# =============================================================================
# 494 — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
# =============================================================================
#
# 494 is a leaf tower. Single backbone P2P:
#   * climax (north) — ether2-climax (AF11), v6 P2P 2606:1c80:0:17::/64 (494 .2)
# Default upstream toward climax via :17::1 — climax forwards to core.
#
# Loopback: 2606:1c80:0:10::111/128
# /44 customer aggregate: 2606:1c80:1A00::/44
# Mgmt LAN: 2606:1c80:1A00::1/64 (assumes `mgmt` bridge — verify name first).
# PPPoE profile assumed `pppoe`. Customer interface-list assumed `customer`.
# =============================================================================

# -----------------------------------------------------------------------------
# WIPE
# -----------------------------------------------------------------------------
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
/ipv6 dhcp-server remove [find]
/ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find]
/ipv6 nd prefix remove [find]
/ipv6 nd remove [find default=no]
/ipv6 pool remove [find]
/ipv6 route remove [find dynamic=no]
/ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find]
/ipv6 address remove [find dynamic=no]

/routing ospf interface-template remove [find area=backbone-v3]
/routing ospf area remove [find name=backbone-v3]
/routing ospf instance remove [find name=default-v3]

/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]

# -----------------------------------------------------------------------------
# APPLY — BGP instance
# -----------------------------------------------------------------------------
/routing bgp template set [find name=default] disabled=no

/routing bgp instance
add name=bgp-instance-1 as=393837 router-id=10.254.254.111

# -----------------------------------------------------------------------------
# APPLY — addresses
# -----------------------------------------------------------------------------
/ipv6 settings set forward=yes accept-router-advertisements=no

/ipv6 address
add address=2606:1c80:0:10::111/128 interface=lo               advertise=no  comment="loopback"
add address=2606:1c80:0:17::2/64    interface=ether2-climax    advertise=no  comment="P2P 494<->climax"
add address=2606:1c80:1A00::1/64    interface=management             advertise=yes comment="494 mgmt LAN"

# -----------------------------------------------------------------------------
# APPLY — static routes
# -----------------------------------------------------------------------------
/ipv6 route
add dst-address=::/0                    gateway=2606:1c80:0:17::1 distance=1   comment="default via climax"
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:17::1 distance=1   comment="core loopback (iBGP bootstrap, via climax)"
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:17::1 distance=1   comment="edge loopback (via climax)"
add dst-address=2606:1c80:1A00::/44 blackhole distance=200 comment="494 /44 aggregate (iBGP origin)"

# -----------------------------------------------------------------------------
# APPLY — neighbour discovery on the mgmt LAN
# -----------------------------------------------------------------------------
/ipv6 nd
add interface=management ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes

/ipv6 nd prefix
add interface=management prefix=2606:1c80:1A00::/64 autonomous=yes on-link=yes

/ipv6 dhcp-server
add interface=management name=494-mgmt-stateless address-pool=static-only

/ipv6 dhcp-server option
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"

# -----------------------------------------------------------------------------
# APPLY — customer PD pool + bind to PPPoE profile
# -----------------------------------------------------------------------------
/ipv6 pool
add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56

/ppp profile
set [find name=494] remote-ipv6-prefix-pool=494-cust-pd-1 dhcpv6-pd-pool=494-cust-pd-1

# -----------------------------------------------------------------------------
# APPLY — firewall
# -----------------------------------------------------------------------------
/ipv6 firewall filter
add chain=input action=accept connection-state=established,related comment="established"
add chain=input action=drop   connection-state=invalid             comment="invalid"
add chain=input action=accept protocol=icmpv6                      comment="icmpv6"
add chain=input action=accept src-address=fe80::/10                comment="link-local"
add chain=input action=accept src-address=2606:1c80::/32           comment="internal"
add chain=input action=drop                                        comment="default deny"

add chain=forward action=accept connection-state=established,related              comment="established"
add chain=forward action=drop   connection-state=invalid                          comment="invalid"
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1                 comment="PMTUD"
add chain=forward action=accept protocol=icmpv6                                   comment="icmpv6"
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
add chain=forward action=accept src-address=2606:1c80:1A00::/44                   comment="v6 outbound from 494 customers"
add chain=forward action=drop                                                     comment="default deny"

# -----------------------------------------------------------------------------
# APPLY — iBGP to core (v6 RR)
# -----------------------------------------------------------------------------
/routing filter rule
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { accept; } else { reject; }"

/routing bgp connection
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
    afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::111 \
    remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
    nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
    output.redistribute=connected,static \
    comment="iBGP to core (v6 RR), v6 transport"