85 lines
5.1 KiB
Django/Jinja
85 lines
5.1 KiB
Django/Jinja
set interfaces wireguard wg42 description 'OCI AMD / DN42 internal transport'
|
|
set interfaces wireguard wg42 address '172.21.111.161/32'
|
|
set interfaces wireguard wg42 address 'fdd0:98df:15b0:ffff::2/64'
|
|
set interfaces wireguard wg42 mtu '1380'
|
|
set interfaces wireguard wg42 port '51820'
|
|
set interfaces wireguard wg42 peer amd address '129.225.176.134'
|
|
set interfaces wireguard wg42 peer amd port '51820'
|
|
set interfaces wireguard wg42 peer amd public-key '{{ hostvars.oci_amd.wg_public_key.stdout | trim }}'
|
|
set interfaces wireguard wg42 peer amd persistent-keepalive '25'
|
|
set interfaces wireguard wg42 peer amd allowed-ips '10.255.254.1/32'
|
|
set interfaces wireguard wg42 peer amd allowed-ips '10.0.0.0/24'
|
|
set interfaces wireguard wg42 peer amd allowed-ips '172.21.111.162/32'
|
|
set interfaces wireguard wg42 peer amd allowed-ips 'fdd0:98df:15b0::/48'
|
|
set interfaces loopback lo address 'fdd0:98df:15b0::1/128'
|
|
set protocols static route 172.21.111.160/27 blackhole distance '254'
|
|
set protocols static route6 fdd0:98df:15b0::/48 blackhole distance '254'
|
|
set protocols bgp system-as '{{ dn42_asn }}'
|
|
set protocols bgp parameters router-id '172.21.111.161'
|
|
{% for p in ['10.0.0.0/24', '172.21.111.162/32', '172.20.0.0/14'] %}
|
|
set policy prefix-list OCI-SITE-IN rule {{ loop.index * 10 }} action 'permit'
|
|
set policy prefix-list OCI-SITE-IN rule {{ loop.index * 10 }} prefix '{{ p }}'
|
|
{% endfor %}
|
|
{% for p in wg_home_prefixes + [dn42_ipv4] %}
|
|
set protocols bgp address-family ipv4-unicast network '{{ p }}'
|
|
set policy prefix-list OCI-SITE-OUT rule {{ loop.index * 10 }} action 'permit'
|
|
set policy prefix-list OCI-SITE-OUT rule {{ loop.index * 10 }} prefix '{{ p }}'
|
|
{% endfor %}
|
|
set protocols bgp address-family ipv6-unicast network '{{ dn42_ipv6 }}'
|
|
set policy prefix-list6 OCI-SITE6-IN rule 10 action 'permit'
|
|
set policy prefix-list6 OCI-SITE6-IN rule 10 prefix 'fdd0:98df:15b0::2/128'
|
|
set policy prefix-list6 OCI-SITE6-OUT rule 10 action 'permit'
|
|
set policy prefix-list6 OCI-SITE6-OUT rule 10 prefix '{{ dn42_ipv6 }}'
|
|
set policy prefix-list OCI-TO-OSPF rule 10 action 'permit'
|
|
set policy prefix-list OCI-TO-OSPF rule 10 prefix '10.0.0.0/24'
|
|
set policy route-map OCI-TO-OSPF rule 10 action 'permit'
|
|
set policy route-map OCI-TO-OSPF rule 10 match ip address prefix-list 'OCI-TO-OSPF'
|
|
set protocols ospf redistribute bgp route-map 'OCI-TO-OSPF'
|
|
set protocols ospf redistribute bgp metric-type '1'
|
|
set policy prefix-list DN42-TO-OSPF rule 10 action 'permit'
|
|
set policy prefix-list DN42-TO-OSPF rule 10 prefix '{{ dn42_ipv4 }}'
|
|
set policy route-map DN42-TO-OSPF rule 10 action 'permit'
|
|
set policy route-map DN42-TO-OSPF rule 10 match ip address prefix-list 'DN42-TO-OSPF'
|
|
set protocols ospf redistribute static route-map 'DN42-TO-OSPF'
|
|
set protocols ospf redistribute static metric-type '1'
|
|
set interfaces wireguard wg42 peer amd allowed-ips 'fe80::/64'
|
|
|
|
set interfaces wireguard wg42 peer amd allowed-ips '172.20.0.0/14'
|
|
set interfaces wireguard wg42 peer amd allowed-ips 'fd00::/8'
|
|
set policy prefix-list6 OCI-SITE6-IN rule 20 action 'permit'
|
|
set policy prefix-list6 OCI-SITE6-IN rule 20 prefix 'fd00::/8'
|
|
set policy prefix-list OCI-TO-OSPF rule 20 action 'permit'
|
|
set policy prefix-list OCI-TO-OSPF rule 20 prefix '172.20.0.0/14'
|
|
|
|
set interfaces wireguard wg42 address 'fe80::1811:1/64'
|
|
set protocols bgp neighbor fe80::1811:2 remote-as '{{ dn42_asn }}'
|
|
set protocols bgp neighbor fe80::1811:2 description 'OCI AMD internal MP-BGP'
|
|
set protocols bgp neighbor fe80::1811:2 interface source-interface 'wg42'
|
|
set protocols bgp neighbor fe80::1811:2 update-source 'fe80::1811:1'
|
|
set protocols bgp neighbor fe80::1811:2 capability extended-nexthop
|
|
set protocols bgp neighbor fe80::1811:2 address-family ipv4-unicast prefix-list import 'OCI-SITE-IN'
|
|
set protocols bgp neighbor fe80::1811:2 address-family ipv4-unicast prefix-list export 'OCI-SITE-OUT'
|
|
set protocols bgp neighbor fe80::1811:2 address-family ipv6-unicast prefix-list import 'OCI-SITE6-IN'
|
|
set protocols bgp neighbor fe80::1811:2 address-family ipv6-unicast prefix-list export 'OCI-SITE6-OUT'
|
|
|
|
{% for path in vyos_retired_paths %}
|
|
{% if vyos_retired_present.results[loop.index0].rc == 0 %}
|
|
delete {{ path }}
|
|
{% endif %}
|
|
{% endfor %}
|
|
set nat source rule 18100 description 'Exclude local DN42 allocation'
|
|
set nat source rule 18100 outbound-interface name 'wg42'
|
|
set nat source rule 18100 destination address '172.21.111.160/27'
|
|
set nat source rule 18100 exclude
|
|
{% for prefix in wg_home_prefixes %}
|
|
set nat source rule {{ 18100 + loop.index * 10 }} description 'LAN to DN42 masquerade'
|
|
set nat source rule {{ 18100 + loop.index * 10 }} outbound-interface name 'wg42'
|
|
set nat source rule {{ 18100 + loop.index * 10 }} source address '{{ prefix }}'
|
|
set nat source rule {{ 18100 + loop.index * 10 }} destination address '172.20.0.0/14'
|
|
set nat source rule {{ 18100 + loop.index * 10 }} translation address 'masquerade'
|
|
{% endfor %}
|
|
set policy route-map OCI-MP-IN rule 10 action 'permit'
|
|
set policy route-map OCI-MP-IN rule 10 set ipv6-next-hop prefer-global
|
|
set protocols bgp neighbor fe80::1811:2 address-family ipv4-unicast route-map import 'OCI-MP-IN'
|
|
set protocols bgp neighbor fe80::1811:2 address-family ipv6-unicast route-map import 'OCI-MP-IN'
|