlan_id = bridge_config['native_vlan']
                     add_vlan.append(vlan_id)
                     native_vlan_id = vlan_id
 
                 if 'allowed_vlan' in bridge_config:
                     for vlan in bridge_config['allowed_vlan']:
                         vlan_range = vlan.split('-')
                         if len(vlan_range) == 2:
                             for vlan_add in range(int(vlan_range[0]),int(vlan_range[1]) + 1):
                                 add_vlan.append(str(vlan_add))
                                 allowed_vlan_ids.append(str(vlan_add))
                         else:
                             add_vlan.append(vlan)
                             allowed_vlan_ids.append(vlan)
 
                 # Remove redundant VLANs from the system
                 for vlan in list_diff(cur_vlan_ids, add_vlan):
                     cmd = f'bridge vlan del dev {ifname} vid {vlan} master'
                     self._cmd(cmd)
 
                 for vlan in allowed_vlan_ids:
                     cmd = f'bridge vlan add dev {ifname} vid {vlan} master'
                     self._cmd(cmd)
                 # Setting native VLAN to system
                 if native_vlan_id:
                     cmd = f'bridge vlan add dev {ifname} vid {native_vlan_id} pvid untagged master'
                     self._cmd(cmd)
 
     def set_dhcp(self, enable):
         """
         Enable/Disable DHCP client on a given interface.
         """
         if enable not in [True, False]:
             raise ValueError()
 
         ifname = self.ifname
         config_base = r'/var/lib/dhcp/dhclient'
         config_file = f'{config_base}_{ifname}.conf'
         options_file = f'{config_base}_{ifname}.options'
         pid_file = f'{config_base}_{ifname}.pid'
         lease_file = f'{config_base}_{ifname}.leases'
 
         # Stop client with old config files to get the right IF_METRIC.
         self._cmd(f'systemctl stop dhclient@{ifname}.service')
 
         if enable and 'disable' not in self._config:
             if dict_search('dhcp_options.host_name', self._config) == None:
                 # read configured system hostname.
                 # maybe change to vyos hostd client ???
                 hostname = 'vyos'
                 with open('/etc/hostname', 'r') as f:
                     hostname = f.read().rstrip('\n')
                     tmp = {'dhcp_options' : { 'host_name' : hostname}}
                     self._config = dict_merge(tmp, self._config)
 
             render(options_file, 'dhcp-client/daemon-options.tmpl',
                    self._config)
             render(config_file, 'dhcp-client/ipv4.tmpl',
                    self._config)
 
             # 'up' check is mandatory b/c even if the interface is A/D, as soon as
             # the DHCP client is started the interface will be placed in u/u state.
             # This is not what we intended to do when disabling an interface.
             return self._cmd(f'systemctl start dhclient@{ifname}.service')
         else:
             # cleanup old config files
             for file in [config_file, options_file, pid_file, lease_file]:
                 if os.path.isfile(file):
                     os.remove(file)
 
 
     def set_dhcpv6(self, enable):
         """
         Enable/Disable DHCPv6 client on a given interface.
         """
         if enable not in [True, False]:
             raise ValueError()
 
         ifname = self.ifname
         config_file = f'/run/dhcp6c/dhcp6c.{ifname}.conf'
 
         if enable and 'disable' not in self._config:
             render(config_file, 'dhcp-client/ipv6.tmpl',
                    self._config)
 
             # We must ignore any return codes. This is required to enable DHCPv6-PD
             # for interfaces which are yet not up and running.
             return self._popen(f'systemctl restart dhcp6c@{ifname}.service')
         else:
             self._popen(f'systemctl stop dhcp6c@{ifname}.service')
 
             if os.path.isfile(config_file):
                 os.remove(config_file)
 
     def set_mirror(self):
         # Please refer to the document for details
         #   - https://man7.org/linux/man-pages/man8/tc.8.html
         #   - https://man7.org/linux/man-pages/man8/tc-mirred.8.html
         # Depening if we are the source or the target interface of the port
         # mirror we need to setup some variables.
         source_if = self._config['ifname']
         config = self._config.get('mirror', None)
 
         if 'is_mirror_intf' in self._config:
             source_if = next(iter(self._config['is_mirror_intf']))
             config = self._config['is_mirror_intf'][source_if].get('mirror', None)
 
         # Please do not clear the 'set $? = 0 '. It's meant to force a return of 0
         # Remove existing mirroring rules
         delete_tc_cmd  = f'tc qdisc del dev {source_if} handle ffff: ingress 2> /dev/null;'
         delete_tc_cmd += f'tc qdisc del dev {source_if} handle 1: root prio 2> /dev/null;'
         delete_tc_cmd += 'set $?=0'
         self._popen(delete_tc_cmd)
 
         # Bail out early if nothing needs to be configured
         if not config:
             return
 
         for direction, mirror_if in config.items():
             if mirror_if not in interfaces():
                 continue
 
             if direction == 'ingress':
                 handle = 'ffff: ingress'
                 parent = 'ffff:'
             elif direction == 'egress':
                 handle = '1: root prio'
                 parent = '1:'
 
             # Mirror egress traffic
             mirror_cmd  = f'tc qdisc add dev {source_if} handle {handle}; '
             # Export the mirrored traffic to the interface
             mirror_cmd += f'tc filter add dev {source_if} parent {parent} protocol all prio 10 u32 match u32 0 0 flowid 1:1 action mirred egress mirror dev {mirror_if}'
             self._popen(mirror_cmd)
 
 
     def set_xdp(self, state):
         """
         Enable Kernel XDP support. State can be either True or False.
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> i = Interface('eth0')
         >>> i.set_xdp(True)
         """
         if not isinstance(state, bool):
             raise ValueError("Value out of range")
 
         # https://phabricator.vyos.net/T3448 - there is (yet) no RPI support for XDP
         if not os.path.exists('/usr/sbin/xdp_loader'):
             return
 
         ifname = self.config['ifname']
         cmd = f'xdp_loader -d {ifname} -U --auto-mode'
         if state:
             # Using 'xdp' will automatically decide if the driver supports
             # 'xdpdrv' or only 'xdpgeneric'. A user later sees which driver is
             # actually in use by calling 'ip a' or 'show interfaces ethernet'
             cmd = f'xdp_loader -d {ifname} --auto-mode -F --progsec xdp_router ' \
                   f'--filename /usr/share/vyos/xdp/xdp_prog_kern.o && ' \
                   f'xdp_prog_user -d {ifname}'
 
         return self._cmd(cmd)
 
     def update(self, config):
         """ General helper function which works on a dictionary retrived by
         get_config_dict(). It's main intention is to consolidate the scattered
         interface setup code and provide a single point of entry when workin
         on any interface. """
 
         if self.debug:
             import pprint
             pprint.pprint(config)
 
         # Cache the configuration - it will be reused inside e.g. DHCP handler
         # XXX: maybe pass the option via __init__ in the future and rename this
         # method to apply()?
         self._config = config
 
         # Change interface MAC address - re-set to real hardware address (hw-id)
         # if custom mac is removed. Skip if bond member.
         if 'is_bond_member' not in config:
             mac = config.get('hw_id')
             if 'mac' in config:
                 mac = config.get('mac')
             if mac:
                 self.set_mac(mac)
 
         # Update interface description
         self.set_alias(config.get('description', ''))
 
         # Ignore link state changes
         value = '2' if 'disable_link_detect' in config else '1'
         self.set_link_detect(value)
 
         # Configure assigned interface IP addresses. No longer
         # configured addresses will be removed first
         new_addr = config.get('address', [])
 
         # always ensure DHCP client is stopped (when not configured explicitly)
         if 'dhcp' not in new_addr:
             self.del_addr('dhcp')
 
         # always ensure DHCPv6 client is stopped (when not configured as client
         # for IPv6 address or prefix delegation)
         dhcpv6pd = dict_search('dhcpv6_options.pd', config)
         dhcpv6pd = dhcpv6pd != None and len(dhcpv6pd) != 0
         if 'dhcpv6' not in new_addr and not dhcpv6pd:
             self.del_addr('dhcpv6')
 
         # determine IP addresses which are assigned to the interface and build a
         # list of addresses which are no longer in the dict so they can be removed
         cur_addr = self.get_addr()
         for addr in list_diff(cur_addr, new_addr):
             # we will delete all interface specific IP addresses if they are not
             # explicitly configured on the CLI
             if is_ipv6_link_local(addr):
                 eui64 = mac2eui64(self.get_mac(), 'fe80::/64')
                 if addr != f'{eui64}/64':
                     self.del_addr(addr)
             else:
                 self.del_addr(addr)
 
         for addr in new_addr:
             self.add_addr(addr)
 
         # start DHCPv6 client when only PD was configured
         if dhcpv6pd:
             self.set_dhcpv6(True)
 
         # There are some items in the configuration which can only be applied
         # if this instance is not bound to a bridge. This should be checked
         # by the caller but better save then sorry!
         if not any(k in ['is_bond_member', 'is_bridge_member'] for k in config):
             # Bind interface to given VRF or unbind it if vrf node is not set.
             # unbinding will call 'ip link set dev eth0 nomaster' which will
             # also drop the interface out of a bridge or bond - thus this is
             # checked before
             self.set_vrf(config.get('vrf', ''))
 
         # Configure ARP cache timeout in milliseconds - has default value
         tmp = dict_search('ip.arp_cache_timeout', config)
         value = tmp if (tmp != None) else '30'
         self.set_arp_cache_tmo(value)
 
         # Configure ARP filter configuration
         tmp = dict_search('ip.disable_arp_filter', config)
         value = '0' if (tmp != None) else '1'
         self.set_arp_filter(value)
 
         # Configure ARP accept
         tmp = dict_search('ip.enable_arp_accept', config)
         value = '1' if (tmp != None) else '0'
         self.set_arp_accept(value)
 
         # Configure ARP announce
         tmp = dict_search('ip.enable_arp_announce', config)
         value = '1' if (tmp != None) else '0'
         self.set_arp_announce(value)
 
         # Configure ARP ignore
         tmp = dict_search('ip.enable_arp_ignore', config)
         value = '1' if (tmp != None) else '0'
         self.set_arp_ignore(value)
 
         # Enable proxy-arp on this interface
         tmp = dict_search('ip.enable_proxy_arp', config)
         value = '1' if (tmp != None) else '0'
         self.set_proxy_arp(value)
 
         # Enable private VLAN proxy ARP on this interface
         tmp = dict_search('ip.proxy_arp_pvlan', config)
         value = '1' if (tmp != None) else '0'
         self.set_proxy_arp_pvlan(value)
 
         # IPv4 forwarding
         tmp = dict_search('ip.disable_forwarding', config)
         value = '0' if (tmp != None) else '1'
         self.set_ipv4_forwarding(value)
 
         # IPv4 source-validation
         tmp = dict_search('ip.source_validation', config)
         value = tmp if (tmp != None) else '0'
         self.set_ipv4_source_validation(value)
 
         # IPv6 forwarding
         tmp = dict_search('ipv6.disable_forwarding', config)
         value = '0' if (tmp != None) else '1'
         self.set_ipv6_forwarding(value)
 
         # IPv6 router advertisements
         tmp = dict_search('ipv6.address.autoconf', config)
         value = '2' if (tmp != None) else '1'
         if 'dhcpv6' in new_addr:
             value = '2'
         self.set_ipv6_accept_ra(value)
 
         # IPv6 address autoconfiguration
         tmp = dict_search('ipv6.address.autoconf', config)
         value = '1' if (tmp != None) else '0'
         self.set_ipv6_autoconf(value)
 
         # IPv6 Duplicate Address Detection (DAD) tries
         tmp = dict_search('ipv6.dup_addr_detect_transmits', config)
         value = tmp if (tmp != None) else '1'
         self.set_ipv6_dad_messages(value)
 
         # MTU - Maximum Transfer Unit
         if 'mtu' in config:
             self.set_mtu(config.get('mtu'))
 
         # Delete old IPv6 EUI64 addresses before changing MAC
         tmp = dict_search('ipv6.address.eui64_old', config)
         if tmp:
             for addr in tmp:
                 self.del_ipv6_eui64_address(addr)
 
         # Manage IPv6 link-local addresses
         tmp = dict_search('ipv6.address.no_default_link_local', config)
         # we must check explicitly for None type as if the key is set we will
         # get an empty dict (<class 'dict'>)
         if isinstance(tmp, dict):
             self.del_ipv6_eui64_address('fe80::/64')
         else:
             self.add_ipv6_eui64_address('fe80::/64')
 
         # Add IPv6 EUI-based addresses
         tmp = dict_search('ipv6.address.eui64', config)
         if tmp:
             for addr in tmp:
                 self.add_ipv6_eui64_address(addr)
 
         # re-add ourselves to any bridge we might have fallen out of
         if 'is_bridge_member' in config:
             bridge_dict = config.get('is_bridge_member')
             self.add_to_bridge(bridge_dict)
 
         # eXpress Data Path - highly experimental
         self.set_xdp('xdp' in config)
 
         # configure port mirror
         self.set_mirror()
 
         # Enable/Disable of an interface must always be done at the end of the
         # derived class to make use of the ref-counting set_admin_state()
         # function. We will only enable the interface if 'up' was called as
         # often as 'down'. This is required by some interface implementations
         # as certain parameters can only be changed when the interface is
         # in admin-down state. This ensures the link does not flap during
         # reconfiguration.
         state = 'down' if 'disable' in config else 'up'
         self.set_admin_state(state)
 
         # remove no longer required 802.1ad (Q-in-Q VLANs)
         ifname = config['ifname']
         for vif_s_id in config.get('vif_s_remove', {}):
             vif_s_ifname = f'{ifname}.{vif_s_id}'
             VLANIf(vif_s_ifname).remove()
 
         # create/update 802.1ad (Q-in-Q VLANs)
         for vif_s_id, vif_s_config in config.get('vif_s', {}).items():
             tmp = deepcopy(VLANIf.get_config())
             tmp['protocol'] = vif_s_config['protocol']
             tmp['source_interface'] = ifname
             tmp['vlan_id'] = vif_s_id
 
             vif_s_ifname = f'{ifname}.{vif_s_id}'
             vif_s_config['ifname'] = vif_s_ifname
 
             # It is not possible to change the VLAN encapsulation protocol
             # "on-the-fly". For this "quirk" we need to actively delete and
             # re-create the VIF-S interface.
             if self.exists(vif_s_ifname):
                 cur_cfg = get_interface_config(vif_s_ifname)
                 protocol = dict_search('linkinfo.info_data.protocol', cur_cfg).lower()
                 if protocol != vif_s_config['protocol']:
                     VLANIf(vif_s_ifname).remove()
 
             s_vlan = VLANIf(vif_s_ifname, **tmp)
             s_vlan.update(vif_s_config)
 
             # remove no longer required client VLAN (vif-c)
             for vif_c_id in vif_s_config.get('vif_c_remove', {}):
                 vif_c_ifname = f'{vif_s_ifname}.{vif_c_id}'
                 VLANIf(vif_c_ifname).remove()
 
             # create/update client VLAN (vif-c) interface
             for vif_c_id, vif_c_config in vif_s_config.get('vif_c', {}).items():
                 tmp = deepcopy(VLANIf.get_config())
                 tmp['source_interface'] = vif_s_ifname
                 tmp['vlan_id'] = vif_c_id
 
                 vif_c_ifname = f'{vif_s_ifname}.{vif_c_id}'
                 vif_c_config['ifname'] = vif_c_ifname
                 c_vlan = VLANIf(vif_c_ifname, **tmp)
                 c_vlan.update(vif_c_config)
 
         # remove no longer required 802.1q VLAN interfaces
         for vif_id in config.get('vif_remove', {}):
             vif_ifname = f'{ifname}.{vif_id}'
             VLANIf(vif_ifname).remove()
 
         # create/update 802.1q VLAN interfaces
         for vif_id, vif_config in config.get('vif', {}).items():
 
             vif_ifname = f'{ifname}.{vif_id}'
             vif_config['ifname'] = vif_ifname
 
             tmp = deepcopy(VLANIf.get_config())
             tmp['source_interface'] = ifname
             tmp['vlan_id'] = vif_id
 
             # We need to ensure that the string format is consistent, and we need to exclude redundant spaces.
             sep = ' '
             if 'egress_qos' in vif_config:
                 # Unwrap strings into arrays
                 egress_qos_array = vif_config['egress_qos'].split()
                 # The split array is spliced according to the fixed format
                 tmp['egress_qos'] = sep.join(egress_qos_array)
 
             if 'ingress_qos' in vif_config:
                 # Unwrap strings into arrays
                 ingress_qos_array = vif_config['ingress_qos'].split()
                 # The split array is spliced according to the fixed format
                 tmp['ingress_qos'] = sep.join(ingress_qos_array)
 
             # Since setting the QoS control parameters in the later stage will
             # not completely delete the old settings,
             # we still need to delete the VLAN encapsulation interface in order to
             # ensure that the changed settings are effective.
             cur_cfg = get_interface_config(vif_ifname)
             qos_str = ''
             tmp2 = dict_search('linkinfo.info_data.ingress_qos', cur_cfg)
             if 'ingress_qos' in tmp and tmp2:
                 for item in tmp2:
                     from_key = item['from']
                     to_key = item['to']
                     qos_str += f'{from_key}:{to_key} '
                 if qos_str != tmp['ingress_qos']:
                     if self.exists(vif_ifname):
                         VLANIf(vif_ifname).remove()
 
             qos_str = ''
             tmp2 = dict_search('linkinfo.info_data.egress_qos', cur_cfg)
             if 'egress_qos' in tmp and tmp2:
                 for item in tmp2:
                     from_key = item['from']
                     to_key = item['to']
                     qos_str += f'{from_key}:{to_key} '
                 if qos_str != tmp['egress_qos']:
                     if self.exists(vif_ifname):
                         VLANIf(vif_ifname).remove()
 
             vlan = VLANIf(vif_ifname, **tmp)
             vlan.update(vif_config)
 
 
 class VLANIf(Interface):
     """ Specific class which abstracts 802.1q and 802.1ad (Q-in-Q) VLAN interfaces """
     iftype = 'vlan'
 
     def _create(self):
         # bail out early if interface already exists
         if self.exists(f'{self.ifname}'):
             return
 
         cmd = 'ip link add link {source_interface} name {ifname} type vlan id {vlan_id}'
         if 'protocol' in self.config:
             cmd += ' protocol {protocol}'
         if 'ingress_qos' in self.config:
             cmd += ' ingress-qos-map {ingress_qos}'
         if 'egress_qos' in self.config:
             cmd += ' egress-qos-map {egress_qos}'
 
         self._cmd(cmd.format(**self.config))
 
         # interface is always A/D down. It needs to be enabled explicitly
         self.set_admin_state('down')
 
     def set_admin_state(self, state):
         """
         Set interface administrative state to be 'up' or 'down'
 
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0.10').set_admin_state('down')
         >>> Interface('eth0.10').get_admin_state()
         'down'
         """
         # A VLAN interface can only be placed in admin up state when
         # the lower interface is up, too
         lower_interface = glob(f'/sys/class/net/{self.ifname}/lower*/flags')[0]
         with open(lower_interface, 'r') as f:
             flags = f.read()
         # If parent is not up - bail out as we can not bring up the VLAN.
         # Flags are defined in kernel source include/uapi/linux/if.h
         if not int(flags, 16) & 1:
             return None
 
         return super().set_admin_state(state)
 
     def set_mirror(self):
         return
diff --git a/src/conf_mode/vrf.py b/src/conf_mode/vrf.py
index 936561edc..fbfce646f 100755
--- a/src/conf_mode/vrf.py
+++ b/src/conf_mode/vrf.py
@@ -1,244 +1,268 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2020-2021 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
 
 from sys import exit
 from json import loads
+from tempfile import NamedTemporaryFile
 
 from vyos.config import Config
 from vyos.configdict import node_changed
 from vyos.ifconfig import Interface
 from vyos.template import render
 from vyos.template import render_to_string
 from vyos.util import call
 from vyos.util import cmd
+from vyos.util import popen
 from vyos.util import dict_search
 from vyos.util import get_interface_config
 from vyos import ConfigError
 from vyos import frr
 from vyos import airbag
 airbag.enable()
 
 frr_daemon = 'zebra'
 
 config_file = r'/etc/iproute2/rt_tables.d/vyos-vrf.conf'
 
 def list_rules():
     command = 'ip -j -4 rule show'
     answer = loads(cmd(command))
     return [_ for _ in answer if _]
 
 def vrf_interfaces(c, match):
     matched = []
     old_level = c.get_level()
     c.set_level(['interfaces'])
     section = c.get_config_dict([], get_first_key=True)
     for type in section:
         interfaces = section[type]
         for name in interfaces:
             interface = interfaces[name]
             if 'vrf' in interface:
                 v = interface.get('vrf', '')
                 if v == match:
                     matched.append(name)
 
     c.set_level(old_level)
     return matched
 
 def vrf_routing(c, match):
     matched = []
     old_level = c.get_level()
     c.set_level(['protocols', 'vrf'])
     if match in c.list_nodes([]):
         matched.append(match)
 
     c.set_level(old_level)
     return matched
 
 
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
 
     base = ['vrf']
     vrf = conf.get_config_dict(base, get_first_key=True)
 
     # determine which VRF has been removed
     for name in node_changed(conf, base + ['name']):
         if 'vrf_remove' not in vrf:
             vrf.update({'vrf_remove' : {}})
 
         vrf['vrf_remove'][name] = {}
         # get VRF bound interfaces
         interfaces = vrf_interfaces(conf, name)
         if interfaces: vrf['vrf_remove'][name]['interface'] = interfaces
         # get VRF bound routing instances
         routes = vrf_routing(conf, name)
         if routes: vrf['vrf_remove'][name]['route'] = routes
 
     return vrf
 
 def verify(vrf):
     # ensure VRF is not assigned to any interface
     if 'vrf_remove' in vrf:
         for name, config in vrf['vrf_remove'].items():
             if 'interface' in config:
                 raise ConfigError(f'Can not remove VRF "{name}", it still has '\
                                   f'member interfaces!')
             if 'route' in config:
                 raise ConfigError(f'Can not remove VRF "{name}", it still has '\
                                   f'static routes installed!')
 
     if 'name' in vrf:
         table_ids = []
         for name, config in vrf['name'].items():
             # table id is mandatory
             if 'table' not in config:
                 raise ConfigError(f'VRF "{name}" table id is mandatory!')
 
             # routing table id can't be changed - OS restriction
             if os.path.isdir(f'/sys/class/net/{name}'):
                 tmp = str(dict_search('linkinfo.info_data.table', get_interface_config(name)))
                 if tmp and tmp != config['table']:
                     raise ConfigError(f'VRF "{name}" table id modification not possible!')
 
             # VRf routing table ID must be unique on the system
             if config['table'] in table_ids:
                 raise ConfigError(f'VRF "{name}" table id is not unique!')
             table_ids.append(config['table'])
 
     return None
 
+
 def generate(vrf):
     render(config_file, 'vrf/vrf.conf.tmpl', vrf)
     vrf['new_frr_config'] = render_to_string('frr/vrf.frr.tmpl', vrf)
+    # Render nftables zones config
+    vrf['nft_vrf_zones'] = NamedTemporaryFile().name
+    render(vrf['nft_vrf_zones'], 'firewall/nftables-vrf-zones.tmpl', vrf)
+
     return None
 
+
 def apply(vrf):
     # Documentation
     #
     # - https://github.com/torvalds/linux/blob/master/Documentation/networking/vrf.txt
     # - https://github.com/Mellanox/mlxsw/wiki/Virtual-Routing-and-Forwarding-(VRF)
     # - https://github.com/Mellanox/mlxsw/wiki/L3-Tunneling
     # - https://netdevconf.info/1.1/proceedings/slides/ahern-vrf-tutorial.pdf
     # - https://netdevconf.info/1.2/slides/oct6/02_ahern_what_is_l3mdev_slides.pdf
 
     # set the default VRF global behaviour
     bind_all = '0'
     if 'bind-to-all' in vrf:
         bind_all = '1'
     call(f'sysctl -wq net.ipv4.tcp_l3mdev_accept={bind_all}')
     call(f'sysctl -wq net.ipv4.udp_l3mdev_accept={bind_all}')
 
     for tmp in (dict_search('vrf_remove', vrf) or []):
         if os.path.isdir(f'/sys/class/net/{tmp}'):
             call(f'ip -4 route del vrf {tmp} unreachable default metric 4278198272')
             call(f'ip -6 route del vrf {tmp} unreachable default metric 4278198272')
             call(f'ip link delete dev {tmp}')
+            # Remove nftables conntrack zone map item
+            nft_del_element = f'delete element inet vrf_zones ct_iface_map {{ "{tmp}" }}'
+            cmd(f'nft {nft_del_element}')
 
     if 'name' in vrf:
+        # Separate VRFs in conntrack table
+        # check if table already exists
+        _, err = popen('nft list table inet vrf_zones')
+        # If not, create a table
+        if err:
+            cmd(f'nft -f {vrf["nft_vrf_zones"]}')
+            os.unlink(vrf['nft_vrf_zones'])
+
         for name, config in vrf['name'].items():
             table = config['table']
 
             if not os.path.isdir(f'/sys/class/net/{name}'):
                 # For each VRF apart from your default context create a VRF
                 # interface with a separate routing table
                 call(f'ip link add {name} type vrf table {table}')
                 # The kernel Documentation/networking/vrf.txt also recommends
                 # adding unreachable routes to the VRF routing tables so that routes
                 # afterwards are taken.
                 call(f'ip -4 route add vrf {name} unreachable default metric 4278198272')
                 call(f'ip -6 route add vrf {name} unreachable default metric 4278198272')
                 # We also should add proper loopback IP addresses to the newly
                 # created VRFs for services bound to the loopback address (SNMP, NTP)
                 call(f'ip -4 addr add 127.0.0.1/8 dev {name}')
                 call(f'ip -6 addr add ::1/128 dev {name}')
 
             # set VRF description for e.g. SNMP monitoring
             vrf_if = Interface(name)
             vrf_if.set_alias(config.get('description', ''))
             # Enable/Disable of an interface must always be done at the end of the
             # derived class to make use of the ref-counting set_admin_state()
             # function. We will only enable the interface if 'up' was called as
             # often as 'down'. This is required by some interface implementations
             # as certain parameters can only be changed when the interface is
             # in admin-down state. This ensures the link does not flap during
             # reconfiguration.
             state = 'down' if 'disable' in config else 'up'
             vrf_if.set_admin_state(state)
+            # Add nftables conntrack zone map item
+            nft_add_element = f'add element inet vrf_zones ct_iface_map {{ "{name}" : {table} }}'
+            cmd(f'nft {nft_add_element}')
 
     # Linux routing uses rules to find tables - routing targets are then
     # looked up in those tables. If the lookup got a matching route, the
     # process ends.
     #
     # TL;DR; first table with a matching entry wins!
     #
     # You can see your routing table lookup rules using "ip rule", sadly the
     # local lookup is hit before any VRF lookup. Pinging an addresses from the
     # VRF will usually find a hit in the local table, and never reach the VRF
     # routing table - this is usually not what you want. Thus we will
     # re-arrange the tables and move the local lookup furhter down once VRFs
     # are enabled.
 
     # get current preference on local table
     local_pref = [r.get('priority') for r in list_rules() if r.get('table') == 'local'][0]
 
     # change preference when VRFs are enabled and local lookup table is default
     if not local_pref and 'name' in vrf:
         for af in ['-4', '-6']:
             call(f'ip {af} rule add pref 32765 table local')
             call(f'ip {af} rule del pref 0')
 
     # return to default lookup preference when no VRF is configured
     if 'name' not in vrf:
         for af in ['-4', '-6']:
             call(f'ip {af} rule add pref 0 table local')
             call(f'ip {af} rule del pref 32765')
 
             # clean out l3mdev-table rule if present
             if 1000 in [r.get('priority') for r in list_rules() if r.get('priority') == 1000]:
                 call(f'ip {af} rule del pref 1000')
+        # Remove VRF zones table from nftables
+        cmd('nft delete table inet vrf_zones')
 
     # add configuration to FRR
     frr_cfg = frr.FRRConfig()
     frr_cfg.load_configuration(frr_daemon)
     frr_cfg.modify_section(f'^vrf [a-zA-Z-]*$', '')
     frr_cfg.add_before(r'(interface .*|line vty)', vrf['new_frr_config'])
     frr_cfg.commit_configuration(frr_daemon)
 
     # If FRR config is blank, rerun the blank commit x times due to frr-reload
     # behavior/bug not properly clearing out on one commit.
     if vrf['new_frr_config'] == '':
         for a in range(5):
             frr_cfg.commit_configuration(frr_daemon)
 
     # Save configuration to /run/frr/config/frr.conf
     frr.save_configuration()
 
     return None
 
 if __name__ == '__main__':
     try:
         c = get_config()
         verify(c)
         generate(c)
         apply(c)
     except ConfigError as e:
         print(e)
         exit(1)
diff --git a/src/migration-scripts/vrf/2-to-3 b/src/migration-scripts/vrf/2-to-3
new file mode 100755
index 000000000..8e0f97141
--- /dev/null
+++ b/src/migration-scripts/vrf/2-to-3
@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Since connection tracking zones are int16, VRFs tables maximum value must
+# be limited to 65535
+# Also, interface names in nftables cannot start from numbers,
+# so VRF name should not start from a number
+
+from sys import argv
+from sys import exit
+from random import randrange
+from random import choice
+from string import ascii_lowercase
+from vyos.configtree import ConfigTree
+import re
+
+
+# Helper function to find all config items with a VRF name
+def _search_vrfs(config_commands, vrf_name):
+    vrf_values = []
+    # Regex to find path of config command with old VRF
+    regex_filter = re.compile(rf'^set (?P<cmd_path>[^\']+vrf) \'{vrf_name}\'$')
+    # Check each command for VRF value
+    for config_command in config_commands:
+        search_result = regex_filter.search(config_command)
+        if search_result:
+            # Append VRF command to a list
+            vrf_values.append(search_result.group('cmd_path').split())
+    if vrf_values:
+        return vrf_values
+    else:
+        return None
+
+
+# Helper function to find all config items with a table number
+def _search_tables(config_commands, table_num):
+    table_items = {'table_tags': [], 'table_values': []}
+    # Regex to find values and nodes with a table number
+    regex_tags = re.compile(rf'^set (?P<cmd_path>[^\']+table {table_num}) ?.*$')
+    regex_values = re.compile(
+        rf'^set (?P<cmd_path>[^\']+table) \'{table_num}\'$')
+    for config_command in config_commands:
+        # Search for tag nodes
+        search_result = regex_tags.search(config_command)
+        if search_result:
+            # Append table node path to a tag nodes list
+            cmd_path = search_result.group('cmd_path').split()
+            if cmd_path not in table_items['table_tags']:
+                table_items['table_tags'].append(cmd_path)
+        # Search for value nodes
+        search_result = regex_values.search(config_command)
+        if search_result:
+            # Append table node path to a value nodes list
+            table_items['table_values'].append(
+                search_result.group('cmd_path').split())
+    return table_items
+
+
+if (len(argv) < 2):
+    print("Must specify file name!")
+    exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+base = ['vrf', 'name']
+config = ConfigTree(config_file)
+
+if not config.exists(base):
+    # Nothing to do
+    exit(0)
+
+# Get a list of all currently used VRFs and tables
+vrfs_current = {}
+for vrf in config.list_nodes(base):
+    vrfs_current[vrf] = int(config.return_value(base + [vrf, 'table']))
+
+# Check VRF names and table numbers
+name_regex = re.compile(r'^\d.*$')
+for vrf_name, vrf_table in vrfs_current.items():
+    # Check table number
+    if vrf_table > 65535:
+        # Find new unused table number
+        vrfs_current[vrf_name] = None
+        while not vrfs_current[vrf_name]:
+            table_random = randrange(100, 65535)
+            if table_random not in vrfs_current.values():
+                vrfs_current[vrf_name] = table_random
+        # Update number to a new one
+        config.set(['vrf', 'name', vrf_name, 'table'],
+                   vrfs_current[vrf_name],
+                   replace=True)
+        # Check config items with old table number and replace to new one
+        config_commands = config.to_commands().split('\n')
+        table_config_lines = _search_tables(config_commands, vrf_table)
+        # Rename table nodes
+        if table_config_lines.get('table_tags'):
+            for table_config_path in table_config_lines.get('table_tags'):
+                config.rename(table_config_path, f'{vrfs_current[vrf_name]}')
+        # Replace table values
+        if table_config_lines.get('table_values'):
+            for table_config_path in table_config_lines.get('table_values'):
+                config.set(table_config_path,
+                           f'{vrfs_current[vrf_name]}',
+                           replace=True)
+
+    # Check VRF name
+    if name_regex.match(vrf_name):
+        vrf_name_new = None
+        while not vrf_name_new:
+            vrf_name_rand = f'{choice(ascii_lowercase)}{vrf_name}'[:15]
+            if vrf_name_rand not in vrfs_current:
+                vrf_name_new = vrf_name_rand
+        # Update VRF name to a new one
+        config.rename(['vrf', 'name', vrf_name], vrf_name_new)
+        # Check config items with old VRF name and replace to new one
+        config_commands = config.to_commands().split('\n')
+        vrf_config_lines = _search_vrfs(config_commands, vrf_name)
+        # Rename VRF to a new name
+        if vrf_config_lines:
+            for vrf_value_path in vrf_config_lines:
+                config.set(vrf_value_path, vrf_name_new, replace=True)
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    exit(1)
diff --git a/src/validators/vrf-name b/src/validators/vrf-name
index c78a80776..29167c635 100755
--- a/src/validators/vrf-name
+++ b/src/validators/vrf-name
@@ -1,41 +1,41 @@
 #!/usr/bin/env python3
 #
 # Copyright (C) 2020 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
 # published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import re
 from sys import argv, exit
 
 if __name__ == '__main__':
     if len(argv) != 2:
         exit(1)
 
     vrf = argv[1]
     length = len(vrf)
 
     if length not in range(1, 16):
         exit(1)
 
     # Treat loopback interface "lo" explicitly. Adding "lo" explicitly to the
     # following regex pattern would deny any VRF name starting with lo - thuse
     # local-vrf would be illegal - and that we do not want.
     if vrf == "lo":
         exit(1)
 
-    pattern = "^(?!(bond|br|dum|eth|lan|eno|ens|enp|enx|gnv|ipoe|l2tp|l2tpeth|" \
-              "vtun|ppp|pppoe|peth|tun|vti|vxlan|wg|wlan|wwan)\d+(\.\d+(v.+)?)?$).*$"
+    pattern = r'^(?!(bond|br|dum|eth|lan|eno|ens|enp|enx|gnv|ipoe|l2tp|l2tpeth|\
+       vtun|ppp|pppoe|peth|tun|vti|vxlan|wg|wlan|wwan|\d)\d*(\.\d+)?(v.+)?).*$'
     if not re.match(pattern, vrf):
         exit(1)
 
     exit(0)