168 lines
9.4 KiB
Text
168 lines
9.4 KiB
Text
# =============================================================================
|
|
# edge — IPv6 apply script (ROS 6.49.18, BGP-only / no OSPFv3)
|
|
# =============================================================================
|
|
#
|
|
# Edge is the iBGP hub: it terminates the TWC v6 eBGP peering and the v4
|
|
# transport iBGP sessions to every tower. v6 NLRI rides v4 transport (so the
|
|
# existing v4 OSPF reachability between loopbacks is reused; no v6 IGP is
|
|
# needed). This matches the verona-v6-apply.rsc design choice.
|
|
#
|
|
# Two paths edge<->core:
|
|
# 1. PRIMARY: sfp-sfpplus11-preseem, /127 via the Preseem shaper
|
|
# (transparent L2). OSPFv2 cost on edge is the default 10. v6 P2P:
|
|
# 2606:1c80:0:1002::1 (edge) <-> :2 (core)
|
|
# 2. BACKUP: sfp-sfpplus7-core-direct, /127 direct fiber. OSPFv2 cost on
|
|
# edge is 100 (same on core's side). v6 P2P:
|
|
# 2606:1c80:0:11::1 (edge) <-> :2 (core)
|
|
# Static v6 routes for the infra /48 mirror that cost relationship by
|
|
# distance (lower = preferred): preseem at distance=1, direct at
|
|
# distance=2.
|
|
#
|
|
# What this script DOES NOT touch (USER CONSTRAINT 2026-05-09):
|
|
# * TWC v6 eBGP peer `twc-v6` (remote 2605:6000:0:8::f:372, AS11427) —
|
|
# name doesn't match the ^ibgp- wipe pattern, so it survives.
|
|
# * The 2606:1c80::/32 BGP network announcement upstream.
|
|
# * The TWC P2P address 2605:6000:0:8::f:373/127 on sfp-sfpplus12-spectrum
|
|
# — enabled, so it survives the [find disabled=yes] wipe.
|
|
# * The existing server LAN address 2606:1c80::1 on vlan9_sfpplus8 —
|
|
# enabled, so it survives. We only ADD a per-interface ND override
|
|
# to suppress RA there; the IP and prefix are unmodified.
|
|
# * v4 OSPFv2 / RIP / firewall rules — v4 control plane is unchanged.
|
|
#
|
|
# Apply order: review -> paste in winbox/SSH on edge -> verify with checks
|
|
# at the bottom -> only then run the matching `core-v6-apply.rsc` so the
|
|
# preseem and direct /127 endpoints come up symmetrically.
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# WIPE — only the stale internal-only v6 state on edge. Leaves TWC peering,
|
|
# the upstream /32 announcement, the server LAN address, and v4 alone.
|
|
# -----------------------------------------------------------------------------
|
|
# Drop any disabled placeholder v6 internal addresses (none on edge today,
|
|
# but harmless if present).
|
|
/ipv6 address remove [find disabled=yes]
|
|
|
|
# Drop any leftover OSPFv3 interface entries (we are committing to BGP-only
|
|
# for v6; any v3 instances on edge have been minimal/stub).
|
|
/routing ospf-v3 interface remove [find]
|
|
|
|
# Drop only internal iBGP v6 peers if any exist; never touch twc-v6.
|
|
/routing bgp peer remove [find name~"^ibgp-" and address-families~"ipv6"]
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — addresses
|
|
# -----------------------------------------------------------------------------
|
|
/ipv6 settings set forward=yes accept-router-advertisements=no
|
|
|
|
/ipv6 address
|
|
add address=2606:1c80:0:10::254/128 interface=loopback advertise=no comment="edge loopback"
|
|
add address=2606:1c80:0:11::1/127 interface=sfp-sfpplus7-core-direct advertise=no comment="P2P edge<->core direct (backup)"
|
|
add address=2606:1c80:0:1002::1/127 interface=sfp-sfpplus11-preseem advertise=no comment="P2P edge<->core via preseem (primary)"
|
|
|
|
# NOTE: the server LAN address 2606:1c80::1 on vlan9_sfpplus8 is left
|
|
# untouched per user constraint. The ND override below makes it RA-free
|
|
# without modifying the address itself.
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — neighbour discovery: SUPPRESS RA on the server LAN
|
|
# -----------------------------------------------------------------------------
|
|
# Server LAN is static-only per the IPv6 plan — disable RA + DHCPv6 hints.
|
|
# A per-interface entry overrides the global default.
|
|
/ipv6 nd
|
|
add interface=vlan9_sfpplus8 disabled=no advertise=no managed-address-configuration=no other-configuration=no comment="server LAN: static only, no SLAAC"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — static routes (replace what an IGP would have learned)
|
|
# -----------------------------------------------------------------------------
|
|
# Infra /48 covers all router loopbacks (2606:1c80:0:10::/64), all P2P
|
|
# /127s, and any future infra slots. Two entries with different distances
|
|
# pin preseem as primary and direct as backup. The connected /64 server
|
|
# LAN at 2606:1c80::/64 wins by longest-prefix-match, so this /48 doesn't
|
|
# steal local server traffic.
|
|
/ipv6 route
|
|
add dst-address=2606:1c80::/48 gateway=2606:1c80:0:1002::2 distance=1 comment="infra: via preseem (primary)"
|
|
add dst-address=2606:1c80::/48 gateway=2606:1c80:0:11::2 distance=2 comment="infra: via direct (backup)"
|
|
|
|
# Tower /44s are learned via iBGP from each tower (next-hop = tower's v6
|
|
# loopback inside :10::/64, recursively resolved through the /48 above).
|
|
# No static needed for them.
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — firewall (extend the existing minimal v6 ruleset)
|
|
# -----------------------------------------------------------------------------
|
|
# The existing v6 firewall already accepts BGP (179) and established. Add
|
|
# the rules required for internal-network forwarding + ICMPv6 / link-local.
|
|
/ipv6 firewall filter
|
|
add chain=input action=accept protocol=icmpv6 comment="icmpv6 input"
|
|
add chain=input action=accept src-address=fe80::/10 comment="link-local input"
|
|
add chain=input action=accept src-address=2606:1c80::/32 comment="internal input"
|
|
|
|
add chain=forward action=accept protocol=icmpv6 hop-limit=equal:1 comment="PMTUD forward"
|
|
add chain=forward action=accept protocol=icmpv6 comment="icmpv6 forward"
|
|
add chain=forward action=accept src-address=2606:1c80::/32 dst-address=2606:1c80::/32 comment="internal<->internal"
|
|
|
|
# (we do not add a default-deny; edge has long-running customer transit
|
|
# paths and a sudden v6 default-deny would break them. existing rules at
|
|
# the bottom of /ipv6 firewall filter remain authoritative.)
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — iBGP route filters (v6)
|
|
# -----------------------------------------------------------------------------
|
|
# in-filter: accept any /44 inside the tower allocation block 2606:1c80:1000::/36.
|
|
# Anything else from a tower iBGP peer is rejected (defense in depth — we
|
|
# don't want a tower advertising the world to us).
|
|
/routing filter
|
|
add chain=ibgp-tower-in-v6 prefix=2606:1c80:1000::/36 prefix-length=44 action=accept comment="tower /44 customer aggregate"
|
|
add chain=ibgp-tower-in-v6 prefix=2606:1c80:0:10::/64 prefix-length=128 action=accept comment="tower v6 loopback"
|
|
add chain=ibgp-tower-in-v6 action=discard comment="default deny"
|
|
|
|
# out-filter: edge sends ONLY the v6 default to towers. Towers don't need
|
|
# anything else from edge — they reach customers via their own routes and
|
|
# transit upstream via the default.
|
|
add chain=ibgp-tower-out-v6 prefix=::/0 prefix-length=0 action=accept comment="default route to tower"
|
|
add chain=ibgp-tower-out-v6 action=discard comment="default deny"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLY — iBGP peer to verona (over v4 transport, carrying v6 NLRI)
|
|
# -----------------------------------------------------------------------------
|
|
# ROS6 syntax: address-families=ipv6 with a v4 remote-address gives
|
|
# MP-BGP v6-NLRI-over-v4-TCP. update-source=loopback ensures the TCP
|
|
# session sources from the v4 loopback (10.254.254.254).
|
|
# nexthop-choice=force-self pins the v6 next-hop edge advertises to
|
|
# its own v6 loopback (2606:1c80:0:10::254), reachable from verona once
|
|
# climax has its v6 apply.
|
|
/routing bgp peer
|
|
add name=ibgp-verona-v6 \
|
|
remote-address=10.254.254.101 remote-as=393837 \
|
|
update-source=loopback \
|
|
address-families=ipv6 \
|
|
nexthop-choice=force-self \
|
|
in-filter=ibgp-tower-in-v6 out-filter=ibgp-tower-out-v6 \
|
|
default-originate=always \
|
|
comment="iBGP to verona, v4 transport / v6 NLRI"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# VERIFY (paste after apply)
|
|
# -----------------------------------------------------------------------------
|
|
# /ipv6 address print
|
|
# /ipv6 route print where active
|
|
# /ipv6 nd print
|
|
# /routing bgp peer print where name~"v6"
|
|
# /routing bgp advertisements print peer=ibgp-verona-v6
|
|
#
|
|
# Expected immediately:
|
|
# * /ipv6 address print shows 2606:1c80:0:10::254/128 (loopback),
|
|
# :11::1/127 (direct), :1002::1/127 (preseem), :1::/64 server LAN
|
|
# * /ipv6 nd print shows the vlan9_sfpplus8 entry with advertise=no
|
|
# * the new /48 routes show as inactive (gateway unreachable until core
|
|
# applies), which is fine
|
|
# * ibgp-verona-v6 is in `connecting` state until verona reaches edge's
|
|
# v6 loopback (which needs core configured) — for the bare TCP
|
|
# session, v4 loopback reachability is enough so the session SHOULD
|
|
# come up immediately. confirm with /routing bgp peer print.
|
|
#
|
|
# Once core has its matching v6 apply:
|
|
# /ping 2606:1c80:0:1002::2 count=3 ;; core preseem-side
|
|
# /ping 2606:1c80:0:11::2 count=3 ;; core direct-side
|
|
# /ping 2606:1c80:0:10::253 count=3 ;; core loopback (via preseem)
|
|
# /ip route check dst=2606:1c80:0:10::101 ;; verona loopback path
|