From bfb81d4963a38794d2d37c1f1b276abf5798f6d8 Mon Sep 17 00:00:00 2001 From: Graham McIntire Date: Sat, 9 May 2026 09:31:03 -0500 Subject: [PATCH] routers update --- mikrotik-tool/494.rsc | 2 +- mikrotik-tool/982.rsc | 2 +- mikrotik-tool/climax.rsc | 12 ++--- mikrotik-tool/core.rsc | 100 +++++++++++++++++++++++++++---------- mikrotik-tool/culleoka.rsc | 2 +- mikrotik-tool/edge.rsc | 2 +- mikrotik-tool/lowry.rsc | 2 +- mikrotik-tool/newhope.rsc | 2 +- mikrotik-tool/routers.yaml | 2 + mikrotik-tool/verona.rsc | 4 +- 10 files changed, 90 insertions(+), 40 deletions(-) diff --git a/mikrotik-tool/494.rsc b/mikrotik-tool/494.rsc index ba27091..0a10ca4 100644 --- a/mikrotik-tool/494.rsc +++ b/mikrotik-tool/494.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:26:03 by RouterOS 7.21.4 +# 2026-05-09 09:30:35 by RouterOS 7.21.4 # software id = K4QG-8NQV # # model = RB5009UG+S+ diff --git a/mikrotik-tool/982.rsc b/mikrotik-tool/982.rsc index 924f8de..1e2290c 100644 --- a/mikrotik-tool/982.rsc +++ b/mikrotik-tool/982.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:26:03 by RouterOS 7.21.4 +# 2026-05-09 09:30:35 by RouterOS 7.21.4 # software id = FUVS-HCM5 # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/climax.rsc b/mikrotik-tool/climax.rsc index 452b0c7..7d88c47 100644 --- a/mikrotik-tool/climax.rsc +++ b/mikrotik-tool/climax.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:26:02 by RouterOS 7.21.4 +# 2026-05-09 09:30:35 by RouterOS 7.21.4 # software id = UETF-WF31 # # model = CCR2004-16G-2S+ @@ -417,13 +417,13 @@ set host-key-type=ed25519 strong-crypto=yes /ipv6 address add address=2606:1c80:0:10::102/128 advertise=no comment=loopback interface=\ lo -add address=2606:1c80:0:12::2/127 advertise=no comment="P2P climax<->core" \ +add address=2606:1c80:0:12::2 advertise=no comment="P2P climax<->core" \ interface=ether4-380-airfiber24 -add address=2606:1c80:0:20::2/127 advertise=no comment="P2P climax<->verona" \ +add address=2606:1c80:0:20::2 advertise=no comment="P2P climax<->verona" \ interface=ether6-verona-11ghz -add address=2606:1c80:0:21::1/127 advertise=no comment=\ - "P2P climax<->culleoka" interface=ether3-culleoka-11ghz -add address=2606:1c80:0:17::1/127 advertise=no comment="P2P climax<->494" \ +add address=2606:1c80:0:21::1 advertise=no comment="P2P climax<->culleoka" \ + interface=ether3-culleoka-11ghz +add address=2606:1c80:0:17::1 advertise=no comment="P2P climax<->494" \ interface=ether5-494 add address=2606:1c80:1100::1 comment="climax mgmt LAN" interface=mgmt /ipv6 dhcp-relay option diff --git a/mikrotik-tool/core.rsc b/mikrotik-tool/core.rsc index 8ad7115..144337f 100644 --- a/mikrotik-tool/core.rsc +++ b/mikrotik-tool/core.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:26:03 by RouterOS 7.21.4 +# 2026-05-09 09:30:35 by RouterOS 7.21.4 # software id = XS5B-41QR # # model = CCR1009-7G-1C-1S+ @@ -220,9 +220,14 @@ add address-pool=380-mgmt interface=vlan10_combo1 lease-script="{\ \n" lease-time=1h name=380-mgmt /ip smb users set [ find default=yes ] disabled=yes +/ipv6 dhcp-server option +add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'" +/ipv6 pool +add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56 /ppp profile -add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \ - local-address=100.64.11.253 name=380 on-down="{\ +add change-tcp-mss=yes dhcpv6-pd-pool=core-cust-pd-1 dns-server=\ + 204.110.191.240,204.110.191.20 local-address=100.64.11.253 name=380 \ + on-down="{\ \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\ uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\ 7f4443-fc8a-4fe0-807c-f535d2aa1865\"\ @@ -330,7 +335,8 @@ add change-tcp-mss=yes dns-server=204.110.191.240,204.110.191.20 \ \n }\ \n} while ( \$attempts < \$max )\ \n}\ - \n" remote-address=380 use-ipv6=no use-upnp=no + \n" remote-address=380 remote-ipv6-prefix-pool=core-cust-pd-1 use-ipv6=no \ + use-upnp=no set *FFFFFFFE local-address=172.16.91.254 remote-address=sstp /queue type add kind=fq-codel name=FQ_Codel @@ -345,7 +351,7 @@ set ether6-culleoka-11ghz queue=FQ_Codel set ether7-380tower queue=FQ_Codel set sfp-sfpplus1-edge-preseem queue=FQ_Codel /routing bgp instance -add as=65530 name=bgp-instance-1 router-id=10.254.254.253 +add as=393837 name=bgp-instance-1 router-id=10.254.254.253 /routing bgp template set default as=65530 disabled=no /routing id @@ -353,11 +359,8 @@ add disabled=no id=10.254.254.253 name=id-1 select-dynamic-id="" /routing ospf instance add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\ ospf-out redistribute=connected,static router-id=id-1 routing-table=main -add disabled=no name=default-v3 redistribute=connected,static router-id=id-1 \ - routing-table=main version=3 /routing ospf area add disabled=no instance=default-v2 name=backbone-v2 -add disabled=no instance=default-v3 name=backbone-v3 /routing table add fib name=testnat /snmp community @@ -369,14 +372,19 @@ add name=logs remote=204.110.191.229 remote-port=1514 src-address=\ /ip smb set enabled=no /ip firewall connection tracking +# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings set tcp-established-timeout=4h tcp-fin-wait-timeout=2m tcp-time-wait-timeout=\ 2m /ip neighbor discovery-settings +# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings set discover-interface-list=!dynamic /ip settings +# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings set max-neighbor-entries=8192 tcp-syncookies=yes /ipv6 settings -set max-neighbor-entries=8192 soft-max-neighbor-entries=8191 +# ipv6 *accept router advertisements* configuration has changed, please restart device to apply settings +set accept-router-advertisements=no max-neighbor-entries=8192 \ + soft-max-neighbor-entries=8191 /interface pppoe-server server add authentication=mschap2 default-profile=380 disabled=no interface=\ combo1-380 max-mru=1492 max-mtu=1492 service-name=380 @@ -465,6 +473,17 @@ add dst-address=10.250.1.144/29 gateway=10.250.1.94 add dst-address=10.254.254.111/32 gateway=10.250.1.94 add dst-address=100.64.160.0/20 gateway=10.250.1.94 add dst-address=204.110.188.64/27 gateway=10.250.1.94 +/ipv6 route +add comment="default via preseem (primary)" distance=1 dst-address=::/0 \ + gateway=2606:1c80:0:1002::1 +add comment="default via direct (backup)" distance=2 dst-address=::/0 \ + gateway=2606:1c80:0:11::1 +add comment="edge loopback via preseem" distance=1 dst-address=\ + 2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 +add comment="edge loopback via direct" distance=2 dst-address=\ + 2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 +add blackhole comment="core /44 aggregate (iBGP origin)" distance=200 \ + dst-address=2606:1c80:1400::/44 /ip service set ftp disabled=yes set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes @@ -476,12 +495,46 @@ set api-ssl certificate=myCa /ip ssh set host-key-type=ed25519 password-authentication=yes strong-crypto=yes /ipv6 address -add address=2606:1c80:0:1000::1 disabled=yes interface=ether5-climax -add address=2606:1c80:0:1001::1 disabled=yes interface=ether4-newhope -add address=2606:1c80:0:1002::2 disabled=yes interface=\ +add address=2606:1c80:0:10::253/128 advertise=no comment=loopback interface=\ + lo +add address=2606:1c80:0:11::2 advertise=no comment=\ + "P2P core<->edge direct (backup)" interface=ether3-edge-direct +add address=2606:1c80:0:1002::2 advertise=no comment=\ + "P2P core<->edge via preseem (primary)" interface=\ sfp-sfpplus1-edge-preseem +add address=2606:1c80:0:12::1 advertise=no comment="P2P core<->climax" \ + interface=ether5-climax +add address=2606:1c80:0:13::1 advertise=no comment="P2P core<->newhope" \ + interface=ether4-newhope +add address=2606:1c80:0:14::1 advertise=no comment="P2P core<->982 60GHz" \ + interface=ether1-982-60ghz +add address=2606:1c80:0:15::1 advertise=no comment="P2P core<->culleoka" \ + interface=ether6-culleoka-11ghz +add address=2606:1c80:1400::1 comment="380 mgmt LAN" interface=vlan10_combo1 +/ipv6 dhcp-server +add interface=vlan10_combo1 name=core-mgmt-stateless +/ipv6 firewall filter +add action=accept chain=input comment=established connection-state=\ + established,related +add action=drop chain=input comment=invalid connection-state=invalid +add action=accept chain=input comment=icmpv6 protocol=icmpv6 +add action=accept chain=input comment=link-local src-address=fe80::/10 +add action=accept chain=input comment=internal src-address=2606:1c80::/32 +add action=drop chain=input comment="default deny" +add action=accept chain=forward comment=established connection-state=\ + established,related +add action=drop chain=forward comment=invalid connection-state=invalid +add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\ + icmpv6 +add action=accept chain=forward comment=icmpv6 protocol=icmpv6 +add action=accept chain=forward comment=internal-to-internal dst-address=\ + 2606:1c80::/32 src-address=2606:1c80::/32 +add action=accept chain=forward comment="v6 outbound from 380 tower" \ + src-address=2606:1c80:1400::/44 +add action=drop chain=forward comment="default deny" /ipv6 nd set [ find default=yes ] advertise-dns=yes +add advertise-dns=yes interface=vlan10_combo1 other-configuration=yes /mpls interface add interface=ether5-climax mpls-mtu=1508 add interface=ether6-culleoka-11ghz mpls-mtu=1508 @@ -507,18 +560,22 @@ add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\ /routing bfd configuration add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5 /routing bgp connection -add disabled=yes instance=bgp-instance-1 local.role=ibgp name=climax \ - remote.address=10.250.1.94/32 routing-table=main templates=default +add afi=ip,ipv6 comment="iBGP to edge, v4 transport / v6 NLRI" instance=\ + bgp-instance-1 local.address=10.254.254.253 .role=ibgp multihop=yes name=\ + ibgp-edge-v6 nexthop-choice=force-self output.filter-chain=v6-ibgp-out \ + remote.address=10.254.254.254 .as=393837 templates=default /routing filter rule add chain=ospf-in disabled=no rule="accept;" add chain=ospf-out disabled=no rule="accept;" +add chain=v6-ibgp-out disabled=no rule=\ + "if (dst==2606:1c80:1400::/44) { accept; } else { reject; }" /routing ospf interface-template add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=\ sfp-sfpplus1-edge-preseem priority=1 type=ptp use-bfd=yes add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\ - ether5-climax priority=1 type=ptp use-bfd=yes + ether5-climax priority=1 type=ptp use-bfd=no add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\ - ether4-newhope priority=1 type=ptp use-bfd=yes + ether4-newhope priority=1 type=ptp use-bfd=no add area=backbone-v2 auth-id=1 cost=100 disabled=no interfaces=\ ether3-edge-direct priority=1 type=ptp use-bfd=yes add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=ether2-office \ @@ -526,16 +583,7 @@ add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=ether2-office \ add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=\ ether1-982-60ghz priority=1 type=ptp use-bfd=no add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\ - ether6-culleoka-11ghz priority=1 type=ptp use-bfd=yes -add area=backbone-v3 cost=10 disabled=no priority=1 use-bfd=no -add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\ - ether4-newhope type=ptp -add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\ - ether1-982-60ghz type=ptp -add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\ - ether5-climax type=ptp -add area=backbone-v3 auth=sha512 auth-id=1 disabled=yes interfaces=\ - ether6-culleoka-11ghz type=ptp + ether6-culleoka-11ghz priority=1 type=ptp use-bfd=no /routing ospf static-neighbor add address=204.110.191.186%sfp-sfpplus1-edge-preseem area=backbone-v2 \ disabled=no diff --git a/mikrotik-tool/culleoka.rsc b/mikrotik-tool/culleoka.rsc index 40b53bb..5556297 100644 --- a/mikrotik-tool/culleoka.rsc +++ b/mikrotik-tool/culleoka.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:26:03 by RouterOS 7.21.4 +# 2026-05-09 09:30:35 by RouterOS 7.21.4 # software id = HVP9-3G0K # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/edge.rsc b/mikrotik-tool/edge.rsc index be3ab0d..26e2673 100644 --- a/mikrotik-tool/edge.rsc +++ b/mikrotik-tool/edge.rsc @@ -1,4 +1,4 @@ -# may/09/2026 09:26:02 by RouterOS 6.49.18 +# may/09/2026 09:30:34 by RouterOS 6.49.18 # software id = 8XZE-R7EJ # # model = CCR2004-1G-12S+2XS diff --git a/mikrotik-tool/lowry.rsc b/mikrotik-tool/lowry.rsc index b0bb0b0..bb52aba 100644 --- a/mikrotik-tool/lowry.rsc +++ b/mikrotik-tool/lowry.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:26:03 by RouterOS 7.21.4 +# 2026-05-09 09:30:35 by RouterOS 7.21.4 # software id = 2I9X-PQZP # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/newhope.rsc b/mikrotik-tool/newhope.rsc index 3a769b2..57d58ff 100644 --- a/mikrotik-tool/newhope.rsc +++ b/mikrotik-tool/newhope.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:26:03 by RouterOS 7.21.4 +# 2026-05-09 09:30:35 by RouterOS 7.21.4 # software id = 5HTF-YFWV # # model = CCR1009-7G-1C-1S+ diff --git a/mikrotik-tool/routers.yaml b/mikrotik-tool/routers.yaml index 8c4e7b7..790311a 100644 --- a/mikrotik-tool/routers.yaml +++ b/mikrotik-tool/routers.yaml @@ -31,3 +31,5 @@ routers: host: 10.254.254.253 - name: edge host: 10.254.254.254 + - name: home + host: 10.0.19.254 diff --git a/mikrotik-tool/verona.rsc b/mikrotik-tool/verona.rsc index 14a2b79..909ad1a 100644 --- a/mikrotik-tool/verona.rsc +++ b/mikrotik-tool/verona.rsc @@ -1,4 +1,4 @@ -# 2026-05-09 09:26:02 by RouterOS 7.21.4 +# 2026-05-09 09:30:35 by RouterOS 7.21.4 # software id = Y1CT-1WB1 # # model = CCR2004-16G-2S+ @@ -923,7 +923,7 @@ set host-key-type=ed25519 password-authentication=yes strong-crypto=yes /ipv6 address add address=2606:1c80:0:10::101/128 advertise=no comment=loopback interface=\ lo -add address=2606:1c80:0:20::1/127 advertise=no comment="P2P verona<->climax" \ +add address=2606:1c80:0:20::1 advertise=no comment="P2P verona<->climax" \ interface=ether3-climax-11ghz add address=2606:1c80:1000::1 comment="verona mgmt LAN" interface=verona add address=2606:1c80:1500::1 comment="altoga mgmt LAN" interface=\