firewall { all-ping enable broadcast-ping disable config-trap disable ipv6-receive-redirects disable ipv6-src-route disable ip-src-route disable log-martians disable options { interface vti31 { adjust-mss 1350 } interface vti32 { adjust-mss 1350 } interface vti41 { adjust-mss 1350 } interface vti42 { adjust-mss 1350 } interface vti51 { adjust-mss 1350 } interface vti52 { adjust-mss 1350 } } receive-redirects disable send-redirects enable source-validation disable syn-cookies enable twa-hazards-protection disable } high-availability { vrrp { group DMZ-VLAN-3962 { interface eth1 preempt-delay 180 priority 200 virtual-address 192.168.34.36/27 vrid 62 } } } interfaces { ethernet eth0 { address 192.0.2.189/27 duplex auto smp-affinity auto speed auto } ethernet eth1 { address 192.168.34.37/27 duplex auto smp-affinity auto speed auto } loopback lo { } vti vti31 { } vti vti32 { } vti vti41 { } vti vti42 { } vti vti51 { } vti vti52 { } } policy { prefix-list AZURE-BGP-IPv4-in { description "Prefixes received from Azure" rule 100 { action permit le 32 prefix 100.64.0.0/10 } } prefix-list ONPREM-BGP-IPv4-out { description "Prefixes allowed to be announced into Azure" rule 100 { action permit prefix 10.0.0.0/8 } rule 200 { action permit prefix 172.16.0.0/12 } rule 300 { action permit prefix 192.168.0.0/16 } } } protocols { bgp 65522 { address-family { ipv4-unicast { network 10.0.0.0/8 { } network 172.16.0.0/12 { } network 192.168.0.0/16 { } } } neighbor 100.66.8.36 { peer-group AZURE remote-as 64517 } neighbor 100.66.8.37 { peer-group AZURE remote-as 64517 } neighbor 100.66.24.36 { peer-group AZURE remote-as 64513 } neighbor 100.66.24.37 { peer-group AZURE remote-as 64513 } neighbor 100.66.40.36 { peer-group AZURE remote-as 64515 } neighbor 100.66.40.37 { peer-group AZURE remote-as 64515 } neighbor 192.168.34.38 { address-family { ipv4-unicast { nexthop-self soft-reconfiguration { inbound } } } capability { dynamic } password VyOSR0xx123 remote-as 65522 update-source eth1 } peer-group AZURE { address-family { ipv4-unicast { maximum-prefix 50 prefix-list { export ONPREM-BGP-IPv4-out import AZURE-BGP-IPv4-in } } } ebgp-multihop 2 update-source eth1 } timers { holdtime 30 keepalive 5 } } static { interface-route 100.66.8.36/32 { next-hop-interface vti31 { } next-hop-interface vti32 { } } interface-route 100.66.8.37/32 { next-hop-interface vti31 { } next-hop-interface vti32 { } } interface-route 100.66.24.36/32 { next-hop-interface vti41 { } next-hop-interface vti42 { } } interface-route 100.66.24.37/32 { next-hop-interface vti41 { } next-hop-interface vti42 { } } interface-route 100.66.40.36/32 { next-hop-interface vti51 { } next-hop-interface vti52 { } } interface-route 100.66.40.37/32 { next-hop-interface vti51 { } next-hop-interface vti52 { } } route 0.0.0.0/0 { next-hop 192.168.34.33 { } } route 51.105.0.0/16 { next-hop 192.0.2.161 { } } route 52.143.0.0/16 { next-hop 192.0.2.161 { } } route 195.137.175.0/24 { next-hop 192.0.2.161 { } } route 212.23.159.0/26 { next-hop 192.0.2.161 { } } } } service { ssh { disable-host-validation port 22 } } system { config-management { commit-revisions 100 } console { device ttyS0 { speed 115200 } } domain-name vyos.net flow-accounting { interface eth1 interface vti31 interface vti32 interface vti41 interface vti42 interface vti51 interface vti52 netflow { server 10.0.1.1 { port 2055 } source-ip 192.168.34.37 version 10 } syslog-facility daemon } host-name azure-gw-01 login { radius-server 192.0.2.253 { port 1812 secret secret1234 timeout 2 } radius-server 192.0.2.254 { port 1812 secret secret1234 timeout 2 } radius-source-address 192.168.34.37 user vyos { authentication { encrypted-password $6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0 plaintext-password "" } } } name-server 192.0.2.254 ntp { server 192.0.2.254 { } } syslog { global { archive { file 10 size 20480 } facility all { level info } facility protocols { level debug } } host 10.0.9.188 { facility all { level info protocol udp } } } time-zone Europe/Berlin } vpn { ipsec { auto-update 120 esp-group ESP-AZURE { compression disable lifetime 27000 mode tunnel pfs disable proposal 1 { encryption aes256 hash sha1 } } ike-group IKE-AZURE { close-action none dead-peer-detection { action restart interval 2 timeout 15 } ikev2-reauth no key-exchange ikev2 lifetime 27000 proposal 1 { dh-group 2 encryption aes256 hash sha1 } } ipsec-interfaces { interface eth0 } logging { log-level 2 log-modes ike } site-to-site { peer 51.105.0.1 { authentication { mode pre-shared-secret pre-shared-secret averysecretpsktowardsazure } connection-type respond default-esp-group ESP-AZURE ike-group IKE-AZURE ikev2-reauth inherit local-address 192.0.2.189 vti { bind vti51 } } peer 51.105.0.2 { authentication { mode pre-shared-secret pre-shared-secret averysecretpsktowardsazure } connection-type respond default-esp-group ESP-AZURE ike-group IKE-AZURE ikev2-reauth inherit local-address 192.0.2.189 vti { bind vti52 } } peer 51.105.0.3 { authentication { mode pre-shared-secret pre-shared-secret averysecretpsktowardsazure } connection-type respond ike-group IKE-AZURE ikev2-reauth inherit local-address 192.0.2.189 vti { bind vti32 esp-group ESP-AZURE } } peer 51.105.0.4 { authentication { mode pre-shared-secret pre-shared-secret averysecretpsktowardsazure } connection-type respond ike-group IKE-AZURE ikev2-reauth inherit local-address 192.0.2.189 vti { bind vti31 esp-group ESP-AZURE } } peer 51.105.0.5 { authentication { mode pre-shared-secret pre-shared-secret averysecretpsktowardsazure } connection-type respond ike-group IKE-AZURE ikev2-reauth inherit local-address 192.0.2.189 vti { bind vti42 esp-group ESP-AZURE } } peer 51.105.0.6 { authentication { mode pre-shared-secret pre-shared-secret averysecretpsktowardsazure } connection-type respond ike-group IKE-AZURE ikev2-reauth inherit local-address 192.0.2.189 vti { bind vti41 esp-group ESP-AZURE } } } } } /* Warning: Do not remove the following line. */ /* === vyatta-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack-sync@1:conntrack@1:dhcp-relay@2:dhcp-server@5:dns-forwarding@1:firewall@5:ipsec@5:l2tp@1:mdns@1:nat@4:ntp@1:pptp@1:qos@1:quagga@6:snmp@1:ssh@1:system@9:vrrp@2:wanloadbalance@3:webgui@1:webproxy@1:webproxy@2:zone-policy@1" === */ /* Release version: 1.2.5 */