170 lines
9.3 KiB
Text
170 lines
9.3 KiB
Text
# =============================================================================
|
|
# climax — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
|
# =============================================================================
|
|
#
|
|
# Climax sits between verona (south-west) and the rest of the network
|
|
# (via core). One v6 default upstream — toward core via :12::1.
|
|
#
|
|
# P2P interfaces:
|
|
# ether4-380-airfiber24 :12::/64 (climax .2, core .1)
|
|
# ether6-verona-11ghz :20::/64 (verona .1, climax .2)
|
|
# ether3-culleoka-11ghz :21::/64 (climax .1, culleoka .2)
|
|
# ether5-494 :17::/64 (climax .1, 494 .2)
|
|
#
|
|
# Mgmt LAN: bridge `mgmt`, v6 = 2606:1c80:1100::1/64
|
|
# PPPoE customers: profile name `pppoe`, customer pool 2606:1c80:1101::/48 → /56
|
|
#
|
|
# BFD on wireless OSPFv2 templates was already turned off on this router
|
|
# earlier today (2026-05-09) — verified via the freshly-pulled climax.rsc.
|
|
# No BFD changes here.
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# WIPE — drop OSPFv3 + stale internal v6
|
|
# -----------------------------------------------------------------------------
|
|
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
|
/ipv6 dhcp-server remove [find]
|
|
/ipv6 dhcp-server option remove [find]
|
|
/ipv6 dhcp-client remove [find]
|
|
/ipv6 nd prefix remove [find]
|
|
/ipv6 nd remove [find default=no]
|
|
/ipv6 pool remove [find]
|
|
/ipv6 route remove [find dynamic=no]
|
|
/ipv6 firewall filter remove [find]
|
|
/ipv6 firewall mangle remove [find]
|
|
/ipv6 firewall raw remove [find]
|
|
/ipv6 address remove [find dynamic=no]
|
|
|
|
# OSPFv3 — instance, area, and the orphan culleoka-11ghz template entry
|
|
# (currently lives under area=backbone-v3) all get removed.
|
|
/routing ospf interface-template remove [find area=backbone-v3]
|
|
/routing ospf area remove [find name=backbone-v3]
|
|
/routing ospf instance remove [find name=default-v3]
|
|
|
|
# Drop any stale internal v6 iBGP peers (none present, but defensive).
|
|
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — BGP instance (climax has none today)
|
|
# -----------------------------------------------------------------------------
|
|
/routing bgp instance
|
|
add name=bgp-instance-1 as=393837 router-id=10.254.254.102
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — addresses
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 settings set forward=yes accept-router-advertisements=no
|
|
|
|
/ipv6 address
|
|
add address=2606:1c80:0:10::102/128 interface=lo advertise=no comment="loopback"
|
|
add address=2606:1c80:0:12::2/64 interface=ether4-380-airfiber24 advertise=no comment="P2P climax<->core"
|
|
add address=2606:1c80:0:20::2/64 interface=ether6-verona-11ghz advertise=no comment="P2P climax<->verona"
|
|
add address=2606:1c80:0:21::1/64 interface=ether3-culleoka-11ghz advertise=no comment="P2P climax<->culleoka"
|
|
add address=2606:1c80:0:17::1/64 interface=ether5-494 advertise=no comment="P2P climax<->494"
|
|
add address=2606:1c80:1100::1/64 interface=mgmt advertise=yes comment="climax mgmt LAN"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — static routes (replace what an IGP would have learned)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 route
|
|
# Default upstream toward core (only one path from climax — core forwards
|
|
# upward via preseem/direct).
|
|
add dst-address=::/0 gateway=2606:1c80:0:12::1 distance=1 comment="default via core"
|
|
|
|
# Edge loopback explicit (recursively resolved through default; explicit
|
|
# entry helps iBGP control plane converge quickly on first bring-up).
|
|
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:12::1 distance=1 comment="edge loopback via core"
|
|
|
|
# 494 sits one hop further out via the climax<->494 P2P; climax is the
|
|
# only neighbour that can deliver to its loopback. Without this, return
|
|
# traffic for 494's /128 from core/edge loops at climax.
|
|
add dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:17::2 distance=1 comment="494 loopback via P2P"
|
|
|
|
# verona's loopback is reachable through verona's own P2P side. Adding
|
|
# this static beats the BGP-learned next-hop during convergence and
|
|
# avoids the stale-next-hop loop we hit on 2026-05-09.
|
|
add dst-address=2606:1c80:0:10::101/128 gateway=2606:1c80:0:20::1 distance=1 comment="verona loopback via P2P"
|
|
|
|
# Blackhole climax's /44 aggregate so iBGP has the prefix to advertise.
|
|
add dst-address=2606:1c80:1100::/44 blackhole distance=200 comment="climax /44 aggregate (iBGP origin)"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 nd
|
|
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
|
|
|
/ipv6 nd prefix
|
|
add interface=mgmt prefix=2606:1c80:1100::/64 autonomous=yes on-link=yes
|
|
|
|
/ipv6 dhcp-server
|
|
add interface=mgmt name=climax-mgmt-stateless address-pool=static-only
|
|
|
|
/ipv6 dhcp-server option
|
|
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — customer PD pool + bind to the climax PPPoE profile
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 pool
|
|
add name=climax-cust-pd-1 prefix=2606:1c80:1101::/48 prefix-length=56
|
|
|
|
/ppp profile
|
|
set [find name=pppoe] remote-ipv6-prefix-pool=climax-cust-pd-1 dhcpv6-pd-pool=climax-cust-pd-1
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — firewall (mirrors v4 hygiene; deny by default)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 firewall filter
|
|
add chain=input action=accept connection-state=established,related comment="established"
|
|
add chain=input action=drop connection-state=invalid comment="invalid"
|
|
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
|
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
|
add chain=input action=drop comment="default deny"
|
|
|
|
add chain=forward action=accept connection-state=established,related comment="established"
|
|
add chain=forward action=drop connection-state=invalid comment="invalid"
|
|
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
|
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
|
add chain=forward action=accept in-interface-list=customer comment="v6 outbound from customers"
|
|
add chain=forward action=drop comment="default deny"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — iBGP to edge (v4 transport / v6 NLRI)
|
|
# -----------------------------------------------------------------------------
|
|
# Output filter: advertise climax's own routes — /44 customer aggregate,
|
|
# loopback /128, and connected /64 P2Ps toward verona, core, culleoka, 494.
|
|
# Core (v6 RR) reflects these to every other client.
|
|
/routing filter rule
|
|
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1100::/44 || dst==2606:1c80:0:10::102/128 || (dst-len==64 && (dst==2606:1c80:0:12::/64 || dst==2606:1c80:0:17::/64 || dst==2606:1c80:0:20::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }"
|
|
|
|
# Single iBGP session to CORE (which is the v6 route reflector for the fleet).
|
|
# v6 transport (loopback-to-loopback). output.redistribute=connected,static
|
|
# picks up the loopback /128 (connected) and the /44 blackhole aggregate
|
|
# (static); the filter chain narrows the set.
|
|
/routing bgp connection
|
|
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
|
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::102 \
|
|
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
|
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
|
output.redistribute=connected,static \
|
|
comment="iBGP to core (v6 RR), v6 transport"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# VERIFY (paste after apply)
|
|
# -----------------------------------------------------------------------------
|
|
# /ipv6 address print
|
|
# /ipv6 route print where active
|
|
# /routing ospf neighbor print ;; only OSPFv2 should remain
|
|
# /routing bgp instance print
|
|
# /routing bgp connection print
|
|
# /routing bgp session print
|
|
#
|
|
# After core + edge have applied:
|
|
# /ping 2606:1c80:0:12::1 count=3 ;; core P2P side
|
|
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback
|
|
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback
|
|
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare end-to-end
|
|
# /routing bgp session print ;; ibgp-edge-v6 should be Established
|