routers update
This commit is contained in:
parent
34c88a2380
commit
10ee58cd1e
13 changed files with 608 additions and 25 deletions
10
CLAUDE.md
10
CLAUDE.md
|
|
@ -284,7 +284,15 @@ the rule.
|
|||
|
||||
### IGP / routing
|
||||
- OSPFv2 area `backbone-v2` (id 0.0.0.0) on all spine links, SHA-512 auth
|
||||
with `auth-id=1` and a shared key. PTP type, BFD enabled where supported.
|
||||
with `auth-id=1` and a shared key. PTP type. **BFD is off on every
|
||||
wireless backbone interface (AF11/AF24/60GHz)** — the global timers
|
||||
(`/routing/bfd/configuration` = 200ms×5 = 1s detection) are too
|
||||
aggressive for AF RF: a single >1s burst tore down OSPF on
|
||||
climax↔494 every ~15–40 min until `use-bfd=false` was applied to both
|
||||
ends 2026-05-09. Wired fiber links may keep BFD if desired. If
|
||||
sub-second failover on a wireless link is genuinely needed, also
|
||||
loosen the BFD timers (e.g. min-rx/min-tx=500ms, multiplier=3) — do
|
||||
not flip `use-bfd=true` alone.
|
||||
- OSPFv3 area `backbone-v3` for IPv6 (some interfaces only).
|
||||
- All instances `redistribute=connected` with passthrough filters
|
||||
(`/routing filter rule chain=ospf-out rule="accept;"`).
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
||||
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||
# software id = K4QG-8NQV
|
||||
#
|
||||
# model = RB5009UG+S+
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
||||
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||
# software id = FUVS-HCM5
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
152
mikrotik-tool/climax-v6-apply.rsc
Normal file
152
mikrotik-tool/climax-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,152 @@
|
|||
# =============================================================================
|
||||
# climax — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Climax sits between verona (south-west) and the rest of the network
|
||||
# (via core). One v6 default upstream — toward core via :12::1.
|
||||
#
|
||||
# P2P interfaces:
|
||||
# ether4-380-airfiber24 :12::/64 (climax .2, core .1)
|
||||
# ether6-verona-11ghz :20::/64 (verona .1, climax .2)
|
||||
# ether3-culleoka-11ghz :21::/64 (climax .1, culleoka .2)
|
||||
# ether5-494 :17::/64 (climax .1, 494 .2)
|
||||
#
|
||||
# Mgmt LAN: bridge `mgmt`, v6 = 2606:1c80:1100::1/64
|
||||
# PPPoE customers: profile name `pppoe`, customer pool 2606:1c80:1101::/48 → /56
|
||||
#
|
||||
# BFD on wireless OSPFv2 templates was already turned off on this router
|
||||
# earlier today (2026-05-09) — verified via the freshly-pulled climax.rsc.
|
||||
# No BFD changes here.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — drop OSPFv3 + stale internal v6
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
|
||||
# OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry
|
||||
# (currently lives under area=backbone-v3) all get removed.
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
# Drop any stale internal v6 iBGP peers (none present, but defensive).
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — BGP instance (climax has none today)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp instance
|
||||
add name=bgp-instance-1 as=393837 router-id=10.254.254.102
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::102/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:12::2/127 interface=ether4-380-airfiber24 advertise=no comment="P2P climax<->core"
|
||||
add address=2606:1c80:0:20::2/127 interface=ether6-verona-11ghz advertise=no comment="P2P climax<->verona"
|
||||
add address=2606:1c80:0:21::1/127 interface=ether3-culleoka-11ghz advertise=no comment="P2P climax<->culleoka"
|
||||
add address=2606:1c80:0:17::1/127 interface=ether5-494 advertise=no comment="P2P climax<->494"
|
||||
add address=2606:1c80:1100::1/64 interface=mgmt advertise=yes comment="climax mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes (replace what an IGP would have learned)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
# Default upstream toward core (only one path from climax — core forwards
|
||||
# upward via preseem/direct).
|
||||
add dst-address=::/0 gateway=2606:1c80:0:12::1 distance=1 comment="default via core"
|
||||
|
||||
# Edge loopback explicit (recursively resolved through default; explicit
|
||||
# entry helps iBGP control plane converge quickly on first bring-up).
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core"
|
||||
|
||||
# Blackhole climax's /44 aggregate so iBGP has the prefix to advertise.
|
||||
add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=mgmt prefix=2606:1c80:1100::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=climax-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to the climax PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=pppoe] remote-ipv6-prefix-pool=climax-cust-pd-1 dhcpv6-pd-pool=climax-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall (mirrors v4 hygiene; deny by default)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to edge (v4 transport / v6 NLRI)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=10.254.254.102 \
|
||||
remote.address=10.254.254.254 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
comment="iBGP to edge, v4 transport / v6 NLRI"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /routing ospf neighbor print ;; only OSPFv2 should remain
|
||||
# /routing bgp instance print
|
||||
# /routing bgp connection print
|
||||
# /routing bgp session print
|
||||
#
|
||||
# After core + edge have applied:
|
||||
# /ping 2606:1c80:0:12::1 count=3 ;; core P2P side
|
||||
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback
|
||||
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback
|
||||
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end
|
||||
# /routing bgp session print ;; ibgp-edge-v6 should be Established
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
||||
# 2026-05-09 09:26:02 by RouterOS 7.21.4
|
||||
# software id = UETF-WF31
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
@ -133,11 +133,14 @@ add address-pool=climax-mgmt interface=mgmt lease-script="{\
|
|||
\n} while ( \$attempts < \$max )\
|
||||
\n}\
|
||||
\n" name=climax-mgmt
|
||||
/ipv6 dhcp-server option
|
||||
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
/ipv6 pool
|
||||
add name=climax-v6 prefix=2606:1c80:1:2000::/52 prefix-length=64
|
||||
add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
|
||||
/ppp profile
|
||||
add bridge-learning=no change-tcp-mss=yes dns-server=\
|
||||
204.110.191.240,204.110.191.20 local-address=cgnat name=pppoe on-down="{\
|
||||
add bridge-learning=no change-tcp-mss=yes dhcpv6-pd-pool=climax-cust-pd-1 \
|
||||
dns-server=204.110.191.240,204.110.191.20 local-address=cgnat name=pppoe \
|
||||
on-down="{\
|
||||
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
||||
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
||||
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
||||
|
|
@ -245,8 +248,8 @@ add bridge-learning=no change-tcp-mss=yes dns-server=\
|
|||
\n }\
|
||||
\n} while ( \$attempts < \$max )\
|
||||
\n}\
|
||||
\n" remote-address=cgnat use-compression=no use-encryption=no use-ipv6=no \
|
||||
use-mpls=no use-upnp=no
|
||||
\n" remote-address=cgnat remote-ipv6-prefix-pool=climax-cust-pd-1 \
|
||||
use-compression=no use-encryption=no use-ipv6=no use-mpls=no use-upnp=no
|
||||
/queue type
|
||||
add kind=fq-codel name=fq-codel
|
||||
/queue interface
|
||||
|
|
@ -268,16 +271,15 @@ set ether15 queue=fq-codel
|
|||
set ether16 queue=fq-codel
|
||||
set sfp-sfpplus1 queue=fq-codel
|
||||
set sfp-sfpplus2 queue=fq-codel
|
||||
/routing bgp instance
|
||||
add as=393837 name=bgp-instance-1 router-id=10.254.254.102
|
||||
/routing id
|
||||
add disabled=no id=10.254.254.102 name=id-1 select-dynamic-id=""
|
||||
/routing ospf instance
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v2 originate-default=\
|
||||
never out-filter-chain=ospf-out redistribute=connected router-id=id-1
|
||||
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
|
||||
ospf-out redistribute=connected router-id=id-1 version=3
|
||||
/routing ospf area
|
||||
add disabled=no instance=default-v2 name=backbone-v2
|
||||
add disabled=no instance=default-v3 name=backbone-v3
|
||||
/snmp community
|
||||
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
||||
kdyyJrT0Mm
|
||||
|
|
@ -297,14 +299,20 @@ add bridge=climax-bridge interface=sfp-sfpplus1
|
|||
add bridge=mgmt interface=vlan10_ether7
|
||||
add bridge=mgmt interface=vlan10_sfp-sfpplus1
|
||||
/ip firewall connection tracking
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set enabled=yes icmp-timeout=30s tcp-close-wait-timeout=1m \
|
||||
tcp-established-timeout=4h tcp-fin-wait-timeout=2m tcp-last-ack-timeout=\
|
||||
30s tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
||||
/ip neighbor discovery-settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set discover-interface-list=!dynamic
|
||||
/ip settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set max-neighbor-entries=8192 tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||
set accept-router-advertisements=no
|
||||
/interface pppoe-server server
|
||||
add authentication=chap,mschap2 default-profile=pppoe disabled=no interface=\
|
||||
climax-bridge max-mru=1492 max-mtu=1492 one-session-per-host=yes \
|
||||
|
|
@ -388,6 +396,13 @@ add dst-address=100.64.160.0/20 gateway=10.250.1.65
|
|||
add dst-address=204.110.188.64/27 gateway=10.250.1.65
|
||||
add disabled=no dst-address=10.254.254.101/32 gateway=10.250.1.25 \
|
||||
routing-table=main
|
||||
/ipv6 route
|
||||
add comment="default via core" distance=1 dst-address=::/0 gateway=\
|
||||
2606:1c80:0:12::1
|
||||
add comment="edge loopback via core" distance=1 dst-address=\
|
||||
2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1
|
||||
add blackhole comment="climax /44 aggregate (iBGP origin)" distance=200 \
|
||||
dst-address=2606:1c80:1100::/44
|
||||
/ip service
|
||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||
|
|
@ -399,10 +414,45 @@ set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
|||
set api-ssl certificate=MyCA
|
||||
/ip ssh
|
||||
set host-key-type=ed25519 strong-crypto=yes
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::102/128 advertise=no comment=loopback interface=\
|
||||
lo
|
||||
add address=2606:1c80:0:12::2/127 advertise=no comment="P2P climax<->core" \
|
||||
interface=ether4-380-airfiber24
|
||||
add address=2606:1c80:0:20::2/127 advertise=no comment="P2P climax<->verona" \
|
||||
interface=ether6-verona-11ghz
|
||||
add address=2606:1c80:0:21::1/127 advertise=no comment=\
|
||||
"P2P climax<->culleoka" interface=ether3-culleoka-11ghz
|
||||
add address=2606:1c80:0:17::1/127 advertise=no comment="P2P climax<->494" \
|
||||
interface=ether5-494
|
||||
add address=2606:1c80:1100::1 comment="climax mgmt LAN" interface=mgmt
|
||||
/ipv6 dhcp-relay option
|
||||
set client_mac value="0x0001\$(CLIENT_MAC)"
|
||||
/ipv6 dhcp-server
|
||||
add interface=mgmt name=climax-mgmt-stateless
|
||||
/ipv6 firewall filter
|
||||
add action=accept chain=input comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=input comment=invalid connection-state=invalid
|
||||
add action=accept chain=input comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=input comment=link-local src-address=fe80::/10
|
||||
add action=accept chain=input comment=internal src-address=2606:1c80::/32
|
||||
add action=drop chain=input comment="default deny"
|
||||
add action=accept chain=forward comment=established connection-state=\
|
||||
established,related
|
||||
add action=drop chain=forward comment=invalid connection-state=invalid
|
||||
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
|
||||
icmpv6
|
||||
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
|
||||
add action=accept chain=forward comment=internal-to-internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
add action=accept chain=forward comment=\
|
||||
"v6 outbound from climax tower (customer + mgmt)" src-address=\
|
||||
2606:1c80:1100::/44
|
||||
add action=drop chain=forward comment="default deny"
|
||||
/ipv6 nd
|
||||
set [ find default=yes ] advertise-dns=yes
|
||||
add advertise-dns=yes interface=mgmt other-configuration=yes
|
||||
/mpls interface
|
||||
add interface=ether6-verona-11ghz mpls-mtu=1508
|
||||
add interface=ether4-380-airfiber24 mpls-mtu=1508
|
||||
|
|
@ -426,17 +476,21 @@ set accept=yes
|
|||
/routing bfd configuration
|
||||
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 vrf=\
|
||||
main
|
||||
/routing bgp connection
|
||||
add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\
|
||||
bgp-instance-1 local.address=10.254.254.102 .role=ibgp multihop=yes name=\
|
||||
ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
remote.address=10.254.254.254 .as=393837 templates=default
|
||||
/routing filter rule
|
||||
add chain=ospf-in disabled=no rule=accept
|
||||
add chain=ospf-out disabled=no rule=accept
|
||||
add chain=v6-ibgp-out disabled=no rule=\
|
||||
"if (dst==2606:1c80:1100::/44) { accept; } else { reject; }"
|
||||
/routing ospf interface-template
|
||||
add area=backbone-v3 cost=10 disabled=no use-bfd=no
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether6-verona-11ghz priority=1 type=ptp use-bfd=no
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether5-494 priority=1 type=ptp use-bfd=no
|
||||
add area=backbone-v3 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether3-culleoka-11ghz priority=1 type=ptp use-bfd=no
|
||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||
ether4-380-airfiber24 priority=1 type=ptp use-bfd=no
|
||||
/routing ospf static-neighbor
|
||||
|
|
|
|||
169
mikrotik-tool/core-v6-apply.rsc
Normal file
169
mikrotik-tool/core-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,169 @@
|
|||
# =============================================================================
|
||||
# core (380) — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Core sits between edge and the towers. Two paths to edge mirror v4:
|
||||
# 1. PRIMARY: sfp-sfpplus1-edge-preseem, /127 :1002::2 — edge cost 10
|
||||
# 2. BACKUP: ether3-edge-direct, /127 :11::2 — OSPFv2 cost 100 on both
|
||||
# ends; v6 mirrors via static distance.
|
||||
#
|
||||
# Tower-facing P2Ps (per ipv6.md):
|
||||
# ether5-climax :12::/64 (core .1, climax .2)
|
||||
# ether4-newhope :13::/64 (core .1, newhope .2)
|
||||
# ether1-982-60ghz :14::/64 (core .1, 982 .2)
|
||||
# ether6-culleoka-11ghz :15::/64 (core .1, culleoka .2)
|
||||
#
|
||||
# Mgmt LAN: vlan10_combo1 (vlan 10 on combo1-380), v6 = 2606:1c80:1400::1/64
|
||||
# PPPoE customers: profile name `380`, customer pool 2606:1c80:1401::/48 → /56
|
||||
#
|
||||
# Two pre-apply fixes required on core:
|
||||
# (a) /routing/bgp/instance bgp-instance-1 currently has as=65530 — must
|
||||
# be 393837 to peer iBGP with edge. We update it in place.
|
||||
# (b) BFD is currently on for ether5-climax (AF24), ether4-newhope, and
|
||||
# ether6-culleoka-11ghz (AF11). Per fleet policy (no BFD on
|
||||
# wireless), we set use-bfd=no on those three OSPFv2 templates.
|
||||
# Wired backbone (sfp-sfpplus1-edge-preseem, ether3-edge-direct)
|
||||
# keeps BFD as-is.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — drop OSPFv3 + stale internal v6
|
||||
# -----------------------------------------------------------------------------
|
||||
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||
/ipv6 dhcp-server remove [find]
|
||||
/ipv6 dhcp-server option remove [find]
|
||||
/ipv6 dhcp-client remove [find]
|
||||
/ipv6 nd prefix remove [find]
|
||||
/ipv6 nd remove [find !default]
|
||||
/ipv6 pool remove [find]
|
||||
/ipv6 route remove [find !dynamic]
|
||||
/ipv6 firewall filter remove [find]
|
||||
/ipv6 firewall mangle remove [find]
|
||||
/ipv6 firewall raw remove [find]
|
||||
/ipv6 address remove [find !dynamic]
|
||||
|
||||
/routing ospf interface-template remove [find area=backbone-v3]
|
||||
/routing ospf area remove [find name=backbone-v3]
|
||||
/routing ospf instance remove [find name=default-v3]
|
||||
|
||||
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||
# also remove the disabled placeholder climax connection (will be replaced
|
||||
# by the future climax tower's own iBGP-to-edge session).
|
||||
/routing bgp connection remove [find name=climax and disabled=yes]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — fix BGP instance AS (65530 → 393837 to match the fleet)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing bgp instance set [find name=bgp-instance-1] as=393837
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — turn off BFD on wireless backbone OSPFv2 templates
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing ospf interface-template set [find interfaces=ether5-climax] use-bfd=no
|
||||
/routing ospf interface-template set [find interfaces=ether4-newhope] use-bfd=no
|
||||
/routing ospf interface-template set [find interfaces=ether6-culleoka-11ghz] use-bfd=no
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::253/128 interface=lo advertise=no comment="loopback"
|
||||
add address=2606:1c80:0:11::2/127 interface=ether3-edge-direct advertise=no comment="P2P core<->edge direct (backup)"
|
||||
add address=2606:1c80:0:1002::2/127 interface=sfp-sfpplus1-edge-preseem advertise=no comment="P2P core<->edge via preseem (primary)"
|
||||
add address=2606:1c80:0:12::1/127 interface=ether5-climax advertise=no comment="P2P core<->climax"
|
||||
add address=2606:1c80:0:13::1/127 interface=ether4-newhope advertise=no comment="P2P core<->newhope"
|
||||
add address=2606:1c80:0:14::1/127 interface=ether1-982-60ghz advertise=no comment="P2P core<->982 60GHz"
|
||||
add address=2606:1c80:0:15::1/127 interface=ether6-culleoka-11ghz advertise=no comment="P2P core<->culleoka"
|
||||
add address=2606:1c80:1400::1/64 interface=vlan10_combo1 advertise=yes comment="380 mgmt LAN"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes (replace what an IGP would have learned)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 route
|
||||
# v6 default toward edge — preseem primary, direct backup (mirrors v4 cost relationship).
|
||||
add dst-address=::/0 gateway=2606:1c80:0:1002::1 distance=1 comment="default via preseem (primary)"
|
||||
add dst-address=::/0 gateway=2606:1c80:0:11::1 distance=2 comment="default via direct (backup)"
|
||||
|
||||
# Edge loopback static fallback (so iBGP TCP control plane can reach edge
|
||||
# even before BGP populates anything beyond defaults).
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem"
|
||||
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 distance=2 comment="edge loopback via direct"
|
||||
|
||||
# Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward.
|
||||
add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery on the 380 mgmt LAN (SLAAC + RDNSS)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 nd
|
||||
add interface=vlan10_combo1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||
|
||||
/ipv6 nd prefix
|
||||
add interface=vlan10_combo1 prefix=2606:1c80:1400::/64 autonomous=yes on-link=yes
|
||||
|
||||
/ipv6 dhcp-server
|
||||
add interface=vlan10_combo1 name=core-mgmt-stateless address-pool=static-only
|
||||
|
||||
/ipv6 dhcp-server option
|
||||
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — customer PD pool + bind to the 380 PPPoE profile
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 pool
|
||||
add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56
|
||||
|
||||
/ppp profile
|
||||
set [find name=380] remote-ipv6-prefix-pool=core-cust-pd-1 dhcpv6-pd-pool=core-cust-pd-1
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall (mirrors v4 hygiene; deny by default)
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept connection-state=established,related comment="established"
|
||||
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||
add chain=input action=drop comment="default deny"
|
||||
|
||||
add chain=forward action=accept connection-state=established,related comment="established"
|
||||
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||
add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers"
|
||||
add chain=forward action=drop comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP to edge (v4 transport / v6 NLRI)
|
||||
# -----------------------------------------------------------------------------
|
||||
/routing filter rule
|
||||
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44) { accept; } else { reject; }"
|
||||
|
||||
/routing bgp connection
|
||||
add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
|
||||
afi=ip,ipv6 local.role=ibgp local.address=10.254.254.253 \
|
||||
remote.address=10.254.254.254 remote.as=393837 multihop=yes \
|
||||
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||
comment="iBGP to edge, v4 transport / v6 NLRI"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /routing ospf neighbor print
|
||||
# /routing ospf interface-template print where use-bfd=yes ;; should be wired-only
|
||||
# /routing bgp instance print
|
||||
# /routing bgp connection print
|
||||
# /routing bgp session print
|
||||
#
|
||||
# After edge has applied:
|
||||
# /ping 2606:1c80:0:1002::1 count=3 ;; edge preseem-side
|
||||
# /ping 2606:1c80:0:11::1 count=3 ;; edge direct-side
|
||||
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback
|
||||
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end
|
||||
# /routing bgp session print ;; ibgp-edge-v6 should be Established
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
||||
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||
# software id = XS5B-41QR
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
||||
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||
# software id = HVP9-3G0K
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
168
mikrotik-tool/edge-v6-apply.rsc
Normal file
168
mikrotik-tool/edge-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,168 @@
|
|||
# =============================================================================
|
||||
# edge — IPv6 apply script (ROS 6.49.18, BGP-only / no OSPFv3)
|
||||
# =============================================================================
|
||||
#
|
||||
# Edge is the iBGP hub: it terminates the TWC v6 eBGP peering and the v4
|
||||
# transport iBGP sessions to every tower. v6 NLRI rides v4 transport (so the
|
||||
# existing v4 OSPF reachability between loopbacks is reused; no v6 IGP is
|
||||
# needed). This matches the verona-v6-apply.rsc design choice.
|
||||
#
|
||||
# Two paths edge<->core:
|
||||
# 1. PRIMARY: sfp-sfpplus11-preseem, /127 via the Preseem shaper
|
||||
# (transparent L2). OSPFv2 cost on edge is the default 10. v6 P2P:
|
||||
# 2606:1c80:0:1002::1 (edge) <-> :2 (core)
|
||||
# 2. BACKUP: sfp-sfpplus7-core-direct, /127 direct fiber. OSPFv2 cost on
|
||||
# edge is 100 (same on core's side). v6 P2P:
|
||||
# 2606:1c80:0:11::1 (edge) <-> :2 (core)
|
||||
# Static v6 routes for the infra /48 mirror that cost relationship by
|
||||
# distance (lower = preferred): preseem at distance=1, direct at
|
||||
# distance=2.
|
||||
#
|
||||
# What this script DOES NOT touch (USER CONSTRAINT 2026-05-09):
|
||||
# * TWC v6 eBGP peer `twc-v6` (remote 2605:6000:0:8::f:372, AS11427) —
|
||||
# name doesn't match the ^ibgp- wipe pattern, so it survives.
|
||||
# * The 2606:1c80::/32 BGP network announcement upstream.
|
||||
# * The TWC P2P address 2605:6000:0:8::f:373/127 on sfp-sfpplus12-spectrum
|
||||
# — enabled, so it survives the [find disabled=yes] wipe.
|
||||
# * The existing server LAN address 2606:1c80::1 on vlan9_sfpplus8 —
|
||||
# enabled, so it survives. We only ADD a per-interface ND override
|
||||
# to suppress RA there; the IP and prefix are unmodified.
|
||||
# * v4 OSPFv2 / RIP / firewall rules — v4 control plane is unchanged.
|
||||
#
|
||||
# Apply order: review -> paste in winbox/SSH on edge -> verify with checks
|
||||
# at the bottom -> only then run the matching `core-v6-apply.rsc` so the
|
||||
# preseem and direct /127 endpoints come up symmetrically.
|
||||
# =============================================================================
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WIPE — only the stale internal-only v6 state on edge. Leaves TWC peering,
|
||||
# the upstream /32 announcement, the server LAN address, and v4 alone.
|
||||
# -----------------------------------------------------------------------------
|
||||
# Drop any disabled placeholder v6 internal addresses (none on edge today,
|
||||
# but harmless if present).
|
||||
/ipv6 address remove [find disabled=yes]
|
||||
|
||||
# Drop any leftover OSPFv3 interface entries (we are committing to BGP-only
|
||||
# for v6; any v3 instances on edge have been minimal/stub).
|
||||
/routing ospf-v3 interface remove [find]
|
||||
|
||||
# Drop only internal iBGP v6 peers if any exist; never touch twc-v6.
|
||||
/routing bgp peer remove [find name~"^ibgp-" and address-families~"ipv6"]
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — addresses
|
||||
# -----------------------------------------------------------------------------
|
||||
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||
|
||||
/ipv6 address
|
||||
add address=2606:1c80:0:10::254/128 interface=loopback advertise=no comment="edge loopback"
|
||||
add address=2606:1c80:0:11::1/127 interface=sfp-sfpplus7-core-direct advertise=no comment="P2P edge<->core direct (backup)"
|
||||
add address=2606:1c80:0:1002::1/127 interface=sfp-sfpplus11-preseem advertise=no comment="P2P edge<->core via preseem (primary)"
|
||||
|
||||
# NOTE: the server LAN address 2606:1c80::1 on vlan9_sfpplus8 is left
|
||||
# untouched per user constraint. The ND override below makes it RA-free
|
||||
# without modifying the address itself.
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — neighbour discovery: SUPPRESS RA on the server LAN
|
||||
# -----------------------------------------------------------------------------
|
||||
# Server LAN is static-only per the IPv6 plan — disable RA + DHCPv6 hints.
|
||||
# A per-interface entry overrides the global default.
|
||||
/ipv6 nd
|
||||
add interface=vlan9_sfpplus8 disabled=no advertise=no managed-address-configuration=no other-configuration=no comment="server LAN: static only, no SLAAC"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — static routes (replace what an IGP would have learned)
|
||||
# -----------------------------------------------------------------------------
|
||||
# Infra /48 covers all router loopbacks (2606:1c80:0:10::/64), all P2P
|
||||
# /127s, and any future infra slots. Two entries with different distances
|
||||
# pin preseem as primary and direct as backup. The connected /64 server
|
||||
# LAN at 2606:1c80::/64 wins by longest-prefix-match, so this /48 doesn't
|
||||
# steal local server traffic.
|
||||
/ipv6 route
|
||||
add dst-address=2606:1c80::/48 gateway=2606:1c80:0:1002::2 distance=1 comment="infra: via preseem (primary)"
|
||||
add dst-address=2606:1c80::/48 gateway=2606:1c80:0:11::2 distance=2 comment="infra: via direct (backup)"
|
||||
|
||||
# Tower /44s are learned via iBGP from each tower (next-hop = tower's v6
|
||||
# loopback inside :10::/64, recursively resolved through the /48 above).
|
||||
# No static needed for them.
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — firewall (extend the existing minimal v6 ruleset)
|
||||
# -----------------------------------------------------------------------------
|
||||
# The existing v6 firewall already accepts BGP (179) and established. Add
|
||||
# the rules required for internal-network forwarding + ICMPv6 / link-local.
|
||||
/ipv6 firewall filter
|
||||
add chain=input action=accept protocol=icmpv6 comment="icmpv6 input"
|
||||
add chain=input action=accept src-address=fe80::/10 comment="link-local input"
|
||||
add chain=input action=accept src-address=2606:1c80::/32 comment="internal input"
|
||||
|
||||
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD forward"
|
||||
add chain=forward action=accept protocol=icmpv6 comment="icmpv6 forward"
|
||||
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal<->internal"
|
||||
|
||||
# (we do not add a default-deny; edge has long-running customer transit
|
||||
# paths and a sudden v6 default-deny would break them. existing rules at
|
||||
# the bottom of /ipv6 firewall filter remain authoritative.)
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP route filters (v6)
|
||||
# -----------------------------------------------------------------------------
|
||||
# in-filter: accept any /44 inside the tower allocation block 2606:1c80:1000::/36.
|
||||
# Anything else from a tower iBGP peer is rejected (defense in depth — we
|
||||
# don't want a tower advertising the world to us).
|
||||
/routing filter
|
||||
add chain=ibgp-tower-in-v6 prefix=2606:1c80:1000::/36 prefix-length=44 action=accept comment="tower /44 customer aggregate"
|
||||
add chain=ibgp-tower-in-v6 prefix=2606:1c80:0:10::/64 prefix-length=128 action=accept comment="tower v6 loopback"
|
||||
add chain=ibgp-tower-in-v6 action=discard comment="default deny"
|
||||
|
||||
# out-filter: edge sends ONLY the v6 default to towers. Towers don't need
|
||||
# anything else from edge — they reach customers via their own routes and
|
||||
# transit upstream via the default.
|
||||
add chain=ibgp-tower-out-v6 prefix=::/0 prefix-length=0 action=accept comment="default route to tower"
|
||||
add chain=ibgp-tower-out-v6 action=discard comment="default deny"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# APPLY — iBGP peer to verona (over v4 transport, carrying v6 NLRI)
|
||||
# -----------------------------------------------------------------------------
|
||||
# ROS6 syntax: address-families=ipv6 with a v4 remote-address gives
|
||||
# MP-BGP v6-NLRI-over-v4-TCP. update-source=loopback ensures the TCP
|
||||
# session sources from the v4 loopback (10.254.254.254).
|
||||
# nexthop-choice=force-self pins the v6 next-hop edge advertises to
|
||||
# its own v6 loopback (2606:1c80:0:10::254), reachable from verona once
|
||||
# climax has its v6 apply.
|
||||
/routing bgp peer
|
||||
add name=ibgp-verona-v6 \
|
||||
remote-address=10.254.254.101 remote-as=393837 \
|
||||
update-source=loopback \
|
||||
address-families=ipv6 \
|
||||
nexthop-choice=force-self \
|
||||
in-filter=ibgp-tower-in-v6 out-filter=ibgp-tower-out-v6 \
|
||||
default-originate=always \
|
||||
comment="iBGP to verona, v4 transport / v6 NLRI"
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# VERIFY (paste after apply)
|
||||
# -----------------------------------------------------------------------------
|
||||
# /ipv6 address print
|
||||
# /ipv6 route print where active
|
||||
# /ipv6 nd print
|
||||
# /routing bgp peer print where name~"v6"
|
||||
# /routing bgp advertisements print peer=ibgp-verona-v6
|
||||
#
|
||||
# Expected immediately:
|
||||
# * /ipv6 address print shows 2606:1c80:0:10::254/128 (loopback),
|
||||
# :11::1/127 (direct), :1002::1/127 (preseem), :1::/64 server LAN
|
||||
# * /ipv6 nd print shows the vlan9_sfpplus8 entry with advertise=no
|
||||
# * the new /48 routes show as inactive (gateway unreachable until core
|
||||
# applies), which is fine
|
||||
# * ibgp-verona-v6 is in `connecting` state until verona reaches edge's
|
||||
# v6 loopback (which needs core configured) — for the bare TCP
|
||||
# session, v4 loopback reachability is enough so the session SHOULD
|
||||
# come up immediately. confirm with /routing bgp peer print.
|
||||
#
|
||||
# Once core has its matching v6 apply:
|
||||
# /ping 2606:1c80:0:1002::2 count=3 ;; core preseem-side
|
||||
# /ping 2606:1c80:0:11::2 count=3 ;; core direct-side
|
||||
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback (via preseem)
|
||||
# /ip route check dst=2606:1c80:0:10::101 ;; verona loopback path
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# may/09/2026 09:00:22 by RouterOS 6.49.18
|
||||
# may/09/2026 09:26:02 by RouterOS 6.49.18
|
||||
# software id = 8XZE-R7EJ
|
||||
#
|
||||
# model = CCR2004-1G-12S+2XS
|
||||
|
|
@ -65,6 +65,8 @@ set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
|||
set discover-interface-list=!dynamic
|
||||
/ip settings
|
||||
set rp-filter=strict tcp-syncookies=yes
|
||||
/ipv6 settings
|
||||
set accept-router-advertisements=no
|
||||
/ip address
|
||||
add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\
|
||||
71.41.226.116
|
||||
|
|
@ -530,6 +532,12 @@ set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\
|
|||
add address=2605:6000:0:8::f:373/127 advertise=no interface=\
|
||||
sfp-sfpplus12-spectrum
|
||||
add address=2606:1c80::1 interface=vlan9_sfpplus8
|
||||
add address=2606:1c80:0:10::254/128 advertise=no comment="edge loopback" \
|
||||
interface=loopback
|
||||
add address=2606:1c80:0:11::1/127 advertise=no comment=\
|
||||
"P2P edge<->core direct (backup)" interface=sfp-sfpplus7-core-direct
|
||||
add address=2606:1c80:0:1002::1/127 advertise=no comment=\
|
||||
"P2P edge<->core via preseem (primary)" interface=sfp-sfpplus11-preseem
|
||||
/ipv6 firewall address-list
|
||||
add address=2606:1c80::/32 list=bgp-networks
|
||||
/ipv6 firewall filter
|
||||
|
|
@ -545,6 +553,21 @@ add action=accept chain=input comment="IPv6 Established Input" \
|
|||
connection-state=established,related
|
||||
add action=accept chain=forward comment="IPv6 Established Forward" \
|
||||
connection-state=established,related
|
||||
add action=accept chain=input comment="icmpv6 input" protocol=icmpv6
|
||||
add action=accept chain=input comment="link-local input" src-address=\
|
||||
fe80::/10
|
||||
add action=accept chain=input comment="internal input" src-address=\
|
||||
2606:1c80::/32
|
||||
add action=accept chain=forward comment="PMTUD forward" hop-limit=equal:1 \
|
||||
protocol=icmpv6
|
||||
add action=accept chain=forward comment="icmpv6 forward" protocol=icmpv6
|
||||
add action=accept chain=forward comment=internal<->internal dst-address=\
|
||||
2606:1c80::/32 src-address=2606:1c80::/32
|
||||
/ipv6 route
|
||||
add comment="infra: via preseem (primary)" distance=1 dst-address=\
|
||||
2606:1c80::/48 gateway=2606:1c80:0:1002::2
|
||||
add comment="infra: via direct (backup)" distance=2 dst-address=\
|
||||
2606:1c80::/48 gateway=2606:1c80:0:11::2
|
||||
/mpls interface
|
||||
set [ find default=yes ] mpls-mtu=1530
|
||||
add interface=sfp-sfpplus8-server-switch mpls-mtu=1530
|
||||
|
|
@ -584,6 +607,10 @@ add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\
|
|||
add address-families=ip,ipv6 default-originate=always disabled=yes name=\
|
||||
edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
|
||||
remote-address=204.110.191.185 remote-as=393837
|
||||
add address-families=ipv6 comment="iBGP to verona, v4 transport / v6 NLRI" \
|
||||
default-originate=always in-filter=ibgp-tower-in-v6 name=ibgp-verona-v6 \
|
||||
nexthop-choice=force-self out-filter=ibgp-tower-out-v6 remote-address=\
|
||||
10.254.254.101 remote-as=393837 update-source=loopback
|
||||
/routing filter
|
||||
add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\
|
||||
204.110.188.197 prefix-length=32 set-bgp-communities=7486:666
|
||||
|
|
@ -603,6 +630,15 @@ add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
|||
prefix-length=0
|
||||
add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
||||
prefix-length=0-32
|
||||
add action=accept chain=ibgp-tower-in-v6 comment=\
|
||||
"tower /44 customer aggregate" prefix=2606:1c80:1000::/36 prefix-length=\
|
||||
44
|
||||
add action=accept chain=ibgp-tower-in-v6 comment="tower v6 loopback" prefix=\
|
||||
2606:1c80:0:10::/64 prefix-length=128
|
||||
add action=discard chain=ibgp-tower-in-v6 comment="default deny"
|
||||
add action=accept chain=ibgp-tower-out-v6 comment="default route to tower" \
|
||||
prefix=::/0 prefix-length=0
|
||||
add action=discard chain=ibgp-tower-out-v6 comment="default deny"
|
||||
/routing ospf interface
|
||||
add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes
|
||||
add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes
|
||||
|
|
@ -623,10 +659,6 @@ add address=204.110.191.185 poll-interval=10s
|
|||
add address=204.110.191.252 poll-interval=10s
|
||||
/routing ospf network
|
||||
add area=backbone
|
||||
/routing ospf-v3 interface
|
||||
add area=backbone
|
||||
add area=backbone interface=sfp-sfpplus12-spectrum network-type=broadcast \
|
||||
passive=yes
|
||||
/routing rip
|
||||
set distribute-default=always redistribute-connected=yes redistribute-ospf=\
|
||||
yes
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
||||
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||
# software id = 2I9X-PQZP
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
||||
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||
# software id = 5HTF-YFWV
|
||||
#
|
||||
# model = CCR1009-7G-1C-1S+
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
||||
# 2026-05-09 09:26:02 by RouterOS 7.21.4
|
||||
# software id = Y1CT-1WB1
|
||||
#
|
||||
# model = CCR2004-16G-2S+
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue