diff --git a/nfd/debian/nfd.conf b/nfd/debian/nfd.conf
index a3232d7..d309796 100644
--- a/nfd/debian/nfd.conf
+++ b/nfd/debian/nfd.conf
@@ -1,6 +1,9 @@
 ; The general section contains settings of nfd process.
 general
 {
+  ; Specify a user and/or group for NFD to drop privileges to
+  ; when not performing privileged tasks. NFD does not drop
+  ; privileges by default.
   user ndn
   group ndn
 }
@@ -29,7 +32,8 @@
   ; Run:
   ;   nfd --modules
   ;
-  ; Or look for NFD_LOG_INIT(<module name>) statements in .cpp files
+  ; Or look for NFD_LOG_INIT(<module name>) statements in source files.
+  ; Note that the "nfd." prefix can be omitted.
   ;
   ; Example module-level settings:
   ;
@@ -40,11 +44,18 @@
 ; The tables section configures the CS, PIT, FIB, Strategy Choice, and Measurements
 tables
 {
-
   ; ContentStore size limit in number of packets
   ; default is 65536, about 500MB with 8KB packet size
   cs_max_packets 65536
 
+  ; Set the CS replacement policy.
+  ; Available policies are: priority_fifo, lru
+  cs_policy lru
+
+  ; Set a policy to decide whether to cache or drop unsolicited Data.
+  ; Available policies are: drop-all, admit-local, admit-network, admit-all
+  cs_unsolicited_policy drop-all
+
   ; Set the forwarding strategy for the specified prefixes:
   ;   <prefix> <strategy>
   strategy_choice
@@ -69,89 +80,121 @@
 ; The face_system section defines what faces and channels are created.
 face_system
 {
-  ; The unix section contains settings of Unix stream faces and channels.
-  ; Unix channel is always listening; delete unix section to disable
+  ; This section contains options that apply to multiple face protocols.
+  general
+  {
+    ; Set to 'no' to disable congestion marking on supported faces, default 'yes'
+    enable_congestion_marking yes
+  }
+
+  ; The unix section contains settings for Unix stream faces and channels.
+  ; A Unix channel is always listening; delete the unix section to disable
   ; Unix stream faces and channels.
   ;
-  ; The ndn-cxx library expects unix:///var/run/nfd.sock
-  ; to be used as the default transport option. Please change
-  ; the "transport" field in client.conf to an appropriate tcp4 FaceUri
-  ; if you need to disable unix sockets.
+  ; The ndn-cxx library expects unix:///var/run/nfd.sock to be used as
+  ; the default transport option. Please change the "transport" field
+  ; in client.conf to an appropriate tcp4 FaceUri if you want to
+  ; disable Unix sockets and use TCP instead.
   unix
   {
     path /var/run/nfd.sock ; Unix stream listener path
   }
 
-  ; The tcp section contains settings of TCP faces and channels.
+  ; The tcp section contains settings for TCP faces and channels.
   tcp
   {
     listen yes ; set to 'no' to disable TCP listener, default 'yes'
     port 6363 ; TCP listener port number
     enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
     enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
+
+    ; A TCP face has local scope if the local and remote IP addresses match the whitelist but not the blacklist
+    local
+    {
+      whitelist
+      {
+        subnet 127.0.0.0/8
+        subnet ::1/128
+      }
+      blacklist
+      {
+      }
+    }
   }
 
-  ; The udp section contains settings of UDP faces and channels.
-  ; UDP channel is always listening; delete udp section to disable UDP
+  ; The udp section contains settings for UDP faces and channels.
   udp
   {
-    port 6363 ; UDP unicast port number
+    ; UDP unicast settings.
+    listen yes ; set to 'no' to disable UDP listener, default 'yes'
+    port 6363 ; UDP listener port number
     enable_v4 yes ; set to 'no' to disable IPv4 channels, default 'yes'
     enable_v6 yes ; set to 'no' to disable IPv6 channels, default 'yes'
 
-    ; idle time (seconds) before closing a UDP unicast face, the actual timeout would be
-    ; anywhere within [idle_timeout, 2*idle_timeout), default is 600
+    ; Time (in seconds) before closing an idle UDP unicast face.
+    ; The actual timeout will occur anytime between idle_timeout and 2*idle_timeout.
+    ; The default is 600 (10 minutes).
     idle_timeout 600
 
-    keep_alive_interval 25; interval (seconds) between keep-alive refreshes
-
-    ; UDP multicast settings
-    ; NFD creates one UDP multicast face per NIC
-    ;
-    ; In multi-homed Linux machines these settings will NOT work without
-    ; root or settings the appropriate permissions:
-    ;
-    ;    sudo setcap cap_net_raw=eip /full/path/nfd
-    ;
+    ; UDP multicast settings.
+    ; By default, NFD creates one UDP multicast face per NIC.
     mcast yes ; set to 'no' to disable UDP multicast, default 'yes'
-    mcast_port 56363 ; UDP multicast port number
-    mcast_group 224.0.23.170 ; UDP multicast group (IPv4 only)
+    mcast_group 224.0.23.170 ; UDP multicast group (IPv4)
+    mcast_port 56363 ; UDP multicast port number (IPv4)
+    mcast_group_v6 ff02::1234 ; UDP multicast group (IPv6)
+    mcast_port_v6 56363 ; UDP multicast port number (IPv6)
+    mcast_ad_hoc no ; set to 'yes' to make all UDP multicast faces "ad hoc", default 'no'
+
+    ; Whitelist and blacklist can contain, in no particular order:
+    ; - interface names, including wildcard patterns (e.g., 'ifname eth0', 'ifname en*', 'ifname wlp?s0')
+    ; - MAC addresses (e.g., 'ether 85:3b:4d:d3:5f:c2')
+    ; - IPv4 subnets (e.g., 'subnet 192.0.2.0/24')
+    ; - IPv6 subnets (e.g., 'subnet 2001:db8::/32')
+    ; - a single asterisk ('*') that matches all interfaces
+    ; By default, all interfaces are whitelisted.
+    whitelist
+    {
+      *
+    }
+    blacklist
+    {
+    }
   }
 
-  ; The ether section contains settings of Ethernet faces and channels.
-  ; These settings will NOT work without root or setting the appropriate
-  ; permissions:
-  ;
-  ;    sudo setcap cap_net_raw,cap_net_admin=eip /full/path/nfd
-  ;
-  ; You may need to install a package to use setcap:
-  ;
-  ; **Ubuntu:**
-  ;
-  ;    sudo apt-get install libcap2-bin
-  ;
-  ; **Mac OS X:**
-  ;
-  ;    curl https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3373 -o ChmodBPF.tar.gz
-  ;    tar zxvf ChmodBPF.tar.gz
-  ;    open ChmodBPF/Install\ ChmodBPF.app
-  ;
-  ; or manually:
-  ;
-  ;    sudo chgrp admin /dev/bpf*
-  ;    sudo chmod g+rw /dev/bpf*
-
+  ; The ether section contains settings for Ethernet faces and channels.
   ether
   {
-    ; Ethernet multicast settings
-    ; NFD creates one Ethernet multicast face per NIC
+    ; Ethernet unicast settings.
+    listen yes ; set to 'no' to disable Ethernet listener, default 'yes'
 
+    ; Time (in seconds) before closing an idle Ethernet unicast face.
+    ; The actual timeout will occur anytime between idle_timeout and 2*idle_timeout.
+    ; The default is 600 (10 minutes).
+    idle_timeout 600
+
+    ; Ethernet multicast settings.
+    ; By default, NFD creates one Ethernet multicast face per NIC.
     mcast yes ; set to 'no' to disable Ethernet multicast, default 'yes'
     mcast_group 01:00:5E:00:17:AA ; Ethernet multicast group
+    mcast_ad_hoc no ; set to 'yes' to make all Ethernet multicast faces "ad hoc", default 'no'
+
+    ; Whitelist and blacklist can contain, in no particular order:
+    ; - interface names, including wildcard patterns (e.g., 'ifname eth0', 'ifname en*', 'ifname wlp?s0')
+    ; - MAC addresses (e.g., 'ether 85:3b:4d:d3:5f:c2')
+    ; - IPv4 subnets (e.g., 'subnet 192.0.2.0/24')
+    ; - IPv6 subnets (e.g., 'subnet 2001:db8::/32')
+    ; - a single asterisk ('*') that matches all interfaces
+    ; By default, all interfaces are whitelisted.
+    whitelist
+    {
+      *
+    }
+    blacklist
+    {
+    }
   }
 
-  ; The websocket section contains settings of WebSocket faces and channels.
-
+  ; The websocket section contains settings for WebSocket faces and channels.
   websocket
   {
     listen yes ; set to 'no' to disable WebSocket listener, default 'yes'
@@ -170,19 +213,22 @@
     certfile certs/localhost_daemons_nfd.ndncert
     privileges
     {
-        faces
-        fib
-        strategy-choice
+      faces
+      fib
+      cs
+      strategy-choice
     }
   }
 
   authorize
   {
-    certfile any
+    certfile any ; "any" authorizes command interests signed under any certificate,
+                 ; i.e., no actual validation.
     privileges
     {
-        faces
-        strategy-choice
+      faces
+      cs
+      strategy-choice
     }
   }
 
@@ -217,9 +263,9 @@
   ; {
   ;   ; This section defines the trust model for NFD RIB Management. It consists of rules and
   ;   ; trust-anchors, which are briefly defined in this file.  For more information refer to
-  ;   ; manpage of ndn-validator.conf:
+  ;   ; validator configuration file format documentation:
   ;   ;
-  ;   ;     man ndn-validator.conf
+  ;   ;    https://named-data.net/doc/ndn-cxx/current/tutorials/security-validator-config.html
   ;   ;
   ;   ; A trust-anchor is a pre-trusted certificate.  This can be any certificate that is the
   ;   ; root of certification chain (e.g., NDN testbed root certificate) or an existing
@@ -239,13 +285,12 @@
   ;
   ;   rule
   ;   {
-  ;     id "NRD Prefix Registration Command Rule"
+  ;     id "RIB Registration Command Rule"
   ;     for interest                         ; rule for Interests (to validate CommandInterests)
   ;     filter
   ;     {
-  ;       type name                          ; condition on interest name (w/o signature)
-  ;       regex ^[<localhop><localhost>]<nfd><rib>[<register><unregister>]<>$ ; prefix before
-  ;                                                                           ; timestamp
+  ;       type name                          ; condition on interest name (w/o SignatureInfo/SignatureValue)
+  ;       regex ^[<localhop><localhost>]<nfd><rib>[<register><unregister>]<><><>$
   ;     }
   ;     checker
   ;     {
@@ -255,7 +300,7 @@
   ;       {
   ;         type name                        ; key locator must be the certificate name of the
   ;                                          ; signing key
-  ;         regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT>$
+  ;         regex ^<>*<KEY><>$
   ;       }
   ;     }
   ;   }
@@ -266,7 +311,7 @@
   ;     filter
   ;     {
   ;       type name                          ; condition on data name
-  ;       regex ^[^<KEY>]*<KEY><>*<ksk-.*><ID-CERT><>$
+  ;       regex ^<>*<KEY><><><>$
   ;     }
   ;     checker
   ;     {
@@ -313,4 +358,8 @@
     ; policy. Initially, the wait time is set to base_retry_wait, then it will be doubled for every
     ; retry unless beyond the max_retry_wait, in which case max_retry_wait is set as the wait time.
   }
+
+  ; If enabled, routes registered with origin=client (typically from auto_prefix_propagate)
+  ; will be readvertised into local NLSR daemon.
+  readvertise_nlsr no
 }