diff --git a/cli/documentation/en_US/vns/active b/cli/documentation/en_US/vns/active
new file mode 100755
index 0000000..18f270a
--- /dev/null
+++ b/cli/documentation/en_US/vns/active
@@ -0,0 +1,2 @@
+Set the VNS active. If a VNS is inactive the controller will not use it
+or its rules.
diff --git a/cli/documentation/en_US/vns/active-example b/cli/documentation/en_US/vns/active-example
new file mode 100755
index 0000000..ae5ed4b
--- /dev/null
+++ b/cli/documentation/en_US/vns/active-example
@@ -0,0 +1,5 @@
+active
+  Activate this VNS instance
+
+no active
+  Deactivate this VNS instance
diff --git a/cli/documentation/en_US/vns/apr-mode-value-drop-if-unknown b/cli/documentation/en_US/vns/apr-mode-value-drop-if-unknown
new file mode 100755
index 0000000..c75e301
--- /dev/null
+++ b/cli/documentation/en_US/vns/apr-mode-value-drop-if-unknown
@@ -0,0 +1 @@
+Drop ARP packets if the destination is unknown.
diff --git a/cli/documentation/en_US/vns/arp-mode b/cli/documentation/en_US/vns/arp-mode
new file mode 100755
index 0000000..55efb68
--- /dev/null
+++ b/cli/documentation/en_US/vns/arp-mode
@@ -0,0 +1 @@
+Configure the ARP behavior for this VNS instance.
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/arp-mode-example b/cli/documentation/en_US/vns/arp-mode-example
new file mode 100755
index 0000000..0a8abfb
--- /dev/null
+++ b/cli/documentation/en_US/vns/arp-mode-example
@@ -0,0 +1,8 @@
+arp-mode always-flood
+  Do not manage ARP packets, just flood them on all interfaces
+
+arp-mode flood-if-unknown
+  Only flood ARP packets for unknown destinations
+
+arp-mode drop-if-unknown
+  Drop ARP packets from unknown destinations
diff --git a/cli/documentation/en_US/vns/arp-mode-value-always-flood b/cli/documentation/en_US/vns/arp-mode-value-always-flood
new file mode 100755
index 0000000..befa374
--- /dev/null
+++ b/cli/documentation/en_US/vns/arp-mode-value-always-flood
@@ -0,0 +1,2 @@
+Always flood ARP packets on all switch interfaces. No active managment
+of ARP, will leak packets across VNS.
diff --git a/cli/documentation/en_US/vns/arp-mode-value-drop-if-unknown b/cli/documentation/en_US/vns/arp-mode-value-drop-if-unknown
new file mode 100755
index 0000000..f32eeb0
--- /dev/null
+++ b/cli/documentation/en_US/vns/arp-mode-value-drop-if-unknown
@@ -0,0 +1 @@
+Drop ARP packets if the host is unknown
diff --git a/cli/documentation/en_US/vns/arp-mode-value-flood-if-unknown b/cli/documentation/en_US/vns/arp-mode-value-flood-if-unknown
new file mode 100755
index 0000000..8255540
--- /dev/null
+++ b/cli/documentation/en_US/vns/arp-mode-value-flood-if-unknown
@@ -0,0 +1,2 @@
+Flood ARP packets if the destination is unknown. Might leak packets
+across VNS.
diff --git a/cli/documentation/en_US/vns/broadcast b/cli/documentation/en_US/vns/broadcast
new file mode 100755
index 0000000..82dc399
--- /dev/null
+++ b/cli/documentation/en_US/vns/broadcast
@@ -0,0 +1 @@
+Configure broadcast characteristics of the VNS instance.
diff --git a/cli/documentation/en_US/vns/broadcast-example b/cli/documentation/en_US/vns/broadcast-example
new file mode 100755
index 0000000..51e4036
--- /dev/null
+++ b/cli/documentation/en_US/vns/broadcast-example
@@ -0,0 +1,9 @@
+broadcast always-flood
+  Miscellaneious broadcast packets are sent on all interfaces
+
+broadcast forward-to-known
+  Miscellaneous broadcast packets are forwarded only to known hosts
+
+broadcast drop
+  Miscellaneous broadcast packets are dropped
+
diff --git a/cli/documentation/en_US/vns/broadcast-value-always-flood b/cli/documentation/en_US/vns/broadcast-value-always-flood
new file mode 100755
index 0000000..1f23c3e
--- /dev/null
+++ b/cli/documentation/en_US/vns/broadcast-value-always-flood
@@ -0,0 +1,2 @@
+Always flood all non-ARP, non-DHCP broadcast packets on all switch
+interfaces. Will leak packets across VNS.
diff --git a/cli/documentation/en_US/vns/broadcast-value-drop b/cli/documentation/en_US/vns/broadcast-value-drop
new file mode 100755
index 0000000..f34b38e
--- /dev/null
+++ b/cli/documentation/en_US/vns/broadcast-value-drop
@@ -0,0 +1 @@
+Drop all non-ARP, non-DHCP broadcast packets. 
diff --git a/cli/documentation/en_US/vns/broadcast-value-forward-to-known b/cli/documentation/en_US/vns/broadcast-value-forward-to-known
new file mode 100755
index 0000000..38203b5
--- /dev/null
+++ b/cli/documentation/en_US/vns/broadcast-value-forward-to-known
@@ -0,0 +1,2 @@
+Forward all non-ARP, non-DHCP broadcast packets to all known hosts in
+this VNS.
diff --git a/cli/documentation/en_US/vns/description b/cli/documentation/en_US/vns/description
new file mode 100755
index 0000000..dc11e31
--- /dev/null
+++ b/cli/documentation/en_US/vns/description
@@ -0,0 +1 @@
+Within a VNS definition sub-mode, declare a friendly descriptor for the VNS instance.
diff --git a/cli/documentation/en_US/vns/description-example b/cli/documentation/en_US/vns/description-example
new file mode 100755
index 0000000..2de14aa
--- /dev/null
+++ b/cli/documentation/en_US/vns/description-example
@@ -0,0 +1,2 @@
+description "this is my first VNS instance"
+  Add a textual description to a VNS
diff --git a/cli/documentation/en_US/vns/dhcp-ip b/cli/documentation/en_US/vns/dhcp-ip
new file mode 100755
index 0000000..263f723
--- /dev/null
+++ b/cli/documentation/en_US/vns/dhcp-ip
@@ -0,0 +1 @@
+Specify the IP address of the local DHCP server or local DHCP relay. Used by dhcp-mode 'static'.
diff --git a/cli/documentation/en_US/vns/dhcp-ip-example b/cli/documentation/en_US/vns/dhcp-ip-example
new file mode 100755
index 0000000..e4297a1
--- /dev/null
+++ b/cli/documentation/en_US/vns/dhcp-ip-example
@@ -0,0 +1,2 @@
+dhcp-ip 1.2.3.4
+  In static DHCP mode, configure the local DHCP server or relay address 
diff --git a/cli/documentation/en_US/vns/dhcp-mode b/cli/documentation/en_US/vns/dhcp-mode
new file mode 100755
index 0000000..c7d85c5
--- /dev/null
+++ b/cli/documentation/en_US/vns/dhcp-mode
@@ -0,0 +1 @@
+Configure VNS handling of DHCP broadcast packets.
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/dhcp-mode-example b/cli/documentation/en_US/vns/dhcp-mode-example
new file mode 100755
index 0000000..e0dc3d5
--- /dev/null
+++ b/cli/documentation/en_US/vns/dhcp-mode-example
@@ -0,0 +1,8 @@
+dhcp-mode static
+  VNS will forward DHCP traffic to a single known host
+
+dhcp-mode flood-if-unknown
+  Flood DHCP packets if the server is not known
+
+dhcp-mode always-flood
+  Do not manage DHCP traffice
diff --git a/cli/documentation/en_US/vns/dhcp-value-always-flood b/cli/documentation/en_US/vns/dhcp-value-always-flood
new file mode 100755
index 0000000..25c3be6
--- /dev/null
+++ b/cli/documentation/en_US/vns/dhcp-value-always-flood
@@ -0,0 +1 @@
+Always flood all DHCP packets. Will leak packets across VNS.
diff --git a/cli/documentation/en_US/vns/dhcp-value-flood-if-unknown b/cli/documentation/en_US/vns/dhcp-value-flood-if-unknown
new file mode 100755
index 0000000..d887ebc
--- /dev/null
+++ b/cli/documentation/en_US/vns/dhcp-value-flood-if-unknown
@@ -0,0 +1,2 @@
+Flood DHCP packets if the DHCP server location is unknown. DHCP server
+location will be discovered.
diff --git a/cli/documentation/en_US/vns/dhcp-value-static b/cli/documentation/en_US/vns/dhcp-value-static
new file mode 100755
index 0000000..27ee111
--- /dev/null
+++ b/cli/documentation/en_US/vns/dhcp-value-static
@@ -0,0 +1 @@
+Forward DHCP packets to the configured local DHCP server or local DHCP relay.
diff --git a/cli/documentation/en_US/vns/gateway-pool b/cli/documentation/en_US/vns/gateway-pool
new file mode 100755
index 0000000..02c5aa9
--- /dev/null
+++ b/cli/documentation/en_US/vns/gateway-pool
@@ -0,0 +1 @@
+gateway pool name
diff --git a/cli/documentation/en_US/vns/interface-router-connected b/cli/documentation/en_US/vns/interface-router-connected
new file mode 100755
index 0000000..9d58a14
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-router-connected
@@ -0,0 +1 @@
+the 'tenant' keyword specifies the named virtual router interface connects to another tenant virtual router.
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/interface-rule b/cli/documentation/en_US/vns/interface-rule
new file mode 100755
index 0000000..8e3ebcb
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule
@@ -0,0 +1,2 @@
+Set a VNS interface rule and enter submode. Devices are
+assigned into VNS based on interface-rules. 
diff --git a/cli/documentation/en_US/vns/interface-rule-active b/cli/documentation/en_US/vns/interface-rule-active
new file mode 100755
index 0000000..7c7f594
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-active
@@ -0,0 +1 @@
+Mark the rule as active. Only active rules will be matched.
diff --git a/cli/documentation/en_US/vns/interface-rule-active-example b/cli/documentation/en_US/vns/interface-rule-active-example
new file mode 100755
index 0000000..03f89c0
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-active-example
@@ -0,0 +1,5 @@
+active
+  Mark this interface rule as active
+
+no active
+  Mark this interface rule as inactive
diff --git a/cli/documentation/en_US/vns/interface-rule-allow-multiple b/cli/documentation/en_US/vns/interface-rule-allow-multiple
new file mode 100755
index 0000000..31557a9
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-allow-multiple
@@ -0,0 +1,2 @@
+If allow-multiple is set devices matching this rule are allowed to be in
+multiple VNS at the same time.
diff --git a/cli/documentation/en_US/vns/interface-rule-allow-multiple-example b/cli/documentation/en_US/vns/interface-rule-allow-multiple-example
new file mode 100755
index 0000000..bdc4ab0
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-allow-multiple-example
@@ -0,0 +1,6 @@
+allow-multiple
+  Devices matching this rule can be in more than one VNS
+
+no allow-multiple
+  Devices matching this rule can be in a single VNS
+
diff --git a/cli/documentation/en_US/vns/interface-rule-description b/cli/documentation/en_US/vns/interface-rule-description
new file mode 100755
index 0000000..9e5c9eb
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-description
@@ -0,0 +1 @@
+A user provided textual description for this interface-rule.
diff --git a/cli/documentation/en_US/vns/interface-rule-description-example b/cli/documentation/en_US/vns/interface-rule-description-example
new file mode 100755
index 0000000..38bc308
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-description-example
@@ -0,0 +1,2 @@
+description "This is my first VNS interface rule"
+  Describe a VNS interface rule
diff --git a/cli/documentation/en_US/vns/interface-rule-example b/cli/documentation/en_US/vns/interface-rule-example
new file mode 100755
index 0000000..01ff26b
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-example
@@ -0,0 +1,5 @@
+interface-rule my-rule-1
+  Define a new interface rule, and enter its configuration sub-mode
+
+no interface-rule my-rule-1
+  Delete an interface rule by name
diff --git a/cli/documentation/en_US/vns/interface-rule-match-ip-subnet b/cli/documentation/en_US/vns/interface-rule-match-ip-subnet
new file mode 100755
index 0000000..c76d8c7
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-ip-subnet
@@ -0,0 +1 @@
+Associate an IP address or IP subnet with interface-rule. 
diff --git a/cli/documentation/en_US/vns/interface-rule-match-ip-subnet-example b/cli/documentation/en_US/vns/interface-rule-match-ip-subnet-example
new file mode 100755
index 0000000..3266118
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-ip-subnet-example
@@ -0,0 +1,2 @@
+match ip-subnet 10.10.10.10
+match ip-subnet 10.42.10.0/24
diff --git a/cli/documentation/en_US/vns/interface-rule-match-mac b/cli/documentation/en_US/vns/interface-rule-match-mac
new file mode 100755
index 0000000..419c71e
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-mac
@@ -0,0 +1 @@
+Associate MAC address (host) with interface-rule. 
diff --git a/cli/documentation/en_US/vns/interface-rule-match-mac-example b/cli/documentation/en_US/vns/interface-rule-match-mac-example
new file mode 100755
index 0000000..25d6f59
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-mac-example
@@ -0,0 +1,2 @@
+match mac 00:00:00:00:00:01
+  Match a specific MAC address
diff --git a/cli/documentation/en_US/vns/interface-rule-match-switch b/cli/documentation/en_US/vns/interface-rule-match-switch
new file mode 100755
index 0000000..1a0f009
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-switch
@@ -0,0 +1,2 @@
+Associate a switch or set of switch interfaces with this interface-rule.
+Hosts present on the specified switch/interfaces will be matched. 
diff --git a/cli/documentation/en_US/vns/interface-rule-match-switch-example b/cli/documentation/en_US/vns/interface-rule-match-switch-example
new file mode 100755
index 0000000..1576f13
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-switch-example
@@ -0,0 +1,9 @@
+match switch 00:00:11:22:33:44:55:66
+    Matches all interfaces on the switch with this DPID.
+match switch 00:00:11:22:33:44:55:66 Ethernet1
+    Matches interface Ethernet1 on the specified switch.
+match switch 00:00:11:22:33:44:55:66 Ethernet1,Ethernet5-10,port2
+    Matches interfaces Ethernet1, Ethernet5, Ethernet6, ... Ethernet10,
+	and port2 on the specified switch.
+match switch ToR-1-1 
+    Matches the switch with the alias 'ToR-1-1'
diff --git a/cli/documentation/en_US/vns/interface-rule-match-tag b/cli/documentation/en_US/vns/interface-rule-match-tag
new file mode 100755
index 0000000..08e6496
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-tag
@@ -0,0 +1,2 @@
+Associate a tag or list of tags with this interface-rule. If a list of
+tags is given *all* tags need to match.
diff --git a/cli/documentation/en_US/vns/interface-rule-match-tag-example b/cli/documentation/en_US/vns/interface-rule-match-tag-example
new file mode 100755
index 0000000..7e397f8
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-tag-example
@@ -0,0 +1,4 @@
+match tags org.sdnplatform.tenant=CustomerA
+    Matches devices that match the given tag.
+match tags org.sdnplatform.tenant=CustomerA,com.example.type=router
+    Matches devices that match *all* of the given tags.
diff --git a/cli/documentation/en_US/vns/interface-rule-match-vlans b/cli/documentation/en_US/vns/interface-rule-match-vlans
new file mode 100755
index 0000000..cea2544
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-vlans
@@ -0,0 +1 @@
+Associate a vlan (or list or range) with this interface rule.
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/interface-rule-match-vlans-example b/cli/documentation/en_US/vns/interface-rule-match-vlans-example
new file mode 100755
index 0000000..bcbacce
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-match-vlans-example
@@ -0,0 +1,2 @@
+match vlans 42
+  Match packets in VLAN 42
diff --git a/cli/documentation/en_US/vns/interface-rule-priority b/cli/documentation/en_US/vns/interface-rule-priority
new file mode 100755
index 0000000..505dffd
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-priority
@@ -0,0 +1,3 @@
+The priority of this interface-rule. Higher numeric values represent
+higher priority. The highest priority interface-rule that matches a
+given packet will be choosen. 
diff --git a/cli/documentation/en_US/vns/interface-rule-priority-example b/cli/documentation/en_US/vns/interface-rule-priority-example
new file mode 100755
index 0000000..a8be5f0
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-rule-priority-example
@@ -0,0 +1,2 @@
+priority 100
+  Assign a priority to this interface rule
diff --git a/cli/documentation/en_US/vns/interface-vns-connected b/cli/documentation/en_US/vns/interface-vns-connected
new file mode 100755
index 0000000..582a9b4
--- /dev/null
+++ b/cli/documentation/en_US/vns/interface-vns-connected
@@ -0,0 +1 @@
+the 'vns' keyword specifies the named virtual router interface connects to a VNS within the same tenant scope.
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/match b/cli/documentation/en_US/vns/match
new file mode 100755
index 0000000..bcabc8c
--- /dev/null
+++ b/cli/documentation/en_US/vns/match
@@ -0,0 +1,2 @@
+Configure a match for this interface rule. If multiple matches are
+configured they will be logically AND'ed.
diff --git a/cli/documentation/en_US/vns/origin b/cli/documentation/en_US/vns/origin
new file mode 100755
index 0000000..4280742
--- /dev/null
+++ b/cli/documentation/en_US/vns/origin
@@ -0,0 +1 @@
+Describe the origin of this VNS instance
diff --git a/cli/documentation/en_US/vns/origin-example b/cli/documentation/en_US/vns/origin-example
new file mode 100755
index 0000000..5a368f6
--- /dev/null
+++ b/cli/documentation/en_US/vns/origin-example
@@ -0,0 +1,2 @@
+origin rest
+  Note that this VNS instance was configured via REST
diff --git a/cli/documentation/en_US/vns/outgoing-interface b/cli/documentation/en_US/vns/outgoing-interface
new file mode 100755
index 0000000..71bc543
--- /dev/null
+++ b/cli/documentation/en_US/vns/outgoing-interface
@@ -0,0 +1 @@
+outgoing interface name
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/priority b/cli/documentation/en_US/vns/priority
new file mode 100755
index 0000000..6fe279b
--- /dev/null
+++ b/cli/documentation/en_US/vns/priority
@@ -0,0 +1 @@
+Assign a priority to this VNS instance
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/priority-example b/cli/documentation/en_US/vns/priority-example
new file mode 100755
index 0000000..b2a505b
--- /dev/null
+++ b/cli/documentation/en_US/vns/priority-example
@@ -0,0 +1,2 @@
+priority 100
+  Within a vns definition, assign a specific priority to this instance
diff --git a/cli/documentation/en_US/vns/show-id b/cli/documentation/en_US/vns/show-id
new file mode 100755
index 0000000..16ebc39
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-id
@@ -0,0 +1,3 @@
+This 'show vns <id>' command variation is used to identify a specific vns or VNSs defined under current tenant mode.
+This 'show vns all'  command variation is used to display all VNSs defined across all tenants.
+Being backward compatible, 'show vns' command under non config-tenant mode is also accepted and displays the VNSs for default tenant only.
diff --git a/cli/documentation/en_US/vns/show-id-access-lists b/cli/documentation/en_US/vns/show-id-access-lists
new file mode 100755
index 0000000..f1d513c
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-id-access-lists
@@ -0,0 +1,5 @@
+The 'access-list' keyword requests display of the 
+configured access-lists associated with the vns.
+The output includes not only the access-list, but
+a brief descripion of the acl rules associated with
+the access-list.
diff --git a/cli/documentation/en_US/vns/show-id-flow b/cli/documentation/en_US/vns/show-id-flow
new file mode 100755
index 0000000..e5baa76
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-id-flow
@@ -0,0 +1,3 @@
+The 'flow' keyword requests the display of all openflow
+flow-match entries inserted into various switches to
+implement the vns isolation.
diff --git a/cli/documentation/en_US/vns/show-id-interface-rules b/cli/documentation/en_US/vns/show-id-interface-rules
new file mode 100755
index 0000000..2c8c6b8
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-id-interface-rules
@@ -0,0 +1,4 @@
+The 'interface-rules' keyword requests the display of
+the configured interface-rules for the named vns.  The
+vns interface-rules describe the membership rules 
+associated with a vns.
diff --git a/cli/documentation/en_US/vns/show-tenant b/cli/documentation/en_US/vns/show-tenant
new file mode 100755
index 0000000..dcf628f
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-tenant
@@ -0,0 +1,2 @@
+This 'show tenant <tenant-name>' command is used to identify a specific tenant, to describe particular configured details.
+'show tenant' command provides display for every defined tenant. 
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/show-tenant-example b/cli/documentation/en_US/vns/show-tenant-example
new file mode 100755
index 0000000..f2fa1f3
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-tenant-example
@@ -0,0 +1,21 @@
+localhost# show tenant all
+
+	# Tenant ID Active Description Router ID
+
+	-|---------|------|-----------|---------
+
+	1 A         True               vrA
+
+	2 default   True
+
+	3 red       True
+
+	4 system    True               vrsystem
+
+localhost# show tenant A
+
+	# Tenant ID Active Description Router ID
+
+	-|---------|------|-----------|---------
+
+1 A         True               vrA
diff --git a/cli/documentation/en_US/vns/show-tenant-id-router b/cli/documentation/en_US/vns/show-tenant-id-router
new file mode 100755
index 0000000..2c76403
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-tenant-id-router
@@ -0,0 +1,2 @@
+The 'router' keyword requests the display of
+the configured virtual router for the named or current tenant.  
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/show-tenant-id-router-gwippool b/cli/documentation/en_US/vns/show-tenant-id-router-gwippool
new file mode 100755
index 0000000..64e84af
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-tenant-id-router-gwippool
@@ -0,0 +1,3 @@
+The 'gw-address-pool' keyword requests the display of
+the configured gateway ip addresses for all the gateway pools of the named virtual router.  
+
diff --git a/cli/documentation/en_US/vns/show-tenant-id-router-gwpools b/cli/documentation/en_US/vns/show-tenant-id-router-gwpools
new file mode 100755
index 0000000..105e87b
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-tenant-id-router-gwpools
@@ -0,0 +1,2 @@
+The 'gateway-pools' keyword requests the display of
+the configured next hop gateway pools for the named virtual router.
diff --git a/cli/documentation/en_US/vns/show-tenant-id-router-interfaces b/cli/documentation/en_US/vns/show-tenant-id-router-interfaces
new file mode 100755
index 0000000..24a5baf
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-tenant-id-router-interfaces
@@ -0,0 +1,2 @@
+The 'interfaces' keyword requests the display of
+the configured interfaces for the named virtual router. 
diff --git a/cli/documentation/en_US/vns/show-tenant-id-router-ippool b/cli/documentation/en_US/vns/show-tenant-id-router-ippool
new file mode 100755
index 0000000..00a44ab
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-tenant-id-router-ippool
@@ -0,0 +1,2 @@
+The 'ip-address-pool' keyword requests the display of
+the configured ip address/subnet for all the interfaces of the named virtual router.  
diff --git a/cli/documentation/en_US/vns/show-tenant-id-router-route b/cli/documentation/en_US/vns/show-tenant-id-router-route
new file mode 100755
index 0000000..27f3ef1
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-tenant-id-router-route
@@ -0,0 +1,2 @@
+The 'route' keyword requests the display of
+the configured routing rule for the named virtual router. 
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/show-tenant-id-vns b/cli/documentation/en_US/vns/show-tenant-id-vns
new file mode 100755
index 0000000..162c8f2
--- /dev/null
+++ b/cli/documentation/en_US/vns/show-tenant-id-vns
@@ -0,0 +1,2 @@
+The 'vns' keyword requests the display of
+the configured vnss for the named tenant.  
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/src-ip b/cli/documentation/en_US/vns/src-ip
new file mode 100755
index 0000000..7b90b4b
--- /dev/null
+++ b/cli/documentation/en_US/vns/src-ip
@@ -0,0 +1 @@
+An IP address in dotted decimal notation.
diff --git a/cli/documentation/en_US/vns/tenant b/cli/documentation/en_US/vns/tenant
new file mode 100755
index 0000000..d7672e6
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant
@@ -0,0 +1,11 @@
+This submode is used to create a named tenant. Within this submode, properties of
+the tenant can be configured. VNS are configured and managed, which configure the membership of devices.
+Virtual router is configured and managed, which defines the connectivity within and among tenants.
+
+The controller provides a tenant named 'default' to collect devices
+which are not associated with any tenant.
+
+The controller provides a tenant named 'system' to hold system virtual router
+which is used to define the connectivity among all tenants.
+
+The controller provides a tenant named 'external' to hold configuration for external network access.
diff --git a/cli/documentation/en_US/vns/tenant-active b/cli/documentation/en_US/vns/tenant-active
new file mode 100755
index 0000000..778dbcc
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-active
@@ -0,0 +1,2 @@
+Set the tenant active. If a tenant is inactive the controller will not use it
+or its rules.
diff --git a/cli/documentation/en_US/vns/tenant-active-example b/cli/documentation/en_US/vns/tenant-active-example
new file mode 100755
index 0000000..d9eff2b
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-active-example
@@ -0,0 +1,5 @@
+active
+  Activate this tenant instance
+
+no active
+  Deactivate this tenant instance
diff --git a/cli/documentation/en_US/vns/tenant-description b/cli/documentation/en_US/vns/tenant-description
new file mode 100755
index 0000000..52a9a15
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-description
@@ -0,0 +1 @@
+Within a tenant definition sub-mode, declare a friendly descriptor for the tenant instance.
diff --git a/cli/documentation/en_US/vns/tenant-description-example b/cli/documentation/en_US/vns/tenant-description-example
new file mode 100755
index 0000000..2d94514
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-description-example
@@ -0,0 +1,2 @@
+description "this is my first tenant instance"
+  Add a textual description to a tenant
diff --git a/cli/documentation/en_US/vns/tenant-example b/cli/documentation/en_US/vns/tenant-example
new file mode 100755
index 0000000..8c9dcec
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-example
@@ -0,0 +1,6 @@
+tenant my-first-tenant
+  Define a new tenant instance by name,
+  and enter the tenant sub-mode
+
+no tenant my-first-tenant
+  Remove a named tenant
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/tenant-router-active b/cli/documentation/en_US/vns/tenant-router-active
new file mode 100755
index 0000000..4f58af3
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-active
@@ -0,0 +1,2 @@
+Set the tenant virtual router active. If a tenant virtual router is inactive the controller will not use it
+or its rules.
diff --git a/cli/documentation/en_US/vns/tenant-router-active-example b/cli/documentation/en_US/vns/tenant-router-active-example
new file mode 100755
index 0000000..c626eb6
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-active-example
@@ -0,0 +1,5 @@
+localhost(config-tenant-router-intf)# active
+  Activate this interface instance
+
+localhost(config-tenant-router-intf)# no active
+  Deactivate this interface instance
diff --git a/cli/documentation/en_US/vns/tenant-router-description b/cli/documentation/en_US/vns/tenant-router-description
new file mode 100755
index 0000000..89ea234
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-description
@@ -0,0 +1 @@
+Within a tenant virtual router definition sub-mode, declare a friendly descriptor for the virtual router instance.
diff --git a/cli/documentation/en_US/vns/tenant-router-description-example b/cli/documentation/en_US/vns/tenant-router-description-example
new file mode 100755
index 0000000..bd9f779
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-description-example
@@ -0,0 +1,2 @@
+localhost(config-tenant-router)# description "this is the virtual router for testing"
+  Add a textual description to a tenant virtual router
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/tenant-router-gwip b/cli/documentation/en_US/vns/tenant-router-gwip
new file mode 100755
index 0000000..7db55d7
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-gwip
@@ -0,0 +1 @@
+Add an IP address to a gateway pool
diff --git a/cli/documentation/en_US/vns/tenant-router-gwip-example b/cli/documentation/en_US/vns/tenant-router-gwip-example
new file mode 100755
index 0000000..9e4f5dc
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-gwip-example
@@ -0,0 +1,3 @@
+localhost(config-tenant-router-gw)# ip  10.0.1.1/24
+
+localhost(config-tenant-router-gw)# no ip  10.0.1.1/24
diff --git a/cli/documentation/en_US/vns/tenant-router-gwpool b/cli/documentation/en_US/vns/tenant-router-gwpool
new file mode 100755
index 0000000..9f07d6b
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-gwpool
@@ -0,0 +1,2 @@
+This command is used to create a new next hop gateway pool. Any IP address within this gateway pool can be used as a next hop for a routing rule configured with the next hop as this gateway pool.
+
diff --git a/cli/documentation/en_US/vns/tenant-router-gwpool-example b/cli/documentation/en_US/vns/tenant-router-gwpool-example
new file mode 100755
index 0000000..43337f8
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-gwpool-example
@@ -0,0 +1,5 @@
+localhost(config-tenant-router)# gateway-pool pool1
+  create a gateway pool pool1
+
+localhost(config-tenant-router)# no gateway-pool pool1
+  remove the gateway pool named pool1
diff --git a/cli/documentation/en_US/vns/tenant-router-interface b/cli/documentation/en_US/vns/tenant-router-interface
new file mode 100755
index 0000000..138a2f8
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-interface
@@ -0,0 +1,2 @@
+This command is used to create a new virtual router interface and connect the named interface to a defined VNS or another virtual router.
+
diff --git a/cli/documentation/en_US/vns/tenant-router-interface-example b/cli/documentation/en_US/vns/tenant-router-interface-example
new file mode 100755
index 0000000..25f57de
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-interface-example
@@ -0,0 +1,5 @@
+localhost(config-tenant-router)# interface if1 vns A1
+  create a virtual router interface if1 and connect it to VNS A1
+  
+localhost(config-tenant-router)# no interface if1
+  remove the named virtual router interface if1
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/tenant-router-interfaceip b/cli/documentation/en_US/vns/tenant-router-interfaceip
new file mode 100755
index 0000000..d64b903
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-interfaceip
@@ -0,0 +1 @@
+Associate an IP address and IP subnet with an virtual router interface. 
diff --git a/cli/documentation/en_US/vns/tenant-router-interfaceip-example b/cli/documentation/en_US/vns/tenant-router-interfaceip-example
new file mode 100755
index 0000000..a95dea5
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-interfaceip-example
@@ -0,0 +1,3 @@
+localhost(config-tenant-router-intf)# ip  10.0.1.1/24
+
+localhost(config-tenant-router-intf)# no ip  10.0.1.1/24
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/tenant-router-route b/cli/documentation/en_US/vns/tenant-router-route
new file mode 100755
index 0000000..9ff9f6a
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-route
@@ -0,0 +1,2 @@
+This command is used to create a new routing rule for a given tenant virtual router.   
+  
diff --git a/cli/documentation/en_US/vns/tenant-router-route-example b/cli/documentation/en_US/vns/tenant-router-route-example
new file mode 100755
index 0000000..259ff85
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-router-route-example
@@ -0,0 +1,5 @@
+route from tenant A to tenant B permit
+  create a routing rule to permit packets from tenant A to tenant B
+
+no route from tenant A to tenant B permit
+  remove the created routing rule
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/tenant-vrouter b/cli/documentation/en_US/vns/tenant-vrouter
new file mode 100755
index 0000000..b93fd82
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-vrouter
@@ -0,0 +1,2 @@
+This submode is used to create, then describe the connectivity and routing rules for the named virtual router for a given tenant.   
+Within this submode, properties of the virtual router can be configured.   
diff --git a/cli/documentation/en_US/vns/tenant-vrouter-example b/cli/documentation/en_US/vns/tenant-vrouter-example
new file mode 100755
index 0000000..d930dc5
--- /dev/null
+++ b/cli/documentation/en_US/vns/tenant-vrouter-example
@@ -0,0 +1,6 @@
+router my-first-router
+  Define a new router instance by name,
+  and enter the tenant-router sub-mode
+
+no router my-first-router
+  Remove a named router
\ No newline at end of file
diff --git a/cli/documentation/en_US/vns/use-address-space b/cli/documentation/en_US/vns/use-address-space
new file mode 100755
index 0000000..1a9b5a9
--- /dev/null
+++ b/cli/documentation/en_US/vns/use-address-space
@@ -0,0 +1 @@
+Associate this VNS with the specified address-space. 
diff --git a/cli/documentation/en_US/vns/use-address-space-example b/cli/documentation/en_US/vns/use-address-space-example
new file mode 100755
index 0000000..384169a
--- /dev/null
+++ b/cli/documentation/en_US/vns/use-address-space-example
@@ -0,0 +1,5 @@
+use address-space address-space-1
+  Change the association of this VNS from 'default' to 'address-space-1'.
+
+no address-space address-space-1
+  Remove the address space association for this VNS.
diff --git a/cli/documentation/en_US/vns/vns b/cli/documentation/en_US/vns/vns
new file mode 100755
index 0000000..190d8cf
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns
@@ -0,0 +1,11 @@
+This command is used to enter a submode to manage properties
+associated with the virtual switch.  This currently includes
+acl managment, and association of the acls rules to interfaces.
+
+The named vns-id must already exist.  See the vns-definition
+command to create new VNSs.
+
+Withing this submode, two other submodes can be entered.  The
+access-list submode associates specific acl rules with an access list,
+while the interface submode allows association of named access rules
+to specific interfaces.
diff --git a/cli/documentation/en_US/vns/vns-access-group b/cli/documentation/en_US/vns/vns-access-group
new file mode 100755
index 0000000..029bc09
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-group
@@ -0,0 +1 @@
+Associate an access-list configuration with this interface rule. 
diff --git a/cli/documentation/en_US/vns/vns-access-group-direction-in b/cli/documentation/en_US/vns/vns-access-group-direction-in
new file mode 100755
index 0000000..3295471
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-group-direction-in
@@ -0,0 +1 @@
+Apply an access-list to incoming traffic on this VNS interface.
diff --git a/cli/documentation/en_US/vns/vns-access-group-direction-out b/cli/documentation/en_US/vns/vns-access-group-direction-out
new file mode 100755
index 0000000..935679c
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-group-direction-out
@@ -0,0 +1 @@
+Apply an access-list to outgoing traffic on this VNS interface.
diff --git a/cli/documentation/en_US/vns/vns-access-group-example b/cli/documentation/en_US/vns/vns-access-group-example
new file mode 100755
index 0000000..677f5a8
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-group-example
@@ -0,0 +1,5 @@
+access-group pair-blocker in
+  Associate the 'pair-blocker' ACL with input packets to this VNS
+
+no access-group pair-blocker in
+  Remove the input packet ACL for this VNS instance
diff --git a/cli/documentation/en_US/vns/vns-access-list b/cli/documentation/en_US/vns/vns-access-list
new file mode 100755
index 0000000..853d33b
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list
@@ -0,0 +1 @@
+Enter submode to configure VNS access-list. 
diff --git a/cli/documentation/en_US/vns/vns-access-list-cidr-range b/cli/documentation/en_US/vns/vns-access-list-cidr-range
new file mode 100755
index 0000000..41d71d2
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-cidr-range
@@ -0,0 +1 @@
+IP address with prefix length in CIDR format.
diff --git a/cli/documentation/en_US/vns/vns-access-list-description b/cli/documentation/en_US/vns/vns-access-list-description
new file mode 100755
index 0000000..763e127
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-description
@@ -0,0 +1 @@
+A user provided textual description for this access-list.
diff --git a/cli/documentation/en_US/vns/vns-access-list-description-example b/cli/documentation/en_US/vns/vns-access-list-description-example
new file mode 100755
index 0000000..484eea0
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-description-example
@@ -0,0 +1,2 @@
+description "Access list #1"
+  Associate a text description with this access list
diff --git a/cli/documentation/en_US/vns/vns-access-list-entry b/cli/documentation/en_US/vns/vns-access-list-entry
new file mode 100755
index 0000000..e030bdf
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-entry
@@ -0,0 +1 @@
+Add an entry to this VNS access list
diff --git a/cli/documentation/en_US/vns/vns-access-list-entry-action-deny b/cli/documentation/en_US/vns/vns-access-list-entry-action-deny
new file mode 100755
index 0000000..3d366ca
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-entry-action-deny
@@ -0,0 +1 @@
+Deny traffic matching this entry.
diff --git a/cli/documentation/en_US/vns/vns-access-list-entry-action-permit b/cli/documentation/en_US/vns/vns-access-list-entry-action-permit
new file mode 100755
index 0000000..2466151
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-entry-action-permit
@@ -0,0 +1 @@
+Permit traffic matching this entry.
diff --git a/cli/documentation/en_US/vns/vns-access-list-entry-example b/cli/documentation/en_US/vns/vns-access-list-entry-example
new file mode 100755
index 0000000..1885da2
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-entry-example
@@ -0,0 +1,26 @@
+10 deny ip 10.0.0.1 10.0.0.2
+  Add an ACL rule to deny IP traffic between two hosts
+
+11 allow tcp 10.0.0.3
+  Add an ACL rule to allow TCP traffic from a specific host
+
+12 deny 51
+  Add an ACL rule to deny AH packets
+
+13 deny tcp any eq http
+  Add an ACL rule to deny HTTP traffic
+
+14 deny tcp any eq http
+  Add an ACL rule to deny HTTP traffic
+
+15 deny mac 00:00:00:00:00:01 any
+  Add an ACL rule to deny traffic based on source MAC address
+
+16 deny mac 00:00:00:00:00:01 00:00:00:00:00:02
+  Add an ACL rule to deny traffic between MAC addresses
+
+16 deny mac any any 0x0842
+  Add an ACL rule to deny wake-on-LAN packets
+
+17 deny mac any any vlan 42
+  Add an ACL rule to deny packets from a specific VLAN
diff --git a/cli/documentation/en_US/vns/vns-access-list-entry-type-ip b/cli/documentation/en_US/vns/vns-access-list-entry-type-ip
new file mode 100755
index 0000000..3e54b31
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-entry-type-ip
@@ -0,0 +1 @@
+Access list entry for IP packets.
diff --git a/cli/documentation/en_US/vns/vns-access-list-entry-type-ip-protocol b/cli/documentation/en_US/vns/vns-access-list-entry-type-ip-protocol
new file mode 100755
index 0000000..8765786
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-entry-type-ip-protocol
@@ -0,0 +1 @@
+An IP protocol number.
diff --git a/cli/documentation/en_US/vns/vns-access-list-entry-type-tcp b/cli/documentation/en_US/vns/vns-access-list-entry-type-tcp
new file mode 100755
index 0000000..80ce8fb
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-entry-type-tcp
@@ -0,0 +1 @@
+Access list entry for TCP packets.
diff --git a/cli/documentation/en_US/vns/vns-access-list-entry-type-udp b/cli/documentation/en_US/vns/vns-access-list-entry-type-udp
new file mode 100755
index 0000000..b71bac0
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-entry-type-udp
@@ -0,0 +1 @@
+Access list entry for UDP packets.
diff --git a/cli/documentation/en_US/vns/vns-access-list-ether-type b/cli/documentation/en_US/vns/vns-access-list-ether-type
new file mode 100755
index 0000000..c709dcb
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-ether-type
@@ -0,0 +1 @@
+Specify an ether type by number (hex or decimal)
diff --git a/cli/documentation/en_US/vns/vns-access-list-example b/cli/documentation/en_US/vns/vns-access-list-example
new file mode 100755
index 0000000..dbfef41
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-example
@@ -0,0 +1,6 @@
+access-list access-list-1
+  Define a new access list for this VNS,
+  and enter its configuration sub-mode
+
+no access-list access-list-1
+  Remove the definition for this access list
diff --git a/cli/documentation/en_US/vns/vns-access-list-ip-and-mask-ip b/cli/documentation/en_US/vns/vns-access-list-ip-and-mask-ip
new file mode 100755
index 0000000..ef2612f
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-ip-and-mask-ip
@@ -0,0 +1 @@
+IP address in dotted decimal notation.
diff --git a/cli/documentation/en_US/vns/vns-access-list-ip-and-mask-mask b/cli/documentation/en_US/vns/vns-access-list-ip-and-mask-mask
new file mode 100755
index 0000000..3ca923d
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-ip-and-mask-mask
@@ -0,0 +1 @@
+An inverse netmask in dotted decimal notation.
diff --git a/cli/documentation/en_US/vns/vns-access-list-ip-any b/cli/documentation/en_US/vns/vns-access-list-ip-any
new file mode 100755
index 0000000..a598f6f
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-ip-any
@@ -0,0 +1 @@
+Represents any IP address.
diff --git a/cli/documentation/en_US/vns/vns-access-list-ip-icmp b/cli/documentation/en_US/vns/vns-access-list-ip-icmp
new file mode 100755
index 0000000..6d49f85
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-ip-icmp
@@ -0,0 +1,2 @@
+Filter based on ICMP packet types
+
diff --git a/cli/documentation/en_US/vns/vns-access-list-ip-only b/cli/documentation/en_US/vns/vns-access-list-ip-only
new file mode 100755
index 0000000..ef2612f
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-ip-only
@@ -0,0 +1 @@
+IP address in dotted decimal notation.
diff --git a/cli/documentation/en_US/vns/vns-access-list-mac b/cli/documentation/en_US/vns/vns-access-list-mac
new file mode 100755
index 0000000..0c922c0
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-mac
@@ -0,0 +1 @@
+Filter based on source/destionation MAC addresses, ether types and VLAN IDs
diff --git a/cli/documentation/en_US/vns/vns-access-list-name b/cli/documentation/en_US/vns/vns-access-list-name
new file mode 100755
index 0000000..9005ab3
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-name
@@ -0,0 +1 @@
+The name of the access list
diff --git a/cli/documentation/en_US/vns/vns-access-list-port-hex b/cli/documentation/en_US/vns/vns-access-list-port-hex
new file mode 100755
index 0000000..f129316
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-port-hex
@@ -0,0 +1 @@
+Port number in decimal or hex if prefixed with 0x.
diff --git a/cli/documentation/en_US/vns/vns-access-list-port-op-eq b/cli/documentation/en_US/vns/vns-access-list-port-op-eq
new file mode 100755
index 0000000..1919455
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-port-op-eq
@@ -0,0 +1 @@
+Port number equals.
diff --git a/cli/documentation/en_US/vns/vns-access-list-port-op-neq b/cli/documentation/en_US/vns/vns-access-list-port-op-neq
new file mode 100755
index 0000000..bfa8296
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-port-op-neq
@@ -0,0 +1 @@
+Port number does not equal.
diff --git a/cli/documentation/en_US/vns/vns-access-list-port-type b/cli/documentation/en_US/vns/vns-access-list-port-type
new file mode 100755
index 0000000..99ef139
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-port-type
@@ -0,0 +1 @@
+Specify a port by service name
diff --git a/cli/documentation/en_US/vns/vns-access-list-priority b/cli/documentation/en_US/vns/vns-access-list-priority
new file mode 100755
index 0000000..e816770
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-priority
@@ -0,0 +1 @@
+Within a VNS access list definition, set the priority
diff --git a/cli/documentation/en_US/vns/vns-access-list-priority-example b/cli/documentation/en_US/vns/vns-access-list-priority-example
new file mode 100755
index 0000000..42f65a8
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-access-list-priority-example
@@ -0,0 +1,2 @@
+priority 100
+  Set the priority of this ACL to 100
diff --git a/cli/documentation/en_US/vns/vns-definition b/cli/documentation/en_US/vns/vns-definition
new file mode 100755
index 0000000..5bfb995
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-definition
@@ -0,0 +1,16 @@
+This submode is used to create, then describe the membership of
+devices for the named VNS.   Within this submode, properties of
+the VNS can be configured.   Interface-rules are configured and
+managed, which configure the membership of devices.
+
+The controller provides a VNS named 'default' to collect devices
+which are not associated with any VNS.   
+
+Part of the configuration associated with a VNS includes the
+association of a particular address-space.   When not speficially
+configured, the 'default' address-space is associated with the
+VNS.
+
+Each address-space also has an associated default VNS.  IF the
+address space is called 'yellow', then the default VNS for this
+address space is called 'yellow-default'
diff --git a/cli/documentation/en_US/vns/vns-definition-example b/cli/documentation/en_US/vns/vns-definition-example
new file mode 100755
index 0000000..9f7d17d
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-definition-example
@@ -0,0 +1,6 @@
+vns-definition my-first-vns
+  Define a new VNS instance by name,
+  and enter the VNS definition sub-mode
+
+no vns-definition my-first-vns
+  Remove a named VNS
diff --git a/cli/documentation/en_US/vns/vns-example b/cli/documentation/en_US/vns/vns-example
new file mode 100755
index 0000000..6824e0d
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-example
@@ -0,0 +1,3 @@
+vns my-vns-definition
+  Enter VNS definition sub-mode.
+  The VNS name corresponds to a prior vns-definition identifier.
diff --git a/cli/documentation/en_US/vns/vns-id b/cli/documentation/en_US/vns/vns-id
new file mode 100755
index 0000000..37e1ed6
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-id
@@ -0,0 +1,4 @@
+This is the name of the VNS. The VNS name "default" represents the
+default VNS in the default address space. A VNS name conforming to
+"<address-space-name>-default" represents the default VNS for the
+address-space "address-space-name"
diff --git a/cli/documentation/en_US/vns/vns-interface b/cli/documentation/en_US/vns/vns-interface
new file mode 100755
index 0000000..468b0e9
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-interface
@@ -0,0 +1 @@
+Enter VNS interface submode, manage association to access lists.
diff --git a/cli/documentation/en_US/vns/vns-interface-example b/cli/documentation/en_US/vns/vns-interface-example
new file mode 100755
index 0000000..8402b9a
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-interface-example
@@ -0,0 +1,3 @@
+interface main-interface
+  Enter the VNS interface configuration sub-mode.
+  The interface is named based on a corresponding interface-rule specifier.
diff --git a/cli/documentation/en_US/vns/vns-interface-field b/cli/documentation/en_US/vns/vns-interface-field
new file mode 100755
index 0000000..a20226d
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-interface-field
@@ -0,0 +1,2 @@
+The name of the VNS interface. Interface names are derived from
+interface-rules.
diff --git a/cli/documentation/en_US/vns/vns-show-interface b/cli/documentation/en_US/vns/vns-show-interface
new file mode 100755
index 0000000..1be8e6b
--- /dev/null
+++ b/cli/documentation/en_US/vns/vns-show-interface
@@ -0,0 +1,2 @@
+Show VNS interfaces associated with this VNS and its state and
+configuration.