routers update
This commit is contained in:
parent
34c88a2380
commit
10ee58cd1e
13 changed files with 608 additions and 25 deletions
10
CLAUDE.md
10
CLAUDE.md
|
|
@ -284,7 +284,15 @@ the rule.
|
||||||
|
|
||||||
### IGP / routing
|
### IGP / routing
|
||||||
- OSPFv2 area `backbone-v2` (id 0.0.0.0) on all spine links, SHA-512 auth
|
- OSPFv2 area `backbone-v2` (id 0.0.0.0) on all spine links, SHA-512 auth
|
||||||
with `auth-id=1` and a shared key. PTP type, BFD enabled where supported.
|
with `auth-id=1` and a shared key. PTP type. **BFD is off on every
|
||||||
|
wireless backbone interface (AF11/AF24/60GHz)** — the global timers
|
||||||
|
(`/routing/bfd/configuration` = 200ms×5 = 1s detection) are too
|
||||||
|
aggressive for AF RF: a single >1s burst tore down OSPF on
|
||||||
|
climax↔494 every ~15–40 min until `use-bfd=false` was applied to both
|
||||||
|
ends 2026-05-09. Wired fiber links may keep BFD if desired. If
|
||||||
|
sub-second failover on a wireless link is genuinely needed, also
|
||||||
|
loosen the BFD timers (e.g. min-rx/min-tx=500ms, multiplier=3) — do
|
||||||
|
not flip `use-bfd=true` alone.
|
||||||
- OSPFv3 area `backbone-v3` for IPv6 (some interfaces only).
|
- OSPFv3 area `backbone-v3` for IPv6 (some interfaces only).
|
||||||
- All instances `redistribute=connected` with passthrough filters
|
- All instances `redistribute=connected` with passthrough filters
|
||||||
(`/routing filter rule chain=ospf-out rule="accept;"`).
|
(`/routing filter rule chain=ospf-out rule="accept;"`).
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||||
# software id = K4QG-8NQV
|
# software id = K4QG-8NQV
|
||||||
#
|
#
|
||||||
# model = RB5009UG+S+
|
# model = RB5009UG+S+
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||||
# software id = FUVS-HCM5
|
# software id = FUVS-HCM5
|
||||||
#
|
#
|
||||||
# model = CCR1009-7G-1C-1S+
|
# model = CCR1009-7G-1C-1S+
|
||||||
|
|
|
||||||
152
mikrotik-tool/climax-v6-apply.rsc
Normal file
152
mikrotik-tool/climax-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,152 @@
|
||||||
|
# =============================================================================
|
||||||
|
# climax — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||||
|
# =============================================================================
|
||||||
|
#
|
||||||
|
# Climax sits between verona (south-west) and the rest of the network
|
||||||
|
# (via core). One v6 default upstream — toward core via :12::1.
|
||||||
|
#
|
||||||
|
# P2P interfaces:
|
||||||
|
# ether4-380-airfiber24 :12::/64 (climax .2, core .1)
|
||||||
|
# ether6-verona-11ghz :20::/64 (verona .1, climax .2)
|
||||||
|
# ether3-culleoka-11ghz :21::/64 (climax .1, culleoka .2)
|
||||||
|
# ether5-494 :17::/64 (climax .1, 494 .2)
|
||||||
|
#
|
||||||
|
# Mgmt LAN: bridge `mgmt`, v6 = 2606:1c80:1100::1/64
|
||||||
|
# PPPoE customers: profile name `pppoe`, customer pool 2606:1c80:1101::/48 → /56
|
||||||
|
#
|
||||||
|
# BFD on wireless OSPFv2 templates was already turned off on this router
|
||||||
|
# earlier today (2026-05-09) — verified via the freshly-pulled climax.rsc.
|
||||||
|
# No BFD changes here.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# WIPE — drop OSPFv3 + stale internal v6
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||||
|
/ipv6 dhcp-server remove [find]
|
||||||
|
/ipv6 dhcp-server option remove [find]
|
||||||
|
/ipv6 dhcp-client remove [find]
|
||||||
|
/ipv6 nd prefix remove [find]
|
||||||
|
/ipv6 nd remove [find !default]
|
||||||
|
/ipv6 pool remove [find]
|
||||||
|
/ipv6 route remove [find !dynamic]
|
||||||
|
/ipv6 firewall filter remove [find]
|
||||||
|
/ipv6 firewall mangle remove [find]
|
||||||
|
/ipv6 firewall raw remove [find]
|
||||||
|
/ipv6 address remove [find !dynamic]
|
||||||
|
|
||||||
|
# OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry
|
||||||
|
# (currently lives under area=backbone-v3) all get removed.
|
||||||
|
/routing ospf interface-template remove [find area=backbone-v3]
|
||||||
|
/routing ospf area remove [find name=backbone-v3]
|
||||||
|
/routing ospf instance remove [find name=default-v3]
|
||||||
|
|
||||||
|
# Drop any stale internal v6 iBGP peers (none present, but defensive).
|
||||||
|
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — BGP instance (climax has none today)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/routing bgp instance
|
||||||
|
add name=bgp-instance-1 as=393837 router-id=10.254.254.102
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — addresses
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||||
|
|
||||||
|
/ipv6 address
|
||||||
|
add address=2606:1c80:0:10::102/128 interface=lo advertise=no comment="loopback"
|
||||||
|
add address=2606:1c80:0:12::2/127 interface=ether4-380-airfiber24 advertise=no comment="P2P climax<->core"
|
||||||
|
add address=2606:1c80:0:20::2/127 interface=ether6-verona-11ghz advertise=no comment="P2P climax<->verona"
|
||||||
|
add address=2606:1c80:0:21::1/127 interface=ether3-culleoka-11ghz advertise=no comment="P2P climax<->culleoka"
|
||||||
|
add address=2606:1c80:0:17::1/127 interface=ether5-494 advertise=no comment="P2P climax<->494"
|
||||||
|
add address=2606:1c80:1100::1/64 interface=mgmt advertise=yes comment="climax mgmt LAN"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — static routes (replace what an IGP would have learned)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 route
|
||||||
|
# Default upstream toward core (only one path from climax — core forwards
|
||||||
|
# upward via preseem/direct).
|
||||||
|
add dst-address=::/0 gateway=2606:1c80:0:12::1 distance=1 comment="default via core"
|
||||||
|
|
||||||
|
# Edge loopback explicit (recursively resolved through default; explicit
|
||||||
|
# entry helps iBGP control plane converge quickly on first bring-up).
|
||||||
|
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core"
|
||||||
|
|
||||||
|
# Blackhole climax's /44 aggregate so iBGP has the prefix to advertise.
|
||||||
|
add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 nd
|
||||||
|
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||||
|
|
||||||
|
/ipv6 nd prefix
|
||||||
|
add interface=mgmt prefix=2606:1c80:1100::/64 autonomous=yes on-link=yes
|
||||||
|
|
||||||
|
/ipv6 dhcp-server
|
||||||
|
add interface=mgmt name=climax-mgmt-stateless address-pool=static-only
|
||||||
|
|
||||||
|
/ipv6 dhcp-server option
|
||||||
|
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — customer PD pool + bind to the climax PPPoE profile
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 pool
|
||||||
|
add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
|
||||||
|
|
||||||
|
/ppp profile
|
||||||
|
set [find name=pppoe] remote-ipv6-prefix-pool=climax-cust-pd-1 dhcpv6-pd-pool=climax-cust-pd-1
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — firewall (mirrors v4 hygiene; deny by default)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 firewall filter
|
||||||
|
add chain=input action=accept connection-state=established,related comment="established"
|
||||||
|
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||||
|
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||||
|
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||||
|
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||||
|
add chain=input action=drop comment="default deny"
|
||||||
|
|
||||||
|
add chain=forward action=accept connection-state=established,related comment="established"
|
||||||
|
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||||
|
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||||
|
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||||
|
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||||
|
add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers"
|
||||||
|
add chain=forward action=drop comment="default deny"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — iBGP to edge (v4 transport / v6 NLRI)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/routing filter rule
|
||||||
|
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44) { accept; } else { reject; }"
|
||||||
|
|
||||||
|
/routing bgp connection
|
||||||
|
add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
|
||||||
|
afi=ip,ipv6 local.role=ibgp local.address=10.254.254.102 \
|
||||||
|
remote.address=10.254.254.254 remote.as=393837 multihop=yes \
|
||||||
|
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||||
|
comment="iBGP to edge, v4 transport / v6 NLRI"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# VERIFY (paste after apply)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# /ipv6 address print
|
||||||
|
# /ipv6 route print where active
|
||||||
|
# /routing ospf neighbor print ;; only OSPFv2 should remain
|
||||||
|
# /routing bgp instance print
|
||||||
|
# /routing bgp connection print
|
||||||
|
# /routing bgp session print
|
||||||
|
#
|
||||||
|
# After core + edge have applied:
|
||||||
|
# /ping 2606:1c80:0:12::1 count=3 ;; core P2P side
|
||||||
|
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback
|
||||||
|
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback
|
||||||
|
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end
|
||||||
|
# /routing bgp session print ;; ibgp-edge-v6 should be Established
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
# 2026-05-09 09:26:02 by RouterOS 7.21.4
|
||||||
# software id = UETF-WF31
|
# software id = UETF-WF31
|
||||||
#
|
#
|
||||||
# model = CCR2004-16G-2S+
|
# model = CCR2004-16G-2S+
|
||||||
|
|
@ -133,11 +133,14 @@ add address-pool=climax-mgmt interface=mgmt lease-script="{\
|
||||||
\n} while ( \$attempts < \$max )\
|
\n} while ( \$attempts < \$max )\
|
||||||
\n}\
|
\n}\
|
||||||
\n" name=climax-mgmt
|
\n" name=climax-mgmt
|
||||||
|
/ipv6 dhcp-server option
|
||||||
|
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||||
/ipv6 pool
|
/ipv6 pool
|
||||||
add name=climax-v6 prefix=2606:1c80:1:2000::/52 prefix-length=64
|
add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
|
||||||
/ppp profile
|
/ppp profile
|
||||||
add bridge-learning=no change-tcp-mss=yes dns-server=\
|
add bridge-learning=no change-tcp-mss=yes dhcpv6-pd-pool=climax-cust-pd-1 \
|
||||||
204.110.191.240,204.110.191.20 local-address=cgnat name=pppoe on-down="{\
|
dns-server=204.110.191.240,204.110.191.20 local-address=cgnat name=pppoe \
|
||||||
|
on-down="{\
|
||||||
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
||||||
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
||||||
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
||||||
|
|
@ -245,8 +248,8 @@ add bridge-learning=no change-tcp-mss=yes dns-server=\
|
||||||
\n }\
|
\n }\
|
||||||
\n} while ( \$attempts < \$max )\
|
\n} while ( \$attempts < \$max )\
|
||||||
\n}\
|
\n}\
|
||||||
\n" remote-address=cgnat use-compression=no use-encryption=no use-ipv6=no \
|
\n" remote-address=cgnat remote-ipv6-prefix-pool=climax-cust-pd-1 \
|
||||||
use-mpls=no use-upnp=no
|
use-compression=no use-encryption=no use-ipv6=no use-mpls=no use-upnp=no
|
||||||
/queue type
|
/queue type
|
||||||
add kind=fq-codel name=fq-codel
|
add kind=fq-codel name=fq-codel
|
||||||
/queue interface
|
/queue interface
|
||||||
|
|
@ -268,16 +271,15 @@ set ether15 queue=fq-codel
|
||||||
set ether16 queue=fq-codel
|
set ether16 queue=fq-codel
|
||||||
set sfp-sfpplus1 queue=fq-codel
|
set sfp-sfpplus1 queue=fq-codel
|
||||||
set sfp-sfpplus2 queue=fq-codel
|
set sfp-sfpplus2 queue=fq-codel
|
||||||
|
/routing bgp instance
|
||||||
|
add as=393837 name=bgp-instance-1 router-id=10.254.254.102
|
||||||
/routing id
|
/routing id
|
||||||
add disabled=no id=10.254.254.102 name=id-1 select-dynamic-id=""
|
add disabled=no id=10.254.254.102 name=id-1 select-dynamic-id=""
|
||||||
/routing ospf instance
|
/routing ospf instance
|
||||||
add disabled=no in-filter-chain=ospf-in name=default-v2 originate-default=\
|
add disabled=no in-filter-chain=ospf-in name=default-v2 originate-default=\
|
||||||
never out-filter-chain=ospf-out redistribute=connected router-id=id-1
|
never out-filter-chain=ospf-out redistribute=connected router-id=id-1
|
||||||
add disabled=no in-filter-chain=ospf-in name=default-v3 out-filter-chain=\
|
|
||||||
ospf-out redistribute=connected router-id=id-1 version=3
|
|
||||||
/routing ospf area
|
/routing ospf area
|
||||||
add disabled=no instance=default-v2 name=backbone-v2
|
add disabled=no instance=default-v2 name=backbone-v2
|
||||||
add disabled=no instance=default-v3 name=backbone-v3
|
|
||||||
/snmp community
|
/snmp community
|
||||||
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
||||||
kdyyJrT0Mm
|
kdyyJrT0Mm
|
||||||
|
|
@ -297,14 +299,20 @@ add bridge=climax-bridge interface=sfp-sfpplus1
|
||||||
add bridge=mgmt interface=vlan10_ether7
|
add bridge=mgmt interface=vlan10_ether7
|
||||||
add bridge=mgmt interface=vlan10_sfp-sfpplus1
|
add bridge=mgmt interface=vlan10_sfp-sfpplus1
|
||||||
/ip firewall connection tracking
|
/ip firewall connection tracking
|
||||||
|
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||||
set enabled=yes icmp-timeout=30s tcp-close-wait-timeout=1m \
|
set enabled=yes icmp-timeout=30s tcp-close-wait-timeout=1m \
|
||||||
tcp-established-timeout=4h tcp-fin-wait-timeout=2m tcp-last-ack-timeout=\
|
tcp-established-timeout=4h tcp-fin-wait-timeout=2m tcp-last-ack-timeout=\
|
||||||
30s tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
30s tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
|
||||||
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
tcp-time-wait-timeout=2m udp-stream-timeout=2m
|
||||||
/ip neighbor discovery-settings
|
/ip neighbor discovery-settings
|
||||||
|
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||||
set discover-interface-list=!dynamic
|
set discover-interface-list=!dynamic
|
||||||
/ip settings
|
/ip settings
|
||||||
|
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||||
set max-neighbor-entries=8192 tcp-syncookies=yes
|
set max-neighbor-entries=8192 tcp-syncookies=yes
|
||||||
|
/ipv6 settings
|
||||||
|
# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings
|
||||||
|
set accept-router-advertisements=no
|
||||||
/interface pppoe-server server
|
/interface pppoe-server server
|
||||||
add authentication=chap,mschap2 default-profile=pppoe disabled=no interface=\
|
add authentication=chap,mschap2 default-profile=pppoe disabled=no interface=\
|
||||||
climax-bridge max-mru=1492 max-mtu=1492 one-session-per-host=yes \
|
climax-bridge max-mru=1492 max-mtu=1492 one-session-per-host=yes \
|
||||||
|
|
@ -388,6 +396,13 @@ add dst-address=100.64.160.0/20 gateway=10.250.1.65
|
||||||
add dst-address=204.110.188.64/27 gateway=10.250.1.65
|
add dst-address=204.110.188.64/27 gateway=10.250.1.65
|
||||||
add disabled=no dst-address=10.254.254.101/32 gateway=10.250.1.25 \
|
add disabled=no dst-address=10.254.254.101/32 gateway=10.250.1.25 \
|
||||||
routing-table=main
|
routing-table=main
|
||||||
|
/ipv6 route
|
||||||
|
add comment="default via core" distance=1 dst-address=::/0 gateway=\
|
||||||
|
2606:1c80:0:12::1
|
||||||
|
add comment="edge loopback via core" distance=1 dst-address=\
|
||||||
|
2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1
|
||||||
|
add blackhole comment="climax /44 aggregate (iBGP origin)" distance=200 \
|
||||||
|
dst-address=2606:1c80:1100::/44
|
||||||
/ip service
|
/ip service
|
||||||
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||||
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
||||||
|
|
@ -399,10 +414,45 @@ set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
||||||
set api-ssl certificate=MyCA
|
set api-ssl certificate=MyCA
|
||||||
/ip ssh
|
/ip ssh
|
||||||
set host-key-type=ed25519 strong-crypto=yes
|
set host-key-type=ed25519 strong-crypto=yes
|
||||||
|
/ipv6 address
|
||||||
|
add address=2606:1c80:0:10::102/128 advertise=no comment=loopback interface=\
|
||||||
|
lo
|
||||||
|
add address=2606:1c80:0:12::2/127 advertise=no comment="P2P climax<->core" \
|
||||||
|
interface=ether4-380-airfiber24
|
||||||
|
add address=2606:1c80:0:20::2/127 advertise=no comment="P2P climax<->verona" \
|
||||||
|
interface=ether6-verona-11ghz
|
||||||
|
add address=2606:1c80:0:21::1/127 advertise=no comment=\
|
||||||
|
"P2P climax<->culleoka" interface=ether3-culleoka-11ghz
|
||||||
|
add address=2606:1c80:0:17::1/127 advertise=no comment="P2P climax<->494" \
|
||||||
|
interface=ether5-494
|
||||||
|
add address=2606:1c80:1100::1 comment="climax mgmt LAN" interface=mgmt
|
||||||
/ipv6 dhcp-relay option
|
/ipv6 dhcp-relay option
|
||||||
set client_mac value="0x0001\$(CLIENT_MAC)"
|
set client_mac value="0x0001\$(CLIENT_MAC)"
|
||||||
|
/ipv6 dhcp-server
|
||||||
|
add interface=mgmt name=climax-mgmt-stateless
|
||||||
|
/ipv6 firewall filter
|
||||||
|
add action=accept chain=input comment=established connection-state=\
|
||||||
|
established,related
|
||||||
|
add action=drop chain=input comment=invalid connection-state=invalid
|
||||||
|
add action=accept chain=input comment=icmpv6 protocol=icmpv6
|
||||||
|
add action=accept chain=input comment=link-local src-address=fe80::/10
|
||||||
|
add action=accept chain=input comment=internal src-address=2606:1c80::/32
|
||||||
|
add action=drop chain=input comment="default deny"
|
||||||
|
add action=accept chain=forward comment=established connection-state=\
|
||||||
|
established,related
|
||||||
|
add action=drop chain=forward comment=invalid connection-state=invalid
|
||||||
|
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
|
||||||
|
icmpv6
|
||||||
|
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
|
||||||
|
add action=accept chain=forward comment=internal-to-internal dst-address=\
|
||||||
|
2606:1c80::/32 src-address=2606:1c80::/32
|
||||||
|
add action=accept chain=forward comment=\
|
||||||
|
"v6 outbound from climax tower (customer + mgmt)" src-address=\
|
||||||
|
2606:1c80:1100::/44
|
||||||
|
add action=drop chain=forward comment="default deny"
|
||||||
/ipv6 nd
|
/ipv6 nd
|
||||||
set [ find default=yes ] advertise-dns=yes
|
set [ find default=yes ] advertise-dns=yes
|
||||||
|
add advertise-dns=yes interface=mgmt other-configuration=yes
|
||||||
/mpls interface
|
/mpls interface
|
||||||
add interface=ether6-verona-11ghz mpls-mtu=1508
|
add interface=ether6-verona-11ghz mpls-mtu=1508
|
||||||
add interface=ether4-380-airfiber24 mpls-mtu=1508
|
add interface=ether4-380-airfiber24 mpls-mtu=1508
|
||||||
|
|
@ -426,17 +476,21 @@ set accept=yes
|
||||||
/routing bfd configuration
|
/routing bfd configuration
|
||||||
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 vrf=\
|
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 vrf=\
|
||||||
main
|
main
|
||||||
|
/routing bgp connection
|
||||||
|
add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\
|
||||||
|
bgp-instance-1 local.address=10.254.254.102 .role=ibgp multihop=yes name=\
|
||||||
|
ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||||
|
remote.address=10.254.254.254 .as=393837 templates=default
|
||||||
/routing filter rule
|
/routing filter rule
|
||||||
add chain=ospf-in disabled=no rule=accept
|
add chain=ospf-in disabled=no rule=accept
|
||||||
add chain=ospf-out disabled=no rule=accept
|
add chain=ospf-out disabled=no rule=accept
|
||||||
|
add chain=v6-ibgp-out disabled=no rule=\
|
||||||
|
"if (dst==2606:1c80:1100::/44) { accept; } else { reject; }"
|
||||||
/routing ospf interface-template
|
/routing ospf interface-template
|
||||||
add area=backbone-v3 cost=10 disabled=no use-bfd=no
|
|
||||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||||
ether6-verona-11ghz priority=1 type=ptp use-bfd=no
|
ether6-verona-11ghz priority=1 type=ptp use-bfd=no
|
||||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||||
ether5-494 priority=1 type=ptp use-bfd=no
|
ether5-494 priority=1 type=ptp use-bfd=no
|
||||||
add area=backbone-v3 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
|
||||||
ether3-culleoka-11ghz priority=1 type=ptp use-bfd=no
|
|
||||||
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
||||||
ether4-380-airfiber24 priority=1 type=ptp use-bfd=no
|
ether4-380-airfiber24 priority=1 type=ptp use-bfd=no
|
||||||
/routing ospf static-neighbor
|
/routing ospf static-neighbor
|
||||||
|
|
|
||||||
169
mikrotik-tool/core-v6-apply.rsc
Normal file
169
mikrotik-tool/core-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,169 @@
|
||||||
|
# =============================================================================
|
||||||
|
# core (380) — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
||||||
|
# =============================================================================
|
||||||
|
#
|
||||||
|
# Core sits between edge and the towers. Two paths to edge mirror v4:
|
||||||
|
# 1. PRIMARY: sfp-sfpplus1-edge-preseem, /127 :1002::2 — edge cost 10
|
||||||
|
# 2. BACKUP: ether3-edge-direct, /127 :11::2 — OSPFv2 cost 100 on both
|
||||||
|
# ends; v6 mirrors via static distance.
|
||||||
|
#
|
||||||
|
# Tower-facing P2Ps (per ipv6.md):
|
||||||
|
# ether5-climax :12::/64 (core .1, climax .2)
|
||||||
|
# ether4-newhope :13::/64 (core .1, newhope .2)
|
||||||
|
# ether1-982-60ghz :14::/64 (core .1, 982 .2)
|
||||||
|
# ether6-culleoka-11ghz :15::/64 (core .1, culleoka .2)
|
||||||
|
#
|
||||||
|
# Mgmt LAN: vlan10_combo1 (vlan 10 on combo1-380), v6 = 2606:1c80:1400::1/64
|
||||||
|
# PPPoE customers: profile name `380`, customer pool 2606:1c80:1401::/48 → /56
|
||||||
|
#
|
||||||
|
# Two pre-apply fixes required on core:
|
||||||
|
# (a) /routing/bgp/instance bgp-instance-1 currently has as=65530 — must
|
||||||
|
# be 393837 to peer iBGP with edge. We update it in place.
|
||||||
|
# (b) BFD is currently on for ether5-climax (AF24), ether4-newhope, and
|
||||||
|
# ether6-culleoka-11ghz (AF11). Per fleet policy (no BFD on
|
||||||
|
# wireless), we set use-bfd=no on those three OSPFv2 templates.
|
||||||
|
# Wired backbone (sfp-sfpplus1-edge-preseem, ether3-edge-direct)
|
||||||
|
# keeps BFD as-is.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# WIPE — drop OSPFv3 + stale internal v6
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
||||||
|
/ipv6 dhcp-server remove [find]
|
||||||
|
/ipv6 dhcp-server option remove [find]
|
||||||
|
/ipv6 dhcp-client remove [find]
|
||||||
|
/ipv6 nd prefix remove [find]
|
||||||
|
/ipv6 nd remove [find !default]
|
||||||
|
/ipv6 pool remove [find]
|
||||||
|
/ipv6 route remove [find !dynamic]
|
||||||
|
/ipv6 firewall filter remove [find]
|
||||||
|
/ipv6 firewall mangle remove [find]
|
||||||
|
/ipv6 firewall raw remove [find]
|
||||||
|
/ipv6 address remove [find !dynamic]
|
||||||
|
|
||||||
|
/routing ospf interface-template remove [find area=backbone-v3]
|
||||||
|
/routing ospf area remove [find name=backbone-v3]
|
||||||
|
/routing ospf instance remove [find name=default-v3]
|
||||||
|
|
||||||
|
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
||||||
|
# also remove the disabled placeholder climax connection (will be replaced
|
||||||
|
# by the future climax tower's own iBGP-to-edge session).
|
||||||
|
/routing bgp connection remove [find name=climax and disabled=yes]
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — fix BGP instance AS (65530 → 393837 to match the fleet)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/routing bgp instance set [find name=bgp-instance-1] as=393837
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — turn off BFD on wireless backbone OSPFv2 templates
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/routing ospf interface-template set [find interfaces=ether5-climax] use-bfd=no
|
||||||
|
/routing ospf interface-template set [find interfaces=ether4-newhope] use-bfd=no
|
||||||
|
/routing ospf interface-template set [find interfaces=ether6-culleoka-11ghz] use-bfd=no
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — addresses
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||||
|
|
||||||
|
/ipv6 address
|
||||||
|
add address=2606:1c80:0:10::253/128 interface=lo advertise=no comment="loopback"
|
||||||
|
add address=2606:1c80:0:11::2/127 interface=ether3-edge-direct advertise=no comment="P2P core<->edge direct (backup)"
|
||||||
|
add address=2606:1c80:0:1002::2/127 interface=sfp-sfpplus1-edge-preseem advertise=no comment="P2P core<->edge via preseem (primary)"
|
||||||
|
add address=2606:1c80:0:12::1/127 interface=ether5-climax advertise=no comment="P2P core<->climax"
|
||||||
|
add address=2606:1c80:0:13::1/127 interface=ether4-newhope advertise=no comment="P2P core<->newhope"
|
||||||
|
add address=2606:1c80:0:14::1/127 interface=ether1-982-60ghz advertise=no comment="P2P core<->982 60GHz"
|
||||||
|
add address=2606:1c80:0:15::1/127 interface=ether6-culleoka-11ghz advertise=no comment="P2P core<->culleoka"
|
||||||
|
add address=2606:1c80:1400::1/64 interface=vlan10_combo1 advertise=yes comment="380 mgmt LAN"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — static routes (replace what an IGP would have learned)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 route
|
||||||
|
# v6 default toward edge — preseem primary, direct backup (mirrors v4 cost relationship).
|
||||||
|
add dst-address=::/0 gateway=2606:1c80:0:1002::1 distance=1 comment="default via preseem (primary)"
|
||||||
|
add dst-address=::/0 gateway=2606:1c80:0:11::1 distance=2 comment="default via direct (backup)"
|
||||||
|
|
||||||
|
# Edge loopback static fallback (so iBGP TCP control plane can reach edge
|
||||||
|
# even before BGP populates anything beyond defaults).
|
||||||
|
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem"
|
||||||
|
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 distance=2 comment="edge loopback via direct"
|
||||||
|
|
||||||
|
# Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward.
|
||||||
|
add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — neighbour discovery on the 380 mgmt LAN (SLAAC + RDNSS)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 nd
|
||||||
|
add interface=vlan10_combo1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
||||||
|
|
||||||
|
/ipv6 nd prefix
|
||||||
|
add interface=vlan10_combo1 prefix=2606:1c80:1400::/64 autonomous=yes on-link=yes
|
||||||
|
|
||||||
|
/ipv6 dhcp-server
|
||||||
|
add interface=vlan10_combo1 name=core-mgmt-stateless address-pool=static-only
|
||||||
|
|
||||||
|
/ipv6 dhcp-server option
|
||||||
|
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — customer PD pool + bind to the 380 PPPoE profile
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 pool
|
||||||
|
add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56
|
||||||
|
|
||||||
|
/ppp profile
|
||||||
|
set [find name=380] remote-ipv6-prefix-pool=core-cust-pd-1 dhcpv6-pd-pool=core-cust-pd-1
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — firewall (mirrors v4 hygiene; deny by default)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 firewall filter
|
||||||
|
add chain=input action=accept connection-state=established,related comment="established"
|
||||||
|
add chain=input action=drop connection-state=invalid comment="invalid"
|
||||||
|
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
||||||
|
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
||||||
|
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
||||||
|
add chain=input action=drop comment="default deny"
|
||||||
|
|
||||||
|
add chain=forward action=accept connection-state=established,related comment="established"
|
||||||
|
add chain=forward action=drop connection-state=invalid comment="invalid"
|
||||||
|
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
||||||
|
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
||||||
|
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
||||||
|
add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers"
|
||||||
|
add chain=forward action=drop comment="default deny"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — iBGP to edge (v4 transport / v6 NLRI)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/routing filter rule
|
||||||
|
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44) { accept; } else { reject; }"
|
||||||
|
|
||||||
|
/routing bgp connection
|
||||||
|
add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
|
||||||
|
afi=ip,ipv6 local.role=ibgp local.address=10.254.254.253 \
|
||||||
|
remote.address=10.254.254.254 remote.as=393837 multihop=yes \
|
||||||
|
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
||||||
|
comment="iBGP to edge, v4 transport / v6 NLRI"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# VERIFY (paste after apply)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# /ipv6 address print
|
||||||
|
# /ipv6 route print where active
|
||||||
|
# /routing ospf neighbor print
|
||||||
|
# /routing ospf interface-template print where use-bfd=yes ;; should be wired-only
|
||||||
|
# /routing bgp instance print
|
||||||
|
# /routing bgp connection print
|
||||||
|
# /routing bgp session print
|
||||||
|
#
|
||||||
|
# After edge has applied:
|
||||||
|
# /ping 2606:1c80:0:1002::1 count=3 ;; edge preseem-side
|
||||||
|
# /ping 2606:1c80:0:11::1 count=3 ;; edge direct-side
|
||||||
|
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback
|
||||||
|
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end
|
||||||
|
# /routing bgp session print ;; ibgp-edge-v6 should be Established
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||||
# software id = XS5B-41QR
|
# software id = XS5B-41QR
|
||||||
#
|
#
|
||||||
# model = CCR1009-7G-1C-1S+
|
# model = CCR1009-7G-1C-1S+
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||||
# software id = HVP9-3G0K
|
# software id = HVP9-3G0K
|
||||||
#
|
#
|
||||||
# model = CCR1009-7G-1C-1S+
|
# model = CCR1009-7G-1C-1S+
|
||||||
|
|
|
||||||
168
mikrotik-tool/edge-v6-apply.rsc
Normal file
168
mikrotik-tool/edge-v6-apply.rsc
Normal file
|
|
@ -0,0 +1,168 @@
|
||||||
|
# =============================================================================
|
||||||
|
# edge — IPv6 apply script (ROS 6.49.18, BGP-only / no OSPFv3)
|
||||||
|
# =============================================================================
|
||||||
|
#
|
||||||
|
# Edge is the iBGP hub: it terminates the TWC v6 eBGP peering and the v4
|
||||||
|
# transport iBGP sessions to every tower. v6 NLRI rides v4 transport (so the
|
||||||
|
# existing v4 OSPF reachability between loopbacks is reused; no v6 IGP is
|
||||||
|
# needed). This matches the verona-v6-apply.rsc design choice.
|
||||||
|
#
|
||||||
|
# Two paths edge<->core:
|
||||||
|
# 1. PRIMARY: sfp-sfpplus11-preseem, /127 via the Preseem shaper
|
||||||
|
# (transparent L2). OSPFv2 cost on edge is the default 10. v6 P2P:
|
||||||
|
# 2606:1c80:0:1002::1 (edge) <-> :2 (core)
|
||||||
|
# 2. BACKUP: sfp-sfpplus7-core-direct, /127 direct fiber. OSPFv2 cost on
|
||||||
|
# edge is 100 (same on core's side). v6 P2P:
|
||||||
|
# 2606:1c80:0:11::1 (edge) <-> :2 (core)
|
||||||
|
# Static v6 routes for the infra /48 mirror that cost relationship by
|
||||||
|
# distance (lower = preferred): preseem at distance=1, direct at
|
||||||
|
# distance=2.
|
||||||
|
#
|
||||||
|
# What this script DOES NOT touch (USER CONSTRAINT 2026-05-09):
|
||||||
|
# * TWC v6 eBGP peer `twc-v6` (remote 2605:6000:0:8::f:372, AS11427) —
|
||||||
|
# name doesn't match the ^ibgp- wipe pattern, so it survives.
|
||||||
|
# * The 2606:1c80::/32 BGP network announcement upstream.
|
||||||
|
# * The TWC P2P address 2605:6000:0:8::f:373/127 on sfp-sfpplus12-spectrum
|
||||||
|
# — enabled, so it survives the [find disabled=yes] wipe.
|
||||||
|
# * The existing server LAN address 2606:1c80::1 on vlan9_sfpplus8 —
|
||||||
|
# enabled, so it survives. We only ADD a per-interface ND override
|
||||||
|
# to suppress RA there; the IP and prefix are unmodified.
|
||||||
|
# * v4 OSPFv2 / RIP / firewall rules — v4 control plane is unchanged.
|
||||||
|
#
|
||||||
|
# Apply order: review -> paste in winbox/SSH on edge -> verify with checks
|
||||||
|
# at the bottom -> only then run the matching `core-v6-apply.rsc` so the
|
||||||
|
# preseem and direct /127 endpoints come up symmetrically.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# WIPE — only the stale internal-only v6 state on edge. Leaves TWC peering,
|
||||||
|
# the upstream /32 announcement, the server LAN address, and v4 alone.
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# Drop any disabled placeholder v6 internal addresses (none on edge today,
|
||||||
|
# but harmless if present).
|
||||||
|
/ipv6 address remove [find disabled=yes]
|
||||||
|
|
||||||
|
# Drop any leftover OSPFv3 interface entries (we are committing to BGP-only
|
||||||
|
# for v6; any v3 instances on edge have been minimal/stub).
|
||||||
|
/routing ospf-v3 interface remove [find]
|
||||||
|
|
||||||
|
# Drop only internal iBGP v6 peers if any exist; never touch twc-v6.
|
||||||
|
/routing bgp peer remove [find name~"^ibgp-" and address-families~"ipv6"]
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — addresses
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
/ipv6 settings set forward=yes accept-router-advertisements=no
|
||||||
|
|
||||||
|
/ipv6 address
|
||||||
|
add address=2606:1c80:0:10::254/128 interface=loopback advertise=no comment="edge loopback"
|
||||||
|
add address=2606:1c80:0:11::1/127 interface=sfp-sfpplus7-core-direct advertise=no comment="P2P edge<->core direct (backup)"
|
||||||
|
add address=2606:1c80:0:1002::1/127 interface=sfp-sfpplus11-preseem advertise=no comment="P2P edge<->core via preseem (primary)"
|
||||||
|
|
||||||
|
# NOTE: the server LAN address 2606:1c80::1 on vlan9_sfpplus8 is left
|
||||||
|
# untouched per user constraint. The ND override below makes it RA-free
|
||||||
|
# without modifying the address itself.
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — neighbour discovery: SUPPRESS RA on the server LAN
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# Server LAN is static-only per the IPv6 plan — disable RA + DHCPv6 hints.
|
||||||
|
# A per-interface entry overrides the global default.
|
||||||
|
/ipv6 nd
|
||||||
|
add interface=vlan9_sfpplus8 disabled=no advertise=no managed-address-configuration=no other-configuration=no comment="server LAN: static only, no SLAAC"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — static routes (replace what an IGP would have learned)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# Infra /48 covers all router loopbacks (2606:1c80:0:10::/64), all P2P
|
||||||
|
# /127s, and any future infra slots. Two entries with different distances
|
||||||
|
# pin preseem as primary and direct as backup. The connected /64 server
|
||||||
|
# LAN at 2606:1c80::/64 wins by longest-prefix-match, so this /48 doesn't
|
||||||
|
# steal local server traffic.
|
||||||
|
/ipv6 route
|
||||||
|
add dst-address=2606:1c80::/48 gateway=2606:1c80:0:1002::2 distance=1 comment="infra: via preseem (primary)"
|
||||||
|
add dst-address=2606:1c80::/48 gateway=2606:1c80:0:11::2 distance=2 comment="infra: via direct (backup)"
|
||||||
|
|
||||||
|
# Tower /44s are learned via iBGP from each tower (next-hop = tower's v6
|
||||||
|
# loopback inside :10::/64, recursively resolved through the /48 above).
|
||||||
|
# No static needed for them.
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — firewall (extend the existing minimal v6 ruleset)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# The existing v6 firewall already accepts BGP (179) and established. Add
|
||||||
|
# the rules required for internal-network forwarding + ICMPv6 / link-local.
|
||||||
|
/ipv6 firewall filter
|
||||||
|
add chain=input action=accept protocol=icmpv6 comment="icmpv6 input"
|
||||||
|
add chain=input action=accept src-address=fe80::/10 comment="link-local input"
|
||||||
|
add chain=input action=accept src-address=2606:1c80::/32 comment="internal input"
|
||||||
|
|
||||||
|
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD forward"
|
||||||
|
add chain=forward action=accept protocol=icmpv6 comment="icmpv6 forward"
|
||||||
|
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal<->internal"
|
||||||
|
|
||||||
|
# (we do not add a default-deny; edge has long-running customer transit
|
||||||
|
# paths and a sudden v6 default-deny would break them. existing rules at
|
||||||
|
# the bottom of /ipv6 firewall filter remain authoritative.)
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — iBGP route filters (v6)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# in-filter: accept any /44 inside the tower allocation block 2606:1c80:1000::/36.
|
||||||
|
# Anything else from a tower iBGP peer is rejected (defense in depth — we
|
||||||
|
# don't want a tower advertising the world to us).
|
||||||
|
/routing filter
|
||||||
|
add chain=ibgp-tower-in-v6 prefix=2606:1c80:1000::/36 prefix-length=44 action=accept comment="tower /44 customer aggregate"
|
||||||
|
add chain=ibgp-tower-in-v6 prefix=2606:1c80:0:10::/64 prefix-length=128 action=accept comment="tower v6 loopback"
|
||||||
|
add chain=ibgp-tower-in-v6 action=discard comment="default deny"
|
||||||
|
|
||||||
|
# out-filter: edge sends ONLY the v6 default to towers. Towers don't need
|
||||||
|
# anything else from edge — they reach customers via their own routes and
|
||||||
|
# transit upstream via the default.
|
||||||
|
add chain=ibgp-tower-out-v6 prefix=::/0 prefix-length=0 action=accept comment="default route to tower"
|
||||||
|
add chain=ibgp-tower-out-v6 action=discard comment="default deny"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# APPLY — iBGP peer to verona (over v4 transport, carrying v6 NLRI)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# ROS6 syntax: address-families=ipv6 with a v4 remote-address gives
|
||||||
|
# MP-BGP v6-NLRI-over-v4-TCP. update-source=loopback ensures the TCP
|
||||||
|
# session sources from the v4 loopback (10.254.254.254).
|
||||||
|
# nexthop-choice=force-self pins the v6 next-hop edge advertises to
|
||||||
|
# its own v6 loopback (2606:1c80:0:10::254), reachable from verona once
|
||||||
|
# climax has its v6 apply.
|
||||||
|
/routing bgp peer
|
||||||
|
add name=ibgp-verona-v6 \
|
||||||
|
remote-address=10.254.254.101 remote-as=393837 \
|
||||||
|
update-source=loopback \
|
||||||
|
address-families=ipv6 \
|
||||||
|
nexthop-choice=force-self \
|
||||||
|
in-filter=ibgp-tower-in-v6 out-filter=ibgp-tower-out-v6 \
|
||||||
|
default-originate=always \
|
||||||
|
comment="iBGP to verona, v4 transport / v6 NLRI"
|
||||||
|
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# VERIFY (paste after apply)
|
||||||
|
# -----------------------------------------------------------------------------
|
||||||
|
# /ipv6 address print
|
||||||
|
# /ipv6 route print where active
|
||||||
|
# /ipv6 nd print
|
||||||
|
# /routing bgp peer print where name~"v6"
|
||||||
|
# /routing bgp advertisements print peer=ibgp-verona-v6
|
||||||
|
#
|
||||||
|
# Expected immediately:
|
||||||
|
# * /ipv6 address print shows 2606:1c80:0:10::254/128 (loopback),
|
||||||
|
# :11::1/127 (direct), :1002::1/127 (preseem), :1::/64 server LAN
|
||||||
|
# * /ipv6 nd print shows the vlan9_sfpplus8 entry with advertise=no
|
||||||
|
# * the new /48 routes show as inactive (gateway unreachable until core
|
||||||
|
# applies), which is fine
|
||||||
|
# * ibgp-verona-v6 is in `connecting` state until verona reaches edge's
|
||||||
|
# v6 loopback (which needs core configured) — for the bare TCP
|
||||||
|
# session, v4 loopback reachability is enough so the session SHOULD
|
||||||
|
# come up immediately. confirm with /routing bgp peer print.
|
||||||
|
#
|
||||||
|
# Once core has its matching v6 apply:
|
||||||
|
# /ping 2606:1c80:0:1002::2 count=3 ;; core preseem-side
|
||||||
|
# /ping 2606:1c80:0:11::2 count=3 ;; core direct-side
|
||||||
|
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback (via preseem)
|
||||||
|
# /ip route check dst=2606:1c80:0:10::101 ;; verona loopback path
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
# may/09/2026 09:00:22 by RouterOS 6.49.18
|
# may/09/2026 09:26:02 by RouterOS 6.49.18
|
||||||
# software id = 8XZE-R7EJ
|
# software id = 8XZE-R7EJ
|
||||||
#
|
#
|
||||||
# model = CCR2004-1G-12S+2XS
|
# model = CCR2004-1G-12S+2XS
|
||||||
|
|
@ -65,6 +65,8 @@ set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
|
||||||
set discover-interface-list=!dynamic
|
set discover-interface-list=!dynamic
|
||||||
/ip settings
|
/ip settings
|
||||||
set rp-filter=strict tcp-syncookies=yes
|
set rp-filter=strict tcp-syncookies=yes
|
||||||
|
/ipv6 settings
|
||||||
|
set accept-router-advertisements=no
|
||||||
/ip address
|
/ip address
|
||||||
add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\
|
add address=71.41.226.118/30 interface=sfp-sfpplus12-spectrum network=\
|
||||||
71.41.226.116
|
71.41.226.116
|
||||||
|
|
@ -530,6 +532,12 @@ set always-allow-password-login=yes forwarding-enabled=remote strong-crypto=\
|
||||||
add address=2605:6000:0:8::f:373/127 advertise=no interface=\
|
add address=2605:6000:0:8::f:373/127 advertise=no interface=\
|
||||||
sfp-sfpplus12-spectrum
|
sfp-sfpplus12-spectrum
|
||||||
add address=2606:1c80::1 interface=vlan9_sfpplus8
|
add address=2606:1c80::1 interface=vlan9_sfpplus8
|
||||||
|
add address=2606:1c80:0:10::254/128 advertise=no comment="edge loopback" \
|
||||||
|
interface=loopback
|
||||||
|
add address=2606:1c80:0:11::1/127 advertise=no comment=\
|
||||||
|
"P2P edge<->core direct (backup)" interface=sfp-sfpplus7-core-direct
|
||||||
|
add address=2606:1c80:0:1002::1/127 advertise=no comment=\
|
||||||
|
"P2P edge<->core via preseem (primary)" interface=sfp-sfpplus11-preseem
|
||||||
/ipv6 firewall address-list
|
/ipv6 firewall address-list
|
||||||
add address=2606:1c80::/32 list=bgp-networks
|
add address=2606:1c80::/32 list=bgp-networks
|
||||||
/ipv6 firewall filter
|
/ipv6 firewall filter
|
||||||
|
|
@ -545,6 +553,21 @@ add action=accept chain=input comment="IPv6 Established Input" \
|
||||||
connection-state=established,related
|
connection-state=established,related
|
||||||
add action=accept chain=forward comment="IPv6 Established Forward" \
|
add action=accept chain=forward comment="IPv6 Established Forward" \
|
||||||
connection-state=established,related
|
connection-state=established,related
|
||||||
|
add action=accept chain=input comment="icmpv6 input" protocol=icmpv6
|
||||||
|
add action=accept chain=input comment="link-local input" src-address=\
|
||||||
|
fe80::/10
|
||||||
|
add action=accept chain=input comment="internal input" src-address=\
|
||||||
|
2606:1c80::/32
|
||||||
|
add action=accept chain=forward comment="PMTUD forward" hop-limit=equal:1 \
|
||||||
|
protocol=icmpv6
|
||||||
|
add action=accept chain=forward comment="icmpv6 forward" protocol=icmpv6
|
||||||
|
add action=accept chain=forward comment=internal<->internal dst-address=\
|
||||||
|
2606:1c80::/32 src-address=2606:1c80::/32
|
||||||
|
/ipv6 route
|
||||||
|
add comment="infra: via preseem (primary)" distance=1 dst-address=\
|
||||||
|
2606:1c80::/48 gateway=2606:1c80:0:1002::2
|
||||||
|
add comment="infra: via direct (backup)" distance=2 dst-address=\
|
||||||
|
2606:1c80::/48 gateway=2606:1c80:0:11::2
|
||||||
/mpls interface
|
/mpls interface
|
||||||
set [ find default=yes ] mpls-mtu=1530
|
set [ find default=yes ] mpls-mtu=1530
|
||||||
add interface=sfp-sfpplus8-server-switch mpls-mtu=1530
|
add interface=sfp-sfpplus8-server-switch mpls-mtu=1530
|
||||||
|
|
@ -584,6 +607,10 @@ add comment="TEAM-CYMRU BOGON Server #2" disabled=yes in-filter=\
|
||||||
add address-families=ip,ipv6 default-originate=always disabled=yes name=\
|
add address-families=ip,ipv6 default-originate=always disabled=yes name=\
|
||||||
edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
|
edge_core_preseem nexthop-choice=propagate out-filter=bgp-default-only \
|
||||||
remote-address=204.110.191.185 remote-as=393837
|
remote-address=204.110.191.185 remote-as=393837
|
||||||
|
add address-families=ipv6 comment="iBGP to verona, v4 transport / v6 NLRI" \
|
||||||
|
default-originate=always in-filter=ibgp-tower-in-v6 name=ibgp-verona-v6 \
|
||||||
|
nexthop-choice=force-self out-filter=ibgp-tower-out-v6 remote-address=\
|
||||||
|
10.254.254.101 remote-as=393837 update-source=loopback
|
||||||
/routing filter
|
/routing filter
|
||||||
add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\
|
add action=accept chain=twc-out comment=blackhole disabled=yes prefix=\
|
||||||
204.110.188.197 prefix-length=32 set-bgp-communities=7486:666
|
204.110.188.197 prefix-length=32 set-bgp-communities=7486:666
|
||||||
|
|
@ -603,6 +630,15 @@ add action=accept chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
||||||
prefix-length=0
|
prefix-length=0
|
||||||
add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
add action=discard chain=bgp-default-only disabled=yes prefix=0.0.0.0/0 \
|
||||||
prefix-length=0-32
|
prefix-length=0-32
|
||||||
|
add action=accept chain=ibgp-tower-in-v6 comment=\
|
||||||
|
"tower /44 customer aggregate" prefix=2606:1c80:1000::/36 prefix-length=\
|
||||||
|
44
|
||||||
|
add action=accept chain=ibgp-tower-in-v6 comment="tower v6 loopback" prefix=\
|
||||||
|
2606:1c80:0:10::/64 prefix-length=128
|
||||||
|
add action=discard chain=ibgp-tower-in-v6 comment="default deny"
|
||||||
|
add action=accept chain=ibgp-tower-out-v6 comment="default route to tower" \
|
||||||
|
prefix=::/0 prefix-length=0
|
||||||
|
add action=discard chain=ibgp-tower-out-v6 comment="default deny"
|
||||||
/routing ospf interface
|
/routing ospf interface
|
||||||
add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes
|
add interface=sfp-sfpplus12-spectrum network-type=broadcast passive=yes
|
||||||
add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes
|
add interface=sfp-sfpplus11-preseem network-type=point-to-point use-bfd=yes
|
||||||
|
|
@ -623,10 +659,6 @@ add address=204.110.191.185 poll-interval=10s
|
||||||
add address=204.110.191.252 poll-interval=10s
|
add address=204.110.191.252 poll-interval=10s
|
||||||
/routing ospf network
|
/routing ospf network
|
||||||
add area=backbone
|
add area=backbone
|
||||||
/routing ospf-v3 interface
|
|
||||||
add area=backbone
|
|
||||||
add area=backbone interface=sfp-sfpplus12-spectrum network-type=broadcast \
|
|
||||||
passive=yes
|
|
||||||
/routing rip
|
/routing rip
|
||||||
set distribute-default=always redistribute-connected=yes redistribute-ospf=\
|
set distribute-default=always redistribute-connected=yes redistribute-ospf=\
|
||||||
yes
|
yes
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||||
# software id = 2I9X-PQZP
|
# software id = 2I9X-PQZP
|
||||||
#
|
#
|
||||||
# model = CCR1009-7G-1C-1S+
|
# model = CCR1009-7G-1C-1S+
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
# 2026-05-09 09:26:03 by RouterOS 7.21.4
|
||||||
# software id = 5HTF-YFWV
|
# software id = 5HTF-YFWV
|
||||||
#
|
#
|
||||||
# model = CCR1009-7G-1C-1S+
|
# model = CCR1009-7G-1C-1S+
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
# 2026-05-09 09:00:22 by RouterOS 7.21.4
|
# 2026-05-09 09:26:02 by RouterOS 7.21.4
|
||||||
# software id = Y1CT-1WB1
|
# software id = Y1CT-1WB1
|
||||||
#
|
#
|
||||||
# model = CCR2004-16G-2S+
|
# model = CCR2004-16G-2S+
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue