graham/network
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
network/mikrotik-tool/ipv6.md
Graham McIntire bde0beae11
routers update
2026-05-14 09:38:11 -05:00

851 lines
35 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

# IPv6 addressing plan — vntx WISP
**Status:** greenfield design. Any existing IPv6 on the routers (verona /40 PD
pool, climax/culleoka /52s, scattered point-to-point /128s, etc.) is to be
**deleted and replaced** with what's defined here. Don't try to migrate it.
**Allocation:** `2606:1c80::/32` (already advertised to TWC AS11427 from
`edge`, peer `2605:6000:0:8::f:372`).
**Customer prefix:** **`/56`** per PPPoE session via DHCPv6-PD. A /56 lets
customer CPE subnet into 256 /64s (LAN, guest, IoT, VPN, etc.) — the
operationally sane default that matches RIPE-690 / BCOP-690 guidance.
Customer CPE that only knows /64 still works fine — RouterOS hands out
the /56 and the CPE configures the first /64 from it. No NAT66.
---
## Top-level carve
`2606:1c80::/32` is sliced into two purposes:
| Block | Size | Purpose |
|-------------------------------|-------|--------------------------------------|
| `2606:1c80::/48` | /48 | **Infrastructure** — loopbacks, P2P, transit |
| `2606:1c80:1::/48` – `2606:1c80:FFF::/48` | (reserved) | extra infra room |
| `2606:1c80:1000::/36` | /36 | **Tower allocations** — one **/44** per tower |
| `2606:1c80:2000::/36` and higher | bulk | reserved (future expansion) |
The tower block `2606:1c80:1000::/36` holds **256 /44s** (4 096 /44s
fits in a /32 minus the infra pad). At one /44 per tower, that's 256
towers worth of allocations — far more than you'll ever build.
Why /44 per tower? Each /44 = 16 /48s = **4 096 /56s**. Subtract one /48
for tower infra (mgmt, APs, etc.) and you have **3 840 /56 customers per
tower**, comfortably above the ~4 000-IP v4 CGNAT capacity per tower.
---
## Infrastructure block — `2606:1c80::/48`
Subdivided into /64s, indexed by purpose. Servers get the prime
all-zeros /64 so their addresses are as short as the allocation allows;
loopbacks and P2P links shift down to make room.
| Prefix | Use |
|-----------------------------------------|--------------------------------------------------|
| `2606:1c80::/64` | **Core servers** — DNS, NTP, monitoring, billing, internal services (static-only, no SLAAC). Lives at 380 (core); see below. |
| `2606:1c80:0:1::/64` … `:F::/64` | reserved server expansion (DMZ, hypervisor mgmt, alt server VLANs) |
| `2606:1c80:0:10::/64` | **Loopbacks** — one `/128` per router |
| `2606:1c80:0:11::/64` … `:1F::/64` | **Wired backbone P2P links** — one `/64` per link, both ends addressed `/64` |
| `2606:1c80:0:20::/64` … `:FF::/64` | **Wireless backhaul P2P links** — one `/64` per link, both ends addressed `/64` |
| `2606:1c80:0:1000::/64` | Edge↔TWC transit (already `2605:6000:…` upstream; this slot is for future v6 transit/IX) |
| `2606:1c80:0:1001::/64` | Edge↔Spectrum / secondary upstream |
| `2606:1c80:0:1002::/64` | Edge↔Preseem (shaper) |
| `2606:1c80:0:2000::/64` … `:2FFF::/64` | OOB / mgmt-VLAN-of-routers (one /64 per site, optional) |
| `2606:1c80:0:F000::/64` and up | reserved (future infra) |
### Servers — `2606:1c80::/64`
The single server LAN for the entire network, located at the **380**
site and hosted on the **edge** router (the server switch is plugged
into edge's `sfp-sfpplus8-server-switch` port, VLAN 9, same as the
existing v4 server LAN on `vlan9_sfpplus8`). Gateway:
**`2606:1c80::1/64`**. RA is **disabled** — servers get static
addresses, not SLAAC. Stateful DHCPv6 is optional; prefer static config
for server-class hosts.
Suggested numbering mirrors the v4 `204.110.191.X` last-octet so the
two are easy to translate by sight:
| v4 host | v6 host | Role |
|---------------------|----------------------|-------------------------|
| `204.110.191.20` | `2606:1c80::20` | DNS resolver (primary) |
| `204.110.191.240` | `2606:1c80::240` | DNS resolver (secondary) |
| `204.110.191.250` | `2606:1c80::250` | DNS resolver (tertiary) |
| `204.110.191.19` | `2606:1c80::19` | NTP |
`2606:1c80:0:1::/64` through `:F::/64` are reserved server expansion
slots (DMZ, hypervisor mgmt, alternate server VLANs) — populate them
only when there's a concrete need.
### Loopbacks (`2606:1c80:0:10::/64`)
One `/128` per router, all inside `2606:1c80:0:10::/64`. To keep the v6
loopback visually parallel to the v4 loopback (`10.254.254.X`), encode
the v4 last octet as the **last hextet, treated as hex** (so
`:10::101` is the v6 loopback for the router whose v4 loopback is
`10.254.254.101`). Visual mnemonic, not a numeric identity.
| Router | v4 loopback | v6 loopback |
|-----------|-----------------|--------------------------|
| verona | 10.254.254.101 | `2606:1c80:0:10::101/128` |
| climax | 10.254.254.102 | `2606:1c80:0:10::102/128` |
| culleoka | 10.254.254.104 | `2606:1c80:0:10::104/128` |
| newhope | 10.254.254.108 | `2606:1c80:0:10::108/128` |
| lowry | 10.254.254.109 | `2606:1c80:0:10::109/128` |
| 982 | 10.254.254.110 | `2606:1c80:0:10::110/128` |
| 494 | 10.254.254.111 | `2606:1c80:0:10::111/128` |
| core | 10.254.254.253 | `2606:1c80:0:10::253/128` |
| edge | 10.254.254.254 | `2606:1c80:0:10::254/128` |
Loopbacks announce into OSPFv3 only.
### Inter-router P2P links (`2606:1c80:0:11::/64` … `:FF::/64`)
One `/64` per physical/logical link, with both ends addressed `/64` (avoid `/127` —
picking `::1/127` and `::2/127` puts the two ends in *different* /127 networks
since `::1` and `::2` straddle the /127 boundary; verified live 2026-05-09). The
two
ends. Numbering follows the existing v4 `/29` transport scheme.
Wired/fiber transport uses `:11::`–`:1F::`; wireless backhaul uses
`:20::`+. (`:10::/64` is the loopback /64.)
| Link | v4 /29 | v6 /64 | Endpoints (`/64`) |
|----------------------------|---------------------|-------------------------|---------------------------------------------|
| edge ↔ core (sfpplus7) | 204.110.191.180/30 | `2606:1c80:0:11::/64` | `…:11::1` edge / `…:11::2` core |
| core ↔ climax (ether5) | 10.250.1.88/29 | `2606:1c80:0:12::/64` | `…:12::1` core / `…:12::2` climax |
| core ↔ newhope (ether4) | 10.250.1.56/29 | `2606:1c80:0:13::/64` | `…:13::1` core / `…:13::2` newhope |
| core ↔ 982 (ether1) | 10.250.1.32/29 | `2606:1c80:0:14::/64` | `…:14::1` core / `…:14::2` 982 |
| core ↔ culleoka (ether6) | 10.250.1.48/29 | `2606:1c80:0:15::/64` | `…:15::1` core / `…:15::2` culleoka |
| verona ↔ climax (11 GHz) | (existing v6 in use)| `2606:1c80:0:20::/64` | `…:20::1` verona / `…:20::2` climax |
| climax ↔ culleoka (11 GHz) | — | `2606:1c80:0:21::/64` | `…:21::1` climax / `…:21::2` culleoka |
| climax ↔ 494 (ether5) | 10.250.1.64/29 | `2606:1c80:0:17::/64` | `…:17::1` climax / `…:17::2` 494 |
| newhope ↔ lowry (ether6) | 10.250.1.104/29 | `2606:1c80:0:18::/64` | `…:18::1` newhope / `…:18::2` lowry |
Pick the next free `:NN::/64` (wired in `:11::`–`:1F::`, wireless in
`:20::`+) when adding a link; record it here.
The existing `2606:1c80:0:1010::/64` and `2606:1c80:0:0010::/64` get
**deleted** and replaced with `:20::` and `:21::` respectively (note
that the new `:10::/64` slot is now the loopback /64, not a P2P link).
---
## Tower block — `2606:1c80:1000::/36`
One **`/44`** per tower. The third hextet of the /44 encodes the v4
mgmt /20's third octet as `1<oct-hex>0`, so you can map between v4 and
v6 by sight:
| Tower | v4 mgmt | v4 third oct (hex) | v6 /44 | Inverse mnemonic |
|------------|------------------|--------------------|-------------------------|------------------|
| verona | 10.10.0.0/20 | 0 (`0x00`) | `2606:1c80:1000::/44` | `100` |
| climax | 10.10.16.0/20 | 16 (`0x10`) | `2606:1c80:1100::/44` | `110` |
| 982 | 10.10.48.0/20 | 48 (`0x30`) | `2606:1c80:1300::/44` | `130` |
| core (380) | 10.10.64.0/20 | 64 (`0x40`) | `2606:1c80:1400::/44` | `140` |
| altoga | 10.10.80.0/20 | 80 (`0x50`) | `2606:1c80:1500::/44` | `150` |
| culleoka | 10.10.96.0/20 | 96 (`0x60`) | `2606:1c80:1600::/44` | `160` |
| newhope | 10.10.128.0/20 | 128 (`0x80`) | `2606:1c80:1800::/44` | `180` |
| lowry | 10.10.144.0/20 | 144 (`0x90`) | `2606:1c80:1900::/44` | `190` |
| 494 | 10.10.160.0/20 | 160 (`0xA0`) | `2606:1c80:1A00::/44` | `1A0` |
Slots not in the table (`2606:1c80:1010::/44`, `:1020::/44`, `:1200::/44`,
…) are **reserved**. New tower at `10.10.176.0/20` (`0xB0`) takes
`2606:1c80:1B00::/44`. Don't reuse out of band.
Altoga is logical-satellite of verona but gets its own /44 — it serves
its own customer base off `ether6-switch` on the verona router and the
v4 plan already treats it as independent. Easier to operate as a peer.
### Per-tower /44 layout
Each /44 = 16 /48s. The first /48 is tower infra; the other 15 carry
customer /56s.
| Sub-prefix | Use |
|-------------------------------------------|---------------------------------------------------------|
| `2606:1c80:NNN0::/48` | **Tower infrastructure** |
| ↳ `2606:1c80:NNN0::/64` | Router-side mgmt LAN (RA + DHCPv6 stateless) |
| ↳ `2606:1c80:NNN0:F::/64` | Access points (mirrors v4 top-`/24`-of-`/20` rule) |
| ↳ `2606:1c80:NNN0:1::/64`–`:E::/64` | reserved (extra VLANs, IoT, voice, monitoring) |
| ↳ `2606:1c80:NNN0:10::/64`–`:FF::/64` | reserved (sub-tower/repeater /64s) |
| `2606:1c80:NNN1::/48` | **Customer PD pool slot 1** — 256 × /56 |
| `2606:1c80:NNN2::/48` | Customer PD pool slot 2 — instantiate when 1 fills |
| `2606:1c80:NNN3::/48` … `2606:1c80:NNNF::/48` | Customer pool slots 3–15 (instantiate as needed) |
Servers are **not** allocated per-tower — there's a single dedicated
core-servers /64 in the infrastructure block (see below). Towers don't
host server-class hosts.
Customer capacity per tower: **15 × 256 = 3 840 /56s**.
The router itself uses `2606:1c80:NNN0::1/64` on the mgmt LAN (mirrors
the v4 `.X.254` gateway convention but moved to `::1` for v6 since
`::1` is what humans type). APs autoconfig EUI-64 inside `:NNN0:F::/64`;
when you need a known address, use `:F::1` … `:F::FF`.
**Operational note on pool growth.** Start each tower with one customer
pool (`:NNN1::/48`, prefix-length=56 → 256 /56s). When the pool drops
below ~30 free /56s, add the next one (`:NNN2::/48` → next 256 /56s) as
a second pool and assign it to the same PPP profile. RouterOS will draw
from any pool the profile references. Each pool drop is a `/ipv6 pool
add` — no PPPoE disruption.
---
## Routing
### IGP — OSPFv3
Edge already runs OSPFv3 in area `backbone`. Every router gets:
```rsc
/routing ospf-v3 instance
add name=default-v3 router-id=<v4-loopback> redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=<each-transit-interface> network-type=point-to-point
```
Loopbacks and connected /64s redistribute as type-1. Customer PD
allocations do **not** redistribute into OSPF — they're on-link via the
PPPoE interface, and edge/core learn aggregates via iBGP.
### iBGP — `/44` aggregates → edge
Each tower router peers iBGP with `edge` (and optionally `core` as a
route-reflector if you want to scale; today direct works fine) over its
loopback. Peer config on every tower:
```rsc
/routing bgp instance
set default as=393837 router-id=<v4-loopback>
/routing bgp peer
add address-families=ipv6 name=ibgp-edge \
remote-address=2606:1c80:0:10::254 remote-as=393837 \
update-source=lo multihop=yes
/routing bgp network
add network=2606:1c80:NNN0::/44 synchronize=no
```
Edge already has `2606:1c80::/32` in its `/routing bgp network`, which
covers all towers — that aggregate goes upstream to TWC. The per-tower
`/44`s announced over iBGP are for **internal** longest-match so traffic
returning into the network can find the right tower without flooding the
default through the IGP.
(If iBGP feels overkill, OSPFv3 redistribution of the per-tower /44
works too. iBGP scales better and matches your v4 structure.)
### Customer PD — DHCPv6-PD on PPPoE (/56 per session)
On each tower router:
```rsc
/ipv6 pool
add name=<tower>-cust-pd-1 prefix=2606:1c80:NNN1::/48 prefix-length=56
/ppp profile
set [find name=<pppoe-profile>] \
remote-ipv6-prefix-pool=<tower>-cust-pd-1 \
dhcpv6-pd-pool=<tower>-cust-pd-1
/ipv6 dhcp-server
add name=<tower>-pd interface=<tower-bridge> \
address-pool=<tower>-cust-pd-1
```
Each PPPoE session gets a single `/56` from the pool, delegated via
DHCPv6-PD. CPE configures `/64`s out of it on its LANs.
### Mgmt-LAN / wired customers (no PPPoE)
For the wired mgmt LAN at each tower (`2606:1c80:NNN0::/64`), use
SLAAC + RDNSS:
```rsc
/ipv6 address
add address=2606:1c80:NNN0::1/64 interface=<mgmt-bridge> advertise=yes
/ipv6 nd
add interface=<mgmt-bridge> ra-interval=3m20s-10m \
other-configuration=yes managed-address-configuration=no
/ipv6 nd prefix
add interface=<mgmt-bridge> prefix=2606:1c80:NNN0::/64 \
autonomous=yes on-link=yes
/ipv6 dhcp-server
add interface=<mgmt-bridge> name=<tower>-mgmt-stateless \
address-pool=none
```
DNS via RDNSS pointing at v6 resolvers (the v6 equivalents of
`204.110.191.240` and `.20`); configure those on the resolver hosts when
you v6-enable them.
---
## Firewall (every router)
Mirror your v4 input chain. Minimum:
```rsc
/ipv6 firewall filter
add chain=input action=accept connection-state=established,related
add chain=input action=accept protocol=icmpv6
add chain=input action=accept src-address=fe80::/10
add chain=input action=accept src-address=2606:1c80::/32 ;; internal
add chain=input action=drop
add chain=forward action=accept connection-state=established,related
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 ;; PMTUD
add chain=forward action=accept protocol=icmpv6
add chain=forward action=accept src-address=2606:1c80::/32 ;; v6 outbound + transit
add chain=forward action=drop
```
The `src-address=2606:1c80::/32` forward rule is **load-bearing and must
match the whole /32, not a per-tower /44**. Traffic from one tower's
customers transits other routers on the way to `edge`, so a router that
only accepts its own `/44` blackholes every other tower's customers at
its `default deny` (presents as "ICMPv6 pings work, TCP/HTTP doesn't" —
the `accept protocol=icmpv6` rule lets echo through while forwarded TCP
hits the drop). It also covers internal-to-internal, so no separate
`src+dst=2606:1c80::/32` rule is needed. Do **not** use
`in-interface-list=customer` — that list was never populated on the
fleet and the rule silently matched nothing. Unsolicited inbound from
the internet to customers still hits `default deny`; only
`established,related` returns.
Edge keeps its existing inbound BGP rules. Do **not** NAT v6 — every
prefix is GUA from your /32.
---
## DNS
- Forward DNS for `2606:1c80::/32`: AAAA records under `vntx.net` for
router loopbacks (`verona-loopback.vntx.net AAAA 2606:1c80::101`,
etc.) and customer PTR delegations.
- Reverse DNS: request a `1.c.8.1.6.0.6.2.ip6.arpa` delegation from
ARIN matching the /32. Then run a v6 PTR generator (mirror the v4
side).
---
## Migration notes
This is a greenfield plan but the routers have *some* v6 already:
- Delete on every router before applying:
`/ipv6 address remove [find]`,
`/ipv6 pool remove [find]`,
`/ipv6 dhcp-server remove [find]`,
`/ipv6 nd remove [find !default]`.
- Keep edge's `/routing bgp network add 2606:1c80::/32 synchronize=no`
and its TWC v6 peer.
- Keep edge's `/ipv6 firewall filter` rules — extend per the template,
don't replace.
Apply tower-by-tower in the same order as the CGNAT renumber sequence
(see `subnets.md`) so you're not running two transitions in parallel.
---
## Per-router config skeletons
### edge (loopback `:10::254`, hosts the global server /64)
```rsc
/ipv6 address
add address=2606:1c80:0:10::254/128 interface=lo advertise=no
add address=2606:1c80:0:11::1/64 interface=sfp-sfpplus7-core-direct
add address=2606:1c80:0:1002::1/64 interface=sfp-sfpplus11-preseem
add address=2606:1c80::1/64 interface=vlan9_sfpplus8 ;; server LAN
;; existing TWC peering address lives outside our /32 — leave it
;; suppress RA on the servers /64 — static-only, no SLAAC
/ipv6 nd
add interface=vlan9_sfpplus8 disabled=no advertise=no \
managed-address-configuration=no other-configuration=no
/routing bgp network
add network=2606:1c80::/64 synchronize=no ;; server LAN, advertised from edge
;; existing add network=2606:1c80::/32 stays — the upstream-facing aggregate
```
### core (loopback `:10::253`, tower /44 `1400::/44`)
```rsc
/ipv6 address
add address=2606:1c80:0:10::253/128 interface=lo advertise=no
add address=2606:1c80:0:11::2/64 interface=ether3-edge-direct
add address=2606:1c80:0:12::1/64 interface=ether5-climax
add address=2606:1c80:0:13::1/64 interface=ether4-newhope
add address=2606:1c80:0:14::1/64 interface=ether1-982-60ghz
add address=2606:1c80:0:15::1/64 interface=ether6-culleoka-11ghz
add address=2606:1c80:1400::1/64 interface=vlan10_combo1 ;; 380 mgmt LAN
/ipv6 pool
add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56
/routing bgp network
add network=2606:1c80:1400::/44 synchronize=no
```
### verona (loopback `:10::101`, towers verona `1000::/44` + altoga `1500::/44`)
```rsc
/ipv6 address
add address=2606:1c80:0:10::101/128 interface=lo advertise=no
add address=2606:1c80:0:20::1/64 interface=ether3-climax-11ghz
add address=2606:1c80:1000::1/64 interface=verona ;; verona mgmt LAN
add address=2606:1c80:1500::1/64 interface=ether6-switch ;; altoga mgmt LAN
/ipv6 pool
add name=verona-cust-pd-1 prefix=2606:1c80:1001::/48 prefix-length=56
add name=altoga-cust-pd-1 prefix=2606:1c80:1501::/48 prefix-length=56
/ppp profile
set [find name=pppoe-verona] remote-ipv6-prefix-pool=verona-cust-pd-1 \
dhcpv6-pd-pool=verona-cust-pd-1
set [find name=pppoe-altoga] remote-ipv6-prefix-pool=altoga-cust-pd-1 \
dhcpv6-pd-pool=altoga-cust-pd-1
/routing bgp network
add network=2606:1c80:1000::/44 synchronize=no
add network=2606:1c80:1500::/44 synchronize=no
```
### climax (loopback `:10::102`, /44 `1100::/44`)
```rsc
/ipv6 address
add address=2606:1c80:0:10::102/128 interface=lo advertise=no
add address=2606:1c80:0:20::2/64 interface=ether6-verona-11ghz
add address=2606:1c80:0:21::1/64 interface=<climax-culleoka-11ghz>
add address=2606:1c80:0:12::2/64 interface=<climax-core-link>
add address=2606:1c80:1100::1/64 interface=climax-bridge
/ipv6 pool
add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
/routing bgp network
add network=2606:1c80:1100::/44 synchronize=no
```
### Other towers
Same template — substitute loopback, /44, interface names from each
router's `.rsc`, and the matching P2P /64:
| Router | Loopback | /44 | First customer pool prefix | Mgmt LAN /64 |
|-----------|-----------------------|----------------------|----------------------------|------------------------|
| culleoka | `2606:1c80:0:10::104` | `2606:1c80:1600::/44`| `2606:1c80:1601::/48` | `2606:1c80:1600::1/64` |
| newhope | `2606:1c80:0:10::108` | `2606:1c80:1800::/44`| `2606:1c80:1801::/48` | `2606:1c80:1800::1/64` |
| lowry | `2606:1c80:0:10::109` | `2606:1c80:1900::/44`| `2606:1c80:1901::/48` | `2606:1c80:1900::1/64` |
| 982 | `2606:1c80:0:10::110` | `2606:1c80:1300::/44`| `2606:1c80:1301::/48` | `2606:1c80:1300::1/64` |
| 494 | `2606:1c80:0:10::111` | `2606:1c80:1A00::/44`| `2606:1c80:1A01::/48` | `2606:1c80:1A00::1/64` |
---
## Verification checklist (per router, post-apply)
```rsc
:put [/ipv6 address print]
:put [/ipv6 route print where active]
:put [/routing ospf-v3 neighbor print]
:put [/routing bgp peer print where remote-address~"2606:1c80"]
/ping 2606:1c80:0:10::254 count=3 src-address=2606:1c80:0:10::<self-last-hextet>
/ping 2606:4700:4700::1111 count=3 ;; Cloudflare, end-to-end
```
End-to-end CPE test: connect a known PPPoE customer, verify a `/56` is
delegated, verify SLAAC inside the first `/64` of that /56 reaches
`2606:4700:4700::1111`.
---
## Allocation registry (keep this updated)
| Prefix | Tower / purpose | First allocated | Notes |
|-------------------------|-----------------|-----------------|-----------------------------|
| `2606:1c80::/64` | core servers | 2026-05-08 | global server LAN at 380 — static only, no RA |
| `2606:1c80::/48` | infra | 2026-05-08 | servers/loopbacks/P2P/transit |
| `2606:1c80:0:10::/64` | router loopbacks | 2026-05-08 | one /128 per router |
| `2606:1c80:1000::/44` | verona | 2026-05-08 | 3 840 /56 customer capacity |
| `2606:1c80:1100::/44` | climax | 2026-05-08 | |
| `2606:1c80:1300::/44` | 982 | 2026-05-08 | |
| `2606:1c80:1400::/44` | core (380) | 2026-05-08 | |
| `2606:1c80:1500::/44` | altoga | 2026-05-08 | served from verona router |
| `2606:1c80:1600::/44` | culleoka | 2026-05-08 | |
| `2606:1c80:1800::/44` | newhope | 2026-05-08 | |
| `2606:1c80:1900::/44` | lowry | 2026-05-08 | |
| `2606:1c80:1A00::/44` | 494 | 2026-05-08 | |
---
## Per-router migration commands
Two phases per router: **WIPE** (remove all stale internal v6 config —
loopbacks, transit, tower LANs, OSPFv3, internal iBGP, customer pools)
then **APPLY** (configure exactly per the plan above). External eBGP
peerings (Charter/Spectrum, both v4 and v6) and the existing
`2606:1c80::/32` aggregate on edge are preserved by filtering the wipe
commands on `name=` and `network=`. **The v4 control plane is never
touched.**
Apply order: **edge → core → verona → climax → 494 → 982 → culleoka →
newhope → lowry**. Altoga sits on the verona router so it gets
configured during verona's APPLY. Bring up edge first so the iBGP
target loopback exists when each tower comes online.
### WIPE (run on every router; same script everywhere)
```rsc
# ---- v6 wipe — removes everything internal, leaves external peerings alone
/ipv6 address remove [find !dynamic]
/ipv6 nd prefix remove [find]
/ipv6 nd remove [find !default]
/ipv6 dhcp-server remove [find]
/ipv6 dhcp-server option remove [find]
/ipv6 dhcp-client remove [find]
/ipv6 pool remove [find]
/ipv6 route remove [find !dynamic]
/ipv6 firewall filter remove [find]
/ipv6 firewall mangle remove [find]
/ipv6 firewall raw remove [find]
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
/routing ospf-v3 interface remove [find]
/routing ospf-v3 instance remove [find]
# internal iBGP only — leave external eBGP peers (twc, twc-v6) alone
/routing bgp peer remove [find name~"ibgp" and address-families~"ipv6"]
# v6 BGP networks — leave the upstream-facing 2606:1c80::/32 aggregate
/routing bgp network remove [find network~":" and network!="2606:1c80::/32"]
```
### Common firewall + IGP baseline (run on every router AFTER its WIPE)
```rsc
# ---- v6 firewall: input + forward minimum, mirrors v4 hygiene
/ipv6 firewall filter
add chain=input action=accept connection-state=established,related
add chain=input action=accept protocol=icmpv6
add chain=input action=accept src-address=fe80::/10
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
add chain=input action=drop comment="default deny"
add chain=forward action=accept connection-state=established,related
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
add chain=forward action=accept protocol=icmpv6
add chain=forward action=accept src-address=2606:1c80::/32 comment="v6 outbound (all vntx sources)"
add chain=forward action=drop comment="default deny"
# ---- OSPFv3 (router-id = v4 loopback)
/routing ospf-v3 instance
add name=default-v3 router-id=<v4-loopback> redistribute-connected=as-type-1
# OSPFv3 interfaces are added per-router in each APPLY block below
```
### edge — APPLY
```rsc
/ipv6 address
add address=2606:1c80:0:10::254/128 interface=lo advertise=no
add address=2606:1c80:0:11::1/64 interface=sfp-sfpplus7-core-direct
add address=2606:1c80:0:1002::1/64 interface=sfp-sfpplus11-preseem
add address=2606:1c80::1/64 interface=vlan9_sfpplus8 ;; server LAN
/ipv6 nd
add interface=vlan9_sfpplus8 disabled=no advertise=no \
managed-address-configuration=no other-configuration=no
/routing ospf-v3 instance
add name=default-v3 router-id=10.254.254.254 redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=lo passive=yes
add area=backbone interface=sfp-sfpplus7-core-direct network-type=point-to-point
# eBGP TWC v6 peer is preserved by the wipe — do NOT re-add it here.
# /routing bgp network keeps the existing 2606:1c80::/32. Add the server /64:
/routing bgp network
add network=2606:1c80::/64 synchronize=no comment="server LAN, originated by edge"
```
### core — APPLY
```rsc
/ipv6 address
add address=2606:1c80:0:10::253/128 interface=lo advertise=no
add address=2606:1c80:0:11::2/64 interface=ether3-edge-direct
add address=2606:1c80:0:12::1/64 interface=ether5-climax
add address=2606:1c80:0:13::1/64 interface=ether4-newhope
add address=2606:1c80:0:14::1/64 interface=ether1-982-60ghz
add address=2606:1c80:0:15::1/64 interface=ether6-culleoka-11ghz
add address=2606:1c80:1400::1/64 interface=vlan10_combo1 ;; 380 mgmt LAN
/ipv6 pool
add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56
/ppp profile
set [find name=380] remote-ipv6-prefix-pool=core-cust-pd-1 \
dhcpv6-pd-pool=core-cust-pd-1
/routing ospf-v3 instance
add name=default-v3 router-id=10.254.254.253 redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=lo passive=yes
add area=backbone interface=ether3-edge-direct network-type=point-to-point
add area=backbone interface=ether5-climax network-type=point-to-point
add area=backbone interface=ether4-newhope network-type=point-to-point
add area=backbone interface=ether1-982-60ghz network-type=point-to-point
add area=backbone interface=ether6-culleoka-11ghz network-type=point-to-point
/routing bgp peer
add address-families=ipv6 name=ibgp-edge \
remote-address=2606:1c80:0:10::254 remote-as=393837 \
update-source=lo multihop=yes
/routing bgp network
add network=2606:1c80:1400::/44 synchronize=no
```
### verona — APPLY (also configures altoga)
```rsc
/ipv6 address
add address=2606:1c80:0:10::101/128 interface=lo advertise=no
add address=2606:1c80:0:20::1/64 interface=ether3-climax-11ghz
add address=2606:1c80:1000::1/64 interface=verona ;; verona mgmt LAN
add address=2606:1c80:1500::1/64 interface=ether6-switch ;; altoga mgmt LAN
/ipv6 pool
add name=verona-cust-pd-1 prefix=2606:1c80:1001::/48 prefix-length=56
add name=altoga-cust-pd-1 prefix=2606:1c80:1501::/48 prefix-length=56
/ppp profile
set [find name=pppoe-verona] remote-ipv6-prefix-pool=verona-cust-pd-1 \
dhcpv6-pd-pool=verona-cust-pd-1
set [find name=pppoe-altoga] remote-ipv6-prefix-pool=altoga-cust-pd-1 \
dhcpv6-pd-pool=altoga-cust-pd-1
/routing ospf-v3 instance
add name=default-v3 router-id=10.254.254.101 redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=lo passive=yes
add area=backbone interface=ether3-climax-11ghz network-type=point-to-point
/routing bgp peer
add address-families=ipv6 name=ibgp-edge \
remote-address=2606:1c80:0:10::254 remote-as=393837 \
update-source=lo multihop=yes
/routing bgp network
add network=2606:1c80:1000::/44 synchronize=no
add network=2606:1c80:1500::/44 synchronize=no
```
### climax — APPLY
```rsc
/ipv6 address
add address=2606:1c80:0:10::102/128 interface=lo advertise=no
add address=2606:1c80:0:12::2/64 interface=ether4-380-airfiber24
add address=2606:1c80:0:17::1/64 interface=ether5-494
add address=2606:1c80:0:20::2/64 interface=ether6-verona-11ghz
add address=2606:1c80:0:21::1/64 interface=ether3-culleoka-11ghz
add address=2606:1c80:1100::1/64 interface=climax-bridge
/ipv6 pool
add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
/ppp profile
set [find name=pppoe] remote-ipv6-prefix-pool=climax-cust-pd-1 \
dhcpv6-pd-pool=climax-cust-pd-1
/routing ospf-v3 instance
add name=default-v3 router-id=10.254.254.102 redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=lo passive=yes
add area=backbone interface=ether4-380-airfiber24 network-type=point-to-point
add area=backbone interface=ether5-494 network-type=point-to-point
add area=backbone interface=ether6-verona-11ghz network-type=point-to-point
add area=backbone interface=ether3-culleoka-11ghz network-type=point-to-point
/routing bgp peer
add address-families=ipv6 name=ibgp-edge \
remote-address=2606:1c80:0:10::254 remote-as=393837 \
update-source=lo multihop=yes
/routing bgp network
add network=2606:1c80:1100::/44 synchronize=no
```
### 494 — APPLY
```rsc
/ipv6 address
add address=2606:1c80:0:10::111/128 interface=lo advertise=no
add address=2606:1c80:0:17::2/64 interface=ether2-climax
add address=2606:1c80:1A00::1/64 interface=494 ;; 494 mgmt LAN
/ipv6 pool
add name=494-cust-pd-1 prefix=2606:1c80:1A01::/48 prefix-length=56
/ppp profile
set [find name=pppoe] remote-ipv6-prefix-pool=494-cust-pd-1 \
dhcpv6-pd-pool=494-cust-pd-1
/routing ospf-v3 instance
add name=default-v3 router-id=10.254.254.111 redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=lo passive=yes
add area=backbone interface=ether2-climax network-type=point-to-point
/routing bgp peer
add address-families=ipv6 name=ibgp-edge \
remote-address=2606:1c80:0:10::254 remote-as=393837 \
update-source=lo multihop=yes
/routing bgp network
add network=2606:1c80:1A00::/44 synchronize=no
```
### 982 — APPLY
```rsc
/ipv6 address
add address=2606:1c80:0:10::110/128 interface=lo advertise=no
add address=2606:1c80:0:14::2/64 interface=ether7-380
add address=2606:1c80:1300::1/64 interface=982 ;; 982 mgmt LAN
/ipv6 pool
add name=982-cust-pd-1 prefix=2606:1c80:1301::/48 prefix-length=56
/ppp profile
set [find name=pppoe] remote-ipv6-prefix-pool=982-cust-pd-1 \
dhcpv6-pd-pool=982-cust-pd-1
/routing ospf-v3 instance
add name=default-v3 router-id=10.254.254.110 redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=lo passive=yes
add area=backbone interface=ether7-380 network-type=point-to-point
/routing bgp peer
add address-families=ipv6 name=ibgp-edge \
remote-address=2606:1c80:0:10::254 remote-as=393837 \
update-source=lo multihop=yes
/routing bgp network
add network=2606:1c80:1300::/44 synchronize=no
```
### culleoka — APPLY
```rsc
/ipv6 address
add address=2606:1c80:0:10::104/128 interface=lo advertise=no
add address=2606:1c80:0:15::2/64 interface=ether6-380-11ghz
add address=2606:1c80:0:21::2/64 interface=ether1-climax-11ghz
add address=2606:1c80:1600::1/64 interface=mgmt ;; culleoka mgmt LAN
/ipv6 pool
add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56
/ppp profile
set [find name=pppoe] remote-ipv6-prefix-pool=culleoka-cust-pd-1 \
dhcpv6-pd-pool=culleoka-cust-pd-1
/routing ospf-v3 instance
add name=default-v3 router-id=10.254.254.104 redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=lo passive=yes
add area=backbone interface=ether6-380-11ghz network-type=point-to-point
add area=backbone interface=ether1-climax-11ghz network-type=point-to-point
/routing bgp peer
add address-families=ipv6 name=ibgp-edge \
remote-address=2606:1c80:0:10::254 remote-as=393837 \
update-source=lo multihop=yes
/routing bgp network
add network=2606:1c80:1600::/44 synchronize=no
```
### newhope — APPLY
```rsc
/ipv6 address
add address=2606:1c80:0:10::108/128 interface=lo advertise=no
add address=2606:1c80:0:13::2/64 interface=ether2-380
add address=2606:1c80:0:18::1/64 interface=ether6-lowrycrossing
add address=2606:1c80:1800::1/64 interface=newhope ;; newhope mgmt LAN
/ipv6 pool
add name=newhope-cust-pd-1 prefix=2606:1c80:1801::/48 prefix-length=56
/ppp profile
set [find name=newhope] remote-ipv6-prefix-pool=newhope-cust-pd-1 \
dhcpv6-pd-pool=newhope-cust-pd-1
/routing ospf-v3 instance
add name=default-v3 router-id=10.254.254.108 redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=lo passive=yes
add area=backbone interface=ether2-380 network-type=point-to-point
add area=backbone interface=ether6-lowrycrossing network-type=point-to-point
/routing bgp peer
add address-families=ipv6 name=ibgp-edge \
remote-address=2606:1c80:0:10::254 remote-as=393837 \
update-source=lo multihop=yes
/routing bgp network
add network=2606:1c80:1800::/44 synchronize=no
```
### lowry — APPLY
```rsc
/ipv6 address
add address=2606:1c80:0:10::109/128 interface=lo advertise=no
add address=2606:1c80:0:18::2/64 interface=ether1-newhope
add address=2606:1c80:1900::1/64 interface=lowrycrossing ;; lowry mgmt LAN
/ipv6 pool
add name=lowry-cust-pd-1 prefix=2606:1c80:1901::/48 prefix-length=56
/ppp profile
set [find name=pppoe] remote-ipv6-prefix-pool=lowry-cust-pd-1 \
dhcpv6-pd-pool=lowry-cust-pd-1
/routing ospf-v3 instance
add name=default-v3 router-id=10.254.254.109 redistribute-connected=as-type-1
/routing ospf-v3 interface
add area=backbone interface=lo passive=yes
add area=backbone interface=ether1-newhope network-type=point-to-point
/routing bgp peer
add address-families=ipv6 name=ibgp-edge \
remote-address=2606:1c80:0:10::254 remote-as=393837 \
update-source=lo multihop=yes
/routing bgp network
add network=2606:1c80:1900::/44 synchronize=no
```
### Final verification (run from any tower after all APPLY blocks)
```rsc
:put [/ipv6 address print]
:put [/ipv6 route print where active]
:put [/routing ospf-v3 neighbor print]
:put [/routing bgp peer print where remote-address~"2606:1c80"]
/ping 2606:1c80:0:10::254 count=3 ;; edge loopback (target of all iBGP)
/ping 2606:1c80::20 count=3 ;; primary DNS in the new server LAN
/ping 2606:4700:4700::1111 count=3 ;; Cloudflare end-to-end
```
Reference in a new issue View git blame Copy permalink