169 lines
9.5 KiB
Text
169 lines
9.5 KiB
Text
# =============================================================================
|
|
# core (380) — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
|
# =============================================================================
|
|
#
|
|
# Core sits between edge and the towers. Two paths to edge mirror v4:
|
|
# 1. PRIMARY: sfp-sfpplus1-edge-preseem, /127 :1002::2 — edge cost 10
|
|
# 2. BACKUP: ether3-edge-direct, /127 :11::2 — OSPFv2 cost 100 on both
|
|
# ends; v6 mirrors via static distance.
|
|
#
|
|
# Tower-facing P2Ps (per ipv6.md):
|
|
# ether5-climax :12::/64 (core .1, climax .2)
|
|
# ether4-newhope :13::/64 (core .1, newhope .2)
|
|
# ether1-982-60ghz :14::/64 (core .1, 982 .2)
|
|
# ether6-culleoka-11ghz :15::/64 (core .1, culleoka .2)
|
|
#
|
|
# Mgmt LAN: vlan10_combo1 (vlan 10 on combo1-380), v6 = 2606:1c80:1400::1/64
|
|
# PPPoE customers: profile name `380`, customer pool 2606:1c80:1401::/48 → /56
|
|
#
|
|
# Two pre-apply fixes required on core:
|
|
# (a) /routing/bgp/instance bgp-instance-1 currently has as=65530 — must
|
|
# be 393837 to peer iBGP with edge. We update it in place.
|
|
# (b) BFD is currently on for ether5-climax (AF24), ether4-newhope, and
|
|
# ether6-culleoka-11ghz (AF11). Per fleet policy (no BFD on
|
|
# wireless), we set use-bfd=no on those three OSPFv2 templates.
|
|
# Wired backbone (sfp-sfpplus1-edge-preseem, ether3-edge-direct)
|
|
# keeps BFD as-is.
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# WIPE — drop OSPFv3 + stale internal v6
|
|
# -----------------------------------------------------------------------------
|
|
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
|
/ipv6 dhcp-server remove [find]
|
|
/ipv6 dhcp-server option remove [find]
|
|
/ipv6 dhcp-client remove [find]
|
|
/ipv6 nd prefix remove [find]
|
|
/ipv6 nd remove [find !default]
|
|
/ipv6 pool remove [find]
|
|
/ipv6 route remove [find !dynamic]
|
|
/ipv6 firewall filter remove [find]
|
|
/ipv6 firewall mangle remove [find]
|
|
/ipv6 firewall raw remove [find]
|
|
/ipv6 address remove [find !dynamic]
|
|
|
|
/routing ospf interface-template remove [find area=backbone-v3]
|
|
/routing ospf area remove [find name=backbone-v3]
|
|
/routing ospf instance remove [find name=default-v3]
|
|
|
|
/routing bgp connection remove [find name~"ibgp" and address-families~"ipv6"]
|
|
# also remove the disabled placeholder climax connection (will be replaced
|
|
# by the future climax tower's own iBGP-to-edge session).
|
|
/routing bgp connection remove [find name=climax and disabled=yes]
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — fix BGP instance AS (65530 → 393837 to match the fleet)
|
|
# -----------------------------------------------------------------------------
|
|
/routing bgp instance set [find name=bgp-instance-1] as=393837
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — turn off BFD on wireless backbone OSPFv2 templates
|
|
# -----------------------------------------------------------------------------
|
|
/routing ospf interface-template set [find interfaces=ether5-climax] use-bfd=no
|
|
/routing ospf interface-template set [find interfaces=ether4-newhope] use-bfd=no
|
|
/routing ospf interface-template set [find interfaces=ether6-culleoka-11ghz] use-bfd=no
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — addresses
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 settings set forward=yes accept-router-advertisements=no
|
|
|
|
/ipv6 address
|
|
add address=2606:1c80:0:10::253/128 interface=lo advertise=no comment="loopback"
|
|
add address=2606:1c80:0:11::2/127 interface=ether3-edge-direct advertise=no comment="P2P core<->edge direct (backup)"
|
|
add address=2606:1c80:0:1002::2/127 interface=sfp-sfpplus1-edge-preseem advertise=no comment="P2P core<->edge via preseem (primary)"
|
|
add address=2606:1c80:0:12::1/127 interface=ether5-climax advertise=no comment="P2P core<->climax"
|
|
add address=2606:1c80:0:13::1/127 interface=ether4-newhope advertise=no comment="P2P core<->newhope"
|
|
add address=2606:1c80:0:14::1/127 interface=ether1-982-60ghz advertise=no comment="P2P core<->982 60GHz"
|
|
add address=2606:1c80:0:15::1/127 interface=ether6-culleoka-11ghz advertise=no comment="P2P core<->culleoka"
|
|
add address=2606:1c80:1400::1/64 interface=vlan10_combo1 advertise=yes comment="380 mgmt LAN"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — static routes (replace what an IGP would have learned)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 route
|
|
# v6 default toward edge — preseem primary, direct backup (mirrors v4 cost relationship).
|
|
add dst-address=::/0 gateway=2606:1c80:0:1002::1 distance=1 comment="default via preseem (primary)"
|
|
add dst-address=::/0 gateway=2606:1c80:0:11::1 distance=2 comment="default via direct (backup)"
|
|
|
|
# Edge loopback static fallback (so iBGP TCP control plane can reach edge
|
|
# even before BGP populates anything beyond defaults).
|
|
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1 distance=1 comment="edge loopback via preseem"
|
|
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1 distance=2 comment="edge loopback via direct"
|
|
|
|
# Blackhole core's /44 aggregate so iBGP has the prefix to advertise upward.
|
|
add dst-address=2606:1c80:1400::/44 blackhole distance=200 comment="core /44 aggregate (iBGP origin)"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — neighbour discovery on the 380 mgmt LAN (SLAAC + RDNSS)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 nd
|
|
add interface=vlan10_combo1 ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
|
|
|
/ipv6 nd prefix
|
|
add interface=vlan10_combo1 prefix=2606:1c80:1400::/64 autonomous=yes on-link=yes
|
|
|
|
/ipv6 dhcp-server
|
|
add interface=vlan10_combo1 name=core-mgmt-stateless address-pool=static-only
|
|
|
|
/ipv6 dhcp-server option
|
|
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — customer PD pool + bind to the 380 PPPoE profile
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 pool
|
|
add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56
|
|
|
|
/ppp profile
|
|
set [find name=380] remote-ipv6-prefix-pool=core-cust-pd-1 dhcpv6-pd-pool=core-cust-pd-1
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — firewall (mirrors v4 hygiene; deny by default)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 firewall filter
|
|
add chain=input action=accept connection-state=established,related comment="established"
|
|
add chain=input action=drop connection-state=invalid comment="invalid"
|
|
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
|
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
|
add chain=input action=drop comment="default deny"
|
|
|
|
add chain=forward action=accept connection-state=established,related comment="established"
|
|
add chain=forward action=drop connection-state=invalid comment="invalid"
|
|
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
|
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
|
add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers"
|
|
add chain=forward action=drop comment="default deny"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — iBGP to edge (v4 transport / v6 NLRI)
|
|
# -----------------------------------------------------------------------------
|
|
/routing filter rule
|
|
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44) { accept; } else { reject; }"
|
|
|
|
/routing bgp connection
|
|
add name=ibgp-edge-v6 instance=bgp-instance-1 templates=default \
|
|
afi=ip,ipv6 local.role=ibgp local.address=10.254.254.253 \
|
|
remote.address=10.254.254.254 remote.as=393837 multihop=yes \
|
|
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
|
comment="iBGP to edge, v4 transport / v6 NLRI"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# VERIFY (paste after apply)
|
|
# -----------------------------------------------------------------------------
|
|
# /ipv6 address print
|
|
# /ipv6 route print where active
|
|
# /routing ospf neighbor print
|
|
# /routing ospf interface-template print where use-bfd=yes ;; should be wired-only
|
|
# /routing bgp instance print
|
|
# /routing bgp connection print
|
|
# /routing bgp session print
|
|
#
|
|
# After edge has applied:
|
|
# /ping 2606:1c80:0:1002::1 count=3 ;; edge preseem-side
|
|
# /ping 2606:1c80:0:11::1 count=3 ;; edge direct-side
|
|
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback
|
|
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end
|
|
# /routing bgp session print ;; ibgp-edge-v6 should be Established
|