network/roles/firewall/templates/mgmt.intf.j2

auto mgmt
iface mgmt
    pre-up ip link add $IFACE type vrf table 100
    up ip link set dev $IFACE up
    post-down ip link del $IFACE

{% for iface in interfaces | selectattr('name', 'match', '^mgmt') %}
auto {{ iface.name }}
iface {{ iface.name }}
{% if iface.vrf %}
    requires {{ iface.vrf.name }}
    pre-up ip link set $IFACE master {{ iface.vrf.name }}
{% endif %}
    pre-up sysctl -w net.ipv4.conf.$IFACE.forwarding=0
    pre-up sysctl -w net.ipv6.conf.$IFACE.forwarding=0
{% if iface.mtu %}
    mtu {{ iface.mtu }}
{% endif %}
{% for addr in iface.ip_addresses %}
    address {{ addr.address }}
{% endfor %}
{% if iface.custom_fields.gateway %}
    up ip route add default via {{ iface.custom_fields.gateway.address | ipaddr('address') }}{% if iface.vrf %} vrf {{ iface.vrf.name }}{% endif %}
{% endif +%}

{% endfor %}