149 lines
8 KiB
Text
149 lines
8 KiB
Text
# =============================================================================
|
|
# culleoka — IPv6 apply script (ROS 7.21.4, BGP-only / no OSPFv3)
|
|
# =============================================================================
|
|
#
|
|
# Culleoka has two upstream paths:
|
|
# * core (primary) — ether6-380-11ghz, v6 P2P 2606:1c80:0:15::/64
|
|
# * climax (backup) — ether1-climax-11ghz, v6 P2P 2606:1c80:0:21::/64
|
|
# The climax-↔-culleoka 11 GHz radio link is currently DOWN at the radio
|
|
# (power injector unplugged); the v6 P2P is configured but inactive until
|
|
# the radio comes back up. v4 transit currently goes via core.
|
|
#
|
|
# Loopback: 2606:1c80:0:10::104/128
|
|
# /44 customer aggregate: 2606:1c80:1600::/44
|
|
# Mgmt LAN: 2606:1c80:1600::1/64 — assumes a `mgmt` bridge similar to
|
|
# climax. If culleoka uses a different name (e.g. `bridge1`, `lan`),
|
|
# substitute on apply. PPPoE profile assumed `pppoe` — verify with
|
|
# /ppp profile print before applying.
|
|
#
|
|
# Customer interface-list assumed `customer` (same as climax).
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# WIPE — drop OSPFv3 + stale internal v6
|
|
# -----------------------------------------------------------------------------
|
|
/ppp profile set [find] remote-ipv6-prefix-pool="" dhcpv6-pd-pool=""
|
|
/ipv6 dhcp-server remove [find]
|
|
/ipv6 dhcp-server option remove [find]
|
|
/ipv6 dhcp-client remove [find]
|
|
/ipv6 nd prefix remove [find]
|
|
/ipv6 nd remove [find default=no]
|
|
/ipv6 pool remove [find]
|
|
/ipv6 route remove [find dynamic=no]
|
|
/ipv6 firewall filter remove [find]
|
|
/ipv6 firewall mangle remove [find]
|
|
/ipv6 firewall raw remove [find]
|
|
/ipv6 address remove [find dynamic=no]
|
|
|
|
/routing ospf interface-template remove [find area=backbone-v3]
|
|
/routing ospf area remove [find name=backbone-v3]
|
|
/routing ospf instance remove [find name=default-v3]
|
|
|
|
/routing bgp connection remove [find name~"ibgp" and (afi~"ipv6" or address-families~"ipv6")]
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — BGP instance
|
|
# -----------------------------------------------------------------------------
|
|
/routing bgp template set [find name=default] disabled=no
|
|
|
|
/routing bgp instance
|
|
add name=bgp-instance-1 as=393837 router-id=10.254.254.104
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — addresses
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 settings set forward=yes accept-router-advertisements=no
|
|
|
|
/ipv6 address
|
|
add address=2606:1c80:0:10::104/128 interface=lo advertise=no comment="loopback"
|
|
add address=2606:1c80:0:15::2/64 interface=ether6-380-11ghz advertise=no comment="P2P culleoka<->core"
|
|
add address=2606:1c80:0:21::2/64 interface=ether1-climax-11ghz advertise=no comment="P2P culleoka<->climax (radio DOWN)"
|
|
add address=2606:1c80:1600::1/64 interface=mgmt advertise=yes comment="culleoka mgmt LAN"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — static routes
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 route
|
|
# Default upstream toward core (climax path stays as a higher-distance backup
|
|
# that becomes active automatically when the climax 11 GHz radio is brought
|
|
# back up — same shape as v4 OSPF cost relationship in CLAUDE.md).
|
|
add dst-address=::/0 gateway=2606:1c80:0:15::1 distance=1 comment="default via core (primary)"
|
|
add dst-address=::/0 gateway=2606:1c80:0:21::1 distance=100 comment="default via climax (backup, radio down)"
|
|
|
|
# Bootstrap: reach core's v6 loopback before iBGP comes up. Distance=1 wins
|
|
# over the BGP-learned /128 (distance=200) once the session is up; both
|
|
# routes have the same forwarding outcome.
|
|
add dst-address=2606:1c80:0:10::253/128 gateway=2606:1c80:0:15::1 distance=1 comment="core loopback (iBGP bootstrap)"
|
|
add dst-address=2606:1c80:0:10::254/128 gateway=2606:1c80:0:15::1 distance=1 comment="edge loopback via core"
|
|
|
|
# Blackhole the /44 so output.redistribute=static picks it up for iBGP.
|
|
add dst-address=2606:1c80:1600::/44 blackhole distance=200 comment="culleoka /44 aggregate (iBGP origin)"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — neighbour discovery on the mgmt LAN (SLAAC + RDNSS)
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 nd
|
|
add interface=mgmt ra-interval=3m20s-10m managed-address-configuration=no other-configuration=yes advertise-dns=yes
|
|
|
|
/ipv6 nd prefix
|
|
add interface=mgmt prefix=2606:1c80:1600::/64 autonomous=yes on-link=yes
|
|
|
|
/ipv6 dhcp-server
|
|
add interface=mgmt name=culleoka-mgmt-stateless address-pool=static-only
|
|
|
|
/ipv6 dhcp-server option
|
|
add name=v6-dns code=23 value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — customer PD pool + bind to PPPoE profile
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 pool
|
|
add name=culleoka-cust-pd-1 prefix=2606:1c80:1601::/48 prefix-length=56
|
|
|
|
/ppp profile
|
|
set [find name=pppoe] remote-ipv6-prefix-pool=culleoka-cust-pd-1 dhcpv6-pd-pool=culleoka-cust-pd-1
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — firewall
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 firewall filter
|
|
add chain=input action=accept connection-state=established,related comment="established"
|
|
add chain=input action=drop connection-state=invalid comment="invalid"
|
|
add chain=input action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=input action=accept src-address=fe80::/10 comment="link-local"
|
|
add chain=input action=accept src-address=2606:1c80::/32 comment="internal"
|
|
add chain=input action=drop comment="default deny"
|
|
|
|
add chain=forward action=accept connection-state=established,related comment="established"
|
|
add chain=forward action=drop connection-state=invalid comment="invalid"
|
|
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD"
|
|
add chain=forward action=accept protocol=icmpv6 comment="icmpv6"
|
|
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal-to-internal"
|
|
add chain=forward action=accept src-address=2606:1c80:1600::/44 comment="v6 outbound from culleoka customers"
|
|
add chain=forward action=drop comment="default deny"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — iBGP to core (v6 RR)
|
|
# -----------------------------------------------------------------------------
|
|
/routing filter rule
|
|
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1600::/44 || dst==2606:1c80:0:10::104/128 || (dst-len==64 && (dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:21::/64))) { accept; } else { reject; }"
|
|
|
|
/routing bgp connection
|
|
add name=ibgp-rr-core instance=bgp-instance-1 templates=default \
|
|
afi=ip,ipv6 local.role=ibgp local.address=2606:1c80:0:10::104 \
|
|
remote.address=2606:1c80:0:10::253 remote.as=393837 multihop=yes \
|
|
nexthop-choice=force-self output.filter-chain=v6-ibgp-out \
|
|
output.redistribute=connected,static \
|
|
comment="iBGP to core (v6 RR), v6 transport"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# VERIFY (paste after apply)
|
|
# -----------------------------------------------------------------------------
|
|
# /ipv6 address print
|
|
# /ipv6 route print where active
|
|
# /routing bgp session print ;; ibgp-rr-core should be Established
|
|
#
|
|
# After session is up:
|
|
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback
|
|
# /ping 2606:1c80:0:10::254 count=3 ;; edge loopback (via core)
|
|
# /ping 2606:4700:4700::1111 count=3 ;; cloudflare (needs working TWC v6)
|