13 changed files with 1010 additions and 18 deletions
Unified View
Diff Options
-
+54 -0README.txt
-
+11 -3includes/junos-macros.j2
-
+1 -1includes/junos-v21-core-router/chassis.j2
-
+212 -0includes/junos-v21-core-router/firewall.j2
-
+1 -1includes/junos-v21-core-router/forwarding-options.j2
-
+1 -1includes/junos-v21-core-router/groups.j2
-
+14 -5includes/junos-v21-core-router/interfaces.j2
-
+468 -0includes/junos-v21-core-router/policy-options.j2
-
+146 -0includes/junos-v21-core-router/protocols.j2
-
+77 -2includes/junos-v21-core-router/routing-options.j2
-
+5 -0includes/junos-v21-core-router/snmp.j2
-
+13 -5includes/junos-v21-core-router/system.j2
-
+7 -0junos-v21-core-router.j2
@ -0,0 +1,54 @@ |
|||||
|
59811:666 => /24 = only send to Voxility |
||||
|
/32 = announce to RTBH on ixs/upstreams/UTRS |
||||
|
65535:666 => COMMUNITY-AS59811-BLACKHOLE |
||||
|
|
||||
|
59811:6500x => originated from site |
||||
|
| |
||||
|
x => 0 = all |
||||
|
1 = TN2 |
||||
|
2 = LD5 |
||||
|
3 = MA1 |
||||
|
4 = PUE |
||||
|
|
||||
|
650xy:zzzzz |
||||
|
|||| |
||||
|
x => 0 = all |
||||
|
| | 1 = TN2 |
||||
|
| | 2 = LD5 |
||||
|
| | 3 = MA1 |
||||
|
| | 4 = PUE |
||||
|
| | |
||||
|
y => 0 = no-announce |
||||
|
| 1 = prepend 1 |
||||
|
| 2 = prepend 2 |
||||
|
| 3 = prepend 3 |
||||
|
| 9 = no-export |
||||
|
| |
||||
|
zzzzz => 0 = any peer/upstream/downstream |
||||
|
1299 = Arelion |
||||
|
2914 = NTT |
||||
|
3223 = Voxility (NB see also 59811:666) |
||||
|
6762 = TISparkle |
||||
|
65511 = Tampnet (would be 200781) |
||||
|
|
||||
|
65521 = LON1 |
||||
|
65522 = LON2 |
||||
|
65523 = LINX Manchester |
||||
|
65524 = LINX Scotland |
||||
|
65525 = LONAP |
||||
|
|
||||
|
|
||||
|
|
||||
|
LOCAL PREFERENCES |
||||
|
|
||||
|
100 => transit (de-pref) |
||||
|
200 => transit |
||||
|
300 => transit (up-pref) |
||||
|
|
||||
|
400 => peering (de-pref) |
||||
|
500 => peering |
||||
|
600 => peering (up-pref) |
||||
|
|
||||
|
700 => downstream (de-pref) |
||||
|
800 => downstream |
||||
|
900 => downstream (up-pref) |
||||
@ -0,0 +1,212 @@ |
|||||
|
{{ "firewall"|progress }} { |
||||
|
|
||||
|
{%- set bgp_multihop_prefixes_v4 = [] %} |
||||
|
{%- set bgp_multihop_prefixes_v6 = [] %} |
||||
|
{%- for prefix in 'bgp-multihop'|get_netbox_tagged_prefixes %} |
||||
|
{%- if prefix|ipv4 %}{% do bgp_multihop_prefixes_v4.append( prefix ) %} |
||||
|
{%- elif prefix|ipv6 %}{% do bgp_multihop_prefixes_v6.append( prefix ) %} |
||||
|
{%- endif %} |
||||
|
{%- endfor %} |
||||
|
|
||||
|
{%- set bgp_allowed_prefixes_v4 = [] %} |
||||
|
{%- set bgp_allowed_prefixes_v6 = [] %} |
||||
|
{%- for prefix in 'bgp-allowed'|get_netbox_tagged_prefixes %} |
||||
|
{%- if prefix|ipv4 %}{% do bgp_allowed_prefixes_v4.append( prefix ) %} |
||||
|
{%- elif prefix|ipv6 %}{% do bgp_allowed_prefixes_v6.append( prefix ) %} |
||||
|
{%- endif %} |
||||
|
{%- endfor %} |
||||
|
|
||||
|
{%- set ldp_allowed_prefixes_v4 = [] %} |
||||
|
{%- set ldp_allowed_prefixes_v6 = [] %} |
||||
|
{%- for prefix in 'ldp-allowed'|get_netbox_tagged_prefixes %} |
||||
|
{%- if prefix|ipv4 %}{% do ldp_allowed_prefixes_v4.append( prefix ) %} |
||||
|
{%- elif prefix|ipv6 %}{% do ldp_allowed_prefixes_v6.append( prefix ) %} |
||||
|
{%- endif %} |
||||
|
{%- endfor %} |
||||
|
|
||||
|
family inet { |
||||
|
filter control-plane-protection-IPv4 { |
||||
|
|
||||
|
{% if bgp_multihop_prefixes_v4 %} |
||||
|
term allow-multihop-bgp { |
||||
|
from { |
||||
|
source-address { |
||||
|
{% for prefix in bgp_multihop_prefixes_v4 %} |
||||
|
{{ prefix }}; /* {{ prefix.description }} */ |
||||
|
{% endfor %} |
||||
|
} |
||||
|
protocol tcp; |
||||
|
port 179; |
||||
|
} |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
{% endif %} |
||||
|
{% if bgp_allowed_prefixes_v4 %} |
||||
|
term allow-gtsm-bgp { |
||||
|
from { |
||||
|
protocol tcp; |
||||
|
source-address { |
||||
|
{% for prefix in bgp_allowed_prefixes_v4 %} |
||||
|
{{ prefix }}; /* {{ prefix.description }} */ |
||||
|
{% endfor %} |
||||
|
} |
||||
|
tcp-initial; |
||||
|
ttl 255; |
||||
|
port 179; |
||||
|
} |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term allow-established-bgp { |
||||
|
from { |
||||
|
protocol tcp; |
||||
|
source-address { |
||||
|
{% for prefix in 'bgp-allowed'|get_netbox_tagged_prefixes %}{% if prefix|ipv4 %} |
||||
|
{{ prefix }}; /* {{ prefix.description }} */ |
||||
|
{% endif %}{% endfor %} |
||||
|
} |
||||
|
tcp-established; |
||||
|
port 179; |
||||
|
} |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
{% endif %} |
||||
|
term reject-bgp { |
||||
|
from { |
||||
|
protocol tcp; |
||||
|
port 179; |
||||
|
} |
||||
|
then { |
||||
|
reject tcp-reset; |
||||
|
} |
||||
|
} |
||||
|
{% if ldp_allowed_prefixes_v4 %} |
||||
|
term allow-ldp { |
||||
|
from { |
||||
|
source-address { |
||||
|
{% for prefix in ldp_allowed_prefixes_v4 %} |
||||
|
{{ prefix }}; /* {{ prefix.description }} */ |
||||
|
{% endfor %} |
||||
|
} |
||||
|
protocol tcp; |
||||
|
port 646; |
||||
|
} |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
{% endif %} |
||||
|
term reject-ldp { |
||||
|
from { |
||||
|
protocol tcp; |
||||
|
port 646; |
||||
|
} |
||||
|
then { |
||||
|
reject tcp-reset; |
||||
|
} |
||||
|
} |
||||
|
term else { |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
family inet6 { |
||||
|
filter control-plane-protection-IPv6 { |
||||
|
{% if bgp_multihop_prefixes_v6 %} |
||||
|
term allow-multihop-bgp { |
||||
|
from { |
||||
|
source-address { |
||||
|
{% for prefix in bgp_multihop_prefixes_v6 %} |
||||
|
{{ prefix }}; /* {{ prefix.description }} */ |
||||
|
{% endfor %} |
||||
|
} |
||||
|
next-header tcp; |
||||
|
destination-port 179; |
||||
|
} |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
{% endif %} |
||||
|
{% if bgp_allowed_prefixes_v6 %} |
||||
|
term allow-gtsm-bgp { |
||||
|
from { |
||||
|
next-header tcp; |
||||
|
source-address { |
||||
|
{% for prefix in bgp_allowed_prefixes_v6 %} |
||||
|
{{ prefix }}; /* {{ prefix.description }} */ |
||||
|
{% endfor %} |
||||
|
} |
||||
|
hop-limit 255; |
||||
|
tcp-initial; |
||||
|
destination-port 179; |
||||
|
} |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term allow-established-bgp { |
||||
|
from { |
||||
|
next-header tcp; |
||||
|
source-address { |
||||
|
{% for prefix in bgp_allowed_prefixes_v6 %} |
||||
|
{{ prefix }}; /* {{ prefix.description }} */ |
||||
|
{% endfor %} |
||||
|
} |
||||
|
tcp-established; |
||||
|
destination-port 179; |
||||
|
} |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
{% endif %} |
||||
|
term reject-bgp { |
||||
|
from { |
||||
|
next-header tcp; |
||||
|
destination-port 179; |
||||
|
} |
||||
|
then { |
||||
|
reject tcp-reset; |
||||
|
} |
||||
|
} |
||||
|
{% if ldp_allowed_prefixes_v6 %} |
||||
|
term allow-ldp { |
||||
|
from { |
||||
|
next-header tcp; |
||||
|
source-address { |
||||
|
{% for prefix in ldp_allowed_prefixes_v6 %} |
||||
|
{{ prefix }}; /* {{ prefix.description }} */ |
||||
|
{% endfor %} |
||||
|
} |
||||
|
destination-port 646; |
||||
|
} |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
{% endif %} |
||||
|
term reject-ldp { |
||||
|
from { |
||||
|
next-header tcp; |
||||
|
destination-port 646; |
||||
|
} |
||||
|
then { |
||||
|
reject tcp-reset; |
||||
|
} |
||||
|
} |
||||
|
term else { |
||||
|
then { |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,468 @@ |
|||||
|
{{ "policy-options"|progress }} { |
||||
|
|
||||
|
{# |
||||
|
prefix-list V6 { |
||||
|
2001:db9::/32; |
||||
|
} |
||||
|
prefix-list V4 { |
||||
|
192.0.2.0/24; |
||||
|
} |
||||
|
#} |
||||
|
|
||||
|
policy-statement EXPORT-PROTECT-reject { |
||||
|
term 10 { |
||||
|
from as-path-group NEVER-TO-UPSTREAM-OR-PEERS; |
||||
|
then reject; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
route-filter-list BOGONS-IPv4 { |
||||
|
0.0.0.0/8 orlonger; |
||||
|
10.0.0.0/8 orlonger; |
||||
|
100.64.0.0/10 orlonger; |
||||
|
127.0.0.0/8 orlonger; |
||||
|
169.254.0.0/16 orlonger; |
||||
|
172.16.0.0/12 orlonger; |
||||
|
192.0.0.0/24 orlonger; |
||||
|
192.0.2.0/24 orlonger; |
||||
|
192.168.0.0/16 orlonger; |
||||
|
198.18.0.0/15 orlonger; |
||||
|
198.51.100.0/24 orlonger; |
||||
|
203.0.113.0/24 orlonger; |
||||
|
224.0.0.0/4 orlonger; |
||||
|
240.0.0.0/4 orlonger; |
||||
|
} |
||||
|
|
||||
|
route-filter-list BOGONS-IPv6 { |
||||
|
::/128 exact; |
||||
|
::1/128 exact; |
||||
|
::ffff:0:0/96 orlonger; |
||||
|
::/96 orlonger; |
||||
|
100::/64 orlonger; |
||||
|
2001:10::/28 orlonger; |
||||
|
2001:db8::/32 orlonger; |
||||
|
fc00::/7 orlonger; |
||||
|
fe80::/10 orlonger; |
||||
|
fec0::/10 orlonger; |
||||
|
ff00::/8 orlonger; |
||||
|
} |
||||
|
|
||||
|
route-filter-list DFZ-IPv4 { |
||||
|
0.0.0.0/0 prefix-length-range /8-/24; |
||||
|
} |
||||
|
|
||||
|
route-filter-list DFZ-IPv6 { |
||||
|
::/0 prefix-length-range /20-/48; |
||||
|
} |
||||
|
|
||||
|
policy-statement BOGONS-reject { |
||||
|
term 24 { |
||||
|
from { |
||||
|
family inet; |
||||
|
route-filter-list BOGONS-IPv4; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
term 26 { |
||||
|
from { |
||||
|
family inet6; |
||||
|
route-filter-list BOGONS-IPv6; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
policy-statement DEFAULT-accept { |
||||
|
term 14 { |
||||
|
from { |
||||
|
family inet; |
||||
|
route-filter 0.0.0.0/0 exact; |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
term 16 { |
||||
|
from { |
||||
|
family inet6; |
||||
|
route-filter ::/0 exact; |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
policy-statement DFZ-accept { |
||||
|
term 14 { |
||||
|
from { |
||||
|
family inet; |
||||
|
route-filter 0.0.0.0/0 exact; |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
term 16 { |
||||
|
from { |
||||
|
family inet6; |
||||
|
route-filter ::/0 exact; |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
policy-statement IBGP-import-IPv4 { |
||||
|
then accept; |
||||
|
} |
||||
|
policy-statement IBGP-import-IPv6 { |
||||
|
then accept; |
||||
|
} |
||||
|
policy-statement IBGP-export-IPv4 { |
||||
|
term 10 { |
||||
|
from { |
||||
|
protocol [ direct static ]; |
||||
|
} |
||||
|
then { |
||||
|
local-preference add 900; |
||||
|
next-hop self; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 25 { |
||||
|
from { |
||||
|
protocol bgp; |
||||
|
route-type external; |
||||
|
} |
||||
|
then { |
||||
|
next-hop self; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 29 { |
||||
|
from { |
||||
|
protocol bgp; |
||||
|
community COMMUNITY-AS59811-BLACKHOLE; |
||||
|
route-type external; |
||||
|
} |
||||
|
then { |
||||
|
next-hop 193.162.44.0; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 30 { |
||||
|
from { |
||||
|
protocol bgp; |
||||
|
route-type external; |
||||
|
} |
||||
|
then { |
||||
|
next-hop self; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 40 { |
||||
|
from protocol bgp; |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
policy-statement IBGP-export-IPv6 { |
||||
|
term 10 { |
||||
|
from { |
||||
|
protocol [ direct static ]; |
||||
|
} |
||||
|
then { |
||||
|
local-preference add 900; |
||||
|
next-hop self; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 25 { |
||||
|
from { |
||||
|
protocol bgp; |
||||
|
route-type external; |
||||
|
} |
||||
|
then { |
||||
|
next-hop self; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 29 { |
||||
|
from { |
||||
|
protocol bgp; |
||||
|
community COMMUNITY-AS59811-BLACKHOLE; |
||||
|
route-type external; |
||||
|
} |
||||
|
then { |
||||
|
next-hop 2a10:f0c0::; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 30 { |
||||
|
from { |
||||
|
protocol bgp; |
||||
|
route-type external; |
||||
|
} |
||||
|
then { |
||||
|
next-hop self; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 40 { |
||||
|
from protocol bgp; |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
|
||||
|
policy-statement LOAD-BALANCING { |
||||
|
then { |
||||
|
load-balance per-packet; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
policy-statement CONDITIONAL-DEFAULT-IPv4 { |
||||
|
term 10 { |
||||
|
from { |
||||
|
protocol bgp; |
||||
|
route-filter 198.41.0.0/24 exact; /* a.root-servers.net */ |
||||
|
route-filter 192.228.79.0/24 exact; /* b.root-servers.net */ |
||||
|
route-filter 192.33.4.0/24 exact; /* c.root-servers.net */ |
||||
|
route-filter 128.8.0.0/16 exact; /* d.root-servers.net */ |
||||
|
route-filter 192.203.230.0/24 exact; /* e.root-servers.net */ |
||||
|
route-filter 192.5.5.0/24 exact; /* f.root-servers.net */ |
||||
|
route-filter 192.112.36.0/24 exact; /* g.root-servers.net */ |
||||
|
route-filter 128.63.0.0/16 exact; /* h.root-servers.net */ |
||||
|
route-filter 192.36.148.0/24 exact; /* i.root-servers.net */ |
||||
|
route-filter 192.58.128.0/24 exact; /* j.root-servers.net */ |
||||
|
route-filter 193.0.14.0/24 exact; /* k.root-servers.net */ |
||||
|
route-filter 198.32.64.0/24 exact; /* l.root-servers.net */ |
||||
|
route-filter 202.12.27.0/24 exact; /* m.root-servers.net */ |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
|
||||
|
policy-statement CONDITIONAL-DEFAULT-IPv6 { |
||||
|
term 10 { |
||||
|
from { |
||||
|
protocol bgp; |
||||
|
route-filter 2001:503:ba3e::/48 exact; /* a.root-servers.net */ |
||||
|
route-filter 2001:500:2f::/48 exact; /* b.root-servers.net */ |
||||
|
route-filter 2001:500:1::/48 exact; /* c.root-servers.net */ |
||||
|
route-filter 2001:500:2d::/48 exact; /* d.root-servers.net */ |
||||
|
route-filter 2001:500:a8::/48 exact; /* e.root-servers.net */ |
||||
|
route-filter 2001:500:2f::/48 exact; /* f.root-servers.net */ |
||||
|
route-filter 2001:500:12::/48 exact; /* g.root-servers.net */ |
||||
|
route-filter 2001:500:1::/48 exact; /* h.root-servers.net */ |
||||
|
route-filter 2001:7fe::/33 exact; /* i.root-servers.net */ |
||||
|
route-filter 2001:503:c27::/48 exact; /* j.root-servers.net */ |
||||
|
route-filter 2001:7fd::/48 exact; /* k.root-servers.net */ |
||||
|
route-filter 2001:500:9f::/48 exact; /* l.root-servers.net */ |
||||
|
route-filter 2001:dc3::/32 exact; /* m.root-servers.net */ |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
|
||||
|
policy-statement LINX-LON1-IPv4-IN { |
||||
|
term 4 { |
||||
|
from { |
||||
|
family inet; |
||||
|
route-filter 0.0.0.0/0 prefix-length-range /0-/7; |
||||
|
route-filter 0.0.0.0/0 prefix-length-range /25-/32; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
term 6 { |
||||
|
from as-path-group LINX-LON1-ASPATH-DEPREFER; |
||||
|
then { |
||||
|
metric 10; |
||||
|
local-preference 400; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 10 { |
||||
|
then { |
||||
|
metric 10; |
||||
|
local-preference 500; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
|
||||
|
policy-statement LINX-LON1-IPv4-OUT { |
||||
|
term 5 { |
||||
|
from { |
||||
|
family inet; |
||||
|
route-filter 0.0.0.0/0 prefix-length-range /0-/7; |
||||
|
route-filter 0.0.0.0/0 prefix-length-range /25-/32; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
|
||||
|
policy-statement LINX-LON1-IPv6-IN { |
||||
|
term 4 { |
||||
|
from { |
||||
|
family inet6; |
||||
|
route-filter ::/0 prefix-length-range /0-/16; |
||||
|
route-filter ::/0 prefix-length-range /49-/128; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
term 6 { |
||||
|
from as-path-group LINX-LON1-ASPATH-DEPREFER; |
||||
|
then { |
||||
|
metric 10; |
||||
|
local-preference 400; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
term 10 { |
||||
|
then { |
||||
|
metric 10; |
||||
|
local-preference 500; |
||||
|
accept; |
||||
|
} |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
|
||||
|
policy-statement LINX-LON1-IPv6-OUT { |
||||
|
term 5 { |
||||
|
from { |
||||
|
family inet6; |
||||
|
route-filter ::/0 prefix-length-range /0-/16; |
||||
|
route-filter ::/0 prefix-length-range /25-/32; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
|
||||
|
policy-statement UPSTREAM-export-IPv4 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
community COMMUNITY-ORIGIN-AS59811; |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
policy-statement UPSTREAM-import-IPv4 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
family inet; |
||||
|
route-filter 0.0.0.0/0 prefix-length-range /8-/24; |
||||
|
} |
||||
|
then { |
||||
|
accept; /* XXX this needs to go! */ |
||||
|
} |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
policy-statement UPSTREAM-export-IPv6 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
community COMMUNITY-ORIGIN-AS59811; |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
policy-statement UPSTREAM-import-IPv6 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
family inet6; |
||||
|
route-filter ::/0 prefix-length-range /16-/48; |
||||
|
} |
||||
|
then { |
||||
|
accept; /* XXX this needs to go! */ |
||||
|
} |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
policy-statement PEER-export-IPv4 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
community COMMUNITY-ORIGIN-AS59811; |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
policy-statement PEER-import-IPv4 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
family inet; |
||||
|
route-filter 0.0.0.0/0 prefix-length-range /8-/24; |
||||
|
} |
||||
|
then { |
||||
|
community delete COMMUNITY-AS59811-STAR; |
||||
|
accept; /* XXX this needs to go! */ |
||||
|
} |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
policy-statement PEER-export-IPv6 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
community COMMUNITY-ORIGIN-AS59811; |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
policy-statement PEER-import-IPv6 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
family inet6; |
||||
|
route-filter ::/0 prefix-length-range /16-/48; |
||||
|
} |
||||
|
then { |
||||
|
community delete COMMUNITY-AS59811-STAR; |
||||
|
accept; /* XXX this needs to go! */ |
||||
|
} |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
|
||||
|
{% for community in ''|get_bgp_communities %} |
||||
|
community {{ community.slug }} members {% if " " in community.value %}[ {{ community.value }} ]{% else %}{{ community.value }}{% endif %};{% endfor %} |
||||
|
|
||||
|
as-path-group NEVER-TO-UPSTREAM-OR-PEERS { |
||||
|
as-path TIER1-IN-PATH ".* (7018|3320|3257|6830|3356|2914|5511|3491|1239|6453|6762|1299|12956|701|6461) .*"; |
||||
|
as-path TIER2-IN-PATH ".* (4134|4809|7473|174|7922|6939|9002|1273|2828|4637) .*"; |
||||
|
} |
||||
|
|
||||
|
as-path-group LINX-LON1-ASPATH-DEPREFER { |
||||
|
as-path FAELIX-DEPREFER "41495 .*"; |
||||
|
} |
||||
|
|
||||
|
{% for asn in asns_requiring_prefixes|unique %} |
||||
|
{% set prefixes = asn|get_prefixes_for_asn %} |
||||
|
policy-statement AS{{ asn }}-import-IPv4 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
family inet; |
||||
|
{% for prefix in prefixes['ipv4'] %} |
||||
|
route-filter {{ prefix['prefix'] }} {% if prefix['exact'] %}exact{% else %}upto /{{ prefix['less-equal'] }}{% endif %}; |
||||
|
{% endfor %} |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
policy-statement AS{{ asn }}-import-IPv6 { |
||||
|
term 1 { |
||||
|
from { |
||||
|
family inet6; |
||||
|
{% for prefix in prefixes['ipv6'] %} |
||||
|
route-filter {{ prefix['prefix'] }} {% if prefix['exact'] %}exact{% else %}upto /{{ prefix['less-equal'] }}{% endif %}; |
||||
|
{% endfor %} |
||||
|
} |
||||
|
then accept; |
||||
|
} |
||||
|
then reject; |
||||
|
} |
||||
|
{% endfor %} |
||||
|
} |
||||
@ -0,0 +1,146 @@ |
|||||
|
{% macro bgp_neighbor(neighbor, neighbor_data, ibgp) %} |
||||
|
neighbor {{ neighbor }} { |
||||
|
description "{% if neighbor_data['relationship'] %}{{ neighbor['relationship']|safe_string }}: {% endif %}{% if neighbor_data['service_reference'] %}{{ neighbor_data['service_reference']|safe_string }} - {% endif %}{{ neighbor_data['description']|safe_string }}"; |
||||
|
{% if 'local-as' in neighbor_data %}local-as {{ neighbor_data['local-as'] }};{% endif %} |
||||
|
peer-as {{ neighbor_data['remote-as'] }}; |
||||
|
{% if neighbor_data.get('encrypted_password',None) or neighbor_data.get('password',None) %}authentication-key "{{ neighbor_data['encrypted_password'] or neighbor_data['password'] }}";{% endif %} |
||||
|
{% if neighbor_data.get('update-source',None) %}local-address {{ neighbor_data['update-source'].split("/")[0] }};{% endif %} |
||||
|
{% if neighbor_data.get('ebgp-multihop',0) > 1 %}multihop ttl {{ neighbor_data['ebgp-multihop'] }};{% endif %} |
||||
|
{% if neighbor_data.get('shutdown',False) %}shutdown;{% endif %} |
||||
|
|
||||
|
{%- if neighbor_data['import-policies'] %} |
||||
|
import [ {% for policy in neighbor_data['import-policies'] %}{{ policy }} {% endfor %}]; |
||||
|
{%- endif %} |
||||
|
{%- if neighbor_data['export-policies'] %} |
||||
|
export [ {% for policy in neighbor_data['export-policies'] %}{{ policy }} {% endfor %}]; |
||||
|
{%- endif %} |
||||
|
|
||||
|
{%- if neighbor|ipv4 %} |
||||
|
family inet { |
||||
|
unicast; |
||||
|
} |
||||
|
{% if- ibgp %} |
||||
|
family inet-vpn { |
||||
|
unicast; |
||||
|
} |
||||
|
family inet6-vpn { |
||||
|
unicast; |
||||
|
} |
||||
|
family l2vpn { |
||||
|
signaling; |
||||
|
} |
||||
|
{%- endif %} |
||||
|
{%- elif neighbor|ipv6 %} |
||||
|
family inet6 { |
||||
|
unicast; |
||||
|
} |
||||
|
{%- endif %} |
||||
|
|
||||
|
{%- do asns_requiring_prefixes.append(neighbor_data['remote-as']) %} |
||||
|
} |
||||
|
{% endmacro %} |
||||
|
|
||||
|
{{ "protocols"|progress }} { |
||||
|
mpls { |
||||
|
ipv6-tunneling; |
||||
|
icmp-tunneling; |
||||
|
{%- for interface in device_interfaces %} |
||||
|
{%- set tags = interface.tags|tags_to_map %} |
||||
|
{%- if 'core-isis-link' in tags %} |
||||
|
interface {{ interface.name }}; |
||||
|
{%- elif 'isis-loopback' in tags %} |
||||
|
interface {{ interface.name }}; |
||||
|
{%- endif %} |
||||
|
{%- endfor %} |
||||
|
} |
||||
|
bgp { |
||||
|
|
||||
|
{%- set bgp_router = device|get_bgp_router() %} |
||||
|
/* PEERING MANAGER BGP ROUTER: {{ bgp_router }} */ |
||||
|
|
||||
|
precision-timers; |
||||
|
mtu-discovery; |
||||
|
log-updown; |
||||
|
ttl 255; |
||||
|
|
||||
|
{%- if bgp_router %} |
||||
|
{%- for (bgp_group, neighbors) in bgp_router|get_bgp_groups_and_neighbors() %} |
||||
|
{%- if bgp_group %} |
||||
|
group {{ bgp_group.slug }} { |
||||
|
description "{{ bgp_group.name|safe_string }}" |
||||
|
ttl 255; |
||||
|
|
||||
|
{% if bgp_group.import_routing_policies %}import [ {% for policy in bgp_group.import_routing_policies %}{{ policy.slug }} {% endfor %}]{% endif %}; |
||||
|
{% if bgp_group.export_routing_policies %}export [ {% for policy in bgp_group.export_routing_policies %}{{ policy.slug }} {% endfor %}]{% endif %}; |
||||
|
|
||||
|
{%- endif %} |
||||
|
{%- for neighbor in neighbors %} |
||||
|
{%- set ibgp = ( bgp_router.local_autonomous_system.asn == neighbor.autonomous_system.asn ) %} |
||||
|
{{ bgp_neighbor(neighbor.ip_address.split("/")[0], neighbor|peer_to_neighbor_data(bgp_router), ibgp=ibgp) }} |
||||
|
{%- endfor %} |
||||
|
{%- if bgp_group %} |
||||
|
} |
||||
|
{%- endif %} |
||||
|
{%- endfor %} |
||||
|
|
||||
|
{%- for (conn, neighbors) in bgp_router|get_bgp_internet_exchanges_and_neighbors() %} |
||||
|
group {{ conn.internet_exchange_point.slug }} { |
||||
|
description "{{ conn.internet_exchange_point.name|safe_string }}" |
||||
|
{%- for neighbor in neighbors %} |
||||
|
{%- set ibgp = ( bgp_router.local_autonomous_system.asn == neighbor.autonomous_system.asn ) %} |
||||
|
{{ bgp_neighbor(neighbor.ip_address.split("/")[0], neighbor|peer_to_neighbor_data(bgp_router), ibgp=ibgp) }} |
||||
|
{%- endfor %} |
||||
|
} |
||||
|
{%- endfor %} |
||||
|
{%- else %} |
||||
|
/* not this ASN {{ bgp_router.local_autonomous_system.asn }} */ |
||||
|
{%- endif %} |
||||
|
} |
||||
|
isis { |
||||
|
reference-bandwidth 100g; |
||||
|
lsp-lifetime 32767; |
||||
|
spf-options { |
||||
|
delay 50; |
||||
|
holddown 2000; |
||||
|
rapid-runs 1; |
||||
|
} |
||||
|
topologies ipv6-unicast; |
||||
|
level 1 disable; |
||||
|
level 2 { |
||||
|
authentication-key "$9$nR/0CAuOBEcyKcyVYoGq.p0B1EyVb2UjqUjHmPT/9vM8L7Vws4jiqxNds2ojiuOBIRSLX-ws4M8oGDjq.tuORclKvLX7VEc"; {# CaizoophoozahThaGhai5aicoo1okahl #} |
||||
|
authentication-type md5; |
||||
|
wide-metrics-only; |
||||
|
} |
||||
|
|
||||
|
{%- for interface in device_interfaces %} |
||||
|
{%- set tags = interface.tags|tags_to_map %} |
||||
|
{%- if 'core-isis-link' in tags %} |
||||
|
interface {{ interface.name }} { |
||||
|
point-to-point; |
||||
|
level 1 disable; |
||||
|
level 2 { |
||||
|
metric 1; |
||||
|
ipv6-unicast-metric 1; |
||||
|
} |
||||
|
} |
||||
|
{%- elif 'isis-loopback' in tags %} |
||||
|
interface {{ interface.name }} { |
||||
|
level 1 disable; |
||||
|
} |
||||
|
{%- endif %} |
||||
|
{%- endfor %} |
||||
|
} |
||||
|
ldp { |
||||
|
track-igp-metric; |
||||
|
keepalive-interval 10; |
||||
|
keepalive-timeout 90; |
||||
|
{%- for interface in device_interfaces %} |
||||
|
{%- set tags = interface.tags|tags_to_map %} |
||||
|
{%- if 'core-isis-link' in tags %} |
||||
|
interface {{ interface.name }}; |
||||
|
{%- elif 'isis-loopback' in tags %} |
||||
|
interface {{ interface.name }}; |
||||
|
{%- endif %} |
||||
|
{%- endfor %} |
||||
|
} |
||||
|
} |
||||
@ -1,8 +1,83 @@ |
|||||
routing-options { |
|
||||
|
{{ "routing-options"|progress }} { |
||||
|
ppm; |
||||
static { |
static { |
||||
{%- for (route, route_data) in device.config_context.get('routes',{}).items() %} |
{%- for (route, route_data) in device.config_context.get('routes',{}).items() %} |
||||
route {{ route }} next-hop {{ route_data.get('next-hop', None) }}; |
|
||||
|
route {{ route }} { |
||||
|
next-hop {{ route_data.get('next-hop', None) }}; |
||||
|
retain; |
||||
|
no-readvertise; |
||||
|
} |
||||
{%- endfor %} |
{%- endfor %} |
||||
|
|
||||
|
/* blackhole destination */ |
||||
|
route 193.162.44.0/32 { |
||||
|
discard; |
||||
|
no-readvertise; |
||||
|
} |
||||
|
|
||||
|
{% for announcement in 'as59811-origin'|get_netbox_tagged_prefixes %}{% if announcement.prefix|ipv4 %} |
||||
|
route {{ announcement.prefix }} { |
||||
|
/* {{ announcement.description }} */ |
||||
|
discard; |
||||
|
retain; |
||||
|
community [ {{ ("COMMUNITY-ORIGIN-AS59811"|get_bgp_community).value }} ]; |
||||
|
} |
||||
|
{% endif %}{% endfor %} |
||||
|
{% for announcement in 'as59811-origin'|get_netbox_tagged_aggregates %}{% if announcement.prefix|ipv4 %} |
||||
|
route {{ announcement.prefix }} { |
||||
|
/* {{ announcement.description }} */ |
||||
|
discard; |
||||
|
retain; |
||||
|
community [ {{ ("COMMUNITY-ORIGIN-AS59811"|get_bgp_community).value }} ]; |
||||
|
} |
||||
|
{% endif %}{% endfor %} |
||||
|
} |
||||
|
rib inet6.0 { |
||||
|
static { |
||||
|
/* blackhole destination */ |
||||
|
route 2a10:f0c0::/128 { |
||||
|
discard; |
||||
|
no-readvertise; |
||||
|
} |
||||
|
{% for announcement in 'as59811-origin'|get_netbox_tagged_prefixes %}{% if announcement.prefix|ipv6 %} |
||||
|
route {{ announcement.prefix }} { |
||||
|
/* {{ announcement.description }} */ |
||||
|
discard; |
||||
|
retain; |
||||
|
community [ {{ ("COMMUNITY-ORIGIN-AS59811"|get_bgp_community).value }} ]; |
||||
|
} |
||||
|
{% endif %}{% endfor %} |
||||
|
{% for announcement in 'as59811-origin'|get_netbox_tagged_aggregates %}{% if announcement.prefix|ipv6 %} |
||||
|
route {{ announcement.prefix }} { |
||||
|
/* {{ announcement.description }} */ |
||||
|
discard; |
||||
|
retain; |
||||
|
community [ {{ ("COMMUNITY-ORIGIN-AS59811"|get_bgp_community).value }} ]; |
||||
|
} |
||||
|
{% endif %}{% endfor %} |
||||
|
} |
||||
|
generate { |
||||
|
route ::/0 { |
||||
|
policy CONDITIONAL-DEFAULT-IPv6; |
||||
|
discard; |
||||
|
} |
||||
|
} |
||||
} |
} |
||||
nonstop-routing; |
nonstop-routing; |
||||
|
autonomous-system 59811; |
||||
|
forwarding-table { |
||||
|
export LOAD-BALANCING; |
||||
|
chained-composite-next-hop { |
||||
|
ingress { |
||||
|
l2vpn; |
||||
|
l3vpn; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
generate { |
||||
|
route 0.0.0.0/0 { |
||||
|
policy CONDITIONAL-DEFAULT-IPv4; |
||||
|
discard; |
||||
|
} |
||||
|
} |
||||
} |
} |
||||
@ -0,0 +1,5 @@ |
|||||
|
{{ "snmp"|progress }} { |
||||
|
trap-options { |
||||
|
source-address lo0; |
||||
|
} |
||||
|
} |
||||