# 2026-05-09 21:18:17 by RouterOS 7.21.4
# software id = K4QG-8NQV
#
# model = RB5009UG+S+
# serial number = HC907K5P55K
/interface bridge
add name=494 port-cost-mode=short
add name=management port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] comment=ether1 l2mtu=1580
set [ find default-name=ether2 ] comment=ether2 l2mtu=1580 name=ether2-climax
set [ find default-name=ether3 ] comment=ether3 l2mtu=1580
set [ find default-name=ether4 ] comment=ether4 l2mtu=1580
set [ find default-name=ether5 ] comment=ether5 l2mtu=1580
set [ find default-name=ether6 ] comment=ether6 l2mtu=1580
set [ find default-name=ether7 ] comment=ether7 l2mtu=1580
set [ find default-name=ether8 ] comment=ether8 l2mtu=1580
set [ find default-name=sfp-sfpplus1 ] l2mtu=1580
/interface vlan
add interface=ether5 name=vlan10_ether5 vlan-id=10
add interface=ether6 name=vlan10_ether6 vlan-id=10
add interface=ether7 name=vlan10_ether7 vlan-id=10
add interface=ether8 name=vlan10_ether8 vlan-id=10
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=\
    aes-256-cbc,aes-128-cbc pfs-group=modp2048
/ip pool
add name=cgnat ranges=100.64.160.1-100.64.174.254
add name=public ranges=204.110.188.65-204.110.188.93
/ip dhcp-server
add add-arp=yes address-pool=cgnat interface=494 lease-script="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
    c24944-c947-4e01-9c54-07a1653d2e3e\"\
    \n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
    \n:local max 1\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n  :if (\$leaseBound = 0) do {\
    \n    # Try url2 (iptrack.vntx.net) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
    t for \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
    on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    # Try url (gaiia) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
    or \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
    attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 3s;\
    \n    }\
    \n  } else {\
    \n    :delay 1s;\
    \n    :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
    seActIP] agent-remote-id];\
    \n\
    \n    # Try url2 (iptrack.vntx.net) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
    for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
    \_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
    ;\
    \n    }\
    \n\
    \n    # Try url (gaiia) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP assignment successfully sent to gaiia AWS API for\
    \_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
    tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 30s;\
    \n    }\
    \n  }\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" lease-time=1h name=dhcp1
/ip pool
add name=mgmt next-pool=public ranges=10.10.160.1-10.10.174.254
/ip dhcp-server
add add-arp=yes address-pool=mgmt interface=management lease-script="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
    c24944-c947-4e01-9c54-07a1653d2e3e\"\
    \n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
    \n:local max 1\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n  :if (\$leaseBound = 0) do {\
    \n    # Try url2 (iptrack.vntx.net) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
    t for \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
    on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    # Try url (gaiia) - deassignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
    or \$leaseActMAC / \$leaseActIP\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
    attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 3s;\
    \n    }\
    \n  } else {\
    \n    :delay 1s;\
    \n    :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
    seActIP] agent-remote-id];\
    \n\
    \n    # Try url2 (iptrack.vntx.net) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
    t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success1 1;\
    \n      :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
    for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
    \_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
    ;\
    \n    }\
    \n\
    \n    # Try url (gaiia) - assignment\
    \n    :do {\
    \n      /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
    \_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
    und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
    \\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
    \\\":\\\"\$remoteID\\\"}\"\
    \n      :set success2 1;\
    \n      :log info \"DHCP assignment successfully sent to gaiia AWS API for\
    \_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    } on-error={\
    \n      :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
    tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
    \n    }\
    \n\
    \n    :if (\$success1 != 1 || \$success2 != 1) do={\
    \n      :delay 30s;\
    \n    }\
    \n  }\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" lease-time=1h name=dhcp2
/ip smb users
set [ find default=yes ] disabled=yes
/ipv6 dhcp-server option
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
/ipv6 pool
add name=494-cust-pd-1 prefix=2606:1c80:1a01::/48 prefix-length=56
/ppp profile
set *0 dns-server=204.110.191.240,204.110.191.250 local-address=\
    204.110.188.94 remote-address=public use-upnp=no
add change-tcp-mss=yes dhcpv6-pd-pool=494-cust-pd-1 dns-server=\
    204.110.191.240,204.110.191.20 local-address=100.64.175.254 name=494 \
    on-down="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
    7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
    \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
    \n:local max 1\
    \n\
    \n:local localAddr \$\"local-address\"\
    \n:local remoteAddr \$\"remote-address\"\
    \n:local callerId \$\"caller-id\"\
    \n:local calledId \$\"called-id\"\
    \n:local interfaceName [/interface get \$interface name]\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n\
    \n  # Try url2 (iptrack.vntx.net)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
    http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
    d\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
    \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success1 1;\
    \n    :log info \"PPPoE deassignment successfully sent to iptrack.vntx.net\
    \_for \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send deassignment to iptrack.vntx.net o\
    n attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  # Try url (AWS API)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
    ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
    \\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
    \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success2 1;\
    \n    :log info \"PPPoE deassignment successfully sent to gaiia AWS API fo\
    r \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoPoE FAILED to send deassignment to gaiia AWS API on\
    \_attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  } else {\
    \n    :delay 3s;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" on-up="{\
    \n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
    uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
    7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
    \n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
    \n:local max 5\
    \n\
    \n:local localAddr \$\"local-address\"\
    \n:local remoteAddr \$\"remote-address\"\
    \n:local callerId \$\"caller-id\"\
    \n:local calledId \$\"called-id\"\
    \n:local interfaceName [/interface get \$interface name]\
    \n\
    \n:local attempts 0\
    \n:local success1 0\
    \n:local success2 0\
    \n:do {\
    \n  :set attempts (\$attempts+1);\
    \n\
    \n  # Try url2 (iptrack.vntx.net)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
    http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
    d\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
    \\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success1 1;\
    \n    :log info \"PPPoE assignment successfully sent to iptrack.vntx.net f\
    or \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send assignment to iptrack.vntx.net on \
    attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  # Try url (gaiia)\
    \n  :do {\
    \n    /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
    ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
    \\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
    \"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
    \n    :set success2 1;\
    \n    :log info \"PPPoE assignment successfully sent to gaiia AWS API for \
    \$user / \$remoteAddr\";\
    \n  } on-error={\
    \n    :log error \"PPPoE FAILED to send assignment to gaiia AWS API on att\
    empt \$attempts out of \$max for \$user / \$remoteAddr\";\
    \n  }\
    \n\
    \n  :if (\$success1 = 1 && \$success2 = 1) do {\
    \n    :set attempts \$max;\
    \n  } else {\
    \n    :delay 3s;\
    \n  }\
    \n} while ( \$attempts < \$max )\
    \n}\
    \n" remote-address=cgnat remote-ipv6-prefix-pool=494-cust-pd-1 use-upnp=\
    no
/queue type
add kind=fq-codel name=fq-codel
/queue interface
set ether1 queue=fq-codel
set ether2-climax queue=fq-codel
set ether3 queue=fq-codel
set ether4 queue=fq-codel
set ether5 queue=fq-codel
set ether6 queue=fq-codel
set ether7 queue=fq-codel
set ether8 queue=fq-codel
set sfp-sfpplus1 queue=fq-codel
/routing bgp instance
add as=393837 name=bgp-instance-1 router-id=10.254.254.111
add as=393837 name=bgp-instance-1 router-id=10.254.254.111
/routing id
add disabled=no id=10.254.254.111 name=id-1 select-dynamic-id=any \
    select-from-vrf=main
/routing ospf instance
add disabled=no in-filter-chain=ospf-in name=ospf-instance-1 \
    originate-default=never out-filter-chain=ospf-out router-id=id-1
/routing ospf area
add disabled=no instance=ospf-instance-1 name=ospf-area-1
/snmp community
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
    kdyyJrT0Mm
/system logging action
add name=logs remote=204.110.191.229 target=remote
/interface bridge port
add bridge=494 interface=ether8 internal-path-cost=10 path-cost=10
add bridge=494 interface=ether7 internal-path-cost=10 path-cost=10
add bridge=494 interface=ether6 internal-path-cost=10 path-cost=10
add bridge=494 interface=ether5 internal-path-cost=10 path-cost=10
add bridge=management interface=vlan10_ether5 internal-path-cost=10 \
    path-cost=10
add bridge=management interface=vlan10_ether6 internal-path-cost=10 \
    path-cost=10
add bridge=management interface=vlan10_ether7 internal-path-cost=10 \
    path-cost=10
add bridge=management interface=vlan10_ether8 internal-path-cost=10 \
    path-cost=10
/ip firewall connection tracking
set icmp-timeout=30s tcp-close-wait-timeout=1m tcp-established-timeout=4h \
    tcp-fin-wait-timeout=2m tcp-last-ack-timeout=30s \
    tcp-syn-received-timeout=1m tcp-syn-sent-timeout=2m \
    tcp-time-wait-timeout=2m udp-stream-timeout=2m
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ip settings
set tcp-syncookies=yes
/ipv6 settings
set accept-router-advertisements=no
/interface pppoe-server server
add default-profile=494 disabled=no interface=494 max-mru=1492 max-mtu=1492 \
    one-session-per-host=yes service-name=494
/ip address
add address=10.254.254.111 comment=Loopback interface=lo network=\
    10.254.254.111
add address=10.250.1.65/29 interface=ether2-climax network=10.250.1.64
add address=204.110.188.94/27 interface=494 network=204.110.188.64
add address=10.10.175.254/20 interface=management network=10.10.160.0
add address=100.64.175.254/20 interface=494 network=100.64.160.0
/ip dhcp-client
# Interface not active
add interface=ether1
# Interface not active
add interface=ether3
/ip dhcp-server lease
add address=10.10.175.10 mac-address=78:8A:20:AC:C5:32
add address=10.10.175.11 mac-address=58:C1:7A:75:4D:F2
/ip dhcp-server network
add address=10.10.160.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
    vntx.net gateway=10.10.175.254 ntp-server=204.110.191.19
add address=100.64.160.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
    vntx.net gateway=100.64.175.254 ntp-server=204.110.191.19
/ip dns
set servers=9.9.9.9,1.1.1.1
/ip firewall address-list
add address=154.66.115.255 list=CPF
add address=10.0.0.0/8 list=CPF
add address=192.168.0.0/16 list=CPF
add address=172.16.0.0/12 list=CPF
/ip firewall filter
add action=accept chain=forward comment=\
    "bypass fasttrack for MPLS spine (out)" out-interface=ether2-climax
add action=accept chain=forward comment=\
    "bypass fasttrack for MPLS spine (in)" in-interface=ether2-climax
add action=fasttrack-connection chain=forward comment=\
    "fasttrack established/related" connection-state=established,related
add action=drop chain=forward src-address-list=suspended
add action=drop chain=forward dst-address-list=suspended
add action=drop chain=forward dst-port=23 protocol=tcp
add action=accept chain=forward comment="accept established/related" \
    connection-state=established,related
/ip ipsec profile
set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
    dpd-maximum-failures=5 enc-algorithm=aes-256,aes-128 hash-algorithm=\
    sha256
/ip proxy
set port=43133
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\
    10.250.1.70%ether2-climax pref-src="" routing-table=main scope=30 \
    target-scope=10
/ipv6 route
add comment="default via climax" distance=1 dst-address=::/0 gateway=\
    2606:1c80:0:17::1
add comment="core loopback (iBGP bootstrap, via climax)" distance=1 \
    dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:17::1
add comment="edge loopback (via climax)" distance=1 dst-address=\
    2606:1c80:0:10::254/128 gateway=2606:1c80:0:17::1
add blackhole comment="494 /44 aggregate (iBGP origin)" distance=200 \
    dst-address=2606:1c80:1a00::/44
/ip service
set ftp address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set www address=204.110.188.0/22,10.0.0.0/8 disabled=yes
set www-ssl address=204.110.188.0/22,10.0.0.0/8
set ssh address=204.110.188.0/22,10.0.0.0/8 port=1022
set winbox address=204.110.188.0/22,10.0.0.0/8
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
set api-ssl address=0.0.0.0/0 certificate=myCa
/ip ssh
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
/ipv6 address
add address=2606:1c80:0:10::111/128 advertise=no comment=loopback interface=\
    lo
add address=2606:1c80:0:17::2 advertise=no comment="P2P 494<->climax" \
    interface=ether2-climax
add address=2606:1c80:1a00::1 comment="494 mgmt LAN" interface=management
/ipv6 dhcp-server
add interface=management name=494-mgmt-stateless
/ipv6 firewall filter
add action=accept chain=input comment=established connection-state=\
    established,related
add action=drop chain=input comment=invalid connection-state=invalid
add action=accept chain=input comment=icmpv6 protocol=icmpv6
add action=accept chain=input comment=link-local src-address=fe80::/10
add action=accept chain=input comment=internal src-address=2606:1c80::/32
add action=drop chain=input comment="default deny"
add action=accept chain=forward comment=established connection-state=\
    established,related
add action=drop chain=forward comment=invalid connection-state=invalid
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
    icmpv6
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
add action=accept chain=forward comment=internal-to-internal dst-address=\
    2606:1c80::/32 src-address=2606:1c80::/32
add action=accept chain=forward comment="v6 outbound from 494 customers" \
    src-address=2606:1c80:1a00::/44
add action=drop chain=forward comment="default deny"
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
add advertise-dns=yes interface=management other-configuration=yes
/ipv6 nd prefix
add interface=management prefix=2606:1c80:1a00::/64
/mpls interface
add interface=ether2-climax mpls-mtu=1508
/mpls ldp
add disabled=no lsr-id=10.254.254.111 transport-addresses=10.254.254.111 vrf=\
    main
/mpls ldp interface
add interface=ether2-climax
/mpls settings
set propagate-ttl=no
/ppp aaa
set interim-update=15m use-radius=yes
/radius
add address=204.110.191.248 require-message-auth=no service=ppp src-address=\
    204.110.188.94 timeout=300ms
add address=204.110.191.2 require-message-auth=no service=ppp src-address=\
    204.110.188.94 timeout=300ms
add accounting-backup=yes address=45.76.56.5 disabled=yes \
    require-message-auth=no service=ppp src-address=204.110.188.94 timeout=\
    300ms
/routing bfd configuration
add disabled=no interfaces=ether2-climax min-rx=200ms min-tx=200ms \
    multiplier=5 vrf=main
/routing bgp connection
add afi=ip,ipv6 comment="iBGP to core (v6 RR), v6 transport" instance=\
    bgp-instance-1 local.address=2606:1c80:0:10::111 .role=ibgp multihop=yes \
    name=ibgp-rr-core nexthop-choice=force-self output.filter-chain=\
    v6-ibgp-out .redistribute=connected,static remote.address=\
    2606:1c80:0:10::253 .as=393837 templates=default
/routing filter rule
add chain=ospf-in disabled=no rule="accept;\r\
    \n"
add chain=ospf-out disabled=no rule="accept;"
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2\
    606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { acc\
    ept; } else { reject; }"
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1A00::/44 || dst==2\
    606:1c80:0:10::111/128 || (dst-len==64 && dst==2606:1c80:0:17::/64)) { acc\
    ept; } else { reject; }"
/routing ospf interface-template
add area=ospf-area-1 auth=sha512 auth-id=1 disabled=no interfaces=\
    ether2-climax type=ptp use-bfd=no
add area=ospf-area-1 disabled=no passive
/routing ospf static-neighbor
add address=10.250.1.70%ether2-climax area=ospf-area-1 disabled=no \
    poll-interval=10s
/snmp
set contact=graham@vntx.net enabled=yes location="33.208204, -96.462530"
/system identity
set name=494
/system logging
add action=logs prefix=test1 topics=system,info
add action=logs prefix=test1 topics=warning
add action=logs prefix=test1 topics=critical
add action=logs prefix=test1 topics=error,!ospf,!route
/system ntp client
set enabled=yes
/system ntp client servers
add address=ntp.vntx.net
add address=0.us.pool.ntp.org
/system package update
set channel=long-term
/system routerboard settings
set auto-upgrade=yes
/system scheduler
add name=reboot on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=2025-02-16 start-time=03:40:00