diff options
Diffstat (limited to 'docs/configexamples')
| -rw-r--r-- | docs/configexamples/ansible.rst | 264 | ||||
| -rw-r--r-- | docs/configexamples/azure-vpn-bgp.rst | 3 | ||||
| -rw-r--r-- | docs/configexamples/azure-vpn-dual-bgp.rst | 3 | ||||
| -rw-r--r-- | docs/configexamples/firewall.rst | 6 | ||||
| -rw-r--r-- | docs/configexamples/fwall-and-bridge.rst | 15 | ||||
| -rw-r--r-- | docs/configexamples/fwall-and-vrf.rst | 3 | ||||
| -rw-r--r-- | docs/configexamples/index.rst | 3 | ||||
| -rw-r--r-- | docs/configexamples/l3vpn-hub-and-spoke.rst | 419 | ||||
| -rw-r--r-- | docs/configexamples/nmp.rst | 18 | ||||
| -rw-r--r-- | docs/configexamples/policy-based-ipsec-and-firewall.rst | 3 | ||||
| -rw-r--r-- | docs/configexamples/qos.rst | 138 | ||||
| -rw-r--r-- | docs/configexamples/site-2-site-cisco.rst | 13 | ||||
| -rw-r--r-- | docs/configexamples/wan-load-balancing.rst | 3 | ||||
| -rw-r--r-- | docs/configexamples/zone-policy.rst | 3 |
14 files changed, 475 insertions, 419 deletions
diff --git a/docs/configexamples/ansible.rst b/docs/configexamples/ansible.rst index ab3413eb..ee865076 100644 --- a/docs/configexamples/ansible.rst +++ b/docs/configexamples/ansible.rst @@ -9,7 +9,8 @@ Ansible example Setting up Ansible on a server running the Debian operating system. =================================================================== -In this example, we will set up a simple use of Ansible to configure multiple VyoS routers. +In this example, we will set up a simple use of Ansible to configure +multiple VyOS routers. We have four pre-configured routers with this configuration: Using the general schema for example: @@ -23,10 +24,10 @@ We have four pre-configured routers with this configuration: .. code-block:: none - set interfaces ethernet eth0 address dhcp - set service ssh - commit - save + set interfaces ethernet eth0 address dhcp + set service ssh + commit + save * vyos7 - 192.0.2.105 * vyos8 - 192.0.2.106 @@ -37,62 +38,66 @@ Install Ansible: ==================== .. code-block:: none - # apt-get install ansible - Do you want to continue? [Y/n] y + # apt-get install ansible + Do you want to continue? [Y/n] y Install Paramiko: ===================== .. code-block:: none - #apt-get install -y python3-paramiko + #apt-get install -y python3-paramiko Check the version: ================== +.. stop_vyoslinter + .. code-block:: none - # ansible --version - ansible 2.10.8 - config file = None - configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] - ansible python module location = /usr/lib/python3/dist-packages/ansible - executable location = /usr/bin/ansible - python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110] + # ansible --version + ansible 2.10.8 + config file = None + configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] + ansible python module location = /usr/lib/python3/dist-packages/ansible + executable location = /usr/bin/ansible + python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110] + +.. start_vyoslinter Basic configuration of ansible.cfg: ======================================= .. code-block:: none - # nano /root/ansible.cfg - [defaults] - host_key_checking = no + # nano /root/ansible.cfg + [defaults] + host_key_checking = no Add all the VyOS hosts: ======================= .. code-block:: none - # nano /root/hosts - [vyos_hosts] - vyos7 ansible_ssh_host=192.0.2.105 - vyos8 ansible_ssh_host=192.0.2.106 - vyos9 ansible_ssh_host=192.0.2.107 - vyos10 ansible_ssh_host=192.0.2.108 + # nano /root/hosts + [vyos_hosts] + vyos7 ansible_ssh_host=192.0.2.105 + vyos8 ansible_ssh_host=192.0.2.106 + vyos9 ansible_ssh_host=192.0.2.107 + vyos10 ansible_ssh_host=192.0.2.108 Add general variables: ====================== .. code-block:: none - # mkdir /root/group_vars/ - # nano /root/group_vars/vyos_hosts - ansible_python_interpreter: /usr/bin/python3 - ansible_network_os: vyos - ansible_connection: network_cli - ansible_user: vyos - ansible_ssh_pass: vyos + # mkdir /root/group_vars/ + # nano /root/group_vars/vyos_hosts + ansible_python_interpreter: /usr/bin/python3 + ansible_network_os: vyos + ansible_connection: network_cli + ansible_user: vyos + ansible_ssh_pass: vyos Add a simple playbook with the tasks for each router: @@ -100,117 +105,122 @@ Add a simple playbook with the tasks for each router: .. code-block:: none - # nano /root/main.yml - - --- - - hosts: vyos_hosts - gather_facts: 'no' - tasks: - - name: Configure general settings for the vyos hosts group - vyos_config: - lines: - - set system name-server 8.8.8.8 - - set interfaces ethernet eth0 description '#WAN#' - - set interfaces ethernet eth1 description '#LAN#' - - set interfaces ethernet eth2 disable - - set interfaces ethernet eth3 disable - - set system host-name {{ inventory_hostname }} - save: - true - + # nano /root/main.yml + + --- + - hosts: vyos_hosts + gather_facts: 'no' + tasks: + - name: Configure general settings for the vyos hosts group + vyos_config: + lines: + - set system name-server 192.0.2.1 + - set interfaces ethernet eth0 description '#WAN#' + - set interfaces ethernet eth1 description '#LAN#' + - set interfaces ethernet eth2 disable + - set interfaces ethernet eth3 disable + - set system host-name {{ inventory_hostname }} + save: true + Start the playbook: =================== +.. stop_vyoslinter + .. code-block:: none - ansible-playbook -i hosts main.yml - PLAY [vyos_hosts] ************************************************************** - - TASK [Configure general settings for the vyos hosts group] ********************* - ok: [vyos9] - ok: [vyos10] - ok: [vyos7] - ok: [vyos8] - - PLAY RECAP ********************************************************************* - vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + ansible-playbook -i hosts main.yml + PLAY [vyos_hosts] ************************************************************** + + TASK [Configure general settings for the vyos hosts group] ********************* + ok: [vyos9] + ok: [vyos10] + ok: [vyos7] + ok: [vyos8] + + PLAY RECAP ********************************************************************* + vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +.. start_vyoslinter Check the result on the vyos10 router: ====================================== .. code-block:: none - vyos@vyos10:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 192.0.2.108/24 u/u WAN - eth1 - u/u LAN - eth2 - A/D - eth3 - A/D - lo 127.0.0.1/8 u/u - ::1/128 - - vyos@vyos10:~$ sh configuration commands | grep 8.8.8.8 - set system name-server '8.8.8.8' + vyos@vyos10:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 192.0.2.108/24 u/u WAN + eth1 - u/u LAN + eth2 - A/D + eth3 - A/D + lo 127.0.0.1/8 u/u + ::1/128 + + vyos@vyos10:~$ sh configuration commands | grep 192.0.2.1 + set system name-server '192.0.2.1' The simple way without configuration of the hostname (one task for all routers): ================================================================================ .. code-block:: none - # nano /root/hosts_v2 - [vyos_hosts_group] - vyos7 ansible_ssh_host=192.0.2.105 - vyos8 ansible_ssh_host=192.0.2.106 - vyos9 ansible_ssh_host=192.0.2.107 - vyos10 ansible_ssh_host=192.0.2.108 - [vyos_hosts_group:vars] - ansible_python_interpreter=/usr/bin/python3 - ansible_user=vyos - ansible_ssh_pass=vyos - ansible_network_os=vyos - ansible_connection=network_cli - - # nano /root/main_v2.yml - --- - - hosts: vyos_hosts_group - - connection: network_cli - gather_facts: 'no' - - tasks: - - name: Configure remote vyos_hosts_group - vyos_config: - lines: - - set system name-server 8.8.8.8 - - set interfaces ethernet eth0 description WAN - - set interfaces ethernet eth1 description LAN - - set interfaces ethernet eth2 disable - - set interfaces ethernet eth3 disable - save: - true - + # nano /root/hosts_v2 + [vyos_hosts_group] + vyos7 ansible_ssh_host=192.0.2.105 + vyos8 ansible_ssh_host=192.0.2.106 + vyos9 ansible_ssh_host=192.0.2.107 + vyos10 ansible_ssh_host=192.0.2.108 + [vyos_hosts_group:vars] + ansible_python_interpreter=/usr/bin/python3 + ansible_user=vyos + ansible_ssh_pass=vyos + ansible_network_os=vyos + ansible_connection=network_cli + + # nano /root/main_v2.yml + --- + - hosts: vyos_hosts_group + connection: network_cli + gather_facts: 'no' + tasks: + - name: Configure remote vyos_hosts_group + vyos_config: + lines: + - set system name-server 192.0.2.1 + - set interfaces ethernet eth0 description WAN + - set interfaces ethernet eth1 description LAN + - set interfaces ethernet eth2 disable + - set interfaces ethernet eth3 disable + save: true + + +.. stop_vyoslinter + .. code-block:: none - - # ansible-playbook -i hosts_v2 main_v2.yml - - PLAY [vyos_hosts_group] ******************************************************** - - TASK [Configure remote vyos_hosts_group] *************************************** - ok: [vyos8] - ok: [vyos7] - ok: [vyos9] - ok: [vyos10] - - PLAY RECAP ********************************************************************* - vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - - -In the next chapter of the example, we'll use Ansible with jinja2 templates and variables. + + # ansible-playbook -i hosts_v2 main_v2.yml + + PLAY [vyos_hosts_group] ******************************************************** + + TASK [Configure remote vyos_hosts_group] *************************************** + ok: [vyos8] + ok: [vyos7] + ok: [vyos9] + ok: [vyos10] + + PLAY RECAP ********************************************************************* + vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +.. start_vyoslinter + +In the next chapter of the example, we'll use Ansible with jinja2 +templates and variables. diff --git a/docs/configexamples/azure-vpn-bgp.rst b/docs/configexamples/azure-vpn-bgp.rst index 03d637d8..597a4d15 100644 --- a/docs/configexamples/azure-vpn-bgp.rst +++ b/docs/configexamples/azure-vpn-bgp.rst @@ -2,8 +2,9 @@ .. _examples-azure-vpn-bgp: +############################################################ Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) ------------------------------------------------------------- +############################################################ This guide shows an example of a route-based IKEv2 site-to-site VPN to Azure using VTI and BGP for dynamic routing updates. diff --git a/docs/configexamples/azure-vpn-dual-bgp.rst b/docs/configexamples/azure-vpn-dual-bgp.rst index d37aa85c..04a6a631 100644 --- a/docs/configexamples/azure-vpn-dual-bgp.rst +++ b/docs/configexamples/azure-vpn-dual-bgp.rst @@ -2,8 +2,9 @@ .. _examples-azure-vpn-dual-bgp: +###################################################################### Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) ----------------------------------------------------------------------- +###################################################################### This guide shows an example of a redundant (active-active) route-based IKEv2 site-to-site VPN to Azure using VTI diff --git a/docs/configexamples/firewall.rst b/docs/configexamples/firewall.rst index a1ad7e19..6968eb04 100644 --- a/docs/configexamples/firewall.rst +++ b/docs/configexamples/firewall.rst @@ -1,9 +1,11 @@ :lastproofread: 2024-09-11 +################# Firewall Examples -================= +################# -This section contains examples of firewall configurations for various deployments. +This section contains examples of firewall configurations for various +deployments. .. toctree:: :maxdepth: 2 diff --git a/docs/configexamples/fwall-and-bridge.rst b/docs/configexamples/fwall-and-bridge.rst index 32c53fa5..134dd6c0 100644 --- a/docs/configexamples/fwall-and-bridge.rst +++ b/docs/configexamples/fwall-and-bridge.rst @@ -1,7 +1,8 @@ :lastproofread: 2024-09-11 +########################### Bridge and firewall example ---------------------------- +########################### Scenario and requirements ^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -353,12 +354,16 @@ For example, while a host tries to get an IP address from a DHCP server in br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from untrusted servers are dropped: +.. stop_vyoslinter + .. code-block:: none - vyos@bridge:~$ show log firewall bridge - Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302 - Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 - Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 + vyos@bridge:~$ show log firewall bridge + Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302 + Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 + Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 + +.. start_vyoslinter And with operational mode commands, we can check rules matchers, actions, and diff --git a/docs/configexamples/fwall-and-vrf.rst b/docs/configexamples/fwall-and-vrf.rst index fb65e3a4..bd97e1ad 100644 --- a/docs/configexamples/fwall-and-vrf.rst +++ b/docs/configexamples/fwall-and-vrf.rst @@ -1,5 +1,6 @@ +######################## VRF and firewall example ------------------------- +######################## Scenario and requirements ^^^^^^^^^^^^^^^^^^^^^^^^^ diff --git a/docs/configexamples/index.rst b/docs/configexamples/index.rst index 7f173b4a..b5985d7f 100644 --- a/docs/configexamples/index.rst +++ b/docs/configexamples/index.rst @@ -1,7 +1,8 @@ .. _examples: +######################## Configuration Blueprints -======================== +######################## This chapter contains various configuration examples: diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index 1533d0d8..90a036d8 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -46,7 +46,8 @@ The following software was used in the creation of this document: **NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) – The configurations below are specifically for VyOS 1.4.x. -General information can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter. +General information can be found in the +:ref:`configuration/vrf/index:L3VPN VRFs` chapter. @@ -64,8 +65,9 @@ Topology How does it work? ***************** -As we know the main assumption of L3VPN “Hub and Spoke” is, that the traffic -between spokes have to pass via hub, in our scenario VyOS-PE2 is the Hub PE +As we know the main assumption of L3VPN “Hub and Spoke” is, that the +traffic between spokes have to pass via hub, in our scenario VyOS-PE2 +is the Hub PE and the VyOS-CE1-HUB is the central customer office device that is responsible for controlling access between all spokes and announcing its network prefixes (10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its @@ -325,10 +327,12 @@ At this step we are going to enable iBGP protocol on MPLS nodes and Route Reflectors (two routers for redundancy) that will deliver IPv4 VPN (L3VPN) routes between them: +.. stop_vyoslinter + - VyOS-RR1: .. code-block:: none - + set protocols bgp system-as '65001' set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' @@ -554,81 +558,81 @@ Let’s check IPv4 routing and MPLS information on provider nodes vyos@VyOS-P1:~$ show ip ospf neighbor - Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL - 10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 - 10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 - 10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 - 10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 - 10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 + Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL + 10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 + 10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 + 10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 + 10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 + 10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 - “show mpls ldp neighbor “ for checking ldp neighbors .. code-block:: none vyos@VyOS-P1:~$ show mpls ldp neighbor - AF ID State Remote Address Uptime - ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h - ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h - ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h - ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h - ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h + AF ID State Remote Address Uptime + ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h + ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h + ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h + ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h + ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h - “show mpls ldp binding” for checking mpls label assignment .. code-block:: none vyos@VyOS-P1:~$ show mpls ldp discovery - AF Destination Nexthop Local Label Remote Label In Use - ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes - ipv4 10.0.0.1/32 10.0.0.4 23 20 no - ipv4 10.0.0.1/32 10.0.0.5 23 17 no - ipv4 10.0.0.1/32 10.0.0.7 23 16 no - ipv4 10.0.0.1/32 10.0.0.8 23 16 no - ipv4 10.0.0.2/32 10.0.0.1 20 16 no - ipv4 10.0.0.2/32 10.0.0.4 20 22 no - ipv4 10.0.0.2/32 10.0.0.5 20 24 yes - ipv4 10.0.0.2/32 10.0.0.7 20 17 no - ipv4 10.0.0.2/32 10.0.0.8 20 17 no - ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no - ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no - ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no - ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no - ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no - ipv4 10.0.0.4/32 10.0.0.1 16 18 no - ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes - ipv4 10.0.0.4/32 10.0.0.5 16 19 no - ipv4 10.0.0.4/32 10.0.0.7 16 19 no - ipv4 10.0.0.4/32 10.0.0.8 16 19 no - ipv4 10.0.0.5/32 10.0.0.1 21 19 no - ipv4 10.0.0.5/32 10.0.0.4 21 17 no - ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes - ipv4 10.0.0.5/32 10.0.0.7 21 20 no - ipv4 10.0.0.5/32 10.0.0.8 21 20 no - ipv4 10.0.0.6/32 10.0.0.1 17 20 no - ipv4 10.0.0.6/32 10.0.0.4 17 23 yes - ipv4 10.0.0.6/32 10.0.0.5 17 21 yes - ipv4 10.0.0.6/32 10.0.0.7 17 21 no - ipv4 10.0.0.6/32 10.0.0.8 17 21 no - ipv4 10.0.0.7/32 10.0.0.1 22 21 no - ipv4 10.0.0.7/32 10.0.0.4 22 18 no - ipv4 10.0.0.7/32 10.0.0.5 22 20 no - ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes - ipv4 10.0.0.7/32 10.0.0.8 22 22 no - ipv4 10.0.0.8/32 10.0.0.1 24 22 no - ipv4 10.0.0.8/32 10.0.0.4 24 19 no - ipv4 10.0.0.8/32 10.0.0.5 24 16 no - ipv4 10.0.0.8/32 10.0.0.7 24 22 no - ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes - ipv4 10.0.0.9/32 10.0.0.1 18 23 no - ipv4 10.0.0.9/32 10.0.0.4 18 21 yes - ipv4 10.0.0.9/32 10.0.0.5 18 22 no - ipv4 10.0.0.9/32 10.0.0.7 18 23 no - ipv4 10.0.0.9/32 10.0.0.8 18 23 no - ipv4 10.0.0.10/32 10.0.0.1 19 24 no - ipv4 10.0.0.10/32 10.0.0.4 19 24 yes - ipv4 10.0.0.10/32 10.0.0.5 19 23 yes - ipv4 10.0.0.10/32 10.0.0.7 19 24 no - ipv4 10.0.0.10/32 10.0.0.8 19 24 no + AF Destination Nexthop Local Label Remote Label In Use + ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes + ipv4 10.0.0.1/32 10.0.0.4 23 20 no + ipv4 10.0.0.1/32 10.0.0.5 23 17 no + ipv4 10.0.0.1/32 10.0.0.7 23 16 no + ipv4 10.0.0.1/32 10.0.0.8 23 16 no + ipv4 10.0.0.2/32 10.0.0.1 20 16 no + ipv4 10.0.0.2/32 10.0.0.4 20 22 no + ipv4 10.0.0.2/32 10.0.0.5 20 24 yes + ipv4 10.0.0.2/32 10.0.0.7 20 17 no + ipv4 10.0.0.2/32 10.0.0.8 20 17 no + ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no + ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no + ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no + ipv4 10.0.0.4/32 10.0.0.1 16 18 no + ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes + ipv4 10.0.0.4/32 10.0.0.5 16 19 no + ipv4 10.0.0.4/32 10.0.0.7 16 19 no + ipv4 10.0.0.4/32 10.0.0.8 16 19 no + ipv4 10.0.0.5/32 10.0.0.1 21 19 no + ipv4 10.0.0.5/32 10.0.0.4 21 17 no + ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes + ipv4 10.0.0.5/32 10.0.0.7 21 20 no + ipv4 10.0.0.5/32 10.0.0.8 21 20 no + ipv4 10.0.0.6/32 10.0.0.1 17 20 no + ipv4 10.0.0.6/32 10.0.0.4 17 23 yes + ipv4 10.0.0.6/32 10.0.0.5 17 21 yes + ipv4 10.0.0.6/32 10.0.0.7 17 21 no + ipv4 10.0.0.6/32 10.0.0.8 17 21 no + ipv4 10.0.0.7/32 10.0.0.1 22 21 no + ipv4 10.0.0.7/32 10.0.0.4 22 18 no + ipv4 10.0.0.7/32 10.0.0.5 22 20 no + ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes + ipv4 10.0.0.7/32 10.0.0.8 22 22 no + ipv4 10.0.0.8/32 10.0.0.1 24 22 no + ipv4 10.0.0.8/32 10.0.0.4 24 19 no + ipv4 10.0.0.8/32 10.0.0.5 24 16 no + ipv4 10.0.0.8/32 10.0.0.7 24 22 no + ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes + ipv4 10.0.0.9/32 10.0.0.1 18 23 no + ipv4 10.0.0.9/32 10.0.0.4 18 21 yes + ipv4 10.0.0.9/32 10.0.0.5 18 22 no + ipv4 10.0.0.9/32 10.0.0.7 18 23 no + ipv4 10.0.0.9/32 10.0.0.8 18 23 no + ipv4 10.0.0.10/32 10.0.0.1 19 24 no + ipv4 10.0.0.10/32 10.0.0.4 19 24 yes + ipv4 10.0.0.10/32 10.0.0.5 19 23 yes + ipv4 10.0.0.10/32 10.0.0.7 19 24 no + ipv4 10.0.0.10/32 10.0.0.8 19 24 no Now we’re checking iBGP status and routes from route-reflector nodes to other devices: @@ -644,11 +648,11 @@ nodes to other devices: Peers 4, using 85 KiB of memory Peer groups 1, using 64 bytes of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 - 10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 - 10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 - 10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 + 10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 + 10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + 10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 Total number of neighbors 4 @@ -660,37 +664,37 @@ nodes to other devices: BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 Default local pref 100, local AS 65001 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed + i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete - Network Next Hop Metric LocPrf Weight Path + Network Next Hop Metric LocPrf Weight Path Route Distinguisher: 10.50.50.1:1011 - *>i10.50.50.0/24 10.0.0.7 0 100 0 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i10.50.50.0/24 10.0.0.7 0 100 0 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 Route Distinguisher: 10.60.60.1:1011 - *>i10.60.60.0/24 10.0.0.10 0 100 0 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i10.60.60.0/24 10.0.0.10 0 100 0 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 Route Distinguisher: 10.80.80.1:1011 - *>i10.80.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 + *>i10.80.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 *>i100.100.100.100/32 - 10.0.0.8 0 100 0 65035 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 + 10.0.0.8 0 100 0 65035 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 Route Distinguisher: 172.16.80.1:2011 - *>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 - *>i172.16.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 + *>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 + *>i172.16.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 Route Distinguisher: 172.16.100.1:2011 - *>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 - *>i172.16.100.0/24 10.0.0.9 0 100 0 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 + *>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 + *>i172.16.100.0/24 10.0.0.9 0 100 0 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 - “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected for specific VPNv4 destination @@ -704,11 +708,11 @@ nodes to other devices: Advertised to non peer-group peers: 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 65035, (Received from a RR-client) - 10.0.0.8 from 10.0.0.8 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:65035:1030 - Remote label: 80 - Last update: Tue Oct 19 13:45:32 202 + 10.0.0.8 from 10.0.0.8 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:65035:1030 + Remote label: 80 + Last update: Tue Oct 19 13:45:32 202 Also we can verify how PE devices receives VPNv4 networks from the RRs and installing them to the specific customer VRFs: @@ -725,9 +729,9 @@ and installing them to the specific customer VRFs: Peers 2, using 43 KiB of memory Peer groups 1, using 64 bytes of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 - 10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 + 10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 - “show bgp vrf all” for checking all the prefix learning on BGP within VRFs: @@ -743,19 +747,19 @@ and installing them to the specific customer VRFs: BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 Default local pref 100, local AS 65001 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed + i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete - Network Next Hop Metric LocPrf Weight Path - * 10.50.50.0/24 0.0.0.0 0 32768 ? - *> 0.0.0.0 0 32768 i - *> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i - * 10.0.0.8@0< 0 100 0 i - *> 10.0.0.80/32 10.50.50.2 0 0 65035 i + Network Next Hop Metric LocPrf Weight Path + * 10.50.50.0/24 0.0.0.0 0 32768 ? + *> 0.0.0.0 0 32768 i + *> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i + * 10.0.0.8@0< 0 100 0 i + *> 10.0.0.80/32 10.50.50.2 0 0 65035 i *> 10.0.0.100/32 - 10.0.0.8@0< 0 100 0 65035 ? - * 10.0.0.8@0< 0 100 0 65035 ? + 10.0.0.8@0< 0 100 0 65035 ? + * 10.0.0.8@0< 0 100 0 65035 ? - “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor information between PE and CE: @@ -771,8 +775,8 @@ and installing them to the specific customer VRFs: RIB entries 7, using 1344 bytes of memory Peers 1, using 21 KiB of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 Total number of neighbors 1 @@ -785,19 +789,19 @@ and installing them to the specific customer VRFs: vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup VRF BLUE_SPOKE: K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 - “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the specific VPNv4 destination including extended community and @@ -811,19 +815,19 @@ and installing them to the specific customer VRFs: Paths: (2 available, best #1) Not advertised to any peer 65035 - 10.0.0.8 from 10.0.0.1 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Tue Oct 19 13:45:26 2021 + 10.0.0.8 from 10.0.0.1 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Tue Oct 19 13:45:26 2021 65035 - 10.0.0.8 from 10.0.0.2 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Wed Oct 13 12:39:34 202 + 10.0.0.8 from 10.0.0.2 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Wed Oct 13 12:39:34 202 Now, let’s check routing information on out Hub PE: @@ -839,9 +843,9 @@ Now, let’s check routing information on out Hub PE: Peers 2, using 43 KiB of memory Peer groups 1, using 64 bytes of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 - 10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 + 10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 Total number of neighbors @@ -858,31 +862,31 @@ Now, let’s check routing information on out Hub PE: BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 Default local pref 100, local AS 65001 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed + i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete - Network Next Hop Metric LocPrf Weight Path - *> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i - * 10.0.0.7@0< 0 100 0 i - *> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i - * 10.0.0.10@0< 0 100 0 i - * 10.80.80.0/24 10.80.80.2 0 0 65035 ? - * 0.0.0.0 0 32768 i - *> 0.0.0.0 0 32768 ? - *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i - *> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i - * 10.0.0.9@0< 0 100 0 65050 i - *> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i - * 10.0.0.7@0< 0 100 0 65035 i - *> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i - * 10.0.0.10@0< 0 100 0 65035 i + Network Next Hop Metric LocPrf Weight Path + *> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i + * 10.0.0.7@0< 0 100 0 i + *> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i + * 10.0.0.10@0< 0 100 0 i + * 10.80.80.0/24 10.80.80.2 0 0 65035 ? + * 0.0.0.0 0 32768 i + *> 0.0.0.0 0 32768 ? + *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i + *> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i + * 10.0.0.9@0< 0 100 0 65050 i + *> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i + * 10.0.0.7@0< 0 100 0 65035 i + *> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i + * 10.0.0.10@0< 0 100 0 65035 i *> 10.0.0.100/32 - 10.80.80.2 0 0 65035 ? - *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? - 0.0.0.0@9< 0 32768 i - *> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i - * 10.0.0.9@0< 0 100 0 i + 10.80.80.2 0 0 65035 ? + *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? + 0.0.0.0@9< 0 32768 i + *> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i + * 10.0.0.9@0< 0 100 0 i - “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor CE Hub device @@ -897,8 +901,8 @@ Now, let’s check routing information on out Hub PE: RIB entries 19, using 3648 bytes of memory Peers 1, using 21 KiB of memory - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 - “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. With this command we are able to check the transport and @@ -909,30 +913,30 @@ Now, let’s check routing information on out Hub PE: vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup VRF BLUE_HUB: K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 - “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, extended community and remote label of specific destination @@ -945,19 +949,19 @@ Now, let’s check routing information on out Hub PE: Paths: (2 available, best #1) Not advertised to any peer 65035 - 10.0.0.7 from 10.0.0.1 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 + 10.0.0.7 from 10.0.0.1 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 65035 - 10.0.0.7 from 10.0.0.2 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:39:37 2021 + 10.0.0.7 from 10.0.0.2 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:39:37 2021 vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 @@ -965,19 +969,19 @@ Now, let’s check routing information on out Hub PE: Paths: (2 available, best #1) Not advertised to any peer 65035 - 10.0.0.10 from 10.0.0.1 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 + 10.0.0.10 from 10.0.0.1 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 65035 - 10.0.0.10 from 10.0.0.2 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:45:44 2021 + 10.0.0.10 from 10.0.0.2 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:45:44 2021 Finally, let’s check the reachability between CEs: @@ -989,10 +993,10 @@ Finally, let’s check the reachability between CEs: # check rib vyos@VyOS-CE1-SPOKE:~$ show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h @@ -1027,10 +1031,10 @@ Finally, let’s check the reachability between CEs: # check rib vyos@VyOS-CE-HUB:~$ show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m @@ -1086,10 +1090,10 @@ Finally, let’s check the reachability between CEs: # check rib vyos@rt-ce2-SPOKE:~$ show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h @@ -1117,4 +1121,7 @@ Finally, let’s check the reachability between CEs: 3 * * * 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms -**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll see * * * for the transit routers of the mpls backbone. +.. start_vyoslinter + +**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll +see ``* * *`` for the transit routers of the mpls backbone. diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/nmp.rst index b25142cd..8945a9f4 100644 --- a/docs/configexamples/nmp.rst +++ b/docs/configexamples/nmp.rst @@ -7,19 +7,25 @@ NMP example ########### Consider how to quickly set up NMP and VyOS for monitoring. -NMP is multi-vendor network monitoring from 'SolarWinds' built to scale and expand with the needs of your network. +NMP is multi-vendor network monitoring from 'SolarWinds' built to +scale and expand with the needs of your network. Configuration 'VyOS' ==================== -First prepare our VyOS router for connection to NMP. We have to set up the SNMP protocol and connectivity between the router and NMP. +First prepare our VyOS router for connection to NMP. We have to set +up the SNMP protocol and connectivity between the router and NMP. + +.. stop_vyoslinter .. code-block:: none - set interfaces ethernet eth0 address 'dhcp' - set system name-server '8.8.8.8' - set service snmp community router authorization 'test' - set service snmp community router network '0.0.0.0/0' + set interfaces ethernet eth0 address 'dhcp' + set system name-server '8.8.8.8' + set service snmp community router authorization 'test' + set service snmp community router network '0.0.0.0/0' + +.. start_vyoslinter Configuration 'NMP' diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.rst b/docs/configexamples/policy-based-ipsec-and-firewall.rst index cb93daa9..dcf59af9 100644 --- a/docs/configexamples/policy-based-ipsec-and-firewall.rst +++ b/docs/configexamples/policy-based-ipsec-and-firewall.rst @@ -1,8 +1,9 @@ .. _examples-policy-based-ipsec-and-firewall: +######################################################## Policy-Based Site-to-Site VPN and Firewall Configuration --------------------------------------------------------- +######################################################## This guide shows an example policy-based IKEv2 site-to-site VPN between two VyOS routers, and firewall configuration. diff --git a/docs/configexamples/qos.rst b/docs/configexamples/qos.rst index 66751286..96448dd4 100644 --- a/docs/configexamples/qos.rst +++ b/docs/configexamples/qos.rst @@ -9,8 +9,11 @@ QoS example Configuration 'dcsp' and shaper using QoS ========================================= -In this case, we'll try to make a simple lab using QoS and the general ability of the VyOS system. -We recommend you to go through the main article about `QoS <https://docs.vyos.io/en/latest/configuration/trafficpolicy/index.html>`_ first. +In this case, we'll try to make a simple lab using QoS and the +general ability of the VyOS system. +We recommend you to go through the main article about +`QoS <https://docs.vyos.io/en/latest/configuration/trafficpolicy/index.html>`_ +first. Using the general schema for example: @@ -20,8 +23,11 @@ Using the general schema for example: :align: center :alt: Network Topology Diagram -We have four hosts on the local network 172.17.1.0/24. All hosts are labeled CS0 by default. We need to replace labels on all hosts except vpc8. -We will replace the labels on the nearest router “VyOS3” using the IP addresses of the sources. +We have four hosts on the local network 172.17.1.0/24. All hosts are +labeled CS0 by default. We need to replace labels on all hosts except +vpc8. +We will replace the labels on the nearest router “VyOS3” using the IP +addresses of the sources. * 172.17.1.2 CS0 -> CS4 * 172.17.1.3 CS0 -> CS5 @@ -32,30 +38,37 @@ Next, we will replace only all CS4 labels on the “VyOS2” router. * CS4 -> CS5 -In the end, we will configure the traffic shaper using QoS mechanisms on the “VYOS2” router. +In the end, we will configure the traffic shaper using QoS mechanisms +on the “VYOS2” router. Configuration: ============== -Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll use in this case only static routes. -On the VyOS3 router, we need to change the 'dscp' labels for the VPCs. To do this, we use this configuration. +Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll +use in this case only static routes. +On the VyOS3 router, we need to change the 'dscp' labels for the +VPCs. To do this, we use this configuration. + +.. stop_vyoslinter .. code-block:: none - set interfaces ethernet eth0 address '10.1.1.100/24' - set interfaces ethernet eth1 address '172.17.1.1/24' - set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 - set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' - set qos policy shaper vyos3 class 10 set-dscp 'CS4' - set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' - set qos policy shaper vyos3 class 20 set-dscp 'CS5' - set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' - set qos policy shaper vyos3 class 30 set-dscp 'CS6' - set qos policy shaper vyos3 default bandwidth '10%' - set qos policy shaper vyos3 default ceiling '100%' - set qos policy shaper vyos3 default priority '7' - set qos policy shaper vyos3 default queue-type 'fair-queue' - set qos interface eth0 egress 'vyos3' + set interfaces ethernet eth0 address '10.1.1.100/24' + set interfaces ethernet eth1 address '172.17.1.1/24' + set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 + set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' + set qos policy shaper vyos3 class 10 set-dscp 'CS4' + set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' + set qos policy shaper vyos3 class 20 set-dscp 'CS5' + set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' + set qos policy shaper vyos3 class 30 set-dscp 'CS6' + set qos policy shaper vyos3 default bandwidth '10%' + set qos policy shaper vyos3 default ceiling '100%' + set qos policy shaper vyos3 default priority '7' + set qos policy shaper vyos3 default queue-type 'fair-queue' + set qos interface eth0 egress 'vyos3' + +.. start_vyoslinter Main rules: @@ -85,25 +98,27 @@ After the interface eth0 on router VyOS3 :align: center :alt: Network Topology Diagram -On the router, VyOS4 set all traffic as CS4. We have to configure the default class and class for changing all labels from CS0 to CS4 +On the router, VyOS4 set all traffic as CS4. We have to configure the +default class and class for changing all labels from CS0 to CS4 .. code-block:: none - set interfaces ethernet eth0 address '10.2.1.100/24' - set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 - set qos policy shaper vyos4 class 10 bandwidth '100%' - set qos policy shaper vyos4 class 10 burst '15k' - set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' - set qos policy shaper vyos4 class 10 queue-type 'fair-queue' - set qos policy shaper vyos4 class 10 set-dscp 'CS4' - set qos policy shaper vyos4 default bandwidth '10%' - set qos policy shaper vyos4 default burst '15k' - set qos policy shaper vyos4 default ceiling '100%' - set qos policy shaper vyos4 default priority '7' - set qos policy shaper vyos4 default queue-type 'fair-queue' + set interfaces ethernet eth0 address '10.2.1.100/24' + set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 + set qos policy shaper vyos4 class 10 bandwidth '100%' + set qos policy shaper vyos4 class 10 burst '15k' + set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' + set qos policy shaper vyos4 class 10 queue-type 'fair-queue' + set qos policy shaper vyos4 class 10 set-dscp 'CS4' + set qos policy shaper vyos4 default bandwidth '10%' + set qos policy shaper vyos4 default burst '15k' + set qos policy shaper vyos4 default ceiling '100%' + set qos policy shaper vyos4 default priority '7' + set qos policy shaper vyos4 default queue-type 'fair-queue' set qos interface eth0 egress 'vyos4' -Next on the router VyOS2 we will change labels on all incoming traffic only from CS4-> CS6 +Next on the router VyOS2 we will change labels on all incoming +traffic only from CS4-> CS6 .. image:: /_static/images/qos5.* :width: 80% @@ -112,20 +127,20 @@ Next on the router VyOS2 we will change labels on all incoming traffic only from .. code-block:: none - set interfaces ethernet eth0 address '10.1.1.1/24' - set interfaces ethernet eth1 address '10.2.1.1/24' - set interfaces ethernet eth2 address '10.9.9.1/24' - set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 - set qos policy shaper vyos2 class 10 bandwidth '100%' - set qos policy shaper vyos2 class 10 burst '15k' - set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' - set qos policy shaper vyos2 class 10 queue-type 'fair-queue' - set qos policy shaper vyos2 class 10 set-dscp 'CS5' - set qos policy shaper vyos2 default bandwidth '100%' - set qos policy shaper vyos2 default burst '15k' - set qos policy shaper vyos2 default ceiling '100%' - set qos policy shaper vyos2 default priority '7' - set qos policy shaper vyos2 default queue-type 'fair-queue' + set interfaces ethernet eth0 address '10.1.1.1/24' + set interfaces ethernet eth1 address '10.2.1.1/24' + set interfaces ethernet eth2 address '10.9.9.1/24' + set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 + set qos policy shaper vyos2 class 10 bandwidth '100%' + set qos policy shaper vyos2 class 10 burst '15k' + set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' + set qos policy shaper vyos2 class 10 queue-type 'fair-queue' + set qos policy shaper vyos2 class 10 set-dscp 'CS5' + set qos policy shaper vyos2 default bandwidth '100%' + set qos policy shaper vyos2 default burst '15k' + set qos policy shaper vyos2 default ceiling '100%' + set qos policy shaper vyos2 default priority '7' + set qos policy shaper vyos2 default queue-type 'fair-queue' set qos interface eth2 egress 'vyos2' .. image:: /_static/images/qos6.* @@ -154,23 +169,26 @@ Next on the router VyOS2 we will change labels on all incoming traffic only from :align: center :alt: Network Topology Diagram -In the end, on the router “VyOS2” we will set outgoing bandwidth limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work with the help of the “iPerf” utility. +In the end, on the router “VyOS2” we will set outgoing bandwidth +limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for +IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work +with the help of the “iPerf” utility. Set up bandwidth limits on the eth2 interface of the router “VyOS2”. .. code-block:: none - vyos@vyos2# show qos policy shaper vyos2 class 20 - bandwidth 5mbit - description "for VyOS3 eth0" - match VyOS3 { - ip { - source { - address 10.1.1.100/32 - } - } - } + vyos@vyos2# show qos policy shaper vyos2 class 20 + bandwidth 5mbit + description "for VyOS3 eth0" + match VyOS3 { + ip { + source { + address 10.1.1.100/32 + } + } + } Check the result. diff --git a/docs/configexamples/site-2-site-cisco.rst b/docs/configexamples/site-2-site-cisco.rst index 96e48d07..e8322002 100644 --- a/docs/configexamples/site-2-site-cisco.rst +++ b/docs/configexamples/site-2-site-cisco.rst @@ -1,7 +1,8 @@ .. _examples-site-2-site-cisco: +############################################# Site-to-Site IPSec VPN to Cisco using FlexVPN ---------------------------------------------- +############################################# This guide shows a sample configuration for FlexVPN site-to-site Internet Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel. @@ -28,7 +29,7 @@ VyOS set interfaces tunnel tun1 ip adjust-mss '1336' set interfaces tunnel tun1 mtu '1376' set interfaces tunnel tun1 remote '10.1.1.6' - set interfaces tunnel tun1 source-address '88.2.2.1' + set interfaces tunnel tun1 source-address '198.51.100.1' - IPsec: @@ -59,9 +60,9 @@ VyOS set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate' set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1' set vpn ipsec site-to-site peer cisco_hub ike-group 'i1' - set vpn ipsec site-to-site peer cisco_hub local-address '88.2.2.1' + set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1' set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6' - set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '88.2.2.1/32' + set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32' set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre' set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32' set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0' @@ -141,7 +142,7 @@ Verification --------- ---------- --- ----------- eth0 - u/u eth1 - u/u - eth2 88.2.2.1/24 u/u + eth2 198.51.100.1/24 u/u eth3 172.16.1.2/24 u/u lo 127.0.0.1/8 u/u ::1/128 @@ -157,7 +158,7 @@ Verification IPv4 Crypto IKEv2 SA Tunnel-id Local Remote fvrf/ivrf Status - 5 10.1.1.6/4500 88.2.2.1/4500 none/none READY + 5 10.1.1.6/4500 198.51.100.1/4500 none/none READY Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK Life/Active Time: 86400/2694 sec CE id: 0, Session-id: 2 diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst index 906078bb..d03d4ed9 100644 --- a/docs/configexamples/wan-load-balancing.rst +++ b/docs/configexamples/wan-load-balancing.rst @@ -4,8 +4,9 @@ .. stop_vyoslinter # pictures and text have to change +########################## WAN Load Balancer examples -========================== +########################## Example 1: Distributing load evenly diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst index 3c387519..7ea33b95 100644 --- a/docs/configexamples/zone-policy.rst +++ b/docs/configexamples/zone-policy.rst @@ -2,8 +2,9 @@ .. _examples-zone-policy: +################### Zone-Policy example -------------------- +################### .. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. The zone configuration moved from ``zone-policy zone <name>`` to ``firewall |