702 lines
32 KiB
Text
702 lines
32 KiB
Text
# 2026-05-09 16:20:09 by RouterOS 7.21.4
|
|
# software id = XS5B-41QR
|
|
#
|
|
# model = CCR1009-7G-1C-1S+
|
|
# serial number = 8495073BCE3B
|
|
/interface ethernet
|
|
set [ find default-name=combo1 ] l2mtu=9000 name=combo1-380 rx-flow-control=\
|
|
auto tx-flow-control=auto
|
|
set [ find default-name=ether1 ] l2mtu=9000 name=ether1-982-60ghz \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=ether2 ] l2mtu=9000 name=ether2-office \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=ether3 ] l2mtu=9000 name=ether3-edge-direct \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=ether4 ] l2mtu=9000 name=ether4-newhope \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=ether5 ] l2mtu=2024 name=ether5-climax \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=ether6 ] l2mtu=2024 name=ether6-culleoka-11ghz \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=ether7 ] disabled=yes l2mtu=9000 name=ether7-380tower \
|
|
rx-flow-control=auto tx-flow-control=auto
|
|
set [ find default-name=sfp-sfpplus1 ] l2mtu=9000 name=\
|
|
sfp-sfpplus1-edge-preseem rx-flow-control=auto tx-flow-control=auto
|
|
/interface vlan
|
|
add interface=combo1-380 name=vlan10_combo1 vlan-id=10
|
|
/interface lte apn
|
|
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
|
|
/interface wireless security-profiles
|
|
set [ find default=yes ] supplicant-identity=MikroTik
|
|
/ip ipsec proposal
|
|
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=\
|
|
aes-256-cbc,aes-128-cbc pfs-group=modp2048
|
|
/ip pool
|
|
add name=sstp ranges=172.16.91.1-172.16.91.253
|
|
add name=380 ranges=100.64.8.1-100.64.11.230
|
|
add name=380-mgmt ranges=10.10.64.1-10.10.79.230
|
|
/ip dhcp-server
|
|
add address-pool=380 interface=combo1-380 lease-script="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
|
|
c24944-c947-4e01-9c54-07a1653d2e3e\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n :if (\$leaseBound = 0) do {\
|
|
\n # Try url2 (iptrack.vntx.net) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
|
|
t for \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
|
|
on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
|
|
or \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
|
|
attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n } else {\
|
|
\n :delay 1s;\
|
|
\n :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
|
|
seActIP] agent-remote-id];\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
|
|
for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
|
|
\_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
|
|
;\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP assignment successfully sent to gaiia AWS API for\
|
|
\_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
|
|
tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 30s;\
|
|
\n }\
|
|
\n }\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" lease-time=1h name=380
|
|
add address-pool=380-mgmt interface=vlan10_combo1 lease-script="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/cd\
|
|
c24944-c947-4e01-9c54-07a1653d2e3e\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/dhcp\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n :if (\$leaseBound = 0) do {\
|
|
\n # Try url2 (iptrack.vntx.net) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to iptrack.vntx.ne\
|
|
t for \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to iptrack.vntx.net \
|
|
on attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - deassignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP deassignment successfully sent to gaiia AWS API f\
|
|
or \$leaseActMAC / \$leaseActIP\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send deassignment to gaiia AWS API on \
|
|
attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n } else {\
|
|
\n :delay 1s;\
|
|
\n :local remoteID [/ip dhcp-server lease get [find where address=\$lea\
|
|
seActIP] agent-remote-id];\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=pos\
|
|
t http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"DHCP assignment successfully sent to iptrack.vntx.net \
|
|
for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to iptrack.vntx.net on\
|
|
\_attempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\"\
|
|
;\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia) - assignment\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post\
|
|
\_http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bo\
|
|
und\\\":\\\"\$leaseBound\\\",\\\"mac\\\":\\\"\$leaseActMAC\\\",\\\"ip\\\":\
|
|
\\\"\$leaseActIP\\\",\\\"server\\\":\\\"\$leaseServerName\\\",\\\"remoteId\
|
|
\\\":\\\"\$remoteID\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"DHCP assignment successfully sent to gaiia AWS API for\
|
|
\_\$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n } on-error={\
|
|
\n :log error \"DHCP FAILED to send assignment to gaiia AWS API on at\
|
|
tempt \$attempts/\$max for \$leaseActMAC / \$leaseActIP / \$remoteID\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 != 1 || \$success2 != 1) do={\
|
|
\n :delay 30s;\
|
|
\n }\
|
|
\n }\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" lease-time=1h name=380-mgmt
|
|
/ip smb users
|
|
set [ find default=yes ] disabled=yes
|
|
/ipv6 dhcp-server option
|
|
add code=23 name=v6-dns value="'2606:4700:4700::1111''2606:4700:4700::1001'"
|
|
/ipv6 pool
|
|
add name=core-cust-pd-1 prefix=2606:1c80:1401::/48 prefix-length=56
|
|
/ppp profile
|
|
add change-tcp-mss=yes dhcpv6-pd-pool=core-cust-pd-1 dns-server=\
|
|
204.110.191.240,204.110.191.20 local-address=100.64.11.253 name=380 \
|
|
on-down="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
|
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
|
|
\n:local max 1\
|
|
\n\
|
|
\n:local localAddr \$\"local-address\"\
|
|
\n:local remoteAddr \$\"remote-address\"\
|
|
\n:local callerId \$\"caller-id\"\
|
|
\n:local calledId \$\"called-id\"\
|
|
\n:local interfaceName [/interface get \$interface name]\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
|
|
http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
|
|
d\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
|
|
\\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"PPPoE deassignment successfully sent to iptrack.vntx.net\
|
|
\_for \$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoE FAILED to send deassignment to iptrack.vntx.net o\
|
|
n attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (AWS API)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
|
|
ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
|
|
\\\":\\\"0\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
|
|
\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"PPPoE deassignment successfully sent to gaiia AWS API fo\
|
|
r \$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoPoE FAILED to send deassignment to gaiia AWS API on\
|
|
\_attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n } else {\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" on-up="{\
|
|
\n:local url \"https://xtjlpnubrg.execute-api.us-east-1.amazonaws.com/prod\
|
|
uction/on-start-workflow-execution/6f19a48f-04f7-40c1-a4e0-8cb66df99213/0a\
|
|
7f4443-fc8a-4fe0-807c-f535d2aa1865\"\
|
|
\n:local url2 \"https://iptrack.vntx.net/api/pppoe\"\
|
|
\n:local max 5\
|
|
\n\
|
|
\n:local localAddr \$\"local-address\"\
|
|
\n:local remoteAddr \$\"remote-address\"\
|
|
\n:local callerId \$\"caller-id\"\
|
|
\n:local calledId \$\"called-id\"\
|
|
\n:local interfaceName [/interface get \$interface name]\
|
|
\n\
|
|
\n:local attempts 0\
|
|
\n:local success1 0\
|
|
\n:local success2 0\
|
|
\n:do {\
|
|
\n :set attempts (\$attempts+1);\
|
|
\n\
|
|
\n # Try url2 (iptrack.vntx.net)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url2\" http-method=post \
|
|
http-header-field=\"Content-Type: application/json\" http-data=\"{\\\"boun\
|
|
d\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\
|
|
\\\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success1 1;\
|
|
\n :log info \"PPPoE assignment successfully sent to iptrack.vntx.net f\
|
|
or \$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoE FAILED to send assignment to iptrack.vntx.net on \
|
|
attempt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n # Try url (gaiia)\
|
|
\n :do {\
|
|
\n /tool fetch duration=30s mode=https url=\"\$url\" http-method=post h\
|
|
ttp-header-field=\"Content-Type: application/json\" http-data=\"{\\\"bound\
|
|
\\\":\\\"1\\\",\\\"username\\\":\\\"\$user\\\",\\\"callingstationid\\\":\\\
|
|
\"\$callerId\\\",\\\"framedip\\\":\\\"\$remoteAddr\\\"}\"\
|
|
\n :set success2 1;\
|
|
\n :log info \"PPPoE assignment successfully sent to gaiia AWS API for \
|
|
\$user / \$remoteAddr\";\
|
|
\n } on-error={\
|
|
\n :log error \"PPPoE FAILED to send assignment to gaiia AWS API on att\
|
|
empt \$attempts out of \$max for \$user / \$remoteAddr\";\
|
|
\n }\
|
|
\n\
|
|
\n :if (\$success1 = 1 && \$success2 = 1) do {\
|
|
\n :set attempts \$max;\
|
|
\n } else {\
|
|
\n :delay 3s;\
|
|
\n }\
|
|
\n} while ( \$attempts < \$max )\
|
|
\n}\
|
|
\n" remote-address=380 remote-ipv6-prefix-pool=core-cust-pd-1 use-ipv6=no \
|
|
use-upnp=no
|
|
set *FFFFFFFE local-address=172.16.91.254 remote-address=sstp
|
|
/queue type
|
|
add kind=fq-codel name=FQ_Codel
|
|
/queue interface
|
|
set combo1-380 queue=FQ_Codel
|
|
set ether1-982-60ghz queue=FQ_Codel
|
|
set ether2-office queue=FQ_Codel
|
|
set ether3-edge-direct queue=FQ_Codel
|
|
set ether4-newhope queue=FQ_Codel
|
|
set ether5-climax queue=FQ_Codel
|
|
set ether6-culleoka-11ghz queue=FQ_Codel
|
|
set ether7-380tower queue=FQ_Codel
|
|
set sfp-sfpplus1-edge-preseem queue=FQ_Codel
|
|
/routing bgp instance
|
|
add as=393837 cluster-id=10.254.254.253 name=bgp-instance-1 router-id=\
|
|
10.254.254.253
|
|
/routing bgp template
|
|
set default as=65530 disabled=no
|
|
/routing id
|
|
add disabled=no id=10.254.254.253 name=id-1 select-dynamic-id=""
|
|
/routing ospf instance
|
|
add disabled=no in-filter-chain=ospf-in name=default-v2 out-filter-chain=\
|
|
ospf-out redistribute=connected,static router-id=id-1 routing-table=main
|
|
/routing ospf area
|
|
add disabled=no instance=default-v2 name=backbone-v2
|
|
/routing table
|
|
add fib name=testnat
|
|
/snmp community
|
|
set [ find default=yes ] addresses=204.110.188.0/22,10.0.0.0/8 name=\
|
|
kdyyJrT0Mm
|
|
/system logging action
|
|
add name=logs remote=204.110.191.229 src-address=10.254.254.253 target=remote
|
|
/ip smb
|
|
set enabled=no
|
|
/ip firewall connection tracking
|
|
set tcp-established-timeout=4h tcp-fin-wait-timeout=2m tcp-time-wait-timeout=\
|
|
2m
|
|
/ip neighbor discovery-settings
|
|
set discover-interface-list=!dynamic
|
|
/ip settings
|
|
set max-neighbor-entries=8192 tcp-syncookies=yes
|
|
/ipv6 settings
|
|
set accept-router-advertisements=no max-neighbor-entries=8192 \
|
|
soft-max-neighbor-entries=8191
|
|
/interface pppoe-server server
|
|
add authentication=mschap2 default-profile=380 disabled=no interface=\
|
|
combo1-380 max-mru=1492 max-mtu=1492 service-name=380
|
|
/interface sstp-server server
|
|
set certificate=ServerCA enabled=yes
|
|
/ip address
|
|
add address=204.110.191.185/30 interface=sfp-sfpplus1-edge-preseem network=\
|
|
204.110.191.184
|
|
add address=10.0.0.254/24 disabled=yes interface=ether7-380tower network=\
|
|
10.0.0.0
|
|
add address=10.250.1.89/29 interface=ether5-climax network=10.250.1.88
|
|
add address=10.250.1.62/29 interface=ether4-newhope network=10.250.1.56
|
|
add address=204.110.191.181/30 interface=ether3-edge-direct network=\
|
|
204.110.191.180
|
|
add address=10.254.254.253 interface=lo network=10.254.254.253
|
|
add address=10.250.2.6/29 interface=ether2-office network=10.250.2.0
|
|
add address=10.250.1.38/29 interface=ether1-982-60ghz network=10.250.1.32
|
|
add address=10.250.1.54/29 interface=ether6-culleoka-11ghz network=\
|
|
10.250.1.48
|
|
add address=10.250.1.246/29 disabled=yes interface=combo1-380 network=\
|
|
10.250.1.240
|
|
add address=100.64.11.254/22 interface=combo1-380 network=100.64.8.0
|
|
add address=10.10.79.254/20 interface=vlan10_combo1 network=10.10.64.0
|
|
/ip dhcp-server network
|
|
add address=10.10.64.0/20 dns-server=204.110.191.240,204.110.191.20 domain=\
|
|
vntx.net gateway=10.10.79.254 ntp-server=204.110.191.19
|
|
add address=100.64.8.0/22 dns-server=204.110.191.240,204.110.191.20 domain=\
|
|
vntx.net gateway=100.64.11.254 ntp-server=204.110.191.19
|
|
/ip dns
|
|
set servers=9.9.9.9,1.1.1.1
|
|
/ip firewall filter
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (out)" out-interface=ether1-982-60ghz
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (in)" in-interface=ether1-982-60ghz
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (out)" out-interface=ether4-newhope
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (in)" in-interface=ether4-newhope
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (out)" out-interface=\
|
|
ether6-culleoka-11ghz
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (in)" in-interface=ether6-culleoka-11ghz
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (out)" out-interface=ether5-climax
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (in)" in-interface=ether5-climax
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (in)" in-interface=ether3-edge-direct
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (out)" out-interface=ether3-edge-direct
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (in)" in-interface=\
|
|
sfp-sfpplus1-edge-preseem
|
|
add action=accept chain=forward comment=\
|
|
"bypass fasttrack for MPLS spine (out)" out-interface=\
|
|
sfp-sfpplus1-edge-preseem
|
|
add action=fasttrack-connection chain=forward comment=\
|
|
"fasttrack established/related" connection-state=established,related
|
|
add action=drop chain=forward disabled=yes src-address-list=suspended
|
|
add action=drop chain=forward disabled=yes dst-address-list=suspended
|
|
add action=accept chain=forward comment="accept established/related" \
|
|
connection-state=established,related
|
|
/ip ipsec profile
|
|
set [ find default=yes ] dh-group=modp2048 dpd-interval=2m \
|
|
dpd-maximum-failures=5 enc-algorithm=aes-256,aes-128 hash-algorithm=\
|
|
sha256
|
|
/ip proxy
|
|
set port=29347
|
|
/ip proxy access
|
|
add src-address=10.0.0.0/8
|
|
add src-address=100.64.0.0/10
|
|
add src-address=204.110.188.0/22
|
|
add action=deny
|
|
/ip route
|
|
add check-gateway=ping disabled=no dst-address=0.0.0.0/0 gateway=\
|
|
204.110.191.186
|
|
add disabled=no distance=1 dst-address=204.110.188.32/27 gateway=10.250.1.94 \
|
|
routing-table=main scope=30 target-scope=10
|
|
add disabled=no distance=1 dst-address=10.250.1.88/29 gateway=10.250.1.94 \
|
|
routing-table=main scope=30 target-scope=10
|
|
add dst-address=10.254.254.101/32 gateway=10.250.1.94
|
|
add dst-address=10.254.254.102/32 gateway=10.250.1.94
|
|
add dst-address=10.250.1.64/29 gateway=10.250.1.94
|
|
add dst-address=10.250.1.24/29 gateway=10.250.1.94
|
|
add dst-address=10.250.1.8/29 gateway=10.250.1.94
|
|
add dst-address=10.10.16.0/20 gateway=10.250.1.94
|
|
add dst-address=10.10.0.0/20 gateway=10.250.1.94
|
|
add dst-address=204.110.191.0/27 gateway=10.250.1.94
|
|
add dst-address=100.64.4.0/22 gateway=10.250.1.94
|
|
add dst-address=100.64.12.0/22 gateway=10.250.1.94
|
|
add dst-address=100.64.0.0/22 gateway=10.250.1.94
|
|
add dst-address=204.110.188.224/27 gateway=10.250.1.94
|
|
add dst-address=10.250.1.144/29 gateway=10.250.1.94
|
|
add dst-address=10.254.254.111/32 gateway=10.250.1.94
|
|
add dst-address=100.64.160.0/20 gateway=10.250.1.94
|
|
add dst-address=204.110.188.64/27 gateway=10.250.1.94
|
|
/ipv6 route
|
|
add comment="default via preseem (primary)" distance=1 dst-address=::/0 \
|
|
gateway=2606:1c80:0:1002::1
|
|
add comment="default via direct (backup)" distance=2 dst-address=::/0 \
|
|
gateway=2606:1c80:0:11::1
|
|
add comment="edge loopback via preseem" distance=1 dst-address=\
|
|
2606:1c80:0:10::254/128 gateway=2606:1c80:0:1002::1
|
|
add comment="edge loopback via direct" distance=2 dst-address=\
|
|
2606:1c80:0:10::254/128 gateway=2606:1c80:0:11::1
|
|
add blackhole comment="core /44 aggregate (iBGP origin)" distance=200 \
|
|
dst-address=2606:1c80:1400::/44
|
|
add comment="verona loopback via climax" dst-address=2606:1c80:0:10::101/128 \
|
|
gateway=2606:1c80:0:12::2
|
|
add comment="climax loopback via climax P2P" dst-address=\
|
|
2606:1c80:0:10::102/128 gateway=2606:1c80:0:12::2
|
|
add comment="494 loopback (iBGP bootstrap, via climax)" distance=1 \
|
|
dst-address=2606:1c80:0:10::111/128 gateway=2606:1c80:0:12::2
|
|
add comment="982 loopback (iBGP bootstrap)" distance=1 dst-address=\
|
|
2606:1c80:0:10::110/128 gateway=2606:1c80:0:14::2
|
|
add comment="culleoka loopback (iBGP bootstrap)" distance=1 dst-address=\
|
|
2606:1c80:0:10::104/128 gateway=2606:1c80:0:15::2
|
|
add comment="newhope loopback (iBGP bootstrap)" distance=1 dst-address=\
|
|
2606:1c80:0:10::108/128 gateway=2606:1c80:0:13::2
|
|
add comment="lowry loopback (via newhope)" distance=1 dst-address=\
|
|
2606:1c80:0:10::109/128 gateway=2606:1c80:0:13::2
|
|
/ip service
|
|
set ftp disabled=yes
|
|
set telnet address=204.110.188.0/22,10.0.0.0/8 disabled=yes
|
|
set ssh address=204.110.188.0/22,10.0.0.0/8 port=1022
|
|
set www address=204.110.188.225/32 port=2080
|
|
set winbox address=204.110.188.0/22,10.0.0.0/8
|
|
set api address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10
|
|
set api-ssl certificate=myCa
|
|
/ip ssh
|
|
set host-key-type=ed25519 password-authentication=yes strong-crypto=yes
|
|
/ipv6 address
|
|
add address=2606:1c80:0:10::253/128 advertise=no comment=loopback interface=\
|
|
lo
|
|
add address=2606:1c80:0:11::2 advertise=no comment=\
|
|
"P2P core<->edge direct (backup)" interface=ether3-edge-direct
|
|
add address=2606:1c80:0:1002::2 advertise=no comment=\
|
|
"P2P core<->edge via preseem (primary)" interface=\
|
|
sfp-sfpplus1-edge-preseem
|
|
add address=2606:1c80:0:12::1 advertise=no comment="P2P core<->climax" \
|
|
interface=ether5-climax
|
|
add address=2606:1c80:0:13::1 advertise=no comment="P2P core<->newhope" \
|
|
interface=ether4-newhope
|
|
add address=2606:1c80:0:14::1 advertise=no comment="P2P core<->982 60GHz" \
|
|
interface=ether1-982-60ghz
|
|
add address=2606:1c80:0:15::1 advertise=no comment="P2P core<->culleoka" \
|
|
interface=ether6-culleoka-11ghz
|
|
add address=2606:1c80:1400::1 comment="380 mgmt LAN" interface=vlan10_combo1
|
|
add address=2606:1c80:1400:1::1 comment="380 customer LAN (PPPoE+DHCP)" \
|
|
interface=combo1-380
|
|
/ipv6 dhcp-server
|
|
add interface=vlan10_combo1 name=core-mgmt-stateless
|
|
add address-pool=core-cust-pd-1 interface=combo1-380 name=core-cust-pd-server
|
|
/ipv6 firewall filter
|
|
add action=accept chain=input comment=established connection-state=\
|
|
established,related
|
|
add action=drop chain=input comment=invalid connection-state=invalid
|
|
add action=accept chain=input comment=icmpv6 protocol=icmpv6
|
|
add action=accept chain=input comment=link-local src-address=fe80::/10
|
|
add action=accept chain=input comment=internal src-address=2606:1c80::/32
|
|
add action=drop chain=input comment="default deny"
|
|
add action=accept chain=forward comment=established connection-state=\
|
|
established,related
|
|
add action=drop chain=forward comment=invalid connection-state=invalid
|
|
add action=accept chain=forward comment=PMTUD hop-limit=equal:1 protocol=\
|
|
icmpv6
|
|
add action=accept chain=forward comment=icmpv6 protocol=icmpv6
|
|
add action=accept chain=forward comment=internal-to-internal dst-address=\
|
|
2606:1c80::/32 src-address=2606:1c80::/32
|
|
add action=accept chain=forward comment="v6 outbound from 380 tower" \
|
|
src-address=2606:1c80:1400::/44
|
|
add action=drop chain=forward comment="default deny"
|
|
/ipv6 nd
|
|
set [ find default=yes ] advertise-dns=yes
|
|
add advertise-dns=yes interface=vlan10_combo1 other-configuration=yes
|
|
add advertise-dns=yes interface=combo1-380 other-configuration=yes
|
|
/mpls interface
|
|
add interface=ether5-climax mpls-mtu=1508
|
|
add interface=ether6-culleoka-11ghz mpls-mtu=1508
|
|
add interface=ether4-newhope mpls-mtu=1508
|
|
add interface=ether1-982-60ghz mpls-mtu=1508
|
|
add interface=ether3-edge-direct mpls-mtu=1508
|
|
add interface=sfp-sfpplus1-edge-preseem mpls-mtu=1508
|
|
/mpls ldp
|
|
add disabled=no lsr-id=10.254.254.253 transport-addresses=10.254.254.253 vrf=\
|
|
main
|
|
/mpls ldp interface
|
|
add interface=ether5-climax
|
|
add interface=ether6-culleoka-11ghz
|
|
add interface=ether4-newhope
|
|
add interface=ether1-982-60ghz
|
|
/mpls settings
|
|
set propagate-ttl=no
|
|
/ppp aaa
|
|
set use-radius=yes
|
|
/radius
|
|
add address=204.110.191.248 require-message-auth=no service=ppp src-address=\
|
|
204.110.191.185 timeout=300ms
|
|
add address=204.110.191.2 require-message-auth=no service=ppp src-address=\
|
|
204.110.191.185 timeout=300ms
|
|
add accounting-backup=yes address=45.76.56.5 require-message-auth=no service=\
|
|
ppp src-address=204.110.191.185 timeout=300ms
|
|
/routing bfd configuration
|
|
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
|
|
/routing bgp connection
|
|
add afi=ip,ipv6 as=393837 comment="iBGP to edge, v4 transport / v6 NLRI" \
|
|
input.filter=v6-rr-in instance=bgp-instance-1 local.address=\
|
|
2606:1c80:0:10::253 .role=ibgp-rr multihop=yes name=ibgp-rr-edge \
|
|
nexthop-choice=default output.filter-chain=v6-rr-out .redistribute=\
|
|
connected,static remote.address=2606:1c80:0:10::254 .as=393837 templates=\
|
|
default
|
|
add afi=ip,ipv6 as=393837 comment="RR client: climax" input.filter=v6-rr-in \
|
|
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
|
multihop=yes name=ibgp-rr-climax nexthop-choice=default \
|
|
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
|
remote.address=2606:1c80:0:10::102 .as=393837 templates=default
|
|
add afi=ip,ipv6 as=393837 comment="RR client: culleoka" input.filter=v6-rr-in \
|
|
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
|
multihop=yes name=ibgp-rr-culleoka nexthop-choice=default \
|
|
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
|
remote.address=2606:1c80:0:10::104 .as=393837 templates=default
|
|
add afi=ip,ipv6 as=393837 comment="RR client: newhope" input.filter=v6-rr-in \
|
|
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
|
multihop=yes name=ibgp-rr-newhope nexthop-choice=default \
|
|
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
|
remote.address=2606:1c80:0:10::108 .as=393837 templates=default
|
|
add afi=ip,ipv6 as=393837 comment="RR client: lowry" input.filter=v6-rr-in \
|
|
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
|
multihop=yes name=ibgp-rr-lowry nexthop-choice=default \
|
|
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
|
remote.address=2606:1c80:0:10::109 .as=393837 templates=default
|
|
add afi=ip,ipv6 as=393837 comment="RR client: 982" input.filter=v6-rr-in \
|
|
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
|
multihop=yes name=ibgp-rr-982 nexthop-choice=default output.filter-chain=\
|
|
v6-rr-out .redistribute=connected,static remote.address=\
|
|
2606:1c80:0:10::110 .as=393837 templates=default
|
|
add afi=ip,ipv6 as=393837 comment="RR client: 494" input.filter=v6-rr-in \
|
|
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
|
multihop=yes name=ibgp-rr-494 nexthop-choice=default output.filter-chain=\
|
|
v6-rr-out .redistribute=connected,static remote.address=\
|
|
2606:1c80:0:10::111 .as=393837 templates=default
|
|
add afi=ip,ipv6 as=393837 comment="RR client: verona" input.filter=v6-rr-in \
|
|
instance=bgp-instance-1 local.address=2606:1c80:0:10::253 .role=ibgp-rr \
|
|
multihop=yes name=ibgp-rr-verona nexthop-choice=default \
|
|
output.filter-chain=v6-rr-out .redistribute=connected,static \
|
|
remote.address=2606:1c80:0:10::101 .as=393837 templates=default
|
|
/routing filter rule
|
|
add chain=ospf-in disabled=no rule="accept;"
|
|
add chain=ospf-out disabled=no rule="accept;"
|
|
add chain=v6-ibgp-out disabled=no rule="if (dst==2606:1c80:1400::/44 || dst==2\
|
|
606:1c80:0:10::253/128 || (dst-len==64 && (dst==2606:1c80:0:11::/64 || dst\
|
|
==2606:1c80:0:12::/64 || dst==2606:1c80:0:13::/64 || dst==2606:1c80:0:14::\
|
|
/64 || dst==2606:1c80:0:15::/64 || dst==2606:1c80:0:1002::/64))) { accept;\
|
|
\_} else { reject; }"
|
|
add chain=v6-rr-out disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len=\
|
|
=64 || dst-len==128) { accept; } else { reject; }"
|
|
add chain=v6-rr-in disabled=no rule="if (dst==::/0 || dst-len==44 || dst-len==\
|
|
64 || dst-len==128) { accept; } else { reject; }"
|
|
/routing ospf interface-template
|
|
add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=\
|
|
sfp-sfpplus1-edge-preseem priority=1 type=ptp use-bfd=yes
|
|
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
|
ether5-climax priority=1 type=ptp use-bfd=no
|
|
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
|
ether4-newhope priority=1 type=ptp use-bfd=no
|
|
add area=backbone-v2 auth-id=1 cost=100 disabled=no interfaces=\
|
|
ether3-edge-direct priority=1 type=ptp use-bfd=yes
|
|
add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=ether2-office \
|
|
priority=1 type=nbma use-bfd=no
|
|
add area=backbone-v2 auth-id=1 cost=10 disabled=no interfaces=\
|
|
ether1-982-60ghz priority=1 type=ptp use-bfd=no
|
|
add area=backbone-v2 auth=sha512 auth-id=1 cost=10 disabled=no interfaces=\
|
|
ether6-culleoka-11ghz priority=1 type=ptp use-bfd=no
|
|
/routing ospf static-neighbor
|
|
add address=204.110.191.186%sfp-sfpplus1-edge-preseem area=backbone-v2 \
|
|
disabled=no
|
|
add address=10.250.2.1%ether2-office area=backbone-v2 disabled=no
|
|
/routing rip static-neighbor
|
|
add address="" disabled=no instance=*1
|
|
/routing rule
|
|
add action=lookup-only-in-table disabled=yes src-address=10.10.0.0/16 table=\
|
|
testnat
|
|
add action=lookup-only-in-table disabled=yes src-address=100.64.0.0/22 table=\
|
|
testnat
|
|
add action=lookup-only-in-table disabled=yes src-address=100.64.0.0/10 table=\
|
|
testnat
|
|
/snmp
|
|
set contact=graham@vntx.net enabled=yes location="33.174156, -96.491941" \
|
|
trap-generators=temp-exception,interfaces,start-trap trap-interfaces=all \
|
|
trap-target=204.110.191.234
|
|
/system clock
|
|
set time-zone-name=America/Chicago
|
|
/system identity
|
|
set name=Core
|
|
/system logging
|
|
add action=logs topics=info
|
|
add action=logs disabled=yes prefix=ospf topics=ospf
|
|
/system ntp client
|
|
set enabled=yes
|
|
/system ntp client servers
|
|
add address=204.110.191.19
|
|
add address=0.us.pool.ntp.org
|
|
add address=216.229.4.66
|
|
add address=1.us.pool.ntp.org
|
|
/system package update
|
|
set channel=long-term
|
|
/system scheduler
|
|
add name=reboot on-event="/system reboot\
|
|
\n" policy=\
|
|
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
|
|
start-date=2025-01-07 start-time=04:00:00
|
|
/tool graphing interface
|
|
add
|
|
/tool graphing queue
|
|
add
|
|
/tool graphing resource
|
|
add
|