81 lines
2.8 KiB
Django/Jinja
81 lines
2.8 KiB
Django/Jinja
{% set v4_peer = bgp_transport_peer | default(wg_peer_address) %}
|
|
{% set v6_peer = bgp_transport_peer | default(wg_peer_ipv6 | default("")) %}
|
|
! vtysh -f 使用配置模式，write memory 由独立 handler 执行。
|
|
! 只重建本角色拥有的邻居和过滤器，保留既有 BGP/OSPF。
|
|
router bgp {{ bgp_asn }}
|
|
no neighbor {{ v4_peer }}
|
|
{% for peer in bgp_retired_peers | default([]) %}
|
|
no neighbor {{ peer }}
|
|
{% endfor %}
|
|
exit
|
|
no ip prefix-list OCI-WG-IN
|
|
no ip prefix-list OCI-WG-OUT
|
|
{% for prefix in bgp_import %}
|
|
ip prefix-list OCI-WG-IN seq {{ loop.index * 10 }} permit {{ prefix }}
|
|
{% endfor %}
|
|
{% for prefix in bgp_export + (bgp_summary | default([])) %}
|
|
ip prefix-list OCI-WG-OUT seq {{ loop.index * 10 }} permit {{ prefix }}
|
|
{% endfor %}
|
|
router bgp {{ bgp_asn }}
|
|
bgp router-id {{ bgp_router_id }}
|
|
neighbor {{ v4_peer }} remote-as {{ bgp_peer_asn }}
|
|
neighbor {{ v4_peer }} description OCI-WireGuard
|
|
neighbor {{ v4_peer }} update-source {{ wg_interface }}
|
|
{% if bgp_transport_peer is defined %}
|
|
neighbor {{ v4_peer }} interface {{ wg_interface }}
|
|
neighbor {{ v4_peer }} capability extended-nexthop
|
|
{% endif %}
|
|
address-family ipv4 unicast
|
|
{% for prefix in bgp_summary | default([]) %}
|
|
aggregate-address {{ prefix }}
|
|
{% endfor %}
|
|
{% for prefix in bgp_export %}
|
|
network {{ prefix }}
|
|
{% endfor %}
|
|
neighbor {{ v4_peer }} activate
|
|
neighbor {{ v4_peer }} prefix-list OCI-WG-IN in
|
|
neighbor {{ v4_peer }} prefix-list OCI-WG-OUT out
|
|
neighbor {{ v4_peer }} maximum-prefix {{ bgp_import | length }}
|
|
exit-address-family
|
|
exit
|
|
! 仅为这些 BGP 路由选择本机业务 IP；转发报文源地址保持不变，不是 NAT。
|
|
route-map OCI-WG-SOURCE permit 10
|
|
match ip address prefix-list OCI-WG-IN
|
|
set src {{ bgp_router_id }}
|
|
exit
|
|
route-map OCI-WG-SOURCE permit 100
|
|
exit
|
|
ip protocol bgp route-map OCI-WG-SOURCE
|
|
|
|
{% if bgp_export6 is defined %}
|
|
no ipv6 prefix-list OCI-WG6-IN
|
|
no ipv6 prefix-list OCI-WG6-OUT
|
|
{% for prefix in bgp_import6 %}
|
|
ipv6 prefix-list OCI-WG6-IN seq {{ loop.index * 10 }} permit {{ prefix }}
|
|
{% endfor %}
|
|
{% for prefix in bgp_export6 + (bgp_summary6 | default([])) %}
|
|
ipv6 prefix-list OCI-WG6-OUT seq {{ loop.index * 10 }} permit {{ prefix }}
|
|
{% endfor %}
|
|
router bgp {{ bgp_asn }}
|
|
neighbor {{ v6_peer }} remote-as {{ bgp_peer_asn }}
|
|
neighbor {{ v6_peer }} update-source {{ wg_interface }}
|
|
{% if bgp_transport_peer is not defined %}
|
|
address-family ipv4 unicast
|
|
no neighbor {{ v6_peer }} activate
|
|
exit-address-family
|
|
{% endif %}
|
|
address-family ipv6 unicast
|
|
{% for prefix in bgp_summary6 | default([]) %}
|
|
aggregate-address {{ prefix }}
|
|
{% endfor %}
|
|
{% for prefix in bgp_export6 %}
|
|
network {{ prefix }}
|
|
{% endfor %}
|
|
neighbor {{ v6_peer }} activate
|
|
neighbor {{ v6_peer }} prefix-list OCI-WG6-IN in
|
|
neighbor {{ v6_peer }} prefix-list OCI-WG6-OUT out
|
|
neighbor {{ v6_peer }} maximum-prefix {{ bgp_import6 | length }}
|
|
exit-address-family
|
|
exit
|
|
{% endif %}
|