diff options
Diffstat (limited to 'docs/configexamples')
26 files changed, 157 insertions, 76 deletions
diff --git a/docs/configexamples/ansible.rst b/docs/configexamples/ansible.rst index 4d6561d0..ee865076 100644 --- a/docs/configexamples/ansible.rst +++ b/docs/configexamples/ansible.rst @@ -15,7 +15,7 @@ We have four pre-configured routers with this configuration: Using the general schema for example: -.. image:: /_static/images/ansible.png +.. image:: /_static/images/ansible.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst index 77f9b118..f2a98479 100644 --- a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst +++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst @@ -18,7 +18,7 @@ The topology has 3 VyOS routers and one client. Between the DHCP Server and the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large Network. -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: Ansible Example topology image ************* diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp b/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp Binary files differnew file mode 100644 index 00000000..592484cb --- /dev/null +++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/_include/topology.webp diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst index 2a528852..6092199b 100644 --- a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst +++ b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst @@ -53,7 +53,7 @@ Topology We use the following network topology in this example: -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: L3VPN EVPN with VyOS topology image diff --git a/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp b/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp Binary files differnew file mode 100644 index 00000000..f3218799 --- /dev/null +++ b/docs/configexamples/autotest/L3VPN_EVPN/_include/topology.webp diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst index 6666399d..acb880d1 100644 --- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst +++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst @@ -14,7 +14,7 @@ Topology consists of: * VyOS as a OpenVPN Server * VyOS as Client -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: OpenVPN with LDAP topology image Active Directory on Windows server @@ -39,13 +39,20 @@ Here are some PowerShell commands to quickly add a Test Active Directory. Configure VyOS as OpenVPN Server ==================================== -In this example OpenVPN will be setup with a client certificate and username / password authentication. +In this example OpenVPN will be setup with a client certificate and +username / password authentication. -First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed. -Please look :ref:`here <configuration/pki/index:pki>` for more information. +First a CA, a signed server and client ceftificate and a +Diffie-Hellman parameter musst be generated and installed. +Please look :ref:`here <configuration/pki/index:pki>` for more +information. | Add the LDAP plugin configuration file `/config/auth/ldap-auth.config` -| Check all possible settings `here <https://github.com/threerings/openvpn-auth-ldap/blob/master/auth-ldap.conf>`_ + +| Check all possible settings `here`_. + +.. _here: + https://github.com/threerings/openvpn-auth-ldap/blob/master/auth-ldap.conf .. literalinclude:: _include/ldap-auth.config :language: none @@ -93,7 +100,8 @@ OpenVPN Server configuration can be carried out. Client configuration ==================== -One advantage of having the client certificate stored is the ability to create the client configuration. +One advantage of having the client certificate stored is the ability to +create the client configuration. .. code-block:: none diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp b/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp Binary files differnew file mode 100644 index 00000000..13bf2d73 --- /dev/null +++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/_include/topology.webp diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.rst b/docs/configexamples/autotest/Wireguard/Wireguard.rst index 1feb03e8..7d7b216a 100644 --- a/docs/configexamples/autotest/Wireguard/Wireguard.rst +++ b/docs/configexamples/autotest/Wireguard/Wireguard.rst @@ -17,7 +17,7 @@ Topology The topology have a central and a branch VyOS router and one client, to test, in each site. -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: Ansible Example topology image ************* diff --git a/docs/configexamples/autotest/Wireguard/_include/topology.webp b/docs/configexamples/autotest/Wireguard/_include/topology.webp Binary files differnew file mode 100644 index 00000000..3cc5e992 --- /dev/null +++ b/docs/configexamples/autotest/Wireguard/_include/topology.webp diff --git a/docs/configexamples/autotest/tunnelbroker/_include/topology.webp b/docs/configexamples/autotest/tunnelbroker/_include/topology.webp Binary files differnew file mode 100644 index 00000000..c3a812ab --- /dev/null +++ b/docs/configexamples/autotest/tunnelbroker/_include/topology.webp diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst index 370cf9d6..e34cb779 100644 --- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst +++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst @@ -28,7 +28,7 @@ Topology The example topology has 2 VyOS routers. One as The WAN Router and on as a Client, to test a single LAN setup -.. image:: _include/topology.png +.. image:: _include/topology.* :alt: Tunnelbroker topology image @@ -64,6 +64,7 @@ Setup the IPv6 default route to the tunnel interface Now you should be able to ping a public IPv6 Address +.. stop_vyoslinter .. code-block:: none @@ -73,11 +74,13 @@ Now you should be able to ping a public IPv6 Address 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=43.9 ms 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=43.4 ms 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=42.5 ms - + --- 2001:470:20::2 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 2999ms rtt min/avg/max/mdev = 33.802/40.920/43.924/4.139 ms +.. start_vyoslinter + Assuming the pings are successful, you need to add some DNS servers. Some options: @@ -88,6 +91,7 @@ Some options: You should now be able to ping something by IPv6 DNS name: +.. stop_vyoslinter .. code-block:: none @@ -97,11 +101,13 @@ You should now be able to ping something by IPv6 DNS name: 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=48 time=186 ms 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=48 time=178 ms 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=48 time=177 ms - + --- tunnelbroker.net ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3002ms rtt min/avg/max/mdev = 176.707/206.638/285.128/45.457 ms +.. start_vyoslinter + ***************** LAN Configuration @@ -151,6 +157,7 @@ This accomplishes a few things: Now the Client is able to ping a public IPv6 address +.. stop_vyoslinter .. code-block:: none @@ -160,11 +167,13 @@ Now the Client is able to ping a public IPv6 address 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=41.8 ms 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=41.7 ms 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=47.1 ms - + --- 2001:470:20::2 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3005ms rtt min/avg/max/mdev = 32.128/40.688/47.107/5.403 ms +.. start_vyoslinter + Multiple LAN/DMZ Setup ====================== @@ -186,6 +195,8 @@ In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' @@ -200,6 +211,8 @@ So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: set service router-advert interface eth3 name-server '2001:470:20::2' set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 +.. start_vyoslinter + Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, 'valid-lifetime' and 'preferred-lifetime' are set to default values of 30 days and 4 hours respectively. @@ -207,9 +220,11 @@ Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, Firewall ======== -Finally, don't forget the :ref:`Firewall<configuration/firewall/index:Firewall>`. The usage is identical, except for -instead of `set firewall ipv4 name NAME`, you would use `set firewall ipv6 name -NAME`. +Finally, don't forget the +:ref:`Firewall<configuration/firewall/index:Firewall>`. The usage is +identical, except instead of `set firewall ipv4 name NAME`, you would +use `set firewall ipv6 name NAME`. -Similarly, to attach the firewall, you would use `set firewall ipv6 name NAME rule N inbound-interface name eth0` or `set firewall zone LOCAL from WAN firewall -ipv6-name`. +Similarly, to attach the firewall, you would use +`set firewall ipv6 name NAME rule N inbound-interface name eth0` or +`set firewall zone LOCAL from WAN firewall ipv6-name`. diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.rst b/docs/configexamples/dmvpn-dualhub-dualcloud.rst index 5a789647..a3a4e619 100644 --- a/docs/configexamples/dmvpn-dualhub-dualcloud.rst +++ b/docs/configexamples/dmvpn-dualhub-dualcloud.rst @@ -6,16 +6,17 @@ DMVPN Dual HUB Dual Cloud ######################### -This document is to describe a basic setup to build DVMPN network with two Hubs and two clouds using DMVPN Phase3. +This document is to describe a basic setup to build DVMPN network with +two Hubs and two clouds using DMVPN Phase3. OSPF is used as routing protocol inside DMVPN. -In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) -as a Spoke. +In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, +SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) as a Spoke. Network Topology ================ -.. image:: /_static/images/dual-hub-DMVPN.png +.. image:: /_static/images/dual-hub-DMVPN.* :width: 80% :align: center :alt: DMVPN Network Topology @@ -80,9 +81,12 @@ Spoke-3 NHRP configuration __________________ -The next step is to configure the NHRP protocol. In a Dual cloud network, every HUB has to be configured with one GRE -multipoint tunnel interface and every spoke has to be configured with two tunnel interfaces, one tunnel to each hub. -In this example tunnel networks are 10.100.100.0/24 for the first cloud and 10.100.101.0/24 for the second cloud. +The next step is to configure the NHRP protocol. In a Dual cloud +network, every HUB has to be configured with one GRE multipoint tunnel +interface and every spoke has to be configured with two tunnel +interfaces, one tunnel to each hub. +In this example tunnel networks are 10.100.100.0/24 for the first cloud +and 10.100.101.0/24 for the second cloud. But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32. HUB-1 @@ -211,8 +215,10 @@ Spoke-3 Overlay configuration _____________________ -The last step is to configure the routing protocol. In this scenario, OSPF was chosen as the dynamic routing protocol. -But you can use iBGP or eBGP. To form fast convergence it is possible to use BFD protocol. +The last step is to configure the routing protocol. In this scenario, +OSPF was chosen as the dynamic routing protocol. +But you can use iBGP or eBGP. To form fast convergence it is possible +to use BFD protocol. HUB-1 @@ -378,7 +384,8 @@ SPOKE-1 Monitoring ========== -All spokes created IPSec tunnels to Hubs, are registered on Hubs using NHRP protocol and formed adjacency in OSPF. +All spokes created IPSec tunnels to Hubs, are registered on Hubs using +NHRP protocol and formed adjacency in OSPF. .. code-block:: none @@ -468,7 +475,8 @@ For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1 3 *192.168.11.2 3.241 ms (ICMP type:3, code:3, Destination port unreachable) First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2. -Now routing tables are changed. LAN networks 192.168.12.0/24 and 192.168.11.0/24 available directly via SPOKES. +Now routing tables are changed. LAN networks 192.168.12.0/24 and +192.168.11.0/24 available directly via SPOKES. .. code-block:: none @@ -541,8 +549,11 @@ A new Spoke to Spoke IPSec tunnel is created Summary ======= -If one of the Hubs loses connectivity to the Internet, the other Hub will be available and take the main role. -This is a simple example where only one internet connection is used. But in the real world, there can be two -connections to the Internet. In this case, there is a recommendation to build each tunnel via each Internet connection, -choose the main cloud, and manipulate traffic via a routing protocol. It allows the creation failover on link-level +If one of the Hubs loses connectivity to the Internet, the other Hub +will be available and take the main role. +This is a simple example where only one internet connection is used. +But in the real world, there can be two connections to the Internet. +In this case, there is a recommendation to build each tunnel via each +Internet connection, choose the main cloud, and manipulate traffic via +a routing protocol. It allows the creation failover on link-level connections too.
\ No newline at end of file diff --git a/docs/configexamples/fwall-and-vrf.rst b/docs/configexamples/fwall-and-vrf.rst index 992b625e..bd97e1ad 100644 --- a/docs/configexamples/fwall-and-vrf.rst +++ b/docs/configexamples/fwall-and-vrf.rst @@ -9,7 +9,7 @@ This example shows how to configure a VyOS router with VRFs and firewall rules. Diagram used in this example: -.. image:: /_static/images/firewall-and-vrf-blueprints.png +.. image:: /_static/images/firewall-and-vrf-blueprints.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst index 11c23bf0..1f02da8e 100644 --- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst +++ b/docs/configexamples/inter-vrf-routing-vrf-lite.rst @@ -16,7 +16,8 @@ where you might need that some network can access other in a different VRF. The scope of this document is to cover such cases in a dynamic way without the use of MPLS-LDP. -General information about L3VPNs can be found in the :ref:`configuration/vrf/index:L3VPN VRFs` chapter. +General information about L3VPNs can be found in the +:ref:`configuration/vrf/index:L3VPN VRFs` chapter. ******** Overview @@ -70,7 +71,7 @@ community(ies) into that prefix. ******** Topology ******** -.. image:: /_static/images/inter-vrf-routing-vrf-lite.png +.. image:: /_static/images/inter-vrf-routing-vrf-lite.* :width: 70% :align: center :alt: Network Topology Diagram @@ -467,7 +468,7 @@ Now we perform some end-to-end testing - From Management to Outside (fails as intended) - +.. stop_vyoslinter .. code-block:: none @@ -515,6 +516,7 @@ Now we perform some end-to-end testing --- 2001:db8:2::1 ping statistics --- 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms +.. start_vyoslinter - LAN1 to Outside @@ -772,6 +774,8 @@ route-map with an prefix-list. We create a prefix-list first and add all the routes we need to. +.. stop_vyoslinter + .. code-block:: none # set both ipv4 and ipv6 policies @@ -795,6 +799,8 @@ We create a prefix-list first and add all the routes we need to. set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' +.. start_vyoslinter + Then add a route-map and reference to above prefix. Consider that the actions taken inside the prefix will MATCH the routes that will be affected by the actions inside the rules of the route-map. diff --git a/docs/configexamples/ipsec-cisco-policy-based.rst b/docs/configexamples/ipsec-cisco-policy-based.rst index 787c1140..257d98a1 100644 --- a/docs/configexamples/ipsec-cisco-policy-based.rst +++ b/docs/configexamples/ipsec-cisco-policy-based.rst @@ -15,7 +15,7 @@ initiator role on VyOS side. Network Topology ================ -.. image:: /_static/images/cisco-vpn-ipsec.png +.. image:: /_static/images/cisco-vpn-ipsec.* :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/ipsec-cisco-route-based.rst b/docs/configexamples/ipsec-cisco-route-based.rst index f7c3cb08..553c5e2a 100644 --- a/docs/configexamples/ipsec-cisco-route-based.rst +++ b/docs/configexamples/ipsec-cisco-route-based.rst @@ -16,7 +16,7 @@ inside the tunnel. Network Topology ================ -.. image:: /_static/images/cisco-vpn-ipsec.png +.. image:: /_static/images/cisco-vpn-ipsec.* :align: center :alt: Network Topology Diagram @@ -89,6 +89,8 @@ Configuration VyOS ---- +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '10.0.1.2/30' @@ -132,9 +134,13 @@ VyOS set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +.. start_vyoslinter + Cisco ----- +.. stop_vyoslinter + .. code-block:: none crypto isakmp policy 10 @@ -196,6 +202,7 @@ Cisco ! ip route 0.0.0.0 0.0.0.0 10.0.2.1 +.. start_vyoslinter Monitoring @@ -230,6 +237,8 @@ IPsec SAs: OSPF Neighbor Status: +.. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show ip ospf neighbor @@ -237,6 +246,8 @@ OSPF Neighbor Status: Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL 1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 +.. start_vyoslinter + Routing Table: .. code-block:: none @@ -268,6 +279,8 @@ Routing Table: Monitoring on Cisco side ------------------------ +.. stop_vyoslinter + IKE SAs: .. code-block:: none @@ -378,6 +391,8 @@ Routing Table: C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 +.. start_vyoslinter + Checking Connectivity --------------------- diff --git a/docs/configexamples/ipsec-pa-route-based.rst b/docs/configexamples/ipsec-pa-route-based.rst index b6f6f3a7..96349d98 100644 --- a/docs/configexamples/ipsec-pa-route-based.rst +++ b/docs/configexamples/ipsec-pa-route-based.rst @@ -17,7 +17,7 @@ include firewall configuration. Network Topology ================ -.. image:: /_static/images/ipsec-vyos-pa.png +.. image:: /_static/images/ipsec-vyos-pa.* :align: center :alt: Network Topology Diagram @@ -88,6 +88,8 @@ Configuration VyOS ---- +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '10.0.1.2/30' @@ -131,42 +133,46 @@ VyOS set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +.. start_vyoslinter + Palo Alto --------- +.. stop_vyoslinter + GUI Configuration: Network -> Network Profiles -> IKE Crypto - .. image:: /_static/images/PA-IKE-group.png + .. image:: /_static/images/PA-IKE-group.* :align: center Network -> Network Profiles -> IKE Gateways - .. image:: /_static/images/PA-IKE-GW-1.png + .. image:: /_static/images/PA-IKE-GW-1.* :align: center - .. image:: /_static/images/PA-IKE-GW-2.png + .. image:: /_static/images/PA-IKE-GW-2.* :align: center Network -> Network Profiles -> IPSec Crypto - .. image:: /_static/images/PA-ESP-group.png + .. image:: /_static/images/PA-ESP-group.* :align: center Network -> Interfaces - .. image:: /_static/images/PA-tunnel-1.png + .. image:: /_static/images/PA-tunnel-1.* :align: center - .. image:: /_static/images/PA-tunnel-2.png + .. image:: /_static/images/PA-tunnel-2.* :align: center - .. image:: /_static/images/PA-tunnel-3.png + .. image:: /_static/images/PA-tunnel-3.* :align: center Network -> IPSec Tunnels - .. image:: /_static/images/PA-IPsec-tunnel.png + .. image:: /_static/images/PA-IPsec-tunnel.* :align: center CLI configuration with OSPF: @@ -225,6 +231,8 @@ CLI configuration with OSPF: set network virtual-router default protocol ospf router-id 1.1.1.1 set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] +.. start_vyoslinter + Monitoring ========== @@ -260,6 +268,8 @@ IPsec SAs: OSPF Neighbor Status: +.. stop_vyoslinter + .. code-block:: none vyos@vyos:~$ show ip ospf neighbor @@ -267,6 +277,8 @@ OSPF Neighbor Status: Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL 1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 +.. start_vyoslinter + Routing Table: @@ -337,6 +349,8 @@ IPsec SAs: OSPF Neighbor Status: +.. stop_vyoslinter + .. code-block:: none admin@PA-VM> show routing protocol ospf neighbor @@ -361,6 +375,8 @@ OSPF Neighbor Status: restart helper time remaining: 0 restart helper exit reason: none +.. start_vyoslinter + Routing Table: diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst index c05b9a3f..90a036d8 100644 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ b/docs/configexamples/l3vpn-hub-and-spoke.rst @@ -54,7 +54,7 @@ General information can be found in the ******** Topology ******** -.. image:: /_static/images/L3VPN_hub_and_spoke.png +.. image:: /_static/images/L3VPN_hub_and_spoke.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst index 8443ddff..5f344d54 100644 --- a/docs/configexamples/lac-lns.rst +++ b/docs/configexamples/lac-lns.rst @@ -20,7 +20,7 @@ All users with domain **vyos.io** will be tunneled to LNS via L2TP. Network Topology ================ -.. image:: /_static/images/lac-lns-diagram.jpg +.. image:: /_static/images/lac-lns-diagram.* :width: 60% :align: center :alt: Network Topology Diagram @@ -79,6 +79,8 @@ LAC LNS --- +.. stop_vyoslinter + .. code-block:: none set interfaces ethernet eth0 address '192.168.139.100/24' @@ -96,8 +98,11 @@ LNS set vpn l2tp remote-access name-server '8.8.8.8' set vpn l2tp remote-access ppp-options disable-ccp +.. start_vyoslinter + .. note:: This setup requires the Compression Control Protocol (CCP) - being disabled, the command ``set vpn l2tp remote-access ppp-options disable-ccp`` + being disabled, the command + ``set vpn l2tp remote-access ppp-options disable-ccp`` accomplishes that. Client @@ -105,7 +110,7 @@ Client In this lab we use Windows PPPoE client. -.. image:: /_static/images/lac-lns-winclient.jpg +.. image:: /_static/images/lac-lns-winclient.* :width: 100% :align: center :alt: Window PPPoE Client Configuration diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/nmp.rst index 318e9a91..8945a9f4 100644 --- a/docs/configexamples/nmp.rst +++ b/docs/configexamples/nmp.rst @@ -33,37 +33,37 @@ Configuration 'NMP' Next, you just should follow the pictures: -.. image:: /_static/images/nmp1.png +.. image:: /_static/images/nmp1.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp2.png +.. image:: /_static/images/nmp2.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp3.png +.. image:: /_static/images/nmp3.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp4.png +.. image:: /_static/images/nmp4.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp5.png +.. image:: /_static/images/nmp5.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp6.png +.. image:: /_static/images/nmp6.* :width: 80% :align: center :alt: Network Topology Diagram -.. image:: /_static/images/nmp7.png +.. image:: /_static/images/nmp7.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.rst b/docs/configexamples/policy-based-ipsec-and-firewall.rst index 5d98e944..dcf59af9 100644 --- a/docs/configexamples/policy-based-ipsec-and-firewall.rst +++ b/docs/configexamples/policy-based-ipsec-and-firewall.rst @@ -41,7 +41,7 @@ This configuration example and the requirements consists of: - Allow connections from LANs to LANs through the tunnel. -.. image:: /_static/images/policy-based-ipsec-and-firewall.png +.. image:: /_static/images/policy-based-ipsec-and-firewall.* Configuration diff --git a/docs/configexamples/pppoe-ipv6-basic.rst b/docs/configexamples/pppoe-ipv6-basic.rst index ad588def..cc14451c 100644 --- a/docs/configexamples/pppoe-ipv6-basic.rst +++ b/docs/configexamples/pppoe-ipv6-basic.rst @@ -17,7 +17,7 @@ please contact your ISP for more information. Network Topology ================ -.. image:: /_static/images/pppoe-ipv6-pd-diagram.jpg +.. image:: /_static/images/pppoe-ipv6-pd-diagram.* :width: 60% :align: center :alt: Network Topology Diagram @@ -51,8 +51,13 @@ delegation (PD). set interfaces pppoe pppoe0 ipv6 address autoconf set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' +.. stop_vyoslinter + * Here we use the prefix to configure the address of eth1 (LAN) to form ``<prefix>::64``, where ``64`` is hexadecimal of address 100. + +.. start_vyoslinter + * For home network users, most of time ISP only provides /64 prefix, hence there is no need to set SLA ID and prefix length. See :ref:`pppoe-interface` for more information. diff --git a/docs/configexamples/qos.rst b/docs/configexamples/qos.rst index 268163df..96448dd4 100644 --- a/docs/configexamples/qos.rst +++ b/docs/configexamples/qos.rst @@ -18,7 +18,7 @@ first. Using the general schema for example: -.. image:: /_static/images/qos1.png +.. image:: /_static/images/qos1.* :width: 80% :align: center :alt: Network Topology Diagram @@ -79,21 +79,21 @@ Main rules: Check the result -.. image:: /_static/images/qos2.png +.. image:: /_static/images/qos2.* :width: 80% :align: center :alt: Network Topology Diagram Before the interface eth0 on router VyOS3 -.. image:: /_static/images/qos3.png +.. image:: /_static/images/qos3.* :width: 80% :align: center :alt: Network Topology Diagram After the interface eth0 on router VyOS3 -.. image:: /_static/images/qos4.png +.. image:: /_static/images/qos4.* :width: 80% :align: center :alt: Network Topology Diagram @@ -120,7 +120,7 @@ default class and class for changing all labels from CS0 to CS4 Next on the router VyOS2 we will change labels on all incoming traffic only from CS4-> CS6 -.. image:: /_static/images/qos5.png +.. image:: /_static/images/qos5.* :width: 80% :align: center :alt: Network Topology Diagram @@ -143,28 +143,28 @@ traffic only from CS4-> CS6 set qos policy shaper vyos2 default queue-type 'fair-queue' set qos interface eth2 egress 'vyos2' -.. image:: /_static/images/qos6.png +.. image:: /_static/images/qos6.* :width: 80% :align: center :alt: Network Topology Diagram * 172.17.1.2/24 CS0 -.. image:: /_static/images/qos7.png +.. image:: /_static/images/qos7.* :width: 80% :align: center :alt: Network Topology Diagram * 172.17.1.2/24 CS0 - > CS4 -.. image:: /_static/images/qos8.png +.. image:: /_static/images/qos8.* :width: 80% :align: center :alt: Network Topology Diagram * 172.17.1.2/24 CS4 - > CS5 -.. image:: /_static/images/qos9.png +.. image:: /_static/images/qos9.* :width: 80% :align: center :alt: Network Topology Diagram @@ -192,7 +192,7 @@ Set up bandwidth limits on the eth2 interface of the router “VyOS2”. Check the result. -.. image:: /_static/images/qos10.png +.. image:: /_static/images/qos10.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/segment-routing-isis.rst b/docs/configexamples/segment-routing-isis.rst index d9bc439b..86cbec26 100644 --- a/docs/configexamples/segment-routing-isis.rst +++ b/docs/configexamples/segment-routing-isis.rst @@ -11,7 +11,7 @@ blue print as an initial setup to get MPLS ISIS-SR working between those two devices.The lab was build using :abbr:`EVE-NG (Emulated Virtual Environment NG)`. -.. figure:: /_static/images/vyos-sr-isis.png +.. figure:: /_static/images/vyos-sr-isis.* :alt: ISIS-SR network ISIS-SR example network diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst index 38490616..d03d4ed9 100644 --- a/docs/configexamples/wan-load-balancing.rst +++ b/docs/configexamples/wan-load-balancing.rst @@ -14,7 +14,7 @@ Example 1: Distributing load evenly The setup used in this example is shown in the following diagram: -.. image:: /_static/images/Wan_load_balancing1.png +.. image:: /_static/images/Wan_load_balancing1.* :width: 80% :align: center :alt: Network Topology Diagram @@ -159,7 +159,7 @@ Example 5: Exclude traffic from load balancing In this example two LAN interfaces exist in different subnets instead of one like in the previous examples: -.. image:: /_static/images/Wan_load_balancing_exclude1.png +.. image:: /_static/images/Wan_load_balancing_exclude1.* :width: 80% :align: center :alt: Network Topology Diagram diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst index 0c1c2617..7ea33b95 100644 --- a/docs/configexamples/zone-policy.rst +++ b/docs/configexamples/zone-policy.rst @@ -40,7 +40,7 @@ adapted for however many NICs you have**: * DMZ cannot access LAN resources. * Inbound WAN connect to DMZ host. -.. image:: /_static/images/zone-policy-diagram.png +.. image:: /_static/images/zone-policy-diagram.* :width: 80% :align: center :alt: Network Topology Diagram |
