From 5d6fa52b8985f8068314aba26878a1d7d5cb84e5 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 6 May 2026 20:42:32 +0300 Subject: feat: flip swap mechanism — MD as primary, RST as override (Phase 1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is the first of three phases inverting the per-page swap mechanism so MD becomes the canonical primary and RST becomes the rare override. Phase 1 — file renames + conf.py exclude_patterns flip only: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 254 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 254 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty comment-only since no pages need the RST fallback right now - conf.py exclude_patterns flipped: rst-*.rst is now excluded by default instead of md-*.md - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt (Phase 2 will rewrite swap_sources.py to produce these names; for now no swap script runs because overrides list is empty) Phase 2 (next commit on this branch) will rewrite scripts/swap_sources.py with inverted rename direction, delete scripts/import_myst.py + tests, and update tests/test_swap_sources.py for the new semantics. Phase 3 will be the cleanup pass and ready-for-review flip. Generated by robots https://vyos.io --- docs/404.md | 13 + docs/404.rst | 12 - docs/_rst_overrides.txt | 7 + docs/_swap.txt | 262 ---- docs/automation/cloud-init.md | 378 +++++ docs/automation/cloud-init.rst | 416 ------ docs/automation/command-scripting.md | 225 +++ docs/automation/command-scripting.rst | 224 --- docs/automation/index.md | 16 + docs/automation/index.rst | 17 - docs/automation/md-cloud-init.md | 378 ----- docs/automation/md-command-scripting.md | 225 --- docs/automation/md-index.md | 16 - docs/automation/md-vyos-ansible.md | 101 -- docs/automation/md-vyos-api.md | 587 -------- docs/automation/md-vyos-govyos.md | 197 --- docs/automation/md-vyos-napalm.md | 152 -- docs/automation/md-vyos-netmiko.md | 76 - docs/automation/md-vyos-pyvyos.md | 149 -- docs/automation/md-vyos-salt.md | 211 --- docs/automation/rst-cloud-init.rst | 416 ++++++ docs/automation/rst-command-scripting.rst | 224 +++ docs/automation/rst-index.rst | 17 + docs/automation/rst-vyos-ansible.rst | 105 ++ docs/automation/rst-vyos-api.rst | 601 ++++++++ docs/automation/rst-vyos-govyos.rst | 212 +++ docs/automation/rst-vyos-napalm.rst | 155 ++ docs/automation/rst-vyos-netmiko.rst | 76 + docs/automation/rst-vyos-pyvyos.rst | 156 ++ docs/automation/rst-vyos-salt.rst | 232 +++ docs/automation/terraform/index.md | 29 + docs/automation/terraform/index.rst | 33 - docs/automation/terraform/md-index.md | 29 - docs/automation/terraform/md-terraformAWS.md | 548 ------- docs/automation/terraform/md-terraformAZ.md | 501 ------- docs/automation/terraform/md-terraformGoogle.md | 703 --------- docs/automation/terraform/md-terraformvSphere.md | 388 ----- docs/automation/terraform/rst-index.rst | 33 + docs/automation/terraform/rst-terraformAWS.rst | 576 +++++++ docs/automation/terraform/rst-terraformAZ.rst | 514 +++++++ docs/automation/terraform/rst-terraformGoogle.rst | 732 +++++++++ docs/automation/terraform/rst-terraformvSphere.rst | 426 ++++++ docs/automation/terraform/terraformAWS.md | 548 +++++++ docs/automation/terraform/terraformAWS.rst | 576 ------- docs/automation/terraform/terraformAZ.md | 501 +++++++ docs/automation/terraform/terraformAZ.rst | 514 ------- docs/automation/terraform/terraformGoogle.md | 703 +++++++++ docs/automation/terraform/terraformGoogle.rst | 732 --------- docs/automation/terraform/terraformvSphere.md | 388 +++++ docs/automation/terraform/terraformvSphere.rst | 426 ------ docs/automation/vyos-ansible.md | 101 ++ docs/automation/vyos-ansible.rst | 105 -- docs/automation/vyos-api.md | 587 ++++++++ docs/automation/vyos-api.rst | 601 -------- docs/automation/vyos-govyos.md | 197 +++ docs/automation/vyos-govyos.rst | 212 --- docs/automation/vyos-napalm.md | 152 ++ docs/automation/vyos-napalm.rst | 155 -- docs/automation/vyos-netmiko.md | 76 + docs/automation/vyos-netmiko.rst | 76 - docs/automation/vyos-pyvyos.md | 149 ++ docs/automation/vyos-pyvyos.rst | 156 -- docs/automation/vyos-salt.md | 211 +++ docs/automation/vyos-salt.rst | 232 --- docs/cli.md | 868 +++++++++++ docs/cli.rst | 1060 ------------- docs/configexamples/ansible.md | 212 +++ docs/configexamples/ansible.rst | 226 --- .../DHCPRelay_through_GRE/DHCPRelay_through_GRE.md | 89 ++ .../DHCPRelay_through_GRE.rst | 98 -- .../md-DHCPRelay_through_GRE.md | 89 -- .../rst-DHCPRelay_through_GRE.rst | 98 ++ .../autotest/L3VPN_EVPN/L3VPN_EVPN.md | 246 +++ .../autotest/L3VPN_EVPN/L3VPN_EVPN.rst | 251 ---- .../autotest/L3VPN_EVPN/md-L3VPN_EVPN.md | 246 --- .../autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst | 251 ++++ .../OpenVPN_with_LDAP/OpenVPN_with_LDAP.md | 238 +++ .../OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst | 289 ---- .../OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md | 238 --- .../OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst | 289 ++++ .../configexamples/autotest/Wireguard/Wireguard.md | 108 ++ .../autotest/Wireguard/Wireguard.rst | 112 -- .../autotest/Wireguard/md-Wireguard.md | 108 -- .../autotest/Wireguard/rst-Wireguard.rst | 112 ++ .../autotest/tunnelbroker/md-tunnelbroker.md | 206 --- .../autotest/tunnelbroker/rst-tunnelbroker.rst | 230 +++ .../autotest/tunnelbroker/tunnelbroker.md | 206 +++ .../autotest/tunnelbroker/tunnelbroker.rst | 230 --- docs/configexamples/azure-vpn-bgp.md | 134 ++ docs/configexamples/azure-vpn-bgp.rst | 138 -- docs/configexamples/azure-vpn-dual-bgp.md | 160 ++ docs/configexamples/azure-vpn-dual-bgp.rst | 163 -- docs/configexamples/bgp-ipv6-unnumbered.md | 174 +++ docs/configexamples/bgp-ipv6-unnumbered.rst | 176 --- docs/configexamples/dmvpn-dualhub-dualcloud.md | 552 +++++++ docs/configexamples/dmvpn-dualhub-dualcloud.rst | 559 ------- docs/configexamples/firewall.md | 16 + docs/configexamples/firewall.rst | 15 - docs/configexamples/fwall-and-bridge.md | 490 ++++++ docs/configexamples/fwall-and-bridge.rst | 502 ------- docs/configexamples/fwall-and-vrf.md | 121 ++ docs/configexamples/fwall-and-vrf.rst | 122 -- docs/configexamples/ha.md | 556 +++++++ docs/configexamples/ha.rst | 584 -------- docs/configexamples/index.md | 60 + docs/configexamples/index.rst | 63 - docs/configexamples/inter-vrf-routing-vrf-lite.md | 797 ++++++++++ docs/configexamples/inter-vrf-routing-vrf-lite.rst | 856 ----------- docs/configexamples/ipsec-cisco-policy-based.md | 363 +++++ docs/configexamples/ipsec-cisco-policy-based.rst | 355 ----- docs/configexamples/ipsec-cisco-route-based.md | 406 +++++ docs/configexamples/ipsec-cisco-route-based.rst | 420 ------ docs/configexamples/ipsec-pa-route-based.md | 412 +++++ docs/configexamples/ipsec-pa-route-based.rst | 436 ------ docs/configexamples/l3vpn-hub-and-spoke.md | 1091 ++++++++++++++ docs/configexamples/l3vpn-hub-and-spoke.rst | 1127 -------------- docs/configexamples/lac-lns.md | 181 +++ docs/configexamples/lac-lns.rst | 182 --- docs/configexamples/md-ansible.md | 212 --- docs/configexamples/md-azure-vpn-bgp.md | 134 -- docs/configexamples/md-azure-vpn-dual-bgp.md | 160 -- docs/configexamples/md-bgp-ipv6-unnumbered.md | 174 --- docs/configexamples/md-dmvpn-dualhub-dualcloud.md | 552 ------- docs/configexamples/md-firewall.md | 16 - docs/configexamples/md-fwall-and-bridge.md | 490 ------ docs/configexamples/md-fwall-and-vrf.md | 121 -- docs/configexamples/md-ha.md | 556 ------- docs/configexamples/md-index.md | 60 - .../md-inter-vrf-routing-vrf-lite.md | 797 ---------- docs/configexamples/md-ipsec-cisco-policy-based.md | 363 ----- docs/configexamples/md-ipsec-cisco-route-based.md | 406 ----- docs/configexamples/md-ipsec-pa-route-based.md | 412 ----- docs/configexamples/md-l3vpn-hub-and-spoke.md | 1091 -------------- docs/configexamples/md-lac-lns.md | 181 --- docs/configexamples/md-nmp.md | 76 - docs/configexamples/md-ospf-unnumbered.md | 118 -- .../md-policy-based-ipsec-and-firewall.md | 269 ---- docs/configexamples/md-pppoe-ipv6-basic.md | 114 -- docs/configexamples/md-qos.md | 201 --- docs/configexamples/md-segment-routing-isis.md | 277 ---- docs/configexamples/md-site-2-site-cisco.md | 170 --- docs/configexamples/md-wan-load-balancing.md | 183 --- docs/configexamples/md-zone-policy.md | 417 ------ docs/configexamples/nmp.md | 76 + docs/configexamples/nmp.rst | 72 - docs/configexamples/ospf-unnumbered.md | 118 ++ docs/configexamples/ospf-unnumbered.rst | 120 -- .../policy-based-ipsec-and-firewall.md | 269 ++++ .../policy-based-ipsec-and-firewall.rst | 282 ---- docs/configexamples/pppoe-ipv6-basic.md | 114 ++ docs/configexamples/pppoe-ipv6-basic.rst | 121 -- docs/configexamples/qos.md | 201 +++ docs/configexamples/qos.rst | 200 --- docs/configexamples/rst-ansible.rst | 226 +++ docs/configexamples/rst-azure-vpn-bgp.rst | 138 ++ docs/configexamples/rst-azure-vpn-dual-bgp.rst | 163 ++ docs/configexamples/rst-bgp-ipv6-unnumbered.rst | 176 +++ .../configexamples/rst-dmvpn-dualhub-dualcloud.rst | 559 +++++++ docs/configexamples/rst-firewall.rst | 15 + docs/configexamples/rst-fwall-and-bridge.rst | 502 +++++++ docs/configexamples/rst-fwall-and-vrf.rst | 122 ++ docs/configexamples/rst-ha.rst | 584 ++++++++ docs/configexamples/rst-index.rst | 63 + .../rst-inter-vrf-routing-vrf-lite.rst | 856 +++++++++++ .../rst-ipsec-cisco-policy-based.rst | 355 +++++ .../configexamples/rst-ipsec-cisco-route-based.rst | 420 ++++++ docs/configexamples/rst-ipsec-pa-route-based.rst | 436 ++++++ docs/configexamples/rst-l3vpn-hub-and-spoke.rst | 1127 ++++++++++++++ docs/configexamples/rst-lac-lns.rst | 182 +++ docs/configexamples/rst-nmp.rst | 72 + docs/configexamples/rst-ospf-unnumbered.rst | 120 ++ .../rst-policy-based-ipsec-and-firewall.rst | 282 ++++ docs/configexamples/rst-pppoe-ipv6-basic.rst | 121 ++ docs/configexamples/rst-qos.rst | 200 +++ docs/configexamples/rst-segment-routing-isis.rst | 279 ++++ docs/configexamples/rst-site-2-site-cisco.rst | 178 +++ docs/configexamples/rst-wan-load-balancing.rst | 184 +++ docs/configexamples/rst-zone-policy.rst | 421 ++++++ docs/configexamples/segment-routing-isis.md | 277 ++++ docs/configexamples/segment-routing-isis.rst | 279 ---- docs/configexamples/site-2-site-cisco.md | 170 +++ docs/configexamples/site-2-site-cisco.rst | 178 --- docs/configexamples/wan-load-balancing.md | 183 +++ docs/configexamples/wan-load-balancing.rst | 184 --- docs/configexamples/zone-policy.md | 417 ++++++ docs/configexamples/zone-policy.rst | 421 ------ docs/configuration/container/index.md | 479 ++++++ docs/configuration/container/index.rst | 417 ------ docs/configuration/container/md-index.md | 479 ------ docs/configuration/container/rst-index.rst | 417 ++++++ docs/configuration/firewall/bridge.md | 685 +++++++++ docs/configuration/firewall/bridge.rst | 573 ------- docs/configuration/firewall/flowtables.md | 176 +++ docs/configuration/firewall/flowtables.rst | 188 --- docs/configuration/firewall/global-options.md | 186 +++ docs/configuration/firewall/global-options.rst | 182 --- docs/configuration/firewall/groups.md | 477 ++++++ docs/configuration/firewall/groups.rst | 457 ------ docs/configuration/firewall/index.md | 278 ++++ docs/configuration/firewall/index.rst | 267 ---- docs/configuration/firewall/ipv4.md | 1517 +++++++++++++++++++ docs/configuration/firewall/ipv4.rst | 1305 ---------------- docs/configuration/firewall/ipv6.md | 1567 ++++++++++++++++++++ docs/configuration/firewall/ipv6.rst | 1302 ---------------- docs/configuration/firewall/md-bridge.md | 685 --------- docs/configuration/firewall/md-flowtables.md | 176 --- docs/configuration/firewall/md-global-options.md | 186 --- docs/configuration/firewall/md-groups.md | 477 ------ docs/configuration/firewall/md-index.md | 278 ---- docs/configuration/firewall/md-ipv4.md | 1517 ------------------- docs/configuration/firewall/md-ipv6.md | 1567 -------------------- docs/configuration/firewall/md-zone.md | 201 --- docs/configuration/firewall/rst-bridge.rst | 573 +++++++ docs/configuration/firewall/rst-flowtables.rst | 188 +++ docs/configuration/firewall/rst-global-options.rst | 182 +++ docs/configuration/firewall/rst-groups.rst | 457 ++++++ docs/configuration/firewall/rst-index.rst | 267 ++++ docs/configuration/firewall/rst-ipv4.rst | 1305 ++++++++++++++++ docs/configuration/firewall/rst-ipv6.rst | 1302 ++++++++++++++++ docs/configuration/firewall/rst-zone.rst | 205 +++ docs/configuration/firewall/zone.md | 201 +++ docs/configuration/firewall/zone.rst | 205 --- docs/configuration/highavailability/index.md | 561 +++++++ docs/configuration/highavailability/index.rst | 545 ------- docs/configuration/highavailability/md-index.md | 561 ------- docs/configuration/highavailability/rst-index.rst | 545 +++++++ docs/configuration/index.md | 23 + docs/configuration/index.rst | 24 - docs/configuration/interfaces/bonding.md | 764 ++++++++++ docs/configuration/interfaces/bonding.rst | 767 ---------- docs/configuration/interfaces/bridge.md | 431 ++++++ docs/configuration/interfaces/bridge.rst | 424 ------ docs/configuration/interfaces/dummy.md | 87 ++ docs/configuration/interfaces/dummy.rst | 87 -- docs/configuration/interfaces/ethernet.md | 515 +++++++ docs/configuration/interfaces/ethernet.rst | 468 ------ docs/configuration/interfaces/geneve.md | 105 ++ docs/configuration/interfaces/geneve.rst | 100 -- docs/configuration/interfaces/index.md | 26 + docs/configuration/interfaces/index.rst | 28 - docs/configuration/interfaces/l2tpv3.md | 170 +++ docs/configuration/interfaces/l2tpv3.rst | 167 --- docs/configuration/interfaces/loopback.md | 67 + docs/configuration/interfaces/loopback.rst | 65 - docs/configuration/interfaces/macsec.md | 319 ++++ docs/configuration/interfaces/macsec.rst | 322 ---- docs/configuration/interfaces/md-bonding.md | 764 ---------- docs/configuration/interfaces/md-bridge.md | 431 ------ docs/configuration/interfaces/md-dummy.md | 87 -- docs/configuration/interfaces/md-ethernet.md | 515 ------- docs/configuration/interfaces/md-geneve.md | 105 -- docs/configuration/interfaces/md-index.md | 26 - docs/configuration/interfaces/md-l2tpv3.md | 170 --- docs/configuration/interfaces/md-loopback.md | 67 - docs/configuration/interfaces/md-macsec.md | 319 ---- .../interfaces/md-openvpn-examples.md | 769 ---------- docs/configuration/interfaces/md-openvpn.md | 614 -------- docs/configuration/interfaces/md-pppoe.md | 419 ------ .../configuration/interfaces/md-pseudo-ethernet.md | 52 - docs/configuration/interfaces/md-sstp-client.md | 170 --- docs/configuration/interfaces/md-tunnel.md | 309 ---- .../interfaces/md-virtual-ethernet.md | 119 -- docs/configuration/interfaces/md-vti.md | 121 -- docs/configuration/interfaces/md-vxlan.md | 373 ----- docs/configuration/interfaces/md-wireguard.md | 434 ------ docs/configuration/interfaces/md-wireless.md | 923 ------------ docs/configuration/interfaces/md-wwan.md | 355 ----- docs/configuration/interfaces/openvpn-examples.md | 769 ++++++++++ docs/configuration/interfaces/openvpn-examples.rst | 929 ------------ docs/configuration/interfaces/openvpn.md | 614 ++++++++ docs/configuration/interfaces/openvpn.rst | 521 ------- docs/configuration/interfaces/pppoe.md | 419 ++++++ docs/configuration/interfaces/pppoe.rst | 391 ----- docs/configuration/interfaces/pseudo-ethernet.md | 52 + docs/configuration/interfaces/pseudo-ethernet.rst | 54 - docs/configuration/interfaces/rst-bonding.rst | 767 ++++++++++ docs/configuration/interfaces/rst-bridge.rst | 424 ++++++ docs/configuration/interfaces/rst-dummy.rst | 87 ++ docs/configuration/interfaces/rst-ethernet.rst | 468 ++++++ docs/configuration/interfaces/rst-geneve.rst | 100 ++ docs/configuration/interfaces/rst-index.rst | 28 + docs/configuration/interfaces/rst-l2tpv3.rst | 167 +++ docs/configuration/interfaces/rst-loopback.rst | 65 + docs/configuration/interfaces/rst-macsec.rst | 322 ++++ .../interfaces/rst-openvpn-examples.rst | 929 ++++++++++++ docs/configuration/interfaces/rst-openvpn.rst | 521 +++++++ docs/configuration/interfaces/rst-pppoe.rst | 391 +++++ .../interfaces/rst-pseudo-ethernet.rst | 54 + docs/configuration/interfaces/rst-sstp-client.rst | 158 ++ docs/configuration/interfaces/rst-tunnel.rst | 308 ++++ .../interfaces/rst-virtual-ethernet.rst | 117 ++ docs/configuration/interfaces/rst-vti.rst | 115 ++ docs/configuration/interfaces/rst-vxlan.rst | 358 +++++ docs/configuration/interfaces/rst-wireguard.rst | 439 ++++++ docs/configuration/interfaces/rst-wireless.rst | 931 ++++++++++++ docs/configuration/interfaces/rst-wwan.rst | 342 +++++ docs/configuration/interfaces/sstp-client.md | 170 +++ docs/configuration/interfaces/sstp-client.rst | 158 -- docs/configuration/interfaces/tunnel.md | 309 ++++ docs/configuration/interfaces/tunnel.rst | 308 ---- docs/configuration/interfaces/virtual-ethernet.md | 119 ++ docs/configuration/interfaces/virtual-ethernet.rst | 117 -- docs/configuration/interfaces/vti.md | 121 ++ docs/configuration/interfaces/vti.rst | 115 -- docs/configuration/interfaces/vxlan.md | 373 +++++ docs/configuration/interfaces/vxlan.rst | 358 ----- docs/configuration/interfaces/wireguard.md | 434 ++++++ docs/configuration/interfaces/wireguard.rst | 439 ------ docs/configuration/interfaces/wireless.md | 923 ++++++++++++ docs/configuration/interfaces/wireless.rst | 931 ------------ docs/configuration/interfaces/wwan.md | 355 +++++ docs/configuration/interfaces/wwan.rst | 342 ----- docs/configuration/loadbalancing/haproxy.md | 510 +++++++ docs/configuration/loadbalancing/haproxy.rst | 509 ------- docs/configuration/loadbalancing/index.md | 15 + docs/configuration/loadbalancing/index.rst | 14 - docs/configuration/loadbalancing/md-haproxy.md | 510 ------- docs/configuration/loadbalancing/md-index.md | 15 - docs/configuration/loadbalancing/md-wan.md | 306 ---- docs/configuration/loadbalancing/rst-haproxy.rst | 509 +++++++ docs/configuration/loadbalancing/rst-index.rst | 14 + docs/configuration/loadbalancing/rst-wan.rst | 315 ++++ docs/configuration/loadbalancing/wan.md | 306 ++++ docs/configuration/loadbalancing/wan.rst | 315 ---- docs/configuration/md-index.md | 23 - docs/configuration/nat/cgnat.md | 200 +++ docs/configuration/nat/cgnat.rst | 196 --- docs/configuration/nat/index.md | 13 + docs/configuration/nat/index.rst | 14 - docs/configuration/nat/md-cgnat.md | 200 --- docs/configuration/nat/md-index.md | 13 - docs/configuration/nat/md-nat44.md | 788 ---------- docs/configuration/nat/md-nat64.md | 73 - docs/configuration/nat/md-nat66.md | 243 --- docs/configuration/nat/nat44.md | 788 ++++++++++ docs/configuration/nat/nat44.rst | 826 ----------- docs/configuration/nat/nat64.md | 73 + docs/configuration/nat/nat64.rst | 85 -- docs/configuration/nat/nat66.md | 243 +++ docs/configuration/nat/nat66.rst | 256 ---- docs/configuration/nat/rst-cgnat.rst | 196 +++ docs/configuration/nat/rst-index.rst | 14 + docs/configuration/nat/rst-nat44.rst | 826 +++++++++++ docs/configuration/nat/rst-nat64.rst | 85 ++ docs/configuration/nat/rst-nat66.rst | 256 ++++ docs/configuration/pki/index.md | 583 ++++++++ docs/configuration/pki/index.rst | 488 ------ docs/configuration/pki/md-index.md | 583 -------- docs/configuration/pki/rst-index.rst | 488 ++++++ docs/configuration/policy/access-list.md | 70 + docs/configuration/policy/access-list.rst | 70 - docs/configuration/policy/as-path-list.md | 29 + docs/configuration/policy/as-path-list.rst | 33 - docs/configuration/policy/community-list.md | 29 + docs/configuration/policy/community-list.rst | 35 - docs/configuration/policy/examples.md | 205 +++ docs/configuration/policy/examples.rst | 213 --- docs/configuration/policy/extcommunity-list.md | 33 + docs/configuration/policy/extcommunity-list.rst | 40 - docs/configuration/policy/index.md | 53 + docs/configuration/policy/index.rst | 54 - docs/configuration/policy/large-community-list.md | 29 + docs/configuration/policy/large-community-list.rst | 36 - docs/configuration/policy/local-route.md | 100 ++ docs/configuration/policy/local-route.rst | 87 -- docs/configuration/policy/md-access-list.md | 70 - docs/configuration/policy/md-as-path-list.md | 29 - docs/configuration/policy/md-community-list.md | 29 - docs/configuration/policy/md-examples.md | 205 --- docs/configuration/policy/md-extcommunity-list.md | 33 - docs/configuration/policy/md-index.md | 53 - .../policy/md-large-community-list.md | 29 - docs/configuration/policy/md-local-route.md | 100 -- docs/configuration/policy/md-prefix-list.md | 152 -- docs/configuration/policy/md-route-map.md | 439 ------ docs/configuration/policy/md-route.md | 424 ------ docs/configuration/policy/prefix-list.md | 152 ++ docs/configuration/policy/prefix-list.rst | 112 -- docs/configuration/policy/route-map.md | 439 ++++++ docs/configuration/policy/route-map.rst | 383 ----- docs/configuration/policy/route.md | 424 ++++++ docs/configuration/policy/route.rst | 306 ---- docs/configuration/policy/rst-access-list.rst | 70 + docs/configuration/policy/rst-as-path-list.rst | 33 + docs/configuration/policy/rst-community-list.rst | 35 + docs/configuration/policy/rst-examples.rst | 213 +++ .../configuration/policy/rst-extcommunity-list.rst | 40 + docs/configuration/policy/rst-index.rst | 54 + .../policy/rst-large-community-list.rst | 36 + docs/configuration/policy/rst-local-route.rst | 87 ++ docs/configuration/policy/rst-prefix-list.rst | 112 ++ docs/configuration/policy/rst-route-map.rst | 383 +++++ docs/configuration/policy/rst-route.rst | 306 ++++ docs/configuration/protocols/arp.md | 72 + docs/configuration/protocols/arp.rst | 64 - docs/configuration/protocols/babel.md | 296 ++++ docs/configuration/protocols/babel.rst | 278 ---- docs/configuration/protocols/bfd.md | 205 +++ docs/configuration/protocols/bfd.rst | 199 --- docs/configuration/protocols/bgp.md | 1414 ++++++++++++++++++ docs/configuration/protocols/bgp.rst | 1281 ---------------- docs/configuration/protocols/failover.md | 237 +++ docs/configuration/protocols/failover.rst | 224 --- docs/configuration/protocols/igmp-proxy.md | 79 + docs/configuration/protocols/igmp-proxy.rst | 77 - docs/configuration/protocols/index.md | 25 + docs/configuration/protocols/index.rst | 26 - docs/configuration/protocols/isis.md | 746 ++++++++++ docs/configuration/protocols/isis.rst | 747 ---------- docs/configuration/protocols/md-arp.md | 72 - docs/configuration/protocols/md-babel.md | 296 ---- docs/configuration/protocols/md-bfd.md | 205 --- docs/configuration/protocols/md-bgp.md | 1414 ------------------ docs/configuration/protocols/md-failover.md | 237 --- docs/configuration/protocols/md-igmp-proxy.md | 79 - docs/configuration/protocols/md-index.md | 25 - docs/configuration/protocols/md-isis.md | 746 ---------- docs/configuration/protocols/md-mpls.md | 285 ---- docs/configuration/protocols/md-multicast.md | 31 - docs/configuration/protocols/md-openfabric.md | 242 --- docs/configuration/protocols/md-ospf.md | 1504 ------------------- docs/configuration/protocols/md-pim.md | 282 ---- docs/configuration/protocols/md-pim6.md | 100 -- docs/configuration/protocols/md-rip.md | 294 ---- docs/configuration/protocols/md-rpki.md | 210 --- docs/configuration/protocols/md-segment-routing.md | 359 ----- docs/configuration/protocols/md-static.md | 298 ---- .../protocols/md-traffic-engineering.md | 54 - docs/configuration/protocols/mpls.md | 285 ++++ docs/configuration/protocols/mpls.rst | 259 ---- docs/configuration/protocols/multicast.md | 31 + docs/configuration/protocols/multicast.rst | 34 - docs/configuration/protocols/openfabric.md | 242 +++ docs/configuration/protocols/openfabric.rst | 237 --- docs/configuration/protocols/ospf.md | 1504 +++++++++++++++++++ docs/configuration/protocols/ospf.rst | 1386 ----------------- docs/configuration/protocols/pim.md | 282 ++++ docs/configuration/protocols/pim.rst | 281 ---- docs/configuration/protocols/pim6.md | 100 ++ docs/configuration/protocols/pim6.rst | 94 -- docs/configuration/protocols/rip.md | 294 ++++ docs/configuration/protocols/rip.rst | 257 ---- docs/configuration/protocols/rpki.md | 210 +++ docs/configuration/protocols/rpki.rst | 211 --- docs/configuration/protocols/rst-arp.rst | 64 + docs/configuration/protocols/rst-babel.rst | 278 ++++ docs/configuration/protocols/rst-bfd.rst | 199 +++ docs/configuration/protocols/rst-bgp.rst | 1281 ++++++++++++++++ docs/configuration/protocols/rst-failover.rst | 224 +++ docs/configuration/protocols/rst-igmp-proxy.rst | 77 + docs/configuration/protocols/rst-index.rst | 26 + docs/configuration/protocols/rst-isis.rst | 747 ++++++++++ docs/configuration/protocols/rst-mpls.rst | 259 ++++ docs/configuration/protocols/rst-multicast.rst | 34 + docs/configuration/protocols/rst-openfabric.rst | 237 +++ docs/configuration/protocols/rst-ospf.rst | 1386 +++++++++++++++++ docs/configuration/protocols/rst-pim.rst | 281 ++++ docs/configuration/protocols/rst-pim6.rst | 94 ++ docs/configuration/protocols/rst-rip.rst | 257 ++++ docs/configuration/protocols/rst-rpki.rst | 211 +++ .../protocols/rst-segment-routing.rst | 357 +++++ docs/configuration/protocols/rst-static.rst | 301 ++++ .../protocols/rst-traffic-engineering.rst | 51 + docs/configuration/protocols/segment-routing.md | 359 +++++ docs/configuration/protocols/segment-routing.rst | 357 ----- docs/configuration/protocols/static.md | 298 ++++ docs/configuration/protocols/static.rst | 301 ---- .../configuration/protocols/traffic-engineering.md | 54 + .../protocols/traffic-engineering.rst | 51 - docs/configuration/rst-index.rst | 24 + docs/configuration/service/broadcast-relay.md | 70 + docs/configuration/service/broadcast-relay.rst | 66 - docs/configuration/service/config-sync.md | 164 ++ docs/configuration/service/config-sync.rst | 160 -- docs/configuration/service/conntrack-sync.md | 321 ++++ docs/configuration/service/conntrack-sync.rst | 302 ---- docs/configuration/service/console-server.md | 139 ++ docs/configuration/service/console-server.rst | 120 -- docs/configuration/service/dhcp-relay.md | 205 +++ docs/configuration/service/dhcp-relay.rst | 205 --- docs/configuration/service/dhcp-server.md | 1178 +++++++++++++++ docs/configuration/service/dhcp-server.rst | 1087 -------------- docs/configuration/service/dns.md | 582 ++++++++ docs/configuration/service/dns.rst | 511 ------- docs/configuration/service/eventhandler.md | 129 ++ docs/configuration/service/eventhandler.rst | 159 -- docs/configuration/service/https.md | 138 ++ docs/configuration/service/https.rst | 124 -- docs/configuration/service/index.md | 29 + docs/configuration/service/index.rst | 31 - docs/configuration/service/ipoe-server.md | 512 +++++++ docs/configuration/service/ipoe-server.rst | 450 ------ docs/configuration/service/lldp.md | 154 ++ docs/configuration/service/lldp.rst | 148 -- docs/configuration/service/md-broadcast-relay.md | 70 - docs/configuration/service/md-config-sync.md | 164 -- docs/configuration/service/md-conntrack-sync.md | 321 ---- docs/configuration/service/md-console-server.md | 139 -- docs/configuration/service/md-dhcp-relay.md | 205 --- docs/configuration/service/md-dhcp-server.md | 1178 --------------- docs/configuration/service/md-dns.md | 582 -------- docs/configuration/service/md-eventhandler.md | 129 -- docs/configuration/service/md-https.md | 138 -- docs/configuration/service/md-index.md | 29 - docs/configuration/service/md-ipoe-server.md | 512 ------- docs/configuration/service/md-lldp.md | 154 -- docs/configuration/service/md-mdns.md | 131 -- docs/configuration/service/md-monitoring.md | 334 ----- docs/configuration/service/md-ntp.md | 202 --- docs/configuration/service/md-pppoe-server.md | 753 ---------- docs/configuration/service/md-router-advert.md | 121 -- docs/configuration/service/md-salt-minion.md | 51 - docs/configuration/service/md-snmp.md | 258 ---- docs/configuration/service/md-ssh.md | 366 ----- docs/configuration/service/md-suricata.md | 93 -- docs/configuration/service/md-tftp-server.md | 78 - docs/configuration/service/md-webproxy.md | 459 ------ docs/configuration/service/mdns.md | 131 ++ docs/configuration/service/mdns.rst | 124 -- docs/configuration/service/monitoring.md | 334 +++++ docs/configuration/service/monitoring.rst | 289 ---- docs/configuration/service/ntp.md | 202 +++ docs/configuration/service/ntp.rst | 197 --- docs/configuration/service/pppoe-server.md | 753 ++++++++++ docs/configuration/service/pppoe-server.rst | 685 --------- docs/configuration/service/router-advert.md | 121 ++ docs/configuration/service/router-advert.rst | 130 -- docs/configuration/service/rst-broadcast-relay.rst | 66 + docs/configuration/service/rst-config-sync.rst | 160 ++ docs/configuration/service/rst-conntrack-sync.rst | 302 ++++ docs/configuration/service/rst-console-server.rst | 120 ++ docs/configuration/service/rst-dhcp-relay.rst | 205 +++ docs/configuration/service/rst-dhcp-server.rst | 1087 ++++++++++++++ docs/configuration/service/rst-dns.rst | 511 +++++++ docs/configuration/service/rst-eventhandler.rst | 159 ++ docs/configuration/service/rst-https.rst | 124 ++ docs/configuration/service/rst-index.rst | 31 + docs/configuration/service/rst-ipoe-server.rst | 450 ++++++ docs/configuration/service/rst-lldp.rst | 148 ++ docs/configuration/service/rst-mdns.rst | 124 ++ docs/configuration/service/rst-monitoring.rst | 289 ++++ docs/configuration/service/rst-ntp.rst | 197 +++ docs/configuration/service/rst-pppoe-server.rst | 685 +++++++++ docs/configuration/service/rst-router-advert.rst | 130 ++ docs/configuration/service/rst-salt-minion.rst | 53 + docs/configuration/service/rst-snmp.rst | 276 ++++ docs/configuration/service/rst-ssh.rst | 334 +++++ docs/configuration/service/rst-suricata.rst | 101 ++ docs/configuration/service/rst-tftp-server.rst | 80 + docs/configuration/service/rst-webproxy.rst | 445 ++++++ docs/configuration/service/salt-minion.md | 51 + docs/configuration/service/salt-minion.rst | 53 - docs/configuration/service/snmp.md | 258 ++++ docs/configuration/service/snmp.rst | 276 ---- docs/configuration/service/ssh.md | 366 +++++ docs/configuration/service/ssh.rst | 334 ----- docs/configuration/service/suricata.md | 93 ++ docs/configuration/service/suricata.rst | 101 -- docs/configuration/service/tftp-server.md | 78 + docs/configuration/service/tftp-server.rst | 80 - docs/configuration/service/webproxy.md | 459 ++++++ docs/configuration/service/webproxy.rst | 445 ------ docs/configuration/system/acceleration.md | 158 ++ docs/configuration/system/acceleration.rst | 157 -- docs/configuration/system/conntrack.md | 218 +++ docs/configuration/system/conntrack.rst | 210 --- docs/configuration/system/console.md | 59 + docs/configuration/system/console.rst | 57 - docs/configuration/system/default-route.md | 40 + docs/configuration/system/default-route.rst | 40 - docs/configuration/system/flow-accounting.md | 209 +++ docs/configuration/system/flow-accounting.rst | 203 --- docs/configuration/system/frr.md | 45 + docs/configuration/system/frr.rst | 43 - docs/configuration/system/host-name.md | 70 + docs/configuration/system/host-name.rst | 68 - docs/configuration/system/index.md | 34 + docs/configuration/system/index.rst | 36 - docs/configuration/system/ip.md | 126 ++ docs/configuration/system/ip.rst | 120 -- docs/configuration/system/ipv6.md | 193 +++ docs/configuration/system/ipv6.rst | 178 --- docs/configuration/system/lcd.md | 41 + docs/configuration/system/lcd.rst | 45 - docs/configuration/system/login.md | 604 ++++++++ docs/configuration/system/login.rst | 597 -------- docs/configuration/system/md-acceleration.md | 158 -- docs/configuration/system/md-conntrack.md | 218 --- docs/configuration/system/md-console.md | 59 - docs/configuration/system/md-default-route.md | 40 - docs/configuration/system/md-flow-accounting.md | 209 --- docs/configuration/system/md-frr.md | 45 - docs/configuration/system/md-host-name.md | 70 - docs/configuration/system/md-index.md | 34 - docs/configuration/system/md-ip.md | 126 -- docs/configuration/system/md-ipv6.md | 193 --- docs/configuration/system/md-lcd.md | 41 - docs/configuration/system/md-login.md | 604 -------- docs/configuration/system/md-name-server.md | 65 - docs/configuration/system/md-option.md | 190 --- docs/configuration/system/md-proxy.md | 27 - docs/configuration/system/md-sflow.md | 66 - docs/configuration/system/md-sysctl.md | 16 - docs/configuration/system/md-syslog.md | 450 ------ docs/configuration/system/md-task-scheduler.md | 45 - docs/configuration/system/md-time-zone.md | 17 - docs/configuration/system/md-updates.md | 36 - docs/configuration/system/md-watchdog.md | 212 --- docs/configuration/system/name-server.md | 65 + docs/configuration/system/name-server.rst | 74 - docs/configuration/system/option.md | 190 +++ docs/configuration/system/option.rst | 179 --- docs/configuration/system/proxy.md | 27 + docs/configuration/system/proxy.rst | 28 - docs/configuration/system/rst-acceleration.rst | 157 ++ docs/configuration/system/rst-conntrack.rst | 210 +++ docs/configuration/system/rst-console.rst | 57 + docs/configuration/system/rst-default-route.rst | 40 + docs/configuration/system/rst-flow-accounting.rst | 203 +++ docs/configuration/system/rst-frr.rst | 43 + docs/configuration/system/rst-host-name.rst | 68 + docs/configuration/system/rst-index.rst | 36 + docs/configuration/system/rst-ip.rst | 120 ++ docs/configuration/system/rst-ipv6.rst | 178 +++ docs/configuration/system/rst-lcd.rst | 45 + docs/configuration/system/rst-login.rst | 597 ++++++++ docs/configuration/system/rst-name-server.rst | 74 + docs/configuration/system/rst-option.rst | 179 +++ docs/configuration/system/rst-proxy.rst | 28 + docs/configuration/system/rst-sflow.rst | 65 + docs/configuration/system/rst-sysctl.rst | 16 + docs/configuration/system/rst-syslog.rst | 432 ++++++ docs/configuration/system/rst-task-scheduler.rst | 40 + docs/configuration/system/rst-time-zone.rst | 18 + docs/configuration/system/rst-updates.rst | 39 + docs/configuration/system/rst-watchdog.rst | 208 +++ docs/configuration/system/sflow.md | 66 + docs/configuration/system/sflow.rst | 65 - docs/configuration/system/sysctl.md | 16 + docs/configuration/system/sysctl.rst | 16 - docs/configuration/system/syslog.md | 450 ++++++ docs/configuration/system/syslog.rst | 432 ------ docs/configuration/system/task-scheduler.md | 45 + docs/configuration/system/task-scheduler.rst | 40 - docs/configuration/system/time-zone.md | 17 + docs/configuration/system/time-zone.rst | 18 - docs/configuration/system/updates.md | 36 + docs/configuration/system/updates.rst | 39 - docs/configuration/system/watchdog.md | 212 +++ docs/configuration/system/watchdog.rst | 208 --- docs/configuration/trafficpolicy/index.md | 1299 ++++++++++++++++ docs/configuration/trafficpolicy/index.rst | 1361 ----------------- docs/configuration/trafficpolicy/md-index.md | 1299 ---------------- docs/configuration/trafficpolicy/rst-index.rst | 1361 +++++++++++++++++ docs/configuration/vpn/dmvpn.md | 431 ++++++ docs/configuration/vpn/dmvpn.rst | 436 ------ docs/configuration/vpn/index.md | 14 + docs/configuration/vpn/index.rst | 16 - docs/configuration/vpn/ipsec/index.md | 11 + docs/configuration/vpn/ipsec/index.rst | 15 - docs/configuration/vpn/ipsec/ipsec_general.md | 407 +++++ docs/configuration/vpn/ipsec/ipsec_general.rst | 407 ----- docs/configuration/vpn/ipsec/md-index.md | 11 - docs/configuration/vpn/ipsec/md-ipsec_general.md | 407 ----- .../vpn/ipsec/md-remoteaccess_ipsec.md | 186 --- docs/configuration/vpn/ipsec/md-site2site_ipsec.md | 780 ---------- .../vpn/ipsec/md-troubleshooting_ipsec.md | 313 ---- docs/configuration/vpn/ipsec/remoteaccess_ipsec.md | 186 +++ .../configuration/vpn/ipsec/remoteaccess_ipsec.rst | 187 --- docs/configuration/vpn/ipsec/rst-index.rst | 15 + docs/configuration/vpn/ipsec/rst-ipsec_general.rst | 407 +++++ .../vpn/ipsec/rst-remoteaccess_ipsec.rst | 187 +++ .../vpn/ipsec/rst-site2site_ipsec.rst | 763 ++++++++++ .../vpn/ipsec/rst-troubleshooting_ipsec.rst | 330 +++++ docs/configuration/vpn/ipsec/site2site_ipsec.md | 780 ++++++++++ docs/configuration/vpn/ipsec/site2site_ipsec.rst | 763 ---------- .../vpn/ipsec/troubleshooting_ipsec.md | 313 ++++ .../vpn/ipsec/troubleshooting_ipsec.rst | 330 ----- docs/configuration/vpn/l2tp.md | 624 ++++++++ docs/configuration/vpn/l2tp.rst | 579 -------- docs/configuration/vpn/md-dmvpn.md | 431 ------ docs/configuration/vpn/md-index.md | 14 - docs/configuration/vpn/md-l2tp.md | 624 -------- docs/configuration/vpn/md-openconnect.md | 330 ----- docs/configuration/vpn/md-pptp.md | 594 -------- docs/configuration/vpn/md-rsa-keys.md | 114 -- docs/configuration/vpn/md-sstp.md | 698 --------- docs/configuration/vpn/openconnect.md | 330 +++++ docs/configuration/vpn/openconnect.rst | 374 ----- docs/configuration/vpn/pptp.md | 594 ++++++++ docs/configuration/vpn/pptp.rst | 553 ------- docs/configuration/vpn/rsa-keys.md | 114 ++ docs/configuration/vpn/rsa-keys.rst | 123 -- docs/configuration/vpn/rst-dmvpn.rst | 436 ++++++ docs/configuration/vpn/rst-index.rst | 16 + docs/configuration/vpn/rst-l2tp.rst | 579 ++++++++ docs/configuration/vpn/rst-openconnect.rst | 374 +++++ docs/configuration/vpn/rst-pptp.rst | 553 +++++++ docs/configuration/vpn/rst-rsa-keys.rst | 123 ++ docs/configuration/vpn/rst-sstp.rst | 658 ++++++++ docs/configuration/vpn/sstp.md | 698 +++++++++ docs/configuration/vpn/sstp.rst | 658 -------- docs/configuration/vrf/index.md | 646 ++++++++ docs/configuration/vrf/index.rst | 590 -------- docs/configuration/vrf/md-index.md | 646 -------- docs/configuration/vrf/rst-index.rst | 590 ++++++++ docs/contributing/build-vyos.md | 730 +++++++++ docs/contributing/build-vyos.rst | 759 ---------- docs/contributing/cla.md | 45 + docs/contributing/cla.rst | 45 - docs/contributing/debugging.md | 204 +++ docs/contributing/debugging.rst | 223 --- docs/contributing/development.md | 549 +++++++ docs/contributing/development.rst | 588 -------- docs/contributing/index.md | 13 + docs/contributing/index.rst | 14 - docs/contributing/issues-features.md | 122 ++ docs/contributing/issues-features.rst | 130 -- docs/contributing/md-build-vyos.md | 730 --------- docs/contributing/md-cla.md | 45 - docs/contributing/md-debugging.md | 204 --- docs/contributing/md-development.md | 549 ------- docs/contributing/md-index.md | 13 - docs/contributing/md-issues-features.md | 122 -- docs/contributing/md-testing.md | 207 --- docs/contributing/md-upstream-packages.md | 147 -- docs/contributing/rst-build-vyos.rst | 759 ++++++++++ docs/contributing/rst-cla.rst | 45 + docs/contributing/rst-debugging.rst | 223 +++ docs/contributing/rst-development.rst | 588 ++++++++ docs/contributing/rst-index.rst | 14 + docs/contributing/rst-issues-features.rst | 130 ++ docs/contributing/rst-testing.rst | 197 +++ docs/contributing/rst-upstream-packages.rst | 159 ++ docs/contributing/testing.md | 207 +++ docs/contributing/testing.rst | 197 --- docs/contributing/upstream-packages.md | 147 ++ docs/contributing/upstream-packages.rst | 159 -- docs/coverage.md | 59 + docs/coverage.rst | 61 - docs/documentation.md | 442 ++++++ docs/documentation.rst | 467 ------ docs/index.md | 113 ++ docs/index.rst | 113 -- docs/installation/bare-metal.md | 626 ++++++++ docs/installation/bare-metal.rst | 633 -------- docs/installation/cloud/aws.md | 188 +++ docs/installation/cloud/aws.rst | 166 --- docs/installation/cloud/azure.md | 98 ++ docs/installation/cloud/azure.rst | 84 -- docs/installation/cloud/gcp.md | 61 + docs/installation/cloud/gcp.rst | 59 - docs/installation/cloud/index.md | 10 + docs/installation/cloud/index.rst | 11 - docs/installation/cloud/md-aws.md | 188 --- docs/installation/cloud/md-azure.md | 98 -- docs/installation/cloud/md-gcp.md | 61 - docs/installation/cloud/md-index.md | 10 - docs/installation/cloud/md-oracle.md | 17 - docs/installation/cloud/oracle.md | 17 + docs/installation/cloud/oracle.rst | 16 - docs/installation/cloud/rst-aws.rst | 166 +++ docs/installation/cloud/rst-azure.rst | 84 ++ docs/installation/cloud/rst-gcp.rst | 59 + docs/installation/cloud/rst-index.rst | 11 + docs/installation/cloud/rst-oracle.rst | 16 + docs/installation/image.md | 113 ++ docs/installation/image.rst | 112 -- docs/installation/index.md | 30 + docs/installation/index.rst | 27 - docs/installation/install.md | 466 ++++++ docs/installation/install.rst | 475 ------ docs/installation/md-bare-metal.md | 626 -------- docs/installation/md-image.md | 113 -- docs/installation/md-index.md | 30 - docs/installation/md-install.md | 466 ------ docs/installation/md-secure-boot.md | 194 --- docs/installation/md-update.md | 105 -- docs/installation/rst-bare-metal.rst | 633 ++++++++ docs/installation/rst-image.rst | 112 ++ docs/installation/rst-index.rst | 27 + docs/installation/rst-install.rst | 475 ++++++ docs/installation/rst-secure-boot.rst | 192 +++ docs/installation/rst-update.rst | 97 ++ docs/installation/secure-boot.md | 194 +++ docs/installation/secure-boot.rst | 192 --- docs/installation/update.md | 105 ++ docs/installation/update.rst | 97 -- docs/installation/virtual/docker.md | 72 + docs/installation/virtual/docker.rst | 75 - docs/installation/virtual/eve-ng.md | 14 + docs/installation/virtual/eve-ng.rst | 14 - docs/installation/virtual/gns3.md | 191 +++ docs/installation/virtual/gns3.rst | 177 --- docs/installation/virtual/index.md | 16 + docs/installation/virtual/index.rst | 15 - docs/installation/virtual/libvirt.md | 186 +++ docs/installation/virtual/libvirt.rst | 186 --- docs/installation/virtual/md-docker.md | 72 - docs/installation/virtual/md-eve-ng.md | 14 - docs/installation/virtual/md-gns3.md | 191 --- docs/installation/virtual/md-index.md | 16 - docs/installation/virtual/md-libvirt.md | 186 --- docs/installation/virtual/md-proxmox.md | 80 - docs/installation/virtual/md-vmware.md | 38 - docs/installation/virtual/proxmox.md | 80 + docs/installation/virtual/proxmox.rst | 91 -- docs/installation/virtual/rst-docker.rst | 75 + docs/installation/virtual/rst-eve-ng.rst | 14 + docs/installation/virtual/rst-gns3.rst | 177 +++ docs/installation/virtual/rst-index.rst | 15 + docs/installation/virtual/rst-libvirt.rst | 186 +++ docs/installation/virtual/rst-proxmox.rst | 91 ++ docs/installation/virtual/rst-vmware.rst | 41 + docs/installation/virtual/vmware.md | 38 + docs/installation/virtual/vmware.rst | 41 - docs/introducing/about.md | 21 + docs/introducing/about.rst | 23 - docs/introducing/history.md | 171 +++ docs/introducing/history.rst | 172 --- docs/introducing/md-about.md | 21 - docs/introducing/md-history.md | 171 --- docs/introducing/rst-about.rst | 23 + docs/introducing/rst-history.rst | 172 +++ docs/md-404.md | 13 - docs/md-cli.md | 868 ----------- docs/md-coverage.md | 59 - docs/md-documentation.md | 442 ------ docs/md-index.md | 113 -- docs/md-quick-start.md | 381 ----- docs/operation/boot-options.md | 55 + docs/operation/boot-options.rst | 58 - docs/operation/index.md | 12 + docs/operation/index.rst | 13 - docs/operation/information.md | 106 ++ docs/operation/information.rst | 165 --- docs/operation/md-boot-options.md | 55 - docs/operation/md-index.md | 12 - docs/operation/md-information.md | 106 -- docs/operation/md-password-recovery.md | 46 - docs/operation/md-raid.md | 236 --- docs/operation/md-upgrade-recovery.md | 70 - docs/operation/password-recovery.md | 46 + docs/operation/password-recovery.rst | 44 - docs/operation/raid.md | 236 +++ docs/operation/raid.rst | 244 --- docs/operation/rst-boot-options.rst | 58 + docs/operation/rst-index.rst | 13 + docs/operation/rst-information.rst | 165 +++ docs/operation/rst-password-recovery.rst | 44 + docs/operation/rst-raid.rst | 244 +++ docs/operation/rst-upgrade-recovery.rst | 74 + docs/operation/upgrade-recovery.md | 70 + docs/operation/upgrade-recovery.rst | 74 - docs/quick-start.md | 381 +++++ docs/quick-start.rst | 390 ----- docs/rst-404.rst | 12 + docs/rst-cli.rst | 1060 +++++++++++++ docs/rst-coverage.rst | 61 + docs/rst-documentation.rst | 467 ++++++ docs/rst-index.rst | 113 ++ docs/rst-quick-start.rst | 390 +++++ docs/troubleshooting/connectivity.md | 147 ++ docs/troubleshooting/connectivity.rst | 150 -- docs/troubleshooting/index.md | 17 + docs/troubleshooting/index.rst | 18 - docs/troubleshooting/interfaces.md | 36 + docs/troubleshooting/interfaces.rst | 39 - docs/troubleshooting/md-connectivity.md | 147 -- docs/troubleshooting/md-index.md | 17 - docs/troubleshooting/md-interfaces.md | 36 - docs/troubleshooting/md-monitoring.md | 152 -- docs/troubleshooting/md-system.md | 48 - docs/troubleshooting/md-terminal.md | 39 - docs/troubleshooting/monitoring.md | 152 ++ docs/troubleshooting/monitoring.rst | 161 -- docs/troubleshooting/rst-connectivity.rst | 150 ++ docs/troubleshooting/rst-index.rst | 18 + docs/troubleshooting/rst-interfaces.rst | 39 + docs/troubleshooting/rst-monitoring.rst | 161 ++ docs/troubleshooting/rst-system.rst | 57 + docs/troubleshooting/rst-terminal.rst | 42 + docs/troubleshooting/system.md | 48 + docs/troubleshooting/system.rst | 57 - docs/troubleshooting/terminal.md | 39 + docs/troubleshooting/terminal.rst | 42 - docs/vpp/configuration/acl.md | 582 ++++++++ docs/vpp/configuration/acl.rst | 627 -------- docs/vpp/configuration/dataplane/buffers.md | 102 ++ docs/vpp/configuration/dataplane/buffers.rst | 103 -- docs/vpp/configuration/dataplane/cpu.md | 71 + docs/vpp/configuration/dataplane/cpu.rst | 74 - docs/vpp/configuration/dataplane/index.md | 36 + docs/vpp/configuration/dataplane/index.rst | 35 - docs/vpp/configuration/dataplane/interface.md | 104 ++ docs/vpp/configuration/dataplane/interface.rst | 102 -- docs/vpp/configuration/dataplane/ipsec.md | 74 + docs/vpp/configuration/dataplane/ipsec.rst | 72 - docs/vpp/configuration/dataplane/ipv6.md | 46 + docs/vpp/configuration/dataplane/ipv6.rst | 43 - docs/vpp/configuration/dataplane/l2learn.md | 35 + docs/vpp/configuration/dataplane/l2learn.rst | 34 - docs/vpp/configuration/dataplane/lcp.md | 46 + docs/vpp/configuration/dataplane/lcp.rst | 48 - docs/vpp/configuration/dataplane/logging.md | 59 + docs/vpp/configuration/dataplane/logging.rst | 58 - docs/vpp/configuration/dataplane/md-buffers.md | 102 -- docs/vpp/configuration/dataplane/md-cpu.md | 71 - docs/vpp/configuration/dataplane/md-index.md | 36 - docs/vpp/configuration/dataplane/md-interface.md | 104 -- docs/vpp/configuration/dataplane/md-ipsec.md | 74 - docs/vpp/configuration/dataplane/md-ipv6.md | 46 - docs/vpp/configuration/dataplane/md-l2learn.md | 35 - docs/vpp/configuration/dataplane/md-lcp.md | 46 - docs/vpp/configuration/dataplane/md-logging.md | 59 - docs/vpp/configuration/dataplane/md-memory.md | 142 -- docs/vpp/configuration/dataplane/md-system.md | 212 --- docs/vpp/configuration/dataplane/md-unix.md | 57 - docs/vpp/configuration/dataplane/memory.md | 142 ++ docs/vpp/configuration/dataplane/memory.rst | 141 -- docs/vpp/configuration/dataplane/rst-buffers.rst | 103 ++ docs/vpp/configuration/dataplane/rst-cpu.rst | 74 + docs/vpp/configuration/dataplane/rst-index.rst | 35 + docs/vpp/configuration/dataplane/rst-interface.rst | 102 ++ docs/vpp/configuration/dataplane/rst-ipsec.rst | 72 + docs/vpp/configuration/dataplane/rst-ipv6.rst | 43 + docs/vpp/configuration/dataplane/rst-l2learn.rst | 34 + docs/vpp/configuration/dataplane/rst-lcp.rst | 48 + docs/vpp/configuration/dataplane/rst-logging.rst | 58 + docs/vpp/configuration/dataplane/rst-memory.rst | 141 ++ docs/vpp/configuration/dataplane/rst-system.rst | 208 +++ docs/vpp/configuration/dataplane/rst-unix.rst | 55 + docs/vpp/configuration/dataplane/system.md | 212 +++ docs/vpp/configuration/dataplane/system.rst | 208 --- docs/vpp/configuration/dataplane/unix.md | 57 + docs/vpp/configuration/dataplane/unix.rst | 55 - docs/vpp/configuration/index.md | 47 + docs/vpp/configuration/index.rst | 47 - docs/vpp/configuration/interfaces/bonding.md | 255 ++++ docs/vpp/configuration/interfaces/bonding.rst | 263 ---- docs/vpp/configuration/interfaces/bridge.md | 194 +++ docs/vpp/configuration/interfaces/bridge.rst | 210 --- docs/vpp/configuration/interfaces/gre.md | 168 +++ docs/vpp/configuration/interfaces/gre.rst | 176 --- docs/vpp/configuration/interfaces/index.md | 49 + docs/vpp/configuration/interfaces/index.rst | 49 - docs/vpp/configuration/interfaces/ipip.md | 119 ++ docs/vpp/configuration/interfaces/ipip.rst | 123 -- docs/vpp/configuration/interfaces/loopback.md | 148 ++ docs/vpp/configuration/interfaces/loopback.rst | 154 -- docs/vpp/configuration/interfaces/md-bonding.md | 255 ---- docs/vpp/configuration/interfaces/md-bridge.md | 194 --- docs/vpp/configuration/interfaces/md-gre.md | 168 --- docs/vpp/configuration/interfaces/md-index.md | 49 - docs/vpp/configuration/interfaces/md-ipip.md | 119 -- docs/vpp/configuration/interfaces/md-loopback.md | 148 -- docs/vpp/configuration/interfaces/md-vxlan.md | 157 -- docs/vpp/configuration/interfaces/md-xconnect.md | 108 -- docs/vpp/configuration/interfaces/rst-bonding.rst | 263 ++++ docs/vpp/configuration/interfaces/rst-bridge.rst | 210 +++ docs/vpp/configuration/interfaces/rst-gre.rst | 176 +++ docs/vpp/configuration/interfaces/rst-index.rst | 49 + docs/vpp/configuration/interfaces/rst-ipip.rst | 123 ++ docs/vpp/configuration/interfaces/rst-loopback.rst | 154 ++ docs/vpp/configuration/interfaces/rst-vxlan.rst | 162 ++ docs/vpp/configuration/interfaces/rst-xconnect.rst | 113 ++ docs/vpp/configuration/interfaces/vxlan.md | 157 ++ docs/vpp/configuration/interfaces/vxlan.rst | 162 -- docs/vpp/configuration/interfaces/xconnect.md | 108 ++ docs/vpp/configuration/interfaces/xconnect.rst | 113 -- docs/vpp/configuration/ipfix.md | 50 + docs/vpp/configuration/ipfix.rst | 57 - docs/vpp/configuration/ipsec.md | 188 +++ docs/vpp/configuration/ipsec.rst | 199 --- docs/vpp/configuration/md-acl.md | 582 -------- docs/vpp/configuration/md-index.md | 47 - docs/vpp/configuration/md-ipfix.md | 50 - docs/vpp/configuration/md-ipsec.md | 188 --- docs/vpp/configuration/md-sflow.md | 62 - docs/vpp/configuration/nat/cgnat.md | 249 ++++ docs/vpp/configuration/nat/cgnat.rst | 274 ---- docs/vpp/configuration/nat/index.md | 41 + docs/vpp/configuration/nat/index.rst | 42 - docs/vpp/configuration/nat/md-cgnat.md | 249 ---- docs/vpp/configuration/nat/md-index.md | 41 - docs/vpp/configuration/nat/md-nat44.md | 755 ---------- docs/vpp/configuration/nat/nat44.md | 755 ++++++++++ docs/vpp/configuration/nat/nat44.rst | 830 ----------- docs/vpp/configuration/nat/rst-cgnat.rst | 274 ++++ docs/vpp/configuration/nat/rst-index.rst | 42 + docs/vpp/configuration/nat/rst-nat44.rst | 830 +++++++++++ docs/vpp/configuration/rst-acl.rst | 627 ++++++++ docs/vpp/configuration/rst-index.rst | 47 + docs/vpp/configuration/rst-ipfix.rst | 57 + docs/vpp/configuration/rst-ipsec.rst | 199 +++ docs/vpp/configuration/rst-sflow.rst | 46 + docs/vpp/configuration/sflow.md | 62 + docs/vpp/configuration/sflow.rst | 46 - docs/vpp/description.md | 87 ++ docs/vpp/description.rst | 97 -- docs/vpp/index.md | 25 + docs/vpp/index.rst | 23 - docs/vpp/limitations.md | 42 + docs/vpp/limitations.rst | 42 - docs/vpp/md-description.md | 87 -- docs/vpp/md-index.md | 25 - docs/vpp/md-limitations.md | 42 - docs/vpp/md-requirements.md | 131 -- docs/vpp/md-troubleshooting.md | 474 ------ docs/vpp/requirements.md | 131 ++ docs/vpp/requirements.rst | 125 -- docs/vpp/rst-description.rst | 97 ++ docs/vpp/rst-index.rst | 23 + docs/vpp/rst-limitations.rst | 42 + docs/vpp/rst-requirements.rst | 125 ++ docs/vpp/rst-troubleshooting.rst | 508 +++++++ docs/vpp/troubleshooting.md | 474 ++++++ docs/vpp/troubleshooting.rst | 508 ------- 1018 files changed, 129967 insertions(+), 130222 deletions(-) create mode 100644 docs/404.md delete mode 100644 docs/404.rst create mode 100644 docs/_rst_overrides.txt delete mode 100644 docs/_swap.txt create mode 100644 docs/automation/cloud-init.md delete mode 100644 docs/automation/cloud-init.rst create mode 100644 docs/automation/command-scripting.md delete mode 100644 docs/automation/command-scripting.rst create mode 100644 docs/automation/index.md delete mode 100644 docs/automation/index.rst delete mode 100644 docs/automation/md-cloud-init.md delete mode 100644 docs/automation/md-command-scripting.md delete mode 100644 docs/automation/md-index.md delete mode 100644 docs/automation/md-vyos-ansible.md delete mode 100644 docs/automation/md-vyos-api.md delete mode 100644 docs/automation/md-vyos-govyos.md delete mode 100644 docs/automation/md-vyos-napalm.md delete mode 100644 docs/automation/md-vyos-netmiko.md delete mode 100644 docs/automation/md-vyos-pyvyos.md delete mode 100644 docs/automation/md-vyos-salt.md create mode 100644 docs/automation/rst-cloud-init.rst create mode 100644 docs/automation/rst-command-scripting.rst create mode 100644 docs/automation/rst-index.rst create mode 100644 docs/automation/rst-vyos-ansible.rst create mode 100644 docs/automation/rst-vyos-api.rst create mode 100644 docs/automation/rst-vyos-govyos.rst create mode 100644 docs/automation/rst-vyos-napalm.rst create mode 100644 docs/automation/rst-vyos-netmiko.rst create mode 100644 docs/automation/rst-vyos-pyvyos.rst create mode 100644 docs/automation/rst-vyos-salt.rst create mode 100644 docs/automation/terraform/index.md delete mode 100644 docs/automation/terraform/index.rst delete mode 100644 docs/automation/terraform/md-index.md delete mode 100644 docs/automation/terraform/md-terraformAWS.md delete mode 100644 docs/automation/terraform/md-terraformAZ.md delete mode 100644 docs/automation/terraform/md-terraformGoogle.md delete mode 100644 docs/automation/terraform/md-terraformvSphere.md create mode 100644 docs/automation/terraform/rst-index.rst create mode 100644 docs/automation/terraform/rst-terraformAWS.rst create mode 100644 docs/automation/terraform/rst-terraformAZ.rst create mode 100644 docs/automation/terraform/rst-terraformGoogle.rst create mode 100644 docs/automation/terraform/rst-terraformvSphere.rst create mode 100644 docs/automation/terraform/terraformAWS.md delete mode 100644 docs/automation/terraform/terraformAWS.rst create mode 100644 docs/automation/terraform/terraformAZ.md delete mode 100644 docs/automation/terraform/terraformAZ.rst create mode 100644 docs/automation/terraform/terraformGoogle.md delete mode 100644 docs/automation/terraform/terraformGoogle.rst create mode 100644 docs/automation/terraform/terraformvSphere.md delete mode 100644 docs/automation/terraform/terraformvSphere.rst create mode 100644 docs/automation/vyos-ansible.md delete mode 100644 docs/automation/vyos-ansible.rst create mode 100644 docs/automation/vyos-api.md delete mode 100644 docs/automation/vyos-api.rst create mode 100644 docs/automation/vyos-govyos.md delete mode 100644 docs/automation/vyos-govyos.rst create mode 100644 docs/automation/vyos-napalm.md delete mode 100644 docs/automation/vyos-napalm.rst create mode 100644 docs/automation/vyos-netmiko.md delete mode 100644 docs/automation/vyos-netmiko.rst create mode 100644 docs/automation/vyos-pyvyos.md delete mode 100644 docs/automation/vyos-pyvyos.rst create mode 100644 docs/automation/vyos-salt.md delete mode 100644 docs/automation/vyos-salt.rst create mode 100644 docs/cli.md delete mode 100644 docs/cli.rst create mode 100644 docs/configexamples/ansible.md delete mode 100644 docs/configexamples/ansible.rst create mode 100644 docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md delete mode 100644 docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst delete mode 100644 docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md create mode 100644 docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst create mode 100644 docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md delete mode 100644 docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst delete mode 100644 docs/configexamples/autotest/L3VPN_EVPN/md-L3VPN_EVPN.md create mode 100644 docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst create mode 100644 docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md delete mode 100644 docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst delete mode 100644 docs/configexamples/autotest/OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md create mode 100644 docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst create mode 100644 docs/configexamples/autotest/Wireguard/Wireguard.md delete mode 100644 docs/configexamples/autotest/Wireguard/Wireguard.rst delete mode 100644 docs/configexamples/autotest/Wireguard/md-Wireguard.md create mode 100644 docs/configexamples/autotest/Wireguard/rst-Wireguard.rst delete mode 100644 docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md create mode 100644 docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst create mode 100644 docs/configexamples/autotest/tunnelbroker/tunnelbroker.md delete mode 100644 docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst create mode 100644 docs/configexamples/azure-vpn-bgp.md delete mode 100644 docs/configexamples/azure-vpn-bgp.rst create mode 100644 docs/configexamples/azure-vpn-dual-bgp.md delete mode 100644 docs/configexamples/azure-vpn-dual-bgp.rst create mode 100644 docs/configexamples/bgp-ipv6-unnumbered.md delete mode 100644 docs/configexamples/bgp-ipv6-unnumbered.rst create mode 100644 docs/configexamples/dmvpn-dualhub-dualcloud.md delete mode 100644 docs/configexamples/dmvpn-dualhub-dualcloud.rst create mode 100644 docs/configexamples/firewall.md delete mode 100644 docs/configexamples/firewall.rst create mode 100644 docs/configexamples/fwall-and-bridge.md delete mode 100644 docs/configexamples/fwall-and-bridge.rst create mode 100644 docs/configexamples/fwall-and-vrf.md delete mode 100644 docs/configexamples/fwall-and-vrf.rst create mode 100644 docs/configexamples/ha.md delete mode 100644 docs/configexamples/ha.rst create mode 100644 docs/configexamples/index.md delete mode 100644 docs/configexamples/index.rst create mode 100644 docs/configexamples/inter-vrf-routing-vrf-lite.md delete mode 100644 docs/configexamples/inter-vrf-routing-vrf-lite.rst create mode 100644 docs/configexamples/ipsec-cisco-policy-based.md delete mode 100644 docs/configexamples/ipsec-cisco-policy-based.rst create mode 100644 docs/configexamples/ipsec-cisco-route-based.md delete mode 100644 docs/configexamples/ipsec-cisco-route-based.rst create mode 100644 docs/configexamples/ipsec-pa-route-based.md delete mode 100644 docs/configexamples/ipsec-pa-route-based.rst create mode 100644 docs/configexamples/l3vpn-hub-and-spoke.md delete mode 100644 docs/configexamples/l3vpn-hub-and-spoke.rst create mode 100644 docs/configexamples/lac-lns.md delete mode 100644 docs/configexamples/lac-lns.rst delete mode 100644 docs/configexamples/md-ansible.md delete mode 100644 docs/configexamples/md-azure-vpn-bgp.md delete mode 100644 docs/configexamples/md-azure-vpn-dual-bgp.md delete mode 100644 docs/configexamples/md-bgp-ipv6-unnumbered.md delete mode 100644 docs/configexamples/md-dmvpn-dualhub-dualcloud.md delete mode 100644 docs/configexamples/md-firewall.md delete mode 100644 docs/configexamples/md-fwall-and-bridge.md delete mode 100644 docs/configexamples/md-fwall-and-vrf.md delete mode 100644 docs/configexamples/md-ha.md delete mode 100644 docs/configexamples/md-index.md delete mode 100644 docs/configexamples/md-inter-vrf-routing-vrf-lite.md delete mode 100644 docs/configexamples/md-ipsec-cisco-policy-based.md delete mode 100644 docs/configexamples/md-ipsec-cisco-route-based.md delete mode 100644 docs/configexamples/md-ipsec-pa-route-based.md delete mode 100644 docs/configexamples/md-l3vpn-hub-and-spoke.md delete mode 100644 docs/configexamples/md-lac-lns.md delete mode 100644 docs/configexamples/md-nmp.md delete mode 100644 docs/configexamples/md-ospf-unnumbered.md delete mode 100644 docs/configexamples/md-policy-based-ipsec-and-firewall.md delete mode 100644 docs/configexamples/md-pppoe-ipv6-basic.md delete mode 100644 docs/configexamples/md-qos.md delete mode 100644 docs/configexamples/md-segment-routing-isis.md delete mode 100644 docs/configexamples/md-site-2-site-cisco.md delete mode 100644 docs/configexamples/md-wan-load-balancing.md delete mode 100644 docs/configexamples/md-zone-policy.md create mode 100644 docs/configexamples/nmp.md delete mode 100644 docs/configexamples/nmp.rst create mode 100644 docs/configexamples/ospf-unnumbered.md delete mode 100644 docs/configexamples/ospf-unnumbered.rst create mode 100644 docs/configexamples/policy-based-ipsec-and-firewall.md delete mode 100644 docs/configexamples/policy-based-ipsec-and-firewall.rst create mode 100644 docs/configexamples/pppoe-ipv6-basic.md delete mode 100644 docs/configexamples/pppoe-ipv6-basic.rst create mode 100644 docs/configexamples/qos.md delete mode 100644 docs/configexamples/qos.rst create mode 100644 docs/configexamples/rst-ansible.rst create mode 100644 docs/configexamples/rst-azure-vpn-bgp.rst create mode 100644 docs/configexamples/rst-azure-vpn-dual-bgp.rst create mode 100644 docs/configexamples/rst-bgp-ipv6-unnumbered.rst create mode 100644 docs/configexamples/rst-dmvpn-dualhub-dualcloud.rst create mode 100644 docs/configexamples/rst-firewall.rst create mode 100644 docs/configexamples/rst-fwall-and-bridge.rst create mode 100644 docs/configexamples/rst-fwall-and-vrf.rst create mode 100644 docs/configexamples/rst-ha.rst create mode 100644 docs/configexamples/rst-index.rst create mode 100644 docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst create mode 100644 docs/configexamples/rst-ipsec-cisco-policy-based.rst create mode 100644 docs/configexamples/rst-ipsec-cisco-route-based.rst create mode 100644 docs/configexamples/rst-ipsec-pa-route-based.rst create mode 100644 docs/configexamples/rst-l3vpn-hub-and-spoke.rst create mode 100644 docs/configexamples/rst-lac-lns.rst create mode 100644 docs/configexamples/rst-nmp.rst create mode 100644 docs/configexamples/rst-ospf-unnumbered.rst create mode 100644 docs/configexamples/rst-policy-based-ipsec-and-firewall.rst create mode 100644 docs/configexamples/rst-pppoe-ipv6-basic.rst create mode 100644 docs/configexamples/rst-qos.rst create mode 100644 docs/configexamples/rst-segment-routing-isis.rst create mode 100644 docs/configexamples/rst-site-2-site-cisco.rst create mode 100644 docs/configexamples/rst-wan-load-balancing.rst create mode 100644 docs/configexamples/rst-zone-policy.rst create mode 100644 docs/configexamples/segment-routing-isis.md delete mode 100644 docs/configexamples/segment-routing-isis.rst create mode 100644 docs/configexamples/site-2-site-cisco.md delete mode 100644 docs/configexamples/site-2-site-cisco.rst create mode 100644 docs/configexamples/wan-load-balancing.md delete mode 100644 docs/configexamples/wan-load-balancing.rst create mode 100644 docs/configexamples/zone-policy.md delete mode 100644 docs/configexamples/zone-policy.rst create mode 100644 docs/configuration/container/index.md delete mode 100644 docs/configuration/container/index.rst delete mode 100644 docs/configuration/container/md-index.md create mode 100644 docs/configuration/container/rst-index.rst create mode 100644 docs/configuration/firewall/bridge.md delete mode 100644 docs/configuration/firewall/bridge.rst create mode 100644 docs/configuration/firewall/flowtables.md delete mode 100644 docs/configuration/firewall/flowtables.rst create mode 100644 docs/configuration/firewall/global-options.md delete mode 100644 docs/configuration/firewall/global-options.rst create mode 100644 docs/configuration/firewall/groups.md delete mode 100644 docs/configuration/firewall/groups.rst create mode 100644 docs/configuration/firewall/index.md delete mode 100644 docs/configuration/firewall/index.rst create mode 100644 docs/configuration/firewall/ipv4.md delete mode 100644 docs/configuration/firewall/ipv4.rst create mode 100644 docs/configuration/firewall/ipv6.md delete mode 100644 docs/configuration/firewall/ipv6.rst delete mode 100644 docs/configuration/firewall/md-bridge.md delete mode 100644 docs/configuration/firewall/md-flowtables.md delete mode 100644 docs/configuration/firewall/md-global-options.md delete mode 100644 docs/configuration/firewall/md-groups.md delete mode 100644 docs/configuration/firewall/md-index.md delete mode 100644 docs/configuration/firewall/md-ipv4.md delete mode 100644 docs/configuration/firewall/md-ipv6.md delete mode 100644 docs/configuration/firewall/md-zone.md create mode 100644 docs/configuration/firewall/rst-bridge.rst create mode 100644 docs/configuration/firewall/rst-flowtables.rst create mode 100644 docs/configuration/firewall/rst-global-options.rst create mode 100644 docs/configuration/firewall/rst-groups.rst create mode 100644 docs/configuration/firewall/rst-index.rst create mode 100644 docs/configuration/firewall/rst-ipv4.rst create mode 100644 docs/configuration/firewall/rst-ipv6.rst create mode 100644 docs/configuration/firewall/rst-zone.rst create mode 100644 docs/configuration/firewall/zone.md delete mode 100644 docs/configuration/firewall/zone.rst create mode 100644 docs/configuration/highavailability/index.md delete mode 100644 docs/configuration/highavailability/index.rst delete mode 100644 docs/configuration/highavailability/md-index.md create mode 100644 docs/configuration/highavailability/rst-index.rst create mode 100644 docs/configuration/index.md delete mode 100644 docs/configuration/index.rst create mode 100644 docs/configuration/interfaces/bonding.md delete mode 100644 docs/configuration/interfaces/bonding.rst create mode 100644 docs/configuration/interfaces/bridge.md delete mode 100644 docs/configuration/interfaces/bridge.rst create mode 100644 docs/configuration/interfaces/dummy.md delete mode 100644 docs/configuration/interfaces/dummy.rst create mode 100644 docs/configuration/interfaces/ethernet.md delete mode 100644 docs/configuration/interfaces/ethernet.rst create mode 100644 docs/configuration/interfaces/geneve.md delete mode 100644 docs/configuration/interfaces/geneve.rst create mode 100644 docs/configuration/interfaces/index.md delete mode 100644 docs/configuration/interfaces/index.rst create mode 100644 docs/configuration/interfaces/l2tpv3.md delete mode 100644 docs/configuration/interfaces/l2tpv3.rst create mode 100644 docs/configuration/interfaces/loopback.md delete mode 100644 docs/configuration/interfaces/loopback.rst create mode 100644 docs/configuration/interfaces/macsec.md delete mode 100644 docs/configuration/interfaces/macsec.rst delete mode 100644 docs/configuration/interfaces/md-bonding.md delete mode 100644 docs/configuration/interfaces/md-bridge.md delete mode 100644 docs/configuration/interfaces/md-dummy.md delete mode 100644 docs/configuration/interfaces/md-ethernet.md delete mode 100644 docs/configuration/interfaces/md-geneve.md delete mode 100644 docs/configuration/interfaces/md-index.md delete mode 100644 docs/configuration/interfaces/md-l2tpv3.md delete mode 100644 docs/configuration/interfaces/md-loopback.md delete mode 100644 docs/configuration/interfaces/md-macsec.md delete mode 100644 docs/configuration/interfaces/md-openvpn-examples.md delete mode 100644 docs/configuration/interfaces/md-openvpn.md delete mode 100644 docs/configuration/interfaces/md-pppoe.md delete mode 100644 docs/configuration/interfaces/md-pseudo-ethernet.md delete mode 100644 docs/configuration/interfaces/md-sstp-client.md delete mode 100644 docs/configuration/interfaces/md-tunnel.md delete mode 100644 docs/configuration/interfaces/md-virtual-ethernet.md delete mode 100644 docs/configuration/interfaces/md-vti.md delete mode 100644 docs/configuration/interfaces/md-vxlan.md delete mode 100644 docs/configuration/interfaces/md-wireguard.md delete mode 100644 docs/configuration/interfaces/md-wireless.md delete mode 100644 docs/configuration/interfaces/md-wwan.md create mode 100644 docs/configuration/interfaces/openvpn-examples.md delete mode 100644 docs/configuration/interfaces/openvpn-examples.rst create mode 100644 docs/configuration/interfaces/openvpn.md delete mode 100644 docs/configuration/interfaces/openvpn.rst create mode 100644 docs/configuration/interfaces/pppoe.md delete mode 100644 docs/configuration/interfaces/pppoe.rst create mode 100644 docs/configuration/interfaces/pseudo-ethernet.md delete mode 100644 docs/configuration/interfaces/pseudo-ethernet.rst create mode 100644 docs/configuration/interfaces/rst-bonding.rst create mode 100644 docs/configuration/interfaces/rst-bridge.rst create mode 100644 docs/configuration/interfaces/rst-dummy.rst create mode 100644 docs/configuration/interfaces/rst-ethernet.rst create mode 100644 docs/configuration/interfaces/rst-geneve.rst create mode 100644 docs/configuration/interfaces/rst-index.rst create mode 100644 docs/configuration/interfaces/rst-l2tpv3.rst create mode 100644 docs/configuration/interfaces/rst-loopback.rst create mode 100644 docs/configuration/interfaces/rst-macsec.rst create mode 100644 docs/configuration/interfaces/rst-openvpn-examples.rst create mode 100644 docs/configuration/interfaces/rst-openvpn.rst create mode 100644 docs/configuration/interfaces/rst-pppoe.rst create mode 100644 docs/configuration/interfaces/rst-pseudo-ethernet.rst create mode 100644 docs/configuration/interfaces/rst-sstp-client.rst create mode 100644 docs/configuration/interfaces/rst-tunnel.rst create mode 100644 docs/configuration/interfaces/rst-virtual-ethernet.rst create mode 100644 docs/configuration/interfaces/rst-vti.rst create mode 100644 docs/configuration/interfaces/rst-vxlan.rst create mode 100644 docs/configuration/interfaces/rst-wireguard.rst create mode 100644 docs/configuration/interfaces/rst-wireless.rst create mode 100644 docs/configuration/interfaces/rst-wwan.rst create mode 100644 docs/configuration/interfaces/sstp-client.md delete mode 100644 docs/configuration/interfaces/sstp-client.rst create mode 100644 docs/configuration/interfaces/tunnel.md delete mode 100644 docs/configuration/interfaces/tunnel.rst create mode 100644 docs/configuration/interfaces/virtual-ethernet.md delete mode 100644 docs/configuration/interfaces/virtual-ethernet.rst create mode 100644 docs/configuration/interfaces/vti.md delete mode 100644 docs/configuration/interfaces/vti.rst create mode 100644 docs/configuration/interfaces/vxlan.md delete mode 100644 docs/configuration/interfaces/vxlan.rst create mode 100644 docs/configuration/interfaces/wireguard.md delete mode 100644 docs/configuration/interfaces/wireguard.rst create mode 100644 docs/configuration/interfaces/wireless.md delete mode 100644 docs/configuration/interfaces/wireless.rst create mode 100644 docs/configuration/interfaces/wwan.md delete mode 100644 docs/configuration/interfaces/wwan.rst create mode 100644 docs/configuration/loadbalancing/haproxy.md delete mode 100644 docs/configuration/loadbalancing/haproxy.rst create mode 100644 docs/configuration/loadbalancing/index.md delete mode 100644 docs/configuration/loadbalancing/index.rst delete mode 100644 docs/configuration/loadbalancing/md-haproxy.md delete mode 100644 docs/configuration/loadbalancing/md-index.md delete mode 100644 docs/configuration/loadbalancing/md-wan.md create mode 100644 docs/configuration/loadbalancing/rst-haproxy.rst create mode 100644 docs/configuration/loadbalancing/rst-index.rst create mode 100644 docs/configuration/loadbalancing/rst-wan.rst create mode 100644 docs/configuration/loadbalancing/wan.md delete mode 100644 docs/configuration/loadbalancing/wan.rst delete mode 100644 docs/configuration/md-index.md create mode 100644 docs/configuration/nat/cgnat.md delete mode 100644 docs/configuration/nat/cgnat.rst create mode 100644 docs/configuration/nat/index.md delete mode 100644 docs/configuration/nat/index.rst delete mode 100644 docs/configuration/nat/md-cgnat.md delete mode 100644 docs/configuration/nat/md-index.md delete mode 100644 docs/configuration/nat/md-nat44.md delete mode 100644 docs/configuration/nat/md-nat64.md delete mode 100644 docs/configuration/nat/md-nat66.md create mode 100644 docs/configuration/nat/nat44.md delete mode 100644 docs/configuration/nat/nat44.rst create mode 100644 docs/configuration/nat/nat64.md delete mode 100644 docs/configuration/nat/nat64.rst create mode 100644 docs/configuration/nat/nat66.md delete mode 100644 docs/configuration/nat/nat66.rst create mode 100644 docs/configuration/nat/rst-cgnat.rst create mode 100644 docs/configuration/nat/rst-index.rst create mode 100644 docs/configuration/nat/rst-nat44.rst create mode 100644 docs/configuration/nat/rst-nat64.rst create mode 100644 docs/configuration/nat/rst-nat66.rst create mode 100644 docs/configuration/pki/index.md delete mode 100644 docs/configuration/pki/index.rst delete mode 100644 docs/configuration/pki/md-index.md create mode 100644 docs/configuration/pki/rst-index.rst create mode 100644 docs/configuration/policy/access-list.md delete mode 100644 docs/configuration/policy/access-list.rst create mode 100644 docs/configuration/policy/as-path-list.md delete mode 100644 docs/configuration/policy/as-path-list.rst create mode 100644 docs/configuration/policy/community-list.md delete mode 100644 docs/configuration/policy/community-list.rst create mode 100644 docs/configuration/policy/examples.md delete mode 100644 docs/configuration/policy/examples.rst create mode 100644 docs/configuration/policy/extcommunity-list.md delete mode 100644 docs/configuration/policy/extcommunity-list.rst create mode 100644 docs/configuration/policy/index.md delete mode 100644 docs/configuration/policy/index.rst create mode 100644 docs/configuration/policy/large-community-list.md delete mode 100644 docs/configuration/policy/large-community-list.rst create mode 100644 docs/configuration/policy/local-route.md delete mode 100644 docs/configuration/policy/local-route.rst delete mode 100644 docs/configuration/policy/md-access-list.md delete mode 100644 docs/configuration/policy/md-as-path-list.md delete mode 100644 docs/configuration/policy/md-community-list.md delete mode 100644 docs/configuration/policy/md-examples.md delete mode 100644 docs/configuration/policy/md-extcommunity-list.md delete mode 100644 docs/configuration/policy/md-index.md delete mode 100644 docs/configuration/policy/md-large-community-list.md delete mode 100644 docs/configuration/policy/md-local-route.md delete mode 100644 docs/configuration/policy/md-prefix-list.md delete mode 100644 docs/configuration/policy/md-route-map.md delete mode 100644 docs/configuration/policy/md-route.md create mode 100644 docs/configuration/policy/prefix-list.md delete mode 100644 docs/configuration/policy/prefix-list.rst create mode 100644 docs/configuration/policy/route-map.md delete mode 100644 docs/configuration/policy/route-map.rst create mode 100644 docs/configuration/policy/route.md delete mode 100644 docs/configuration/policy/route.rst create mode 100644 docs/configuration/policy/rst-access-list.rst create mode 100644 docs/configuration/policy/rst-as-path-list.rst create mode 100644 docs/configuration/policy/rst-community-list.rst create mode 100644 docs/configuration/policy/rst-examples.rst create mode 100644 docs/configuration/policy/rst-extcommunity-list.rst create mode 100644 docs/configuration/policy/rst-index.rst create mode 100644 docs/configuration/policy/rst-large-community-list.rst create mode 100644 docs/configuration/policy/rst-local-route.rst create mode 100644 docs/configuration/policy/rst-prefix-list.rst create mode 100644 docs/configuration/policy/rst-route-map.rst create mode 100644 docs/configuration/policy/rst-route.rst create mode 100644 docs/configuration/protocols/arp.md delete mode 100644 docs/configuration/protocols/arp.rst create mode 100644 docs/configuration/protocols/babel.md delete mode 100644 docs/configuration/protocols/babel.rst create mode 100644 docs/configuration/protocols/bfd.md delete mode 100644 docs/configuration/protocols/bfd.rst create mode 100644 docs/configuration/protocols/bgp.md delete mode 100644 docs/configuration/protocols/bgp.rst create mode 100644 docs/configuration/protocols/failover.md delete mode 100644 docs/configuration/protocols/failover.rst create mode 100644 docs/configuration/protocols/igmp-proxy.md delete mode 100644 docs/configuration/protocols/igmp-proxy.rst create mode 100644 docs/configuration/protocols/index.md delete mode 100644 docs/configuration/protocols/index.rst create mode 100644 docs/configuration/protocols/isis.md delete mode 100644 docs/configuration/protocols/isis.rst delete mode 100644 docs/configuration/protocols/md-arp.md delete mode 100644 docs/configuration/protocols/md-babel.md delete mode 100644 docs/configuration/protocols/md-bfd.md delete mode 100644 docs/configuration/protocols/md-bgp.md delete mode 100644 docs/configuration/protocols/md-failover.md delete mode 100644 docs/configuration/protocols/md-igmp-proxy.md delete mode 100644 docs/configuration/protocols/md-index.md delete mode 100644 docs/configuration/protocols/md-isis.md delete mode 100644 docs/configuration/protocols/md-mpls.md delete mode 100644 docs/configuration/protocols/md-multicast.md delete mode 100644 docs/configuration/protocols/md-openfabric.md delete mode 100644 docs/configuration/protocols/md-ospf.md delete mode 100644 docs/configuration/protocols/md-pim.md delete mode 100644 docs/configuration/protocols/md-pim6.md delete mode 100644 docs/configuration/protocols/md-rip.md delete mode 100644 docs/configuration/protocols/md-rpki.md delete mode 100644 docs/configuration/protocols/md-segment-routing.md delete mode 100644 docs/configuration/protocols/md-static.md delete mode 100644 docs/configuration/protocols/md-traffic-engineering.md create mode 100644 docs/configuration/protocols/mpls.md delete mode 100644 docs/configuration/protocols/mpls.rst create mode 100644 docs/configuration/protocols/multicast.md delete mode 100644 docs/configuration/protocols/multicast.rst create mode 100644 docs/configuration/protocols/openfabric.md delete mode 100644 docs/configuration/protocols/openfabric.rst create mode 100644 docs/configuration/protocols/ospf.md delete mode 100644 docs/configuration/protocols/ospf.rst create mode 100644 docs/configuration/protocols/pim.md delete mode 100644 docs/configuration/protocols/pim.rst create mode 100644 docs/configuration/protocols/pim6.md delete mode 100644 docs/configuration/protocols/pim6.rst create mode 100644 docs/configuration/protocols/rip.md delete mode 100644 docs/configuration/protocols/rip.rst create mode 100644 docs/configuration/protocols/rpki.md delete mode 100644 docs/configuration/protocols/rpki.rst create mode 100644 docs/configuration/protocols/rst-arp.rst create mode 100644 docs/configuration/protocols/rst-babel.rst create mode 100644 docs/configuration/protocols/rst-bfd.rst create mode 100644 docs/configuration/protocols/rst-bgp.rst create mode 100644 docs/configuration/protocols/rst-failover.rst create mode 100644 docs/configuration/protocols/rst-igmp-proxy.rst create mode 100644 docs/configuration/protocols/rst-index.rst create mode 100644 docs/configuration/protocols/rst-isis.rst create mode 100644 docs/configuration/protocols/rst-mpls.rst create mode 100644 docs/configuration/protocols/rst-multicast.rst create mode 100644 docs/configuration/protocols/rst-openfabric.rst create mode 100644 docs/configuration/protocols/rst-ospf.rst create mode 100644 docs/configuration/protocols/rst-pim.rst create mode 100644 docs/configuration/protocols/rst-pim6.rst create mode 100644 docs/configuration/protocols/rst-rip.rst create mode 100644 docs/configuration/protocols/rst-rpki.rst create mode 100644 docs/configuration/protocols/rst-segment-routing.rst create mode 100644 docs/configuration/protocols/rst-static.rst create mode 100644 docs/configuration/protocols/rst-traffic-engineering.rst create mode 100644 docs/configuration/protocols/segment-routing.md delete mode 100644 docs/configuration/protocols/segment-routing.rst create mode 100644 docs/configuration/protocols/static.md delete mode 100644 docs/configuration/protocols/static.rst create mode 100644 docs/configuration/protocols/traffic-engineering.md delete mode 100644 docs/configuration/protocols/traffic-engineering.rst create mode 100644 docs/configuration/rst-index.rst create mode 100644 docs/configuration/service/broadcast-relay.md delete mode 100644 docs/configuration/service/broadcast-relay.rst create mode 100644 docs/configuration/service/config-sync.md delete mode 100644 docs/configuration/service/config-sync.rst create mode 100644 docs/configuration/service/conntrack-sync.md delete mode 100644 docs/configuration/service/conntrack-sync.rst create mode 100644 docs/configuration/service/console-server.md delete mode 100644 docs/configuration/service/console-server.rst create mode 100644 docs/configuration/service/dhcp-relay.md delete mode 100644 docs/configuration/service/dhcp-relay.rst create mode 100644 docs/configuration/service/dhcp-server.md delete mode 100644 docs/configuration/service/dhcp-server.rst create mode 100644 docs/configuration/service/dns.md delete mode 100644 docs/configuration/service/dns.rst create mode 100644 docs/configuration/service/eventhandler.md delete mode 100644 docs/configuration/service/eventhandler.rst create mode 100644 docs/configuration/service/https.md delete mode 100644 docs/configuration/service/https.rst create mode 100644 docs/configuration/service/index.md delete mode 100644 docs/configuration/service/index.rst create mode 100644 docs/configuration/service/ipoe-server.md delete mode 100644 docs/configuration/service/ipoe-server.rst create mode 100644 docs/configuration/service/lldp.md delete mode 100644 docs/configuration/service/lldp.rst delete mode 100644 docs/configuration/service/md-broadcast-relay.md delete mode 100644 docs/configuration/service/md-config-sync.md delete mode 100644 docs/configuration/service/md-conntrack-sync.md delete mode 100644 docs/configuration/service/md-console-server.md delete mode 100644 docs/configuration/service/md-dhcp-relay.md delete mode 100644 docs/configuration/service/md-dhcp-server.md delete mode 100644 docs/configuration/service/md-dns.md delete mode 100644 docs/configuration/service/md-eventhandler.md delete mode 100644 docs/configuration/service/md-https.md delete mode 100644 docs/configuration/service/md-index.md delete mode 100644 docs/configuration/service/md-ipoe-server.md delete mode 100644 docs/configuration/service/md-lldp.md delete mode 100644 docs/configuration/service/md-mdns.md delete mode 100644 docs/configuration/service/md-monitoring.md delete mode 100644 docs/configuration/service/md-ntp.md delete mode 100644 docs/configuration/service/md-pppoe-server.md delete mode 100644 docs/configuration/service/md-router-advert.md delete mode 100644 docs/configuration/service/md-salt-minion.md delete mode 100644 docs/configuration/service/md-snmp.md delete mode 100644 docs/configuration/service/md-ssh.md delete mode 100644 docs/configuration/service/md-suricata.md delete mode 100644 docs/configuration/service/md-tftp-server.md delete mode 100644 docs/configuration/service/md-webproxy.md create mode 100644 docs/configuration/service/mdns.md delete mode 100644 docs/configuration/service/mdns.rst create mode 100644 docs/configuration/service/monitoring.md delete mode 100644 docs/configuration/service/monitoring.rst create mode 100644 docs/configuration/service/ntp.md delete mode 100644 docs/configuration/service/ntp.rst create mode 100644 docs/configuration/service/pppoe-server.md delete mode 100644 docs/configuration/service/pppoe-server.rst create mode 100644 docs/configuration/service/router-advert.md delete mode 100644 docs/configuration/service/router-advert.rst create mode 100644 docs/configuration/service/rst-broadcast-relay.rst create mode 100644 docs/configuration/service/rst-config-sync.rst create mode 100644 docs/configuration/service/rst-conntrack-sync.rst create mode 100644 docs/configuration/service/rst-console-server.rst create mode 100644 docs/configuration/service/rst-dhcp-relay.rst create mode 100644 docs/configuration/service/rst-dhcp-server.rst create mode 100644 docs/configuration/service/rst-dns.rst create mode 100644 docs/configuration/service/rst-eventhandler.rst create mode 100644 docs/configuration/service/rst-https.rst create mode 100644 docs/configuration/service/rst-index.rst create mode 100644 docs/configuration/service/rst-ipoe-server.rst create mode 100644 docs/configuration/service/rst-lldp.rst create mode 100644 docs/configuration/service/rst-mdns.rst create mode 100644 docs/configuration/service/rst-monitoring.rst create mode 100644 docs/configuration/service/rst-ntp.rst create mode 100644 docs/configuration/service/rst-pppoe-server.rst create mode 100644 docs/configuration/service/rst-router-advert.rst create mode 100644 docs/configuration/service/rst-salt-minion.rst create mode 100644 docs/configuration/service/rst-snmp.rst create mode 100644 docs/configuration/service/rst-ssh.rst create mode 100644 docs/configuration/service/rst-suricata.rst create mode 100644 docs/configuration/service/rst-tftp-server.rst create mode 100644 docs/configuration/service/rst-webproxy.rst create mode 100644 docs/configuration/service/salt-minion.md delete mode 100644 docs/configuration/service/salt-minion.rst create mode 100644 docs/configuration/service/snmp.md delete mode 100644 docs/configuration/service/snmp.rst create mode 100644 docs/configuration/service/ssh.md delete mode 100644 docs/configuration/service/ssh.rst create mode 100644 docs/configuration/service/suricata.md delete mode 100644 docs/configuration/service/suricata.rst create mode 100644 docs/configuration/service/tftp-server.md delete mode 100644 docs/configuration/service/tftp-server.rst create mode 100644 docs/configuration/service/webproxy.md delete mode 100644 docs/configuration/service/webproxy.rst create mode 100644 docs/configuration/system/acceleration.md delete mode 100644 docs/configuration/system/acceleration.rst create mode 100644 docs/configuration/system/conntrack.md delete mode 100644 docs/configuration/system/conntrack.rst create mode 100644 docs/configuration/system/console.md delete mode 100644 docs/configuration/system/console.rst create mode 100644 docs/configuration/system/default-route.md delete mode 100644 docs/configuration/system/default-route.rst create mode 100644 docs/configuration/system/flow-accounting.md delete mode 100644 docs/configuration/system/flow-accounting.rst create mode 100644 docs/configuration/system/frr.md delete mode 100644 docs/configuration/system/frr.rst create mode 100644 docs/configuration/system/host-name.md delete mode 100644 docs/configuration/system/host-name.rst create mode 100644 docs/configuration/system/index.md delete mode 100644 docs/configuration/system/index.rst create mode 100644 docs/configuration/system/ip.md delete mode 100644 docs/configuration/system/ip.rst create mode 100644 docs/configuration/system/ipv6.md delete mode 100644 docs/configuration/system/ipv6.rst create mode 100644 docs/configuration/system/lcd.md delete mode 100644 docs/configuration/system/lcd.rst create mode 100644 docs/configuration/system/login.md delete mode 100644 docs/configuration/system/login.rst delete mode 100644 docs/configuration/system/md-acceleration.md delete mode 100644 docs/configuration/system/md-conntrack.md delete mode 100644 docs/configuration/system/md-console.md delete mode 100644 docs/configuration/system/md-default-route.md delete mode 100644 docs/configuration/system/md-flow-accounting.md delete mode 100644 docs/configuration/system/md-frr.md delete mode 100644 docs/configuration/system/md-host-name.md delete mode 100644 docs/configuration/system/md-index.md delete mode 100644 docs/configuration/system/md-ip.md delete mode 100644 docs/configuration/system/md-ipv6.md delete mode 100644 docs/configuration/system/md-lcd.md delete mode 100644 docs/configuration/system/md-login.md delete mode 100644 docs/configuration/system/md-name-server.md delete mode 100644 docs/configuration/system/md-option.md delete mode 100644 docs/configuration/system/md-proxy.md delete mode 100644 docs/configuration/system/md-sflow.md delete mode 100644 docs/configuration/system/md-sysctl.md delete mode 100644 docs/configuration/system/md-syslog.md delete mode 100644 docs/configuration/system/md-task-scheduler.md delete mode 100644 docs/configuration/system/md-time-zone.md delete mode 100644 docs/configuration/system/md-updates.md delete mode 100644 docs/configuration/system/md-watchdog.md create mode 100644 docs/configuration/system/name-server.md delete mode 100644 docs/configuration/system/name-server.rst create mode 100644 docs/configuration/system/option.md delete mode 100644 docs/configuration/system/option.rst create mode 100644 docs/configuration/system/proxy.md delete mode 100644 docs/configuration/system/proxy.rst create mode 100644 docs/configuration/system/rst-acceleration.rst create mode 100644 docs/configuration/system/rst-conntrack.rst create mode 100644 docs/configuration/system/rst-console.rst create mode 100644 docs/configuration/system/rst-default-route.rst create mode 100644 docs/configuration/system/rst-flow-accounting.rst create mode 100644 docs/configuration/system/rst-frr.rst create mode 100644 docs/configuration/system/rst-host-name.rst create mode 100644 docs/configuration/system/rst-index.rst create mode 100644 docs/configuration/system/rst-ip.rst create mode 100644 docs/configuration/system/rst-ipv6.rst create mode 100644 docs/configuration/system/rst-lcd.rst create mode 100644 docs/configuration/system/rst-login.rst create mode 100644 docs/configuration/system/rst-name-server.rst create mode 100644 docs/configuration/system/rst-option.rst create mode 100644 docs/configuration/system/rst-proxy.rst create mode 100644 docs/configuration/system/rst-sflow.rst create mode 100644 docs/configuration/system/rst-sysctl.rst create mode 100644 docs/configuration/system/rst-syslog.rst create mode 100644 docs/configuration/system/rst-task-scheduler.rst create mode 100644 docs/configuration/system/rst-time-zone.rst create mode 100644 docs/configuration/system/rst-updates.rst create mode 100644 docs/configuration/system/rst-watchdog.rst create mode 100644 docs/configuration/system/sflow.md delete mode 100644 docs/configuration/system/sflow.rst create mode 100644 docs/configuration/system/sysctl.md delete mode 100644 docs/configuration/system/sysctl.rst create mode 100644 docs/configuration/system/syslog.md delete mode 100644 docs/configuration/system/syslog.rst create mode 100644 docs/configuration/system/task-scheduler.md delete mode 100644 docs/configuration/system/task-scheduler.rst create mode 100644 docs/configuration/system/time-zone.md delete mode 100644 docs/configuration/system/time-zone.rst create mode 100644 docs/configuration/system/updates.md delete mode 100644 docs/configuration/system/updates.rst create mode 100644 docs/configuration/system/watchdog.md delete mode 100644 docs/configuration/system/watchdog.rst create mode 100644 docs/configuration/trafficpolicy/index.md delete mode 100644 docs/configuration/trafficpolicy/index.rst delete mode 100644 docs/configuration/trafficpolicy/md-index.md create mode 100644 docs/configuration/trafficpolicy/rst-index.rst create mode 100644 docs/configuration/vpn/dmvpn.md delete mode 100644 docs/configuration/vpn/dmvpn.rst create mode 100644 docs/configuration/vpn/index.md delete mode 100644 docs/configuration/vpn/index.rst create mode 100644 docs/configuration/vpn/ipsec/index.md delete mode 100644 docs/configuration/vpn/ipsec/index.rst create mode 100644 docs/configuration/vpn/ipsec/ipsec_general.md delete mode 100644 docs/configuration/vpn/ipsec/ipsec_general.rst delete mode 100644 docs/configuration/vpn/ipsec/md-index.md delete mode 100644 docs/configuration/vpn/ipsec/md-ipsec_general.md delete mode 100644 docs/configuration/vpn/ipsec/md-remoteaccess_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/md-site2site_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/md-troubleshooting_ipsec.md create mode 100644 docs/configuration/vpn/ipsec/remoteaccess_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/rst-index.rst create mode 100644 docs/configuration/vpn/ipsec/rst-ipsec_general.rst create mode 100644 docs/configuration/vpn/ipsec/rst-remoteaccess_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/rst-site2site_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/rst-troubleshooting_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/site2site_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/site2site_ipsec.rst create mode 100644 docs/configuration/vpn/ipsec/troubleshooting_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/troubleshooting_ipsec.rst create mode 100644 docs/configuration/vpn/l2tp.md delete mode 100644 docs/configuration/vpn/l2tp.rst delete mode 100644 docs/configuration/vpn/md-dmvpn.md delete mode 100644 docs/configuration/vpn/md-index.md delete mode 100644 docs/configuration/vpn/md-l2tp.md delete mode 100644 docs/configuration/vpn/md-openconnect.md delete mode 100644 docs/configuration/vpn/md-pptp.md delete mode 100644 docs/configuration/vpn/md-rsa-keys.md delete mode 100644 docs/configuration/vpn/md-sstp.md create mode 100644 docs/configuration/vpn/openconnect.md delete mode 100644 docs/configuration/vpn/openconnect.rst create mode 100644 docs/configuration/vpn/pptp.md delete mode 100644 docs/configuration/vpn/pptp.rst create mode 100644 docs/configuration/vpn/rsa-keys.md delete mode 100644 docs/configuration/vpn/rsa-keys.rst create mode 100644 docs/configuration/vpn/rst-dmvpn.rst create mode 100644 docs/configuration/vpn/rst-index.rst create mode 100644 docs/configuration/vpn/rst-l2tp.rst create mode 100644 docs/configuration/vpn/rst-openconnect.rst create mode 100644 docs/configuration/vpn/rst-pptp.rst create mode 100644 docs/configuration/vpn/rst-rsa-keys.rst create mode 100644 docs/configuration/vpn/rst-sstp.rst create mode 100644 docs/configuration/vpn/sstp.md delete mode 100644 docs/configuration/vpn/sstp.rst create mode 100644 docs/configuration/vrf/index.md delete mode 100644 docs/configuration/vrf/index.rst delete mode 100644 docs/configuration/vrf/md-index.md create mode 100644 docs/configuration/vrf/rst-index.rst create mode 100644 docs/contributing/build-vyos.md delete mode 100644 docs/contributing/build-vyos.rst create mode 100644 docs/contributing/cla.md delete mode 100644 docs/contributing/cla.rst create mode 100644 docs/contributing/debugging.md delete mode 100644 docs/contributing/debugging.rst create mode 100644 docs/contributing/development.md delete mode 100644 docs/contributing/development.rst create mode 100644 docs/contributing/index.md delete mode 100644 docs/contributing/index.rst create mode 100644 docs/contributing/issues-features.md delete mode 100644 docs/contributing/issues-features.rst delete mode 100644 docs/contributing/md-build-vyos.md delete mode 100644 docs/contributing/md-cla.md delete mode 100644 docs/contributing/md-debugging.md delete mode 100644 docs/contributing/md-development.md delete mode 100644 docs/contributing/md-index.md delete mode 100644 docs/contributing/md-issues-features.md delete mode 100644 docs/contributing/md-testing.md delete mode 100644 docs/contributing/md-upstream-packages.md create mode 100644 docs/contributing/rst-build-vyos.rst create mode 100644 docs/contributing/rst-cla.rst create mode 100644 docs/contributing/rst-debugging.rst create mode 100644 docs/contributing/rst-development.rst create mode 100644 docs/contributing/rst-index.rst create mode 100644 docs/contributing/rst-issues-features.rst create mode 100644 docs/contributing/rst-testing.rst create mode 100644 docs/contributing/rst-upstream-packages.rst create mode 100644 docs/contributing/testing.md delete mode 100644 docs/contributing/testing.rst create mode 100644 docs/contributing/upstream-packages.md delete mode 100644 docs/contributing/upstream-packages.rst create mode 100644 docs/coverage.md delete mode 100644 docs/coverage.rst create mode 100644 docs/documentation.md delete mode 100644 docs/documentation.rst create mode 100644 docs/index.md delete mode 100644 docs/index.rst create mode 100644 docs/installation/bare-metal.md delete mode 100644 docs/installation/bare-metal.rst create mode 100644 docs/installation/cloud/aws.md delete mode 100644 docs/installation/cloud/aws.rst create mode 100644 docs/installation/cloud/azure.md delete mode 100644 docs/installation/cloud/azure.rst create mode 100644 docs/installation/cloud/gcp.md delete mode 100644 docs/installation/cloud/gcp.rst create mode 100644 docs/installation/cloud/index.md delete mode 100644 docs/installation/cloud/index.rst delete mode 100644 docs/installation/cloud/md-aws.md delete mode 100644 docs/installation/cloud/md-azure.md delete mode 100644 docs/installation/cloud/md-gcp.md delete mode 100644 docs/installation/cloud/md-index.md delete mode 100644 docs/installation/cloud/md-oracle.md create mode 100644 docs/installation/cloud/oracle.md delete mode 100644 docs/installation/cloud/oracle.rst create mode 100644 docs/installation/cloud/rst-aws.rst create mode 100644 docs/installation/cloud/rst-azure.rst create mode 100644 docs/installation/cloud/rst-gcp.rst create mode 100644 docs/installation/cloud/rst-index.rst create mode 100644 docs/installation/cloud/rst-oracle.rst create mode 100644 docs/installation/image.md delete mode 100644 docs/installation/image.rst create mode 100644 docs/installation/index.md delete mode 100644 docs/installation/index.rst create mode 100644 docs/installation/install.md delete mode 100644 docs/installation/install.rst delete mode 100644 docs/installation/md-bare-metal.md delete mode 100644 docs/installation/md-image.md delete mode 100644 docs/installation/md-index.md delete mode 100644 docs/installation/md-install.md delete mode 100644 docs/installation/md-secure-boot.md delete mode 100644 docs/installation/md-update.md create mode 100644 docs/installation/rst-bare-metal.rst create mode 100644 docs/installation/rst-image.rst create mode 100644 docs/installation/rst-index.rst create mode 100644 docs/installation/rst-install.rst create mode 100644 docs/installation/rst-secure-boot.rst create mode 100644 docs/installation/rst-update.rst create mode 100644 docs/installation/secure-boot.md delete mode 100644 docs/installation/secure-boot.rst create mode 100644 docs/installation/update.md delete mode 100644 docs/installation/update.rst create mode 100644 docs/installation/virtual/docker.md delete mode 100644 docs/installation/virtual/docker.rst create mode 100644 docs/installation/virtual/eve-ng.md delete mode 100644 docs/installation/virtual/eve-ng.rst create mode 100644 docs/installation/virtual/gns3.md delete mode 100644 docs/installation/virtual/gns3.rst create mode 100644 docs/installation/virtual/index.md delete mode 100644 docs/installation/virtual/index.rst create mode 100644 docs/installation/virtual/libvirt.md delete mode 100644 docs/installation/virtual/libvirt.rst delete mode 100644 docs/installation/virtual/md-docker.md delete mode 100644 docs/installation/virtual/md-eve-ng.md delete mode 100644 docs/installation/virtual/md-gns3.md delete mode 100644 docs/installation/virtual/md-index.md delete mode 100644 docs/installation/virtual/md-libvirt.md delete mode 100644 docs/installation/virtual/md-proxmox.md delete mode 100644 docs/installation/virtual/md-vmware.md create mode 100644 docs/installation/virtual/proxmox.md delete mode 100644 docs/installation/virtual/proxmox.rst create mode 100644 docs/installation/virtual/rst-docker.rst create mode 100644 docs/installation/virtual/rst-eve-ng.rst create mode 100644 docs/installation/virtual/rst-gns3.rst create mode 100644 docs/installation/virtual/rst-index.rst create mode 100644 docs/installation/virtual/rst-libvirt.rst create mode 100644 docs/installation/virtual/rst-proxmox.rst create mode 100644 docs/installation/virtual/rst-vmware.rst create mode 100644 docs/installation/virtual/vmware.md delete mode 100644 docs/installation/virtual/vmware.rst create mode 100644 docs/introducing/about.md delete mode 100644 docs/introducing/about.rst create mode 100644 docs/introducing/history.md delete mode 100644 docs/introducing/history.rst delete mode 100644 docs/introducing/md-about.md delete mode 100644 docs/introducing/md-history.md create mode 100644 docs/introducing/rst-about.rst create mode 100644 docs/introducing/rst-history.rst delete mode 100644 docs/md-404.md delete mode 100644 docs/md-cli.md delete mode 100644 docs/md-coverage.md delete mode 100644 docs/md-documentation.md delete mode 100644 docs/md-index.md delete mode 100644 docs/md-quick-start.md create mode 100644 docs/operation/boot-options.md delete mode 100644 docs/operation/boot-options.rst create mode 100644 docs/operation/index.md delete mode 100644 docs/operation/index.rst create mode 100644 docs/operation/information.md delete mode 100644 docs/operation/information.rst delete mode 100644 docs/operation/md-boot-options.md delete mode 100644 docs/operation/md-index.md delete mode 100644 docs/operation/md-information.md delete mode 100644 docs/operation/md-password-recovery.md delete mode 100644 docs/operation/md-raid.md delete mode 100644 docs/operation/md-upgrade-recovery.md create mode 100644 docs/operation/password-recovery.md delete mode 100755 docs/operation/password-recovery.rst create mode 100644 docs/operation/raid.md delete mode 100644 docs/operation/raid.rst create mode 100644 docs/operation/rst-boot-options.rst create mode 100644 docs/operation/rst-index.rst create mode 100644 docs/operation/rst-information.rst create mode 100755 docs/operation/rst-password-recovery.rst create mode 100644 docs/operation/rst-raid.rst create mode 100644 docs/operation/rst-upgrade-recovery.rst create mode 100644 docs/operation/upgrade-recovery.md delete mode 100644 docs/operation/upgrade-recovery.rst create mode 100644 docs/quick-start.md delete mode 100644 docs/quick-start.rst create mode 100644 docs/rst-404.rst create mode 100644 docs/rst-cli.rst create mode 100644 docs/rst-coverage.rst create mode 100644 docs/rst-documentation.rst create mode 100644 docs/rst-index.rst create mode 100644 docs/rst-quick-start.rst create mode 100644 docs/troubleshooting/connectivity.md delete mode 100644 docs/troubleshooting/connectivity.rst create mode 100644 docs/troubleshooting/index.md delete mode 100644 docs/troubleshooting/index.rst create mode 100644 docs/troubleshooting/interfaces.md delete mode 100644 docs/troubleshooting/interfaces.rst delete mode 100644 docs/troubleshooting/md-connectivity.md delete mode 100644 docs/troubleshooting/md-index.md delete mode 100644 docs/troubleshooting/md-interfaces.md delete mode 100644 docs/troubleshooting/md-monitoring.md delete mode 100644 docs/troubleshooting/md-system.md delete mode 100644 docs/troubleshooting/md-terminal.md create mode 100644 docs/troubleshooting/monitoring.md delete mode 100644 docs/troubleshooting/monitoring.rst create mode 100644 docs/troubleshooting/rst-connectivity.rst create mode 100644 docs/troubleshooting/rst-index.rst create mode 100644 docs/troubleshooting/rst-interfaces.rst create mode 100644 docs/troubleshooting/rst-monitoring.rst create mode 100644 docs/troubleshooting/rst-system.rst create mode 100644 docs/troubleshooting/rst-terminal.rst create mode 100644 docs/troubleshooting/system.md delete mode 100644 docs/troubleshooting/system.rst create mode 100644 docs/troubleshooting/terminal.md delete mode 100644 docs/troubleshooting/terminal.rst create mode 100644 docs/vpp/configuration/acl.md delete mode 100644 docs/vpp/configuration/acl.rst create mode 100644 docs/vpp/configuration/dataplane/buffers.md delete mode 100644 docs/vpp/configuration/dataplane/buffers.rst create mode 100644 docs/vpp/configuration/dataplane/cpu.md delete mode 100644 docs/vpp/configuration/dataplane/cpu.rst create mode 100644 docs/vpp/configuration/dataplane/index.md delete mode 100644 docs/vpp/configuration/dataplane/index.rst create mode 100644 docs/vpp/configuration/dataplane/interface.md delete mode 100644 docs/vpp/configuration/dataplane/interface.rst create mode 100644 docs/vpp/configuration/dataplane/ipsec.md delete mode 100644 docs/vpp/configuration/dataplane/ipsec.rst create mode 100644 docs/vpp/configuration/dataplane/ipv6.md delete mode 100644 docs/vpp/configuration/dataplane/ipv6.rst create mode 100644 docs/vpp/configuration/dataplane/l2learn.md delete mode 100644 docs/vpp/configuration/dataplane/l2learn.rst create mode 100644 docs/vpp/configuration/dataplane/lcp.md delete mode 100644 docs/vpp/configuration/dataplane/lcp.rst create mode 100644 docs/vpp/configuration/dataplane/logging.md delete mode 100644 docs/vpp/configuration/dataplane/logging.rst delete mode 100644 docs/vpp/configuration/dataplane/md-buffers.md delete mode 100644 docs/vpp/configuration/dataplane/md-cpu.md delete mode 100644 docs/vpp/configuration/dataplane/md-index.md delete mode 100644 docs/vpp/configuration/dataplane/md-interface.md delete mode 100644 docs/vpp/configuration/dataplane/md-ipsec.md delete mode 100644 docs/vpp/configuration/dataplane/md-ipv6.md delete mode 100644 docs/vpp/configuration/dataplane/md-l2learn.md delete mode 100644 docs/vpp/configuration/dataplane/md-lcp.md delete mode 100644 docs/vpp/configuration/dataplane/md-logging.md delete mode 100644 docs/vpp/configuration/dataplane/md-memory.md delete mode 100644 docs/vpp/configuration/dataplane/md-system.md delete mode 100644 docs/vpp/configuration/dataplane/md-unix.md create mode 100644 docs/vpp/configuration/dataplane/memory.md delete mode 100644 docs/vpp/configuration/dataplane/memory.rst create mode 100644 docs/vpp/configuration/dataplane/rst-buffers.rst create mode 100644 docs/vpp/configuration/dataplane/rst-cpu.rst create mode 100644 docs/vpp/configuration/dataplane/rst-index.rst create mode 100644 docs/vpp/configuration/dataplane/rst-interface.rst create mode 100644 docs/vpp/configuration/dataplane/rst-ipsec.rst create mode 100644 docs/vpp/configuration/dataplane/rst-ipv6.rst create mode 100644 docs/vpp/configuration/dataplane/rst-l2learn.rst create mode 100644 docs/vpp/configuration/dataplane/rst-lcp.rst create mode 100644 docs/vpp/configuration/dataplane/rst-logging.rst create mode 100644 docs/vpp/configuration/dataplane/rst-memory.rst create mode 100644 docs/vpp/configuration/dataplane/rst-system.rst create mode 100644 docs/vpp/configuration/dataplane/rst-unix.rst create mode 100644 docs/vpp/configuration/dataplane/system.md delete mode 100644 docs/vpp/configuration/dataplane/system.rst create mode 100644 docs/vpp/configuration/dataplane/unix.md delete mode 100644 docs/vpp/configuration/dataplane/unix.rst create mode 100644 docs/vpp/configuration/index.md delete mode 100644 docs/vpp/configuration/index.rst create mode 100644 docs/vpp/configuration/interfaces/bonding.md delete mode 100644 docs/vpp/configuration/interfaces/bonding.rst create mode 100644 docs/vpp/configuration/interfaces/bridge.md delete mode 100644 docs/vpp/configuration/interfaces/bridge.rst create mode 100644 docs/vpp/configuration/interfaces/gre.md delete mode 100644 docs/vpp/configuration/interfaces/gre.rst create mode 100644 docs/vpp/configuration/interfaces/index.md delete mode 100644 docs/vpp/configuration/interfaces/index.rst create mode 100644 docs/vpp/configuration/interfaces/ipip.md delete mode 100644 docs/vpp/configuration/interfaces/ipip.rst create mode 100644 docs/vpp/configuration/interfaces/loopback.md delete mode 100644 docs/vpp/configuration/interfaces/loopback.rst delete mode 100644 docs/vpp/configuration/interfaces/md-bonding.md delete mode 100644 docs/vpp/configuration/interfaces/md-bridge.md delete mode 100644 docs/vpp/configuration/interfaces/md-gre.md delete mode 100644 docs/vpp/configuration/interfaces/md-index.md delete mode 100644 docs/vpp/configuration/interfaces/md-ipip.md delete mode 100644 docs/vpp/configuration/interfaces/md-loopback.md delete mode 100644 docs/vpp/configuration/interfaces/md-vxlan.md delete mode 100644 docs/vpp/configuration/interfaces/md-xconnect.md create mode 100644 docs/vpp/configuration/interfaces/rst-bonding.rst create mode 100644 docs/vpp/configuration/interfaces/rst-bridge.rst create mode 100644 docs/vpp/configuration/interfaces/rst-gre.rst create mode 100644 docs/vpp/configuration/interfaces/rst-index.rst create mode 100644 docs/vpp/configuration/interfaces/rst-ipip.rst create mode 100644 docs/vpp/configuration/interfaces/rst-loopback.rst create mode 100644 docs/vpp/configuration/interfaces/rst-vxlan.rst create mode 100644 docs/vpp/configuration/interfaces/rst-xconnect.rst create mode 100644 docs/vpp/configuration/interfaces/vxlan.md delete mode 100644 docs/vpp/configuration/interfaces/vxlan.rst create mode 100644 docs/vpp/configuration/interfaces/xconnect.md delete mode 100644 docs/vpp/configuration/interfaces/xconnect.rst create mode 100644 docs/vpp/configuration/ipfix.md delete mode 100644 docs/vpp/configuration/ipfix.rst create mode 100644 docs/vpp/configuration/ipsec.md delete mode 100644 docs/vpp/configuration/ipsec.rst delete mode 100644 docs/vpp/configuration/md-acl.md delete mode 100644 docs/vpp/configuration/md-index.md delete mode 100644 docs/vpp/configuration/md-ipfix.md delete mode 100644 docs/vpp/configuration/md-ipsec.md delete mode 100644 docs/vpp/configuration/md-sflow.md create mode 100644 docs/vpp/configuration/nat/cgnat.md delete mode 100644 docs/vpp/configuration/nat/cgnat.rst create mode 100644 docs/vpp/configuration/nat/index.md delete mode 100644 docs/vpp/configuration/nat/index.rst delete mode 100644 docs/vpp/configuration/nat/md-cgnat.md delete mode 100644 docs/vpp/configuration/nat/md-index.md delete mode 100644 docs/vpp/configuration/nat/md-nat44.md create mode 100644 docs/vpp/configuration/nat/nat44.md delete mode 100644 docs/vpp/configuration/nat/nat44.rst create mode 100644 docs/vpp/configuration/nat/rst-cgnat.rst create mode 100644 docs/vpp/configuration/nat/rst-index.rst create mode 100644 docs/vpp/configuration/nat/rst-nat44.rst create mode 100644 docs/vpp/configuration/rst-acl.rst create mode 100644 docs/vpp/configuration/rst-index.rst create mode 100644 docs/vpp/configuration/rst-ipfix.rst create mode 100644 docs/vpp/configuration/rst-ipsec.rst create mode 100644 docs/vpp/configuration/rst-sflow.rst create mode 100644 docs/vpp/configuration/sflow.md delete mode 100644 docs/vpp/configuration/sflow.rst create mode 100644 docs/vpp/description.md delete mode 100644 docs/vpp/description.rst create mode 100644 docs/vpp/index.md delete mode 100644 docs/vpp/index.rst create mode 100644 docs/vpp/limitations.md delete mode 100644 docs/vpp/limitations.rst delete mode 100644 docs/vpp/md-description.md delete mode 100644 docs/vpp/md-index.md delete mode 100644 docs/vpp/md-limitations.md delete mode 100644 docs/vpp/md-requirements.md delete mode 100644 docs/vpp/md-troubleshooting.md create mode 100644 docs/vpp/requirements.md delete mode 100644 docs/vpp/requirements.rst create mode 100644 docs/vpp/rst-description.rst create mode 100644 docs/vpp/rst-index.rst create mode 100644 docs/vpp/rst-limitations.rst create mode 100644 docs/vpp/rst-requirements.rst create mode 100644 docs/vpp/rst-troubleshooting.rst create mode 100644 docs/vpp/troubleshooting.md delete mode 100644 docs/vpp/troubleshooting.rst (limited to 'docs') diff --git a/docs/404.md b/docs/404.md new file mode 100644 index 00000000..f5530747 --- /dev/null +++ b/docs/404.md @@ -0,0 +1,13 @@ +--- +orphan: true +--- + +# Page Not Found + +Sorry, we could not find a page. +Try using the search box or go to the release homepage: + +- [1.2.x (crux)](https://docs.vyos.io/en/crux/) +- [1.3.x (equuleus)](https://docs.vyos.io/en/equuleus/) +- [1.4.x (sagitta)](https://docs.vyos.io/en/sagitta/) +- [rolling release (circinus)](https://docs.vyos.io/en/latest/) diff --git a/docs/404.rst b/docs/404.rst deleted file mode 100644 index 2ae79f2e..00000000 --- a/docs/404.rst +++ /dev/null @@ -1,12 +0,0 @@ -:orphan: - -Page Not Found -============== - -Sorry, We could not find a page. -Try using the search box or go to the release homepage: - - * `1.2.x (crux) `_ - * `1.3.x (equuleus) `_ - * `1.4.x (sagitta) `_ - * `rolling release (circinus) `_ diff --git a/docs/_rst_overrides.txt b/docs/_rst_overrides.txt new file mode 100644 index 00000000..82df65b0 --- /dev/null +++ b/docs/_rst_overrides.txt @@ -0,0 +1,7 @@ +# RST override list +# One page stem per line (relative to docs/, no extension) +# Pages listed here will render from rst-.rst INSTEAD of .md at build time. +# +# Default behaviour: every page builds from its .md primary. Add a stem here +# only if you specifically want the legacy RST version to render for that page. +# Initially empty — MD is canonical for all migrated pages. diff --git a/docs/_swap.txt b/docs/_swap.txt deleted file mode 100644 index 3ffcdaf6..00000000 --- a/docs/_swap.txt +++ /dev/null @@ -1,262 +0,0 @@ -# Incremental MyST swap list -# One page stem per line (relative to docs/, no extension) -# Pages listed here will render from MD instead of RST at build time. -# -# Default: every imported md-*.md page is listed below so MD is served -# by default. To revert a specific page back to RST, remove its line -# (or comment it out). - -404 -automation/cloud-init -automation/command-scripting -automation/index -automation/terraform/index -automation/terraform/terraformAWS -automation/terraform/terraformAZ -automation/terraform/terraformGoogle -automation/terraform/terraformvSphere -automation/vyos-ansible -automation/vyos-api -automation/vyos-govyos -automation/vyos-napalm -automation/vyos-netmiko -automation/vyos-pyvyos -automation/vyos-salt -cli -configexamples/ansible -configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE -configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN -configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP -configexamples/autotest/Wireguard/Wireguard -configexamples/autotest/tunnelbroker/tunnelbroker -configexamples/azure-vpn-bgp -configexamples/azure-vpn-dual-bgp -configexamples/bgp-ipv6-unnumbered -configexamples/dmvpn-dualhub-dualcloud -configexamples/firewall -configexamples/fwall-and-bridge -configexamples/fwall-and-vrf -configexamples/ha -configexamples/index -configexamples/inter-vrf-routing-vrf-lite -configexamples/ipsec-cisco-policy-based -configexamples/ipsec-cisco-route-based -configexamples/ipsec-pa-route-based -configexamples/l3vpn-hub-and-spoke -configexamples/lac-lns -configexamples/nmp -configexamples/ospf-unnumbered -configexamples/policy-based-ipsec-and-firewall -configexamples/pppoe-ipv6-basic -configexamples/qos -configexamples/segment-routing-isis -configexamples/site-2-site-cisco -configexamples/wan-load-balancing -configexamples/zone-policy -configuration/container/index -configuration/firewall/bridge -configuration/firewall/flowtables -configuration/firewall/global-options -configuration/firewall/groups -configuration/firewall/index -configuration/firewall/ipv4 -configuration/firewall/ipv6 -configuration/firewall/zone -configuration/highavailability/index -configuration/index -configuration/interfaces/bonding -configuration/interfaces/bridge -configuration/interfaces/dummy -configuration/interfaces/ethernet -configuration/interfaces/geneve -configuration/interfaces/index -configuration/interfaces/l2tpv3 -configuration/interfaces/loopback -configuration/interfaces/macsec -configuration/interfaces/openvpn -configuration/interfaces/openvpn-examples -configuration/interfaces/pppoe -configuration/interfaces/pseudo-ethernet -configuration/interfaces/sstp-client -configuration/interfaces/tunnel -configuration/interfaces/virtual-ethernet -configuration/interfaces/vti -configuration/interfaces/vxlan -configuration/interfaces/wireguard -configuration/interfaces/wireless -configuration/interfaces/wwan -configuration/loadbalancing/haproxy -configuration/loadbalancing/index -configuration/loadbalancing/wan -configuration/nat/cgnat -configuration/nat/index -configuration/nat/nat44 -configuration/nat/nat64 -configuration/nat/nat66 -configuration/pki/index -configuration/policy/access-list -configuration/policy/as-path-list -configuration/policy/community-list -configuration/policy/examples -configuration/policy/extcommunity-list -configuration/policy/index -configuration/policy/large-community-list -configuration/policy/local-route -configuration/policy/prefix-list -configuration/policy/route -configuration/policy/route-map -configuration/protocols/arp -configuration/protocols/babel -configuration/protocols/bfd -configuration/protocols/bgp -configuration/protocols/failover -configuration/protocols/igmp-proxy -configuration/protocols/index -configuration/protocols/isis -configuration/protocols/mpls -configuration/protocols/multicast -configuration/protocols/openfabric -configuration/protocols/ospf -configuration/protocols/pim -configuration/protocols/pim6 -configuration/protocols/rip -configuration/protocols/rpki -configuration/protocols/segment-routing -configuration/protocols/static -configuration/protocols/traffic-engineering -configuration/service/broadcast-relay -configuration/service/config-sync -configuration/service/conntrack-sync -configuration/service/console-server -configuration/service/dhcp-relay -configuration/service/dhcp-server -configuration/service/dns -configuration/service/eventhandler -configuration/service/https -configuration/service/index -configuration/service/ipoe-server -configuration/service/lldp -configuration/service/mdns -configuration/service/monitoring -configuration/service/ntp -configuration/service/pppoe-server -configuration/service/router-advert -configuration/service/salt-minion -configuration/service/snmp -configuration/service/ssh -configuration/service/suricata -configuration/service/tftp-server -configuration/service/webproxy -configuration/system/acceleration -configuration/system/conntrack -configuration/system/console -configuration/system/default-route -configuration/system/flow-accounting -configuration/system/frr -configuration/system/host-name -configuration/system/index -configuration/system/ip -configuration/system/ipv6 -configuration/system/lcd -configuration/system/login -configuration/system/name-server -configuration/system/option -configuration/system/proxy -configuration/system/sflow -configuration/system/sysctl -configuration/system/syslog -configuration/system/task-scheduler -configuration/system/time-zone -configuration/system/updates -configuration/system/watchdog -configuration/trafficpolicy/index -configuration/vpn/dmvpn -configuration/vpn/index -configuration/vpn/ipsec/index -configuration/vpn/ipsec/ipsec_general -configuration/vpn/ipsec/remoteaccess_ipsec -configuration/vpn/ipsec/site2site_ipsec -configuration/vpn/ipsec/troubleshooting_ipsec -configuration/vpn/l2tp -configuration/vpn/openconnect -configuration/vpn/pptp -configuration/vpn/rsa-keys -configuration/vpn/sstp -configuration/vrf/index -contributing/build-vyos -contributing/cla -contributing/debugging -contributing/development -contributing/index -contributing/issues-features -contributing/testing -contributing/upstream-packages -coverage -documentation -index -installation/bare-metal -installation/cloud/aws -installation/cloud/azure -installation/cloud/gcp -installation/cloud/index -installation/cloud/oracle -installation/image -installation/index -installation/install -installation/secure-boot -installation/update -installation/virtual/docker -installation/virtual/eve-ng -installation/virtual/gns3 -installation/virtual/index -installation/virtual/libvirt -installation/virtual/proxmox -installation/virtual/vmware -introducing/about -introducing/history -operation/boot-options -operation/index -operation/information -operation/password-recovery -operation/raid -operation/upgrade-recovery -quick-start -troubleshooting/connectivity -troubleshooting/index -troubleshooting/interfaces -troubleshooting/monitoring -troubleshooting/system -troubleshooting/terminal -vpp/configuration/acl -vpp/configuration/dataplane/buffers -vpp/configuration/dataplane/cpu -vpp/configuration/dataplane/index -vpp/configuration/dataplane/interface -vpp/configuration/dataplane/ipsec -vpp/configuration/dataplane/ipv6 -vpp/configuration/dataplane/l2learn -vpp/configuration/dataplane/lcp -vpp/configuration/dataplane/logging -vpp/configuration/dataplane/memory -vpp/configuration/dataplane/system -vpp/configuration/dataplane/unix -vpp/configuration/index -vpp/configuration/interfaces/bonding -vpp/configuration/interfaces/bridge -vpp/configuration/interfaces/gre -vpp/configuration/interfaces/index -vpp/configuration/interfaces/ipip -vpp/configuration/interfaces/loopback -vpp/configuration/interfaces/vxlan -vpp/configuration/interfaces/xconnect -vpp/configuration/ipfix -vpp/configuration/ipsec -vpp/configuration/nat/cgnat -vpp/configuration/nat/index -vpp/configuration/nat/nat44 -vpp/configuration/sflow -vpp/description -vpp/index -vpp/limitations -vpp/requirements -vpp/troubleshooting diff --git a/docs/automation/cloud-init.md b/docs/automation/cloud-init.md new file mode 100644 index 00000000..b6350b54 --- /dev/null +++ b/docs/automation/cloud-init.md @@ -0,0 +1,378 @@ +--- +lastproofread: '2026-04-13' +--- + +(cloud-init)= + +# VyOS cloud-init + +VyOS instances in cloud and virtualized environments are initialized using the +industry-standard `cloud-init`. Through `cloud-init`, VyOS injects SSH +keys, configures network settings, and applies custom configurations during the +initial instance boot. + +## Configuration sources + +VyOS `cloud-init` obtains configuration data from the following sources: + +- `meta-data`: Instance-specific details provided by the cloud platform or + hypervisor. In some cloud environments, this data is available via an HTTP + endpoint at `http://169.254.169.254`. +- `network configuration`: Network settings such as IP addresses, routes, and + DNS (only available on certain cloud and virtualization platforms). +- `user-data`: User-supplied CLI configuration commands. + +## User-data + +Major cloud providers support injecting `user-data` as plain text or base64 +encoding text during initial instance boot. As `user-data` has a strict size +limit of \~16384 bytes, long configuration command lists can be compressed using +`gzip`. + +The recommended method for configuring VyOS instances via `user-data` is to +use the `cloud-config` syntax described below. + +## Cloud-config modules + +By default, VyOS enables only two `cloud-config` modules: + +- `write_files`: Inserts user-provided files such as encryption keys, + certificates, or `config.boot` into the filesystem during the initial + instance boot. See [Cloud-init-write_files] for file syntax and file format + requirements. +- `vyos_userdata`: Executes user-provided CLI configuration commands during + the initial instance boot. + +The files to insert and the CLI commands to execute must be provided in a +`cloud-config` YAML file. + +## Cloud-config file format + +`cloud-config` files are written in YAML and must begin with the +`#cloud-config` line. Only `vyos_config_commands` and `write_files` are +supported as top-level keys. The use of these keys is described in the +following two sections. + +## Vyos_config_commands key + +Use the `vyos_config_commands` key to define configuration commands for +initializing your VyOS instance. Commands must follow the set-style syntax +and can include both `set` and `delete` statements. + +Syntax requirements: + +- Place one command per line. +- Enclose values in single quotes. +- Avoid single quotes within commands or values. + +Applying commands from `cloud-config` overrides both settings configured via +`meta-data` and default VyOS settings. After commands are applied, +`cloud-init` automatically performs `commit` and `save`. + +The following is an example of a `cloud-config` file: + +```yaml +#cloud-config +vyos_config_commands: + - set system host-name 'vyos-prod-ashburn' + - set service ntp server 1.pool.ntp.org + - set service ntp server 2.pool.ntp.org + - delete interfaces ethernet eth1 address 'dhcp' + - set interfaces ethernet eth1 address '192.0.2.247/24' + - set protocols static route 198.51.100.0/24 next-hop '192.0.2.1' +``` + + +### Instance defaults/fallbacks + +If no external configuration data is provided, VyOS applies the following +defaults: + +- **SSH:** port 22. +- **Credentials:** `vyos`/`vyos`. +- **Networking:** DHCP is enabled on the first Ethernet interface. + +All defaults can be overridden via `user-data` configurations. + +## Write_files key + +VyOS allows you to run custom scripts during the initial instance boot to +execute operational, configuration, and standard Linux commands. + +Use the `write_files` key to insert these scripts into the +`/opt/vyatta/etc/config/scripts/` directory. + +Depending on when your commands need to run, use one of the following paths: + +- `/opt/vyatta/etc/config/scripts/vyos-preconfig-bootup.script`: Commands + defined here are executed before the system configuration is applied. +- `/opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script`: Commands + defined here are executed after the system configuration is applied. + +In both cases, commands are executed with `root` privileges. + +:::{note} +Use the `/opt/vyatta/etc/config/` path instead of `/config/scripts/` as +referenced in the {ref}`command-scripting` section. The `/config/scripts/` +directory is not mounted when the `write_files` module runs. +::: + +The following example shows how to use `write_files` to execute an +operational command **after** the initial configuration is complete: + +```yaml +#cloud-config +write_files: + - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script + owner: root:vyattacfg + permissions: '0775' + content: | + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + filename=/tmp/bgp_status_`date +"%Y_%m_%d_%I_%M_%p"`.log + run show ip bgp summary >> $filename +``` + +You can combine standard Linux commands to fetch data and VyOS configuration +commands (like `set` and `commit`) in the same script. + +The following example sets the `hostname` based on the instance identifier +obtained from the EC2 Instance Metadata Service (IMDS). + +```yaml +#cloud-config +write_files: + - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script + owner: root:vyattacfg + permissions: '0775' + content: | + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + hostname=`curl -s http://169.254.169.254/latest/meta-data/instance-id` + configure + set system host-name $hostname + commit + exit +``` + + +## NoCloud + +Injecting configuration data is not limited to cloud platforms. The NoCloud +data source allows you to inject `user-data` and `meta-data` on +virtualization platforms such as VMware, Hyper-V, and KVM. + +The simplest way to use the NoCloud data source is to create a `seed.iso` +file and attach it to the virtual machine as a CD drive. The volume must be +formatted as a VFAT or ISO 9660 file system with the label `cidata` or +`CIDATA`. + +Create text files named `user-data` and `meta-data`. On Linux-based +systems, use the `mkisofs` utility to create the `seed.iso` file. The +following syntax adds these files to the ISO 9660 file system: + +```none +mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data user-data +``` + +Once generated, attach the `seed.iso` file to your virtual machine. The +following example shows how to attach the file as a CD drive using KVM: + +```none +$ virt-install -n vyos_r1 \ + --ram 4096 \ + --vcpus 2 \ + --cdrom seed.iso \ + --os-type linux \ + --os-variant debian10 \ + --network network=default \ + --graphics vnc \ + --hvm \ + --virt-type kvm \ + --disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \ + --import \ + --noautoconsole +``` + +For more information on the NoCloud data source, visit the [NoCloud] page in +the `cloud-init` documentation. + +## Troubleshooting + +If your configuration does not apply as expected, follow these troubleshooting +steps: + +1. **Validate your YAML**: Ensure your `cloud-config` file follows proper + YAML syntax. Online resources such as [YAML Lint](https://www.yamllint.com/) + provide simple validation tools. +2. **Check the logs**: `cloud-init` writes logs to `/var/log/cloud-init.log`. + Filter for VyOS-specific entries using: + +```none +sudo grep vyos /var/log/cloud-init.log +``` + + +## Cloud-init on Proxmox + +Before you begin, review the `cloud-init` [network-config-docs] to +understand how to import user and network configuration data. + +Key considerations: + +- Define VyOS configuration commands in the `user-data` file. +- Avoid including network configuration data in the `user-data` file. +- If no network configuration data is provided, the DHCP client is enabled on + the first interface. This happens at the OS level and is not reflected in the + VyOS CLI. + +The following example shows how to disable the DHCP client on `eth0` to +address this behavior. + +In this example: + +- **Proxmox IP address**: `192.168.0.253/24`. +- **Storage**: The `local` volume is mounted at `/var/lib/vz` and contains + all content types, including snippets. + +The goal is to remove the default DHCP client from the first interface and +apply a custom configuration during the initial instance boot using +`cloud-init`. + +### Generate .qcow2 image + +First, generate a VyOS `.qcow2` image with `cloud-init` support from the +[vyos-vm-images] repository: + +1. Clone the `vyos-vm-images` repository and comment out the `download-iso` + role in `qemu.yml`. +2. Download your preferred VyOS `.iso` file and save it as `/tmp/vyos.iso`. +3. Generate the `.qcow2` image (using a 10G disk size for this example): + +```sh +sudo ansible-playbook qemu.yml -e disk_size=10 \ + -e iso_local=/tmp/vyos.iso -e grub_console=serial -e vyos_version=1.5.0 \ + -e cloud_init=true -e cloud_init_ds=NoCloud +``` + +This generates your new image at `/tmp/vyos-1.5.0-cloud-init-10G-qemu.qcow2`. + +4. Copy the resulting image to the Proxmox server: + +```sh +sudo scp /tmp/vyos-1.5.0-cloud-init-10G-qemu.qcow2 root@192.168.0.253:/tmp/ +``` + + +### Prepare cloud-init files + +Create the following files on your Proxmox server to proceed with this setup: + +- `user-data`: Contains VyOS configuration commands. +- `network-config`: Disables the DHCP client on the first interface. +- `meta-data`: An empty file (required by `cloud-init`). + +All files must be placed in the `/tmp/` directory. + +Follow these steps to create the required files: + +1. Navigate to the `/tmp/` directory: + + ```sh + cd /tmp/ + ``` + +2. Create the `user-data` file. Begin the file with `#cloud-config` and + include VyOS configuration commands. + + ```none + #cloud-config + vyos_config_commands: + - set system host-name 'vyos-BRAS' + - set service ntp server '1.pool.ntp.org' + - set service ntp server '2.pool.ntp.org' + - delete interfaces ethernet eth0 address 'dhcp' + - set interfaces ethernet eth0 address '198.51.100.2/30' + - set interfaces ethernet eth0 description 'WAN - ISP01' + - set interfaces ethernet eth1 address '192.168.25.1/24' + - set interfaces ethernet eth1 description 'Coming through VLAN 25' + - set interfaces ethernet eth2 address '192.168.26.1/24' + - set interfaces ethernet eth2 description 'Coming through VLAN 26' + - set protocols static route 0.0.0.0/0 next-hop '198.51.100.1' + ``` + +3. Create the `network-config` file. Include the following: + + ```none + version: 2 + ethernets: + eth0: + dhcp4: false + dhcp6: false + ``` + +4. Create the required empty `meta-data` file. + +### Create seed.iso + +Once you have created the necessary files, generate the `seed.iso` image and +mount it as a CD drive to the new VM. + +```sh +mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data \ +user-data network-config +``` + +:::{note} +Be careful while copying and pasting the above commands. Double quotes may need +to be corrected. +::: + +### Create the VM + +Note that the following settings apply to this particular example and may +require adjustment for other setups: + +- **VM ID**: `555`. +- **VM and .iso file storage**: The local volume (`directory` type, + mounted at `/var/lib/vz`). +- **VM resources**: Can be modified as needed. + +The `seed.iso` file was previously created in the `/tmp/` directory. Move +it to `/var/lib/vz/template/iso`: + +```sh +mv /tmp/seed.iso /var/lib/vz/template/iso/ +``` + +On the Proxmox server: + +```none +## Create VM, import disk and define boot order +qm create 555 --name vyos-1.5.0-cloudinit --memory 1024 --net0 virtio,bridge=vmbr0 +qm importdisk 555 vyos-1.5.0-cloud-init-10G-qemu.qcow2 local +qm set 555 --virtio0 local:555/vm-555-disk-0.raw +qm set 555 --boot order=virtio0 + +## Import seed.iso for cloud init +qm set 555 --ide2 media=cdrom,file=local:iso/seed.iso + +## Since this server has 1 nic, lets add network intefaces (vlan 25 and 26) +qm set 555 --net1 virtio,bridge=vmbr0,firewall=1,tag=25 +qm set 555 --net2 virtio,bridge=vmbr0,firewall=1,tag=26 +``` + + +### Power on and verify the VM + +Power on the VM using the CLI or GUI. After it boots, verify the configuration. + +### References + +- Cloud-init [network-config-docs]. +- Proxmox [Cloud-init-Support]. +[cloud-init-support]: +[cloud-init-write_files]: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files +[network-config-docs]: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html +[nocloud]: https://cloudinit.readthedocs.io/en/latest/reference/datasources/nocloud.html +[vyos-vm-images]: https://github.com/vyos/vyos-vm-images diff --git a/docs/automation/cloud-init.rst b/docs/automation/cloud-init.rst deleted file mode 100644 index 29f56d0d..00000000 --- a/docs/automation/cloud-init.rst +++ /dev/null @@ -1,416 +0,0 @@ -:lastproofread: 2026-04-13 - -.. _cloud-init: - -############### -VyOS cloud-init -############### - -VyOS instances in cloud and virtualized environments are initialized using the -industry-standard ``cloud-init``. Through ``cloud-init``, VyOS injects SSH -keys, configures network settings, and applies custom configurations during the -initial instance boot. - -********************* -Configuration sources -********************* - -VyOS ``cloud-init`` obtains configuration data from the following sources: - -* ``meta-data``: Instance-specific details provided by the cloud platform or - hypervisor. In some cloud environments, this data is available via an HTTP - endpoint at ``http://169.254.169.254``. -* ``network configuration``: Network settings such as IP addresses, routes, and - DNS (only available on certain cloud and virtualization platforms). -* ``user-data``: User-supplied CLI configuration commands. - -********* -User-data -********* - -Major cloud providers support injecting ``user-data`` as plain text or base64 -encoding text during initial instance boot. As ``user-data`` has a strict size -limit of ~16384 bytes, long configuration command lists can be compressed using -``gzip``. - -The recommended method for configuring VyOS instances via ``user-data`` is to -use the ``cloud-config`` syntax described below. - -******************** -Cloud-config modules -******************** - -By default, VyOS enables only two ``cloud-config`` modules: - -* ``write_files``: Inserts user-provided files such as encryption keys, - certificates, or ``config.boot`` into the filesystem during the initial - instance boot. See `Cloud-init-write_files`_ for file syntax and file format - requirements. -* ``vyos_userdata``: Executes user-provided CLI configuration commands during - the initial instance boot. - -The files to insert and the CLI commands to execute must be provided in a -``cloud-config`` YAML file. - -************************ -Cloud-config file format -************************ - -``cloud-config`` files are written in YAML and must begin with the -``#cloud-config`` line. Only ``vyos_config_commands`` and ``write_files`` are -supported as top-level keys. The use of these keys is described in the -following two sections. - -************************ -Vyos_config_commands key -************************ - -Use the ``vyos_config_commands`` key to define configuration commands for -initializing your VyOS instance. Commands must follow the set-style syntax -and can include both ``set`` and ``delete`` statements. - -Syntax requirements: - -* Place one command per line. -* Enclose values in single quotes. -* Avoid single quotes within commands or values. - -Applying commands from ``cloud-config`` overrides both settings configured via -``meta-data`` and default VyOS settings. After commands are applied, -``cloud-init`` automatically performs ``commit`` and ``save``. - -The following is an example of a ``cloud-config`` file: - -.. code-block:: yaml - - #cloud-config - vyos_config_commands: - - set system host-name 'vyos-prod-ashburn' - - set service ntp server 1.pool.ntp.org - - set service ntp server 2.pool.ntp.org - - delete interfaces ethernet eth1 address 'dhcp' - - set interfaces ethernet eth1 address '192.0.2.247/24' - - set protocols static route 198.51.100.0/24 next-hop '192.0.2.1' - ---------------------------- -Instance defaults/fallbacks ---------------------------- - -If no external configuration data is provided, VyOS applies the following -defaults: - -* **SSH:** port 22. -* **Credentials:** ``vyos``/``vyos``. -* **Networking:** DHCP is enabled on the first Ethernet interface. - -All defaults can be overridden via ``user-data`` configurations. - - -*************** -Write_files key -*************** - -VyOS allows you to run custom scripts during the initial instance boot to -execute operational, configuration, and standard Linux commands. - -Use the ``write_files`` key to insert these scripts into the -``/opt/vyatta/etc/config/scripts/`` directory. - -Depending on when your commands need to run, use one of the following paths: - -* ``/opt/vyatta/etc/config/scripts/vyos-preconfig-bootup.script``: Commands - defined here are executed before the system configuration is applied. -* ``/opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script``: Commands - defined here are executed after the system configuration is applied. - -In both cases, commands are executed with ``root`` privileges. - -.. note:: - - Use the ``/opt/vyatta/etc/config/`` path instead of ``/config/scripts/`` as - referenced in the :ref:`command-scripting` section. The ``/config/scripts/`` - directory is not mounted when the ``write_files`` module runs. - -The following example shows how to use ``write_files`` to execute an -operational command **after** the initial configuration is complete: - -.. code-block:: yaml - - #cloud-config - write_files: - - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script - owner: root:vyattacfg - permissions: '0775' - content: | - #!/bin/vbash - source /opt/vyatta/etc/functions/script-template - filename=/tmp/bgp_status_`date +"%Y_%m_%d_%I_%M_%p"`.log - run show ip bgp summary >> $filename - -You can combine standard Linux commands to fetch data and VyOS configuration -commands (like ``set`` and ``commit``) in the same script. - -The following example sets the ``hostname`` based on the instance identifier -obtained from the EC2 Instance Metadata Service (IMDS). - -.. code-block:: yaml - - - #cloud-config - write_files: - - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script - owner: root:vyattacfg - permissions: '0775' - content: | - #!/bin/vbash - source /opt/vyatta/etc/functions/script-template - hostname=`curl -s http://169.254.169.254/latest/meta-data/instance-id` - configure - set system host-name $hostname - commit - exit - -******* -NoCloud -******* - -Injecting configuration data is not limited to cloud platforms. The NoCloud -data source allows you to inject ``user-data`` and ``meta-data`` on -virtualization platforms such as VMware, Hyper-V, and KVM. - -The simplest way to use the NoCloud data source is to create a ``seed.iso`` -file and attach it to the virtual machine as a CD drive. The volume must be -formatted as a VFAT or ISO 9660 file system with the label ``cidata`` or -``CIDATA``. - -Create text files named ``user-data`` and ``meta-data``. On Linux-based -systems, use the ``mkisofs`` utility to create the ``seed.iso`` file. The -following syntax adds these files to the ISO 9660 file system: - -.. code-block:: none - - mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data user-data - -Once generated, attach the ``seed.iso`` file to your virtual machine. The -following example shows how to attach the file as a CD drive using KVM: - -.. code-block:: none - - $ virt-install -n vyos_r1 \ - --ram 4096 \ - --vcpus 2 \ - --cdrom seed.iso \ - --os-type linux \ - --os-variant debian10 \ - --network network=default \ - --graphics vnc \ - --hvm \ - --virt-type kvm \ - --disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \ - --import \ - --noautoconsole - -For more information on the NoCloud data source, visit the `NoCloud`_ page in -the ``cloud-init`` documentation. - -*************** -Troubleshooting -*************** - -If your configuration does not apply as expected, follow these troubleshooting -steps: - -1. **Validate your YAML**: Ensure your ``cloud-config`` file follows proper - YAML syntax. Online resources such as `YAML Lint `_ - provide simple validation tools. -2. **Check the logs**: ``cloud-init`` writes logs to ``/var/log/cloud-init.log``. - Filter for VyOS-specific entries using: - - -.. code-block:: none - - sudo grep vyos /var/log/cloud-init.log - -********************* -Cloud-init on Proxmox -********************* - -Before you begin, review the ``cloud-init`` `network-config-docs`_ to -understand how to import user and network configuration data. - -Key considerations: - -* Define VyOS configuration commands in the ``user-data`` file. -* Avoid including network configuration data in the ``user-data`` file. -* If no network configuration data is provided, the DHCP client is enabled on - the first interface. This happens at the OS level and is not reflected in the - VyOS CLI. - -The following example shows how to disable the DHCP client on ``eth0`` to -address this behavior. - -In this example: - -* **Proxmox IP address**: ``192.168.0.253/24``. -* **Storage**: The ``local`` volume is mounted at ``/var/lib/vz`` and contains - all content types, including snippets. - -The goal is to remove the default DHCP client from the first interface and -apply a custom configuration during the initial instance boot using -``cloud-init``. - ---------------------- -Generate .qcow2 image ---------------------- - -First, generate a VyOS ``.qcow2`` image with ``cloud-init`` support from the -`vyos-vm-images`_ repository: - -#. Clone the ``vyos-vm-images`` repository and comment out the ``download-iso`` - role in ``qemu.yml``. -#. Download your preferred VyOS ``.iso`` file and save it as ``/tmp/vyos.iso``. -#. Generate the ``.qcow2`` image (using a 10G disk size for this example): - -.. code-block:: sh - - sudo ansible-playbook qemu.yml -e disk_size=10 \ - -e iso_local=/tmp/vyos.iso -e grub_console=serial -e vyos_version=1.5.0 \ - -e cloud_init=true -e cloud_init_ds=NoCloud - -This generates your new image at ``/tmp/vyos-1.5.0-cloud-init-10G-qemu.qcow2``. - -#. Copy the resulting image to the Proxmox server: - -.. code-block:: sh - - sudo scp /tmp/vyos-1.5.0-cloud-init-10G-qemu.qcow2 root@192.168.0.253:/tmp/ - - ------------------------- -Prepare cloud-init files ------------------------- - -Create the following files on your Proxmox server to proceed with this setup: - -* ``user-data``: Contains VyOS configuration commands. -* ``network-config``: Disables the DHCP client on the first interface. -* ``meta-data``: An empty file (required by ``cloud-init``). - -All files must be placed in the ``/tmp/`` directory. - -Follow these steps to create the required files: - -1. Navigate to the ``/tmp/`` directory: - - .. code-block:: sh - - cd /tmp/ - -2. Create the ``user-data`` file. Begin the file with ``#cloud-config`` and - include VyOS configuration commands. - - .. code-block:: none - - #cloud-config - vyos_config_commands: - - set system host-name 'vyos-BRAS' - - set service ntp server '1.pool.ntp.org' - - set service ntp server '2.pool.ntp.org' - - delete interfaces ethernet eth0 address 'dhcp' - - set interfaces ethernet eth0 address '198.51.100.2/30' - - set interfaces ethernet eth0 description 'WAN - ISP01' - - set interfaces ethernet eth1 address '192.168.25.1/24' - - set interfaces ethernet eth1 description 'Coming through VLAN 25' - - set interfaces ethernet eth2 address '192.168.26.1/24' - - set interfaces ethernet eth2 description 'Coming through VLAN 26' - - set protocols static route 0.0.0.0/0 next-hop '198.51.100.1' - -3. Create the ``network-config`` file. Include the following: - - .. code-block:: none - - version: 2 - ethernets: - eth0: - dhcp4: false - dhcp6: false - -4. Create the required empty ``meta-data`` file. - - ---------------- -Create seed.iso ---------------- - -Once you have created the necessary files, generate the ``seed.iso`` image and -mount it as a CD drive to the new VM. - -.. code-block:: sh - - mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data \ - user-data network-config - -.. note:: - - Be careful while copying and pasting the above commands. Double quotes may need - to be corrected. - -------------- -Create the VM -------------- - -Note that the following settings apply to this particular example and may -require adjustment for other setups: - -* **VM ID**: ``555``. -* **VM and .iso file storage**: The local volume (``directory`` type, - mounted at ``/var/lib/vz``). -* **VM resources**: Can be modified as needed. - -The ``seed.iso`` file was previously created in the ``/tmp/`` directory. Move -it to ``/var/lib/vz/template/iso``: - -.. code-block:: sh - - mv /tmp/seed.iso /var/lib/vz/template/iso/ - -On the Proxmox server: - -.. code-block:: none - - ## Create VM, import disk and define boot order - qm create 555 --name vyos-1.5.0-cloudinit --memory 1024 --net0 virtio,bridge=vmbr0 - qm importdisk 555 vyos-1.5.0-cloud-init-10G-qemu.qcow2 local - qm set 555 --virtio0 local:555/vm-555-disk-0.raw - qm set 555 --boot order=virtio0 - - ## Import seed.iso for cloud init - qm set 555 --ide2 media=cdrom,file=local:iso/seed.iso - - ## Since this server has 1 nic, lets add network intefaces (vlan 25 and 26) - qm set 555 --net1 virtio,bridge=vmbr0,firewall=1,tag=25 - qm set 555 --net2 virtio,bridge=vmbr0,firewall=1,tag=26 - --------------------------- -Power on and verify the VM --------------------------- - -Power on the VM using the CLI or GUI. After it boots, verify the configuration. - ----------- -References ----------- - -* Cloud-init `network-config-docs`_. - -* Proxmox `Cloud-init-Support`_. - -.. stop_vyoslinter - -.. _network-config-docs: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html -.. _vyos-vm-images: https://github.com/vyos/vyos-vm-images -.. _cloud-init-docs: https://docs.vyos.io/en/equuleus/automation/cloud-init.html?highlight=cloud-init#vyos-cloud-init -.. _Cloud-init-Support: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_cloud_init -.. _Cloud-init-write_files: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files -.. _nocloud: https://cloudinit.readthedocs.io/en/latest/reference/datasources/nocloud.html -.. start_vyoslinter diff --git a/docs/automation/command-scripting.md b/docs/automation/command-scripting.md new file mode 100644 index 00000000..7e736152 --- /dev/null +++ b/docs/automation/command-scripting.md @@ -0,0 +1,225 @@ +--- +lastproofread: '2026-03-16' +--- + +(command-scripting)= + +# Command scripting + +VyOS supports executing configuration and operational commands non-interactively +from shell scripts. + +To include VyOS-specific functions and aliases, source the +`/opt/vyatta/etc/functions/script-template` file at the beginning of your +script. + +```none +#!/bin/vbash +source /opt/vyatta/etc/functions/script-template +exit +``` + + +## Script execute permissions + +Simply placing script files in `/config/scripts/` does not mean the system +can execute them. + +To make your scripts executable, grant them **execute permissions**. Use the +following command: + +```none +chmod +x /config/scripts/script-name.sh +``` + + +## Run configuration commands + +In scripts, present configuration commands as in a standard configuration +session. + +For example, to disable a BGP peer during a VRRP transition to the backup +state, use the following syntax: + +```none +#!/bin/vbash +source /opt/vyatta/etc/functions/script-template +configure +set protocols bgp system-as 65536 +set protocols bgp neighbor 192.168.2.1 shutdown +commit +exit +``` + + +## Run operational commands + +In scripts, **always** prefix operational commands with `run`. + +```none +#!/bin/vbash +source /opt/vyatta/etc/functions/script-template +run show interfaces +exit +``` + + +## Run commands remotely + +You can execute multiple **operational commands** on a remote VyOS system by +passing a script block over SSH. + +```none +ssh 192.0.2.1 'vbash -s' <> $filename -``` - -You can combine standard Linux commands to fetch data and VyOS configuration -commands (like `set` and `commit`) in the same script. - -The following example sets the `hostname` based on the instance identifier -obtained from the EC2 Instance Metadata Service (IMDS). - -```yaml -#cloud-config -write_files: - - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script - owner: root:vyattacfg - permissions: '0775' - content: | - #!/bin/vbash - source /opt/vyatta/etc/functions/script-template - hostname=`curl -s http://169.254.169.254/latest/meta-data/instance-id` - configure - set system host-name $hostname - commit - exit -``` - - -## NoCloud - -Injecting configuration data is not limited to cloud platforms. The NoCloud -data source allows you to inject `user-data` and `meta-data` on -virtualization platforms such as VMware, Hyper-V, and KVM. - -The simplest way to use the NoCloud data source is to create a `seed.iso` -file and attach it to the virtual machine as a CD drive. The volume must be -formatted as a VFAT or ISO 9660 file system with the label `cidata` or -`CIDATA`. - -Create text files named `user-data` and `meta-data`. On Linux-based -systems, use the `mkisofs` utility to create the `seed.iso` file. The -following syntax adds these files to the ISO 9660 file system: - -```none -mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data user-data -``` - -Once generated, attach the `seed.iso` file to your virtual machine. The -following example shows how to attach the file as a CD drive using KVM: - -```none -$ virt-install -n vyos_r1 \ - --ram 4096 \ - --vcpus 2 \ - --cdrom seed.iso \ - --os-type linux \ - --os-variant debian10 \ - --network network=default \ - --graphics vnc \ - --hvm \ - --virt-type kvm \ - --disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \ - --import \ - --noautoconsole -``` - -For more information on the NoCloud data source, visit the [NoCloud] page in -the `cloud-init` documentation. - -## Troubleshooting - -If your configuration does not apply as expected, follow these troubleshooting -steps: - -1. **Validate your YAML**: Ensure your `cloud-config` file follows proper - YAML syntax. Online resources such as [YAML Lint](https://www.yamllint.com/) - provide simple validation tools. -2. **Check the logs**: `cloud-init` writes logs to `/var/log/cloud-init.log`. - Filter for VyOS-specific entries using: - -```none -sudo grep vyos /var/log/cloud-init.log -``` - - -## Cloud-init on Proxmox - -Before you begin, review the `cloud-init` [network-config-docs] to -understand how to import user and network configuration data. - -Key considerations: - -- Define VyOS configuration commands in the `user-data` file. -- Avoid including network configuration data in the `user-data` file. -- If no network configuration data is provided, the DHCP client is enabled on - the first interface. This happens at the OS level and is not reflected in the - VyOS CLI. - -The following example shows how to disable the DHCP client on `eth0` to -address this behavior. - -In this example: - -- **Proxmox IP address**: `192.168.0.253/24`. -- **Storage**: The `local` volume is mounted at `/var/lib/vz` and contains - all content types, including snippets. - -The goal is to remove the default DHCP client from the first interface and -apply a custom configuration during the initial instance boot using -`cloud-init`. - -### Generate .qcow2 image - -First, generate a VyOS `.qcow2` image with `cloud-init` support from the -[vyos-vm-images] repository: - -1. Clone the `vyos-vm-images` repository and comment out the `download-iso` - role in `qemu.yml`. -2. Download your preferred VyOS `.iso` file and save it as `/tmp/vyos.iso`. -3. Generate the `.qcow2` image (using a 10G disk size for this example): - -```sh -sudo ansible-playbook qemu.yml -e disk_size=10 \ - -e iso_local=/tmp/vyos.iso -e grub_console=serial -e vyos_version=1.5.0 \ - -e cloud_init=true -e cloud_init_ds=NoCloud -``` - -This generates your new image at `/tmp/vyos-1.5.0-cloud-init-10G-qemu.qcow2`. - -4. Copy the resulting image to the Proxmox server: - -```sh -sudo scp /tmp/vyos-1.5.0-cloud-init-10G-qemu.qcow2 root@192.168.0.253:/tmp/ -``` - - -### Prepare cloud-init files - -Create the following files on your Proxmox server to proceed with this setup: - -- `user-data`: Contains VyOS configuration commands. -- `network-config`: Disables the DHCP client on the first interface. -- `meta-data`: An empty file (required by `cloud-init`). - -All files must be placed in the `/tmp/` directory. - -Follow these steps to create the required files: - -1. Navigate to the `/tmp/` directory: - - ```sh - cd /tmp/ - ``` - -2. Create the `user-data` file. Begin the file with `#cloud-config` and - include VyOS configuration commands. - - ```none - #cloud-config - vyos_config_commands: - - set system host-name 'vyos-BRAS' - - set service ntp server '1.pool.ntp.org' - - set service ntp server '2.pool.ntp.org' - - delete interfaces ethernet eth0 address 'dhcp' - - set interfaces ethernet eth0 address '198.51.100.2/30' - - set interfaces ethernet eth0 description 'WAN - ISP01' - - set interfaces ethernet eth1 address '192.168.25.1/24' - - set interfaces ethernet eth1 description 'Coming through VLAN 25' - - set interfaces ethernet eth2 address '192.168.26.1/24' - - set interfaces ethernet eth2 description 'Coming through VLAN 26' - - set protocols static route 0.0.0.0/0 next-hop '198.51.100.1' - ``` - -3. Create the `network-config` file. Include the following: - - ```none - version: 2 - ethernets: - eth0: - dhcp4: false - dhcp6: false - ``` - -4. Create the required empty `meta-data` file. - -### Create seed.iso - -Once you have created the necessary files, generate the `seed.iso` image and -mount it as a CD drive to the new VM. - -```sh -mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data \ -user-data network-config -``` - -:::{note} -Be careful while copying and pasting the above commands. Double quotes may need -to be corrected. -::: - -### Create the VM - -Note that the following settings apply to this particular example and may -require adjustment for other setups: - -- **VM ID**: `555`. -- **VM and .iso file storage**: The local volume (`directory` type, - mounted at `/var/lib/vz`). -- **VM resources**: Can be modified as needed. - -The `seed.iso` file was previously created in the `/tmp/` directory. Move -it to `/var/lib/vz/template/iso`: - -```sh -mv /tmp/seed.iso /var/lib/vz/template/iso/ -``` - -On the Proxmox server: - -```none -## Create VM, import disk and define boot order -qm create 555 --name vyos-1.5.0-cloudinit --memory 1024 --net0 virtio,bridge=vmbr0 -qm importdisk 555 vyos-1.5.0-cloud-init-10G-qemu.qcow2 local -qm set 555 --virtio0 local:555/vm-555-disk-0.raw -qm set 555 --boot order=virtio0 - -## Import seed.iso for cloud init -qm set 555 --ide2 media=cdrom,file=local:iso/seed.iso - -## Since this server has 1 nic, lets add network intefaces (vlan 25 and 26) -qm set 555 --net1 virtio,bridge=vmbr0,firewall=1,tag=25 -qm set 555 --net2 virtio,bridge=vmbr0,firewall=1,tag=26 -``` - - -### Power on and verify the VM - -Power on the VM using the CLI or GUI. After it boots, verify the configuration. - -### References - -- Cloud-init [network-config-docs]. -- Proxmox [Cloud-init-Support]. -[cloud-init-support]: -[cloud-init-write_files]: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files -[network-config-docs]: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html -[nocloud]: https://cloudinit.readthedocs.io/en/latest/reference/datasources/nocloud.html -[vyos-vm-images]: https://github.com/vyos/vyos-vm-images diff --git a/docs/automation/md-command-scripting.md b/docs/automation/md-command-scripting.md deleted file mode 100644 index 7e736152..00000000 --- a/docs/automation/md-command-scripting.md +++ /dev/null @@ -1,225 +0,0 @@ ---- -lastproofread: '2026-03-16' ---- - -(command-scripting)= - -# Command scripting - -VyOS supports executing configuration and operational commands non-interactively -from shell scripts. - -To include VyOS-specific functions and aliases, source the -`/opt/vyatta/etc/functions/script-template` file at the beginning of your -script. - -```none -#!/bin/vbash -source /opt/vyatta/etc/functions/script-template -exit -``` - - -## Script execute permissions - -Simply placing script files in `/config/scripts/` does not mean the system -can execute them. - -To make your scripts executable, grant them **execute permissions**. Use the -following command: - -```none -chmod +x /config/scripts/script-name.sh -``` - - -## Run configuration commands - -In scripts, present configuration commands as in a standard configuration -session. - -For example, to disable a BGP peer during a VRRP transition to the backup -state, use the following syntax: - -```none -#!/bin/vbash -source /opt/vyatta/etc/functions/script-template -configure -set protocols bgp system-as 65536 -set protocols bgp neighbor 192.168.2.1 shutdown -commit -exit -``` - - -## Run operational commands - -In scripts, **always** prefix operational commands with `run`. - -```none -#!/bin/vbash -source /opt/vyatta/etc/functions/script-template -run show interfaces -exit -``` - - -## Run commands remotely - -You can execute multiple **operational commands** on a remote VyOS system by -passing a script block over SSH. - -```none -ssh 192.0.2.1 'vbash -s' < -[salt]: https://docs.saltproject.io/en/latest/contents.html diff --git a/docs/automation/rst-cloud-init.rst b/docs/automation/rst-cloud-init.rst new file mode 100644 index 00000000..29f56d0d --- /dev/null +++ b/docs/automation/rst-cloud-init.rst @@ -0,0 +1,416 @@ +:lastproofread: 2026-04-13 + +.. _cloud-init: + +############### +VyOS cloud-init +############### + +VyOS instances in cloud and virtualized environments are initialized using the +industry-standard ``cloud-init``. Through ``cloud-init``, VyOS injects SSH +keys, configures network settings, and applies custom configurations during the +initial instance boot. + +********************* +Configuration sources +********************* + +VyOS ``cloud-init`` obtains configuration data from the following sources: + +* ``meta-data``: Instance-specific details provided by the cloud platform or + hypervisor. In some cloud environments, this data is available via an HTTP + endpoint at ``http://169.254.169.254``. +* ``network configuration``: Network settings such as IP addresses, routes, and + DNS (only available on certain cloud and virtualization platforms). +* ``user-data``: User-supplied CLI configuration commands. + +********* +User-data +********* + +Major cloud providers support injecting ``user-data`` as plain text or base64 +encoding text during initial instance boot. As ``user-data`` has a strict size +limit of ~16384 bytes, long configuration command lists can be compressed using +``gzip``. + +The recommended method for configuring VyOS instances via ``user-data`` is to +use the ``cloud-config`` syntax described below. + +******************** +Cloud-config modules +******************** + +By default, VyOS enables only two ``cloud-config`` modules: + +* ``write_files``: Inserts user-provided files such as encryption keys, + certificates, or ``config.boot`` into the filesystem during the initial + instance boot. See `Cloud-init-write_files`_ for file syntax and file format + requirements. +* ``vyos_userdata``: Executes user-provided CLI configuration commands during + the initial instance boot. + +The files to insert and the CLI commands to execute must be provided in a +``cloud-config`` YAML file. + +************************ +Cloud-config file format +************************ + +``cloud-config`` files are written in YAML and must begin with the +``#cloud-config`` line. Only ``vyos_config_commands`` and ``write_files`` are +supported as top-level keys. The use of these keys is described in the +following two sections. + +************************ +Vyos_config_commands key +************************ + +Use the ``vyos_config_commands`` key to define configuration commands for +initializing your VyOS instance. Commands must follow the set-style syntax +and can include both ``set`` and ``delete`` statements. + +Syntax requirements: + +* Place one command per line. +* Enclose values in single quotes. +* Avoid single quotes within commands or values. + +Applying commands from ``cloud-config`` overrides both settings configured via +``meta-data`` and default VyOS settings. After commands are applied, +``cloud-init`` automatically performs ``commit`` and ``save``. + +The following is an example of a ``cloud-config`` file: + +.. code-block:: yaml + + #cloud-config + vyos_config_commands: + - set system host-name 'vyos-prod-ashburn' + - set service ntp server 1.pool.ntp.org + - set service ntp server 2.pool.ntp.org + - delete interfaces ethernet eth1 address 'dhcp' + - set interfaces ethernet eth1 address '192.0.2.247/24' + - set protocols static route 198.51.100.0/24 next-hop '192.0.2.1' + +--------------------------- +Instance defaults/fallbacks +--------------------------- + +If no external configuration data is provided, VyOS applies the following +defaults: + +* **SSH:** port 22. +* **Credentials:** ``vyos``/``vyos``. +* **Networking:** DHCP is enabled on the first Ethernet interface. + +All defaults can be overridden via ``user-data`` configurations. + + +*************** +Write_files key +*************** + +VyOS allows you to run custom scripts during the initial instance boot to +execute operational, configuration, and standard Linux commands. + +Use the ``write_files`` key to insert these scripts into the +``/opt/vyatta/etc/config/scripts/`` directory. + +Depending on when your commands need to run, use one of the following paths: + +* ``/opt/vyatta/etc/config/scripts/vyos-preconfig-bootup.script``: Commands + defined here are executed before the system configuration is applied. +* ``/opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script``: Commands + defined here are executed after the system configuration is applied. + +In both cases, commands are executed with ``root`` privileges. + +.. note:: + + Use the ``/opt/vyatta/etc/config/`` path instead of ``/config/scripts/`` as + referenced in the :ref:`command-scripting` section. The ``/config/scripts/`` + directory is not mounted when the ``write_files`` module runs. + +The following example shows how to use ``write_files`` to execute an +operational command **after** the initial configuration is complete: + +.. code-block:: yaml + + #cloud-config + write_files: + - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script + owner: root:vyattacfg + permissions: '0775' + content: | + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + filename=/tmp/bgp_status_`date +"%Y_%m_%d_%I_%M_%p"`.log + run show ip bgp summary >> $filename + +You can combine standard Linux commands to fetch data and VyOS configuration +commands (like ``set`` and ``commit``) in the same script. + +The following example sets the ``hostname`` based on the instance identifier +obtained from the EC2 Instance Metadata Service (IMDS). + +.. code-block:: yaml + + + #cloud-config + write_files: + - path: /opt/vyatta/etc/config/scripts/vyos-postconfig-bootup.script + owner: root:vyattacfg + permissions: '0775' + content: | + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + hostname=`curl -s http://169.254.169.254/latest/meta-data/instance-id` + configure + set system host-name $hostname + commit + exit + +******* +NoCloud +******* + +Injecting configuration data is not limited to cloud platforms. The NoCloud +data source allows you to inject ``user-data`` and ``meta-data`` on +virtualization platforms such as VMware, Hyper-V, and KVM. + +The simplest way to use the NoCloud data source is to create a ``seed.iso`` +file and attach it to the virtual machine as a CD drive. The volume must be +formatted as a VFAT or ISO 9660 file system with the label ``cidata`` or +``CIDATA``. + +Create text files named ``user-data`` and ``meta-data``. On Linux-based +systems, use the ``mkisofs`` utility to create the ``seed.iso`` file. The +following syntax adds these files to the ISO 9660 file system: + +.. code-block:: none + + mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data user-data + +Once generated, attach the ``seed.iso`` file to your virtual machine. The +following example shows how to attach the file as a CD drive using KVM: + +.. code-block:: none + + $ virt-install -n vyos_r1 \ + --ram 4096 \ + --vcpus 2 \ + --cdrom seed.iso \ + --os-type linux \ + --os-variant debian10 \ + --network network=default \ + --graphics vnc \ + --hvm \ + --virt-type kvm \ + --disk path=/var/lib/libvirt/images/vyos_kvm.qcow2,bus=virtio \ + --import \ + --noautoconsole + +For more information on the NoCloud data source, visit the `NoCloud`_ page in +the ``cloud-init`` documentation. + +*************** +Troubleshooting +*************** + +If your configuration does not apply as expected, follow these troubleshooting +steps: + +1. **Validate your YAML**: Ensure your ``cloud-config`` file follows proper + YAML syntax. Online resources such as `YAML Lint `_ + provide simple validation tools. +2. **Check the logs**: ``cloud-init`` writes logs to ``/var/log/cloud-init.log``. + Filter for VyOS-specific entries using: + + +.. code-block:: none + + sudo grep vyos /var/log/cloud-init.log + +********************* +Cloud-init on Proxmox +********************* + +Before you begin, review the ``cloud-init`` `network-config-docs`_ to +understand how to import user and network configuration data. + +Key considerations: + +* Define VyOS configuration commands in the ``user-data`` file. +* Avoid including network configuration data in the ``user-data`` file. +* If no network configuration data is provided, the DHCP client is enabled on + the first interface. This happens at the OS level and is not reflected in the + VyOS CLI. + +The following example shows how to disable the DHCP client on ``eth0`` to +address this behavior. + +In this example: + +* **Proxmox IP address**: ``192.168.0.253/24``. +* **Storage**: The ``local`` volume is mounted at ``/var/lib/vz`` and contains + all content types, including snippets. + +The goal is to remove the default DHCP client from the first interface and +apply a custom configuration during the initial instance boot using +``cloud-init``. + +--------------------- +Generate .qcow2 image +--------------------- + +First, generate a VyOS ``.qcow2`` image with ``cloud-init`` support from the +`vyos-vm-images`_ repository: + +#. Clone the ``vyos-vm-images`` repository and comment out the ``download-iso`` + role in ``qemu.yml``. +#. Download your preferred VyOS ``.iso`` file and save it as ``/tmp/vyos.iso``. +#. Generate the ``.qcow2`` image (using a 10G disk size for this example): + +.. code-block:: sh + + sudo ansible-playbook qemu.yml -e disk_size=10 \ + -e iso_local=/tmp/vyos.iso -e grub_console=serial -e vyos_version=1.5.0 \ + -e cloud_init=true -e cloud_init_ds=NoCloud + +This generates your new image at ``/tmp/vyos-1.5.0-cloud-init-10G-qemu.qcow2``. + +#. Copy the resulting image to the Proxmox server: + +.. code-block:: sh + + sudo scp /tmp/vyos-1.5.0-cloud-init-10G-qemu.qcow2 root@192.168.0.253:/tmp/ + + +------------------------ +Prepare cloud-init files +------------------------ + +Create the following files on your Proxmox server to proceed with this setup: + +* ``user-data``: Contains VyOS configuration commands. +* ``network-config``: Disables the DHCP client on the first interface. +* ``meta-data``: An empty file (required by ``cloud-init``). + +All files must be placed in the ``/tmp/`` directory. + +Follow these steps to create the required files: + +1. Navigate to the ``/tmp/`` directory: + + .. code-block:: sh + + cd /tmp/ + +2. Create the ``user-data`` file. Begin the file with ``#cloud-config`` and + include VyOS configuration commands. + + .. code-block:: none + + #cloud-config + vyos_config_commands: + - set system host-name 'vyos-BRAS' + - set service ntp server '1.pool.ntp.org' + - set service ntp server '2.pool.ntp.org' + - delete interfaces ethernet eth0 address 'dhcp' + - set interfaces ethernet eth0 address '198.51.100.2/30' + - set interfaces ethernet eth0 description 'WAN - ISP01' + - set interfaces ethernet eth1 address '192.168.25.1/24' + - set interfaces ethernet eth1 description 'Coming through VLAN 25' + - set interfaces ethernet eth2 address '192.168.26.1/24' + - set interfaces ethernet eth2 description 'Coming through VLAN 26' + - set protocols static route 0.0.0.0/0 next-hop '198.51.100.1' + +3. Create the ``network-config`` file. Include the following: + + .. code-block:: none + + version: 2 + ethernets: + eth0: + dhcp4: false + dhcp6: false + +4. Create the required empty ``meta-data`` file. + + +--------------- +Create seed.iso +--------------- + +Once you have created the necessary files, generate the ``seed.iso`` image and +mount it as a CD drive to the new VM. + +.. code-block:: sh + + mkisofs -joliet -rock -volid "cidata" -output seed.iso meta-data \ + user-data network-config + +.. note:: + + Be careful while copying and pasting the above commands. Double quotes may need + to be corrected. + +------------- +Create the VM +------------- + +Note that the following settings apply to this particular example and may +require adjustment for other setups: + +* **VM ID**: ``555``. +* **VM and .iso file storage**: The local volume (``directory`` type, + mounted at ``/var/lib/vz``). +* **VM resources**: Can be modified as needed. + +The ``seed.iso`` file was previously created in the ``/tmp/`` directory. Move +it to ``/var/lib/vz/template/iso``: + +.. code-block:: sh + + mv /tmp/seed.iso /var/lib/vz/template/iso/ + +On the Proxmox server: + +.. code-block:: none + + ## Create VM, import disk and define boot order + qm create 555 --name vyos-1.5.0-cloudinit --memory 1024 --net0 virtio,bridge=vmbr0 + qm importdisk 555 vyos-1.5.0-cloud-init-10G-qemu.qcow2 local + qm set 555 --virtio0 local:555/vm-555-disk-0.raw + qm set 555 --boot order=virtio0 + + ## Import seed.iso for cloud init + qm set 555 --ide2 media=cdrom,file=local:iso/seed.iso + + ## Since this server has 1 nic, lets add network intefaces (vlan 25 and 26) + qm set 555 --net1 virtio,bridge=vmbr0,firewall=1,tag=25 + qm set 555 --net2 virtio,bridge=vmbr0,firewall=1,tag=26 + +-------------------------- +Power on and verify the VM +-------------------------- + +Power on the VM using the CLI or GUI. After it boots, verify the configuration. + +---------- +References +---------- + +* Cloud-init `network-config-docs`_. + +* Proxmox `Cloud-init-Support`_. + +.. stop_vyoslinter + +.. _network-config-docs: https://cloudinit.readthedocs.io/en/latest/topics/network-config.html +.. _vyos-vm-images: https://github.com/vyos/vyos-vm-images +.. _cloud-init-docs: https://docs.vyos.io/en/equuleus/automation/cloud-init.html?highlight=cloud-init#vyos-cloud-init +.. _Cloud-init-Support: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#qm_cloud_init +.. _Cloud-init-write_files: https://cloudinit.readthedocs.io/en/latest/topics/examples.html#writing-out-arbitrary-files +.. _nocloud: https://cloudinit.readthedocs.io/en/latest/reference/datasources/nocloud.html +.. start_vyoslinter diff --git a/docs/automation/rst-command-scripting.rst b/docs/automation/rst-command-scripting.rst new file mode 100644 index 00000000..91086b42 --- /dev/null +++ b/docs/automation/rst-command-scripting.rst @@ -0,0 +1,224 @@ +:lastproofread: 2026-03-16 + +.. _command-scripting: + +Command scripting +================= + +VyOS supports executing configuration and operational commands non-interactively +from shell scripts. + +To include VyOS-specific functions and aliases, source the +``/opt/vyatta/etc/functions/script-template`` file at the beginning of your +script. + +.. code-block:: none + + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + exit + +Script execute permissions +-------------------------- + +Simply placing script files in ``/config/scripts/`` does not mean the system +can execute them. + +To make your scripts executable, grant them **execute permissions**. Use the +following command: + +.. code-block:: none + + chmod +x /config/scripts/script-name.sh + +Run configuration commands +-------------------------- + +In scripts, present configuration commands as in a standard configuration +session. + +For example, to disable a BGP peer during a VRRP transition to the backup +state, use the following syntax: + +.. code-block:: none + + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + configure + set protocols bgp system-as 65536 + set protocols bgp neighbor 192.168.2.1 shutdown + commit + exit + +Run operational commands +------------------------ + +In scripts, **always** prefix operational commands with ``run``. + +.. code-block:: none + + #!/bin/vbash + source /opt/vyatta/etc/functions/script-template + run show interfaces + exit + +Run commands remotely +--------------------- + +You can execute multiple **operational commands** on a remote VyOS system by +passing a script block over SSH. + +.. code-block:: none + + ssh 192.0.2.1 'vbash -s' <`_: Hosts the source + code. +- `Documentation `_: + Provides the complete API reference, including available types, functions, and + methods. + + +Installation +------------ + +To install Go-VyOS, run: + +.. code-block:: bash + + go install "github.com/ganawaj/go-vyos/vyos" + +Getting started +--------------- + +Import and disable TLS verification +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. stop_vyoslinter + +.. code-block:: none + + import "github.com/ganawaj/go-vyos/vyos" + client := vyos.NewClient(nil).WithToken("AUTH_KEY").WithURL("https://192.168.0.1").Insecure() + +.. start_vyoslinter + +Initialize a VyDevice object +^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + import ( + "github.com/ganawaj/go-vyos/vyos" + "os" + ) + + hostname := os.Getenv('VYDEVICE_HOSTNAME') + port := os.Getenv('VYDEVICE_PORT') + url := fmt.Sprintf("https://%s:%s", hostname, port) + + apikey := os.Getenv('VYDEVICE_APIKEY') + verify_ssl := os.Getenv('VYDEVICE_VERIFY_SSL') + + client := vyos.NewClient(nil).WithToken(apikey).WithURL(url) + + if verify_ssl == "false" { + client = client.Insecure() + } + +Use Go-VyOS +----------- + +Configure, then set +^^^^^^^^^^^^^^^^^^^ + +.. stop_vyoslinter + +.. code-block:: none + + out, resp, err := c.Conf.Set(ctx, "interfaces ethernet eth0 address 192.168.1.1/24") + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + +.. start_vyoslinter + +Show a single object value +^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + out, resp, err := c.Show.Do(ctx, "interfaces dummy dum1 address") + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + fmt.Printf("Data: %v\n", out.Data) + +Configure, then show object +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", nil) + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + fmt.Printf("Data: %v\n", out.Data) + +Configure, then show multivalue object +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + options := RetrieveOptions{ + Multivalue: true, + } + + out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", options) + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + + +Configure, then delete object +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + out, resp, err := c.Conf.Delete(ctx, "interfaces dummy dum1") + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + +Configure, then save +^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + out, resp, err := c.Conf.Save(ctx, "") + + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + +Configure, then save file +^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + out, resp, err := c.Conf.Save(ctx, "/config/test300.config") + + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + +Show object +^^^^^^^^^^^ + +.. code-block:: none + + out, resp, err := c.Show.Do(ctx, "system image") + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + fmt.Printf("Data: %v\n", out.Data) + +Generate object +^^^^^^^^^^^^^^^ + +.. code-block:: none + + out, resp, err := c.Generate.Do(ctx, "pki wireguard key-pair") + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + fmt.Printf("Data: %v\n", out.Data) + +Reset object +^^^^^^^^^^^^ + +.. code-block:: none + + out, resp, err := c.Reset.Do(ctx, "ip bgp 192.0.2.11") + if err != nil { + panic("Error: %v", err) + } + + fmt.Println(out.Success) + fmt.Printf("Data: %v\n", out.Data) + +Configure, then load file +^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + out, resp, err := c.ConfigFile.Load(ctx, "/config/test300.config") + +.. _go-vyos: https://github.com/ganawaj/go-vyos \ No newline at end of file diff --git a/docs/automation/rst-vyos-napalm.rst b/docs/automation/rst-vyos-napalm.rst new file mode 100644 index 00000000..f2f27124 --- /dev/null +++ b/docs/automation/rst-vyos-napalm.rst @@ -0,0 +1,155 @@ +:lastproofread: 2026-04-13 + +.. _vyos-napalm: + +################## +NAPALM VyOS driver +################## + +VyOS can be configured using the `NAPALM VyOS driver`_, which enables you to +retrieve device data and apply configurations via SSH. + +.. note:: + + The ``napalm-vyos`` module is currently in testing. + +To use the NAPALM VyOS driver, install the following packages: + +.. code-block:: none + + apt install python3-pip + pip3 install napalm + pip3 install napalm-vyos + + +Retrieve device data +-------------------- + +The following script connects to a VyOS device, retrieves device facts and +the ARP table, and prints the output in JSON format. + +.. code-block:: none + + #!/usr/bin/env python3 + + import json + from napalm import get_network_driver + + driver = get_network_driver('vyos') + + vyos_router = driver( + hostname="192.0.2.1", + username="vyos", + password="vyospass", + optional_args={"port": 22}, + ) + + vyos_router.open() + output = vyos_router.get_facts() + print(json.dumps(output, indent=4)) + + output = vyos_router.get_arp_table() + print(json.dumps(output, indent=4)) + + vyos_router.close() + +Output: + +.. code-block:: none + + $ ./vyos-napalm.py + { + "uptime": 7185, + "vendor": "VyOS", + "os_version": "1.3.0-rc5", + "serial_number": "", + "model": "Standard PC (Q35 + ICH9, 2009)", + "hostname": "r4-1.3", + "fqdn": "vyos.local", + "interface_list": [ + "eth0", + "eth1", + "eth2", + "lo", + "vtun10" + ] + } + [ + { + "interface": "eth1", + "mac": "52:54:00:b2:38:2c", + "ip": "192.0.2.2", + "age": 0.0 + }, + { + "interface": "eth0", + "mac": "52:54:00:a2:b9:5b", + "ip": "203.0.113.11", + "age": 0.0 + } + ] + +Apply a configuration +--------------------- + +To apply a configuration using NAPALM VyOS driver, you will need a file with +configuration commands (``commands.conf``) and a script that executes and +commits them (``vyos-napalm.py``). + +* ``commands.conf`` + +.. code-block:: none + + set service ssh disable-host-validation + set service ssh port '2222' + set system name-server '192.0.2.8' + set system name-server '203.0.113.8' + set interfaces ethernet eth1 description 'FOO' + +* ``vyos-napalm.py`` + +.. code-block:: none + + #!/usr/bin/env python3 + + from napalm import get_network_driver + + driver = get_network_driver('vyos') + + vyos_router = driver( + hostname="192.0.2.1", + username="vyos", + password="vyospass", + optional_args={"port": 22}, + ) + + vyos_router.open() + vyos_router.load_merge_candidate(filename='commands.conf') + diffs = vyos_router.compare_config() + + if bool(diffs) == True: + print(diffs) + vyos_router.commit_config() + else: + print('No configuration changes to commit') + vyos_router.discard_config() + + vyos_router.close() + +Output: + +.. code-block:: none + + $./vyos-napalm.py + [edit interfaces ethernet eth1] + +description FOO + [edit service ssh] + +disable-host-validation + +port 2222 + [edit system] + +name-server 192.0.2.8 + +name-server 203.0.113.8 + [edit] + +.. _napalm: https://napalm.readthedocs.io/en/latest/base.html +.. _NAPALM VyOS driver: https://github.com/napalm-automation-community/napalm-vyos \ No newline at end of file diff --git a/docs/automation/rst-vyos-netmiko.rst b/docs/automation/rst-vyos-netmiko.rst new file mode 100644 index 00000000..b94b0129 --- /dev/null +++ b/docs/automation/rst-vyos-netmiko.rst @@ -0,0 +1,76 @@ +:lastproofread: 2026-04-13 + +.. _vyos-netmiko: + +####### +Netmiko +####### + +VyOS can be configured using Netmiko_. To use Netmiko, install the +``python3-netmiko`` module. + +Example +------- +The following script connects to a VyOS device, applies configuration changes, +commits them, and runs an operational mode command to verify the updated +configuration. + +.. code-block:: none + + #!/usr/bin/env python3 + + from netmiko import ConnectHandler + + vyos_router = { + "device_type": "vyos", + "host": "192.0.2.1", + "username": "vyos", + "password": "vyospass", + "port": 22, + } + + net_connect = ConnectHandler(**vyos_router) + + config_commands = [ + 'set interfaces ethernet eth0 description WAN', + 'set interfaces ethernet eth1 description LAN', + ] + + # set configuration + output = net_connect.send_config_set(config_commands, exit_config_mode=False) + print(output) + + # commit configuration + output = net_connect.commit() + print(output) + + # operational mode commands + output = net_connect.send_command("run show interfaces") + print(output) + +Output + +.. code-block:: none + + $ ./vyos-netmiko.py + configure + set interfaces ethernet eth0 description WAN + [edit] + vyos@r4-1.5# set interfaces ethernet eth1 description LAN + [edit] + vyos@r4-1.5# + commit + [edit] + vyos@r4-1.5# + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 203.0.113.1/24 u/u WAN + eth1 192.0.2.1/30 u/u LAN + eth2 - u/u + lo 127.0.0.1/8 u/u + ::1/128 + vtun10 10.10.0.1/24 u/u + [edit] + +.. _netmiko: https://github.com/ktbyers/netmiko diff --git a/docs/automation/rst-vyos-pyvyos.rst b/docs/automation/rst-vyos-pyvyos.rst new file mode 100644 index 00000000..cbd315e5 --- /dev/null +++ b/docs/automation/rst-vyos-pyvyos.rst @@ -0,0 +1,156 @@ +:lastproofread: 2026-04-14 + +.. _vyos-pyvyos: + +###### +PyVyOS +###### + +PyVyOS is a Python library for configuring and managing VyOS devices through +their API. + +**Key resources:** + +- `Documentation `_: Provides + installation, configuration, and usage instructions. +- `GitHub repository `_: Hosts the + source code. +- `PyPI `_: Hosts distribution packages for + installation via the Python package installer (``pip``). + + +Installation +------------ + +To install PyVyOS via ``pip``, run: + +.. code-block:: bash + + pip install pyvyos + +Getting started +--------------- + +Import and disable warnings for verify=false +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + import urllib3 + urllib3.disable_warnings() + +Use API response class +^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + @dataclass + class ApiResponse: + status: int + request: dict + result: dict + error: str + +Initialize a VyDevice object +^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + from dotenv import load_dotenv + load_dotenv() + + hostname = os.getenv('VYDEVICE_HOSTNAME') + apikey = os.getenv('VYDEVICE_APIKEY') + port = os.getenv('VYDEVICE_PORT') + protocol = os.getenv('VYDEVICE_PROTOCOL') + verify_ssl = os.getenv('VYDEVICE_VERIFY_SSL') + + verify = verify_ssl.lower() == "true" if verify_ssl else True + + device = VyDevice(hostname=hostname, apikey=apikey, port=port, protocol=protocol, verify=verify) + +Use PyVyOS +---------- + +Configure, then set +^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + response = device.configure_set(path=["interfaces", "ethernet", "eth0", "address", "192.168.1.1/24"]) + if not response.error: + print(response.result) + +Configure, then show a single object value +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + response = device.retrieve_return_values(path=["interfaces", "dummy", "dum1", "address"]) + print(response.result) + +Configure, then show object +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + response = device.retrieve_show_config(path=[]) + if not response.error: + print(response.result) + +Configure, then delete object +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + response = device.configure_delete(path=["interfaces", "dummy", "dum1"]) + +Configure, then save +^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + response = device.config_file_save() + +Configure, then save file +^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + response = device.config_file_save(file="/config/test300.config") + +Show object +^^^^^^^^^^^ + +.. code-block:: none + + response = device.show(path=["system", "image"]) + print(response.result) + +Generate object +^^^^^^^^^^^^^^^ + +.. code-block:: none + + randstring = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(20)) + keyrand = f'/tmp/key_{randstring}' + response = device.generate(path=["ssh", "client-key", keyrand]) + +Reset object +^^^^^^^^^^^^ + +.. code-block:: none + + response = device.reset(path=["conntrack-sync", "internal-cache"]) + if not response.error: + print(response.result) + +Configure, then load file +^^^^^^^^^^^^^^^^^^^^^^^^^ + +.. code-block:: none + + response = device.config_file_load(file="/config/test300.config") + + +.. _pyvyos: https://github.com/robertoberto/pyvyos diff --git a/docs/automation/rst-vyos-salt.rst b/docs/automation/rst-vyos-salt.rst new file mode 100644 index 00000000..3a5b17d7 --- /dev/null +++ b/docs/automation/rst-vyos-salt.rst @@ -0,0 +1,232 @@ +:lastproofread: 2023-01-16 + +.. _vyos-salt: + +.. include:: /_include/need_improvement.txt + +#### +Salt +#### + +VyOS supports op-mode and configuration via salt_. + +Without proxy it requires VyOS minion configuration +and supports op-mode data: + +.. code-block:: none + + set service salt-minion id 'r14' + set service salt-minion master '192.0.2.250' + +Check salt-keys on the salt master + +.. code-block:: none + + / # salt-key --list-all + Accepted Keys: + r11 + Denied Keys: + Unaccepted Keys: + r14 + Rejected Keys: + +Accept minion key + +.. code-block:: none + + / # salt-key --accept r14 + The following keys are going to be accepted: + Unaccepted Keys: + r14 + Proceed? [n/Y] y + Key for minion r14 accepted. + + + +Check that salt master can communicate with minions + +.. code-block:: none + + / # salt '*' test.ping + r14: + True + r11: + True + +At this step we can get some op-mode information from VyOS nodes: + +.. code-block:: none + + / # salt '*' network.interface eth0 + r11: + |_ + ---------- + address: + 192.0.2.11 + broadcast: + 192.0.2.255 + label: + eth0 + netmask: + 255.255.255.0 + r14: + |_ + ---------- + address: + 192.0.2.14 + broadcast: + 192.0.2.255 + label: + eth0 + netmask: + 255.255.255.0 + + + / # salt r14 network.arp + r14: + ---------- + aa:bb:cc:dd:f3:db: + 192.0.2.1 + aa:bb:cc:dd:2e:80: + 203.0.113.1 + + + + +Netmiko-proxy +------------- + +It is possible to configure VyOS via netmiko_ proxy module. +It requires a minion with installed packet ``python3-netmiko`` module +who has a connection to VyOS nodes. Salt-minion have to communicate +with salt master + +Configuration +^^^^^^^^^^^^^ + +Salt master configuration: + +.. code-block:: none + + / # cat /etc/salt/master + file_roots: + base: + - /srv/salt/states + + pillar_roots: + base: + - /srv/salt/pillars + +Structure of /srv/salt: + +.. code-block:: none + + / # tree /srv/salt/ + /srv/salt/ + |___ pillars + | |__ r11-proxy.sls + | |__ top.sls + |___ states + |__ commands.txt + +top.sls + +.. code-block:: none + + / # cat /srv/salt/pillars/top.sls + base: + r11-proxy: + - r11-proxy + + +r11-proxy.sls Includes parameters for connecting to salt-proxy minion + +.. code-block:: none + + / # cat /srv/salt/pillars/r11-proxy.sls + proxy: + proxytype: netmiko # how to connect to proxy minion, change it + device_type: vyos # + host: 192.0.2.250 + username: user + password: secret_passwd + +commands.txt + +.. code-block:: none + + / # cat /srv/salt/states/commands.txt + set interfaces ethernet eth0 description 'WAN' + set interfaces ethernet eth1 description 'LAN' + +Check that proxy minion is alive: + +.. code-block:: none + + / # salt r11-proxy test.ping + r11-proxy: + True + / # + +Examples +^^^^^^^^ + +Example of op-mode: + +.. stop_vyoslinter + +.. code-block:: none + + / # salt r11-proxy netmiko.send_command 'show interfaces ethernet eth0 brief' host=192.0.2.14 device_type=vyos username=vyos password=vyos + r11-proxy: + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 192.0.2.14/24 u/u Upstream + / # + +.. start_vyoslinter + +Example of configuration: + +.. stop_vyoslinter + +.. code-block:: none + + / # salt r11-proxy netmiko.send_config config_commands=['set interfaces ethernet eth0 description Link_to_WAN'] commit=True host=192.0.2.14 device_type=vyos username=vyos password=vyos + r11-proxy: + configure + set interfaces ethernet eth0 description Link_to_WAN + [edit] + vyos@r14# commit + [edit] + vyos@r14# + / # + +.. start_vyoslinter + +Example of configuration commands from the file +"/srv/salt/states/commands.txt" + +.. stop_vyoslinter + +.. code-block:: none + + / # salt r11-proxy netmiko.send_config config_file=salt://commands.txt commit=True host=192.0.2.11 device_type=vyos username=vyos password=vyos + r11-proxy: + configure + set interfaces ethernet eth0 description 'WAN' + [edit] + vyos@r1# set interfaces ethernet eth1 description 'LAN' + [edit] + vyos@r1# commit + [edit] + vyos@r1# + / # + +.. start_vyoslinter + +.. _salt: https://docs.saltproject.io/en/latest/contents.html +.. stop_vyoslinter +.. _netmiko: https://docs.saltproject.io/en/latest/ref/modules/all/salt.modules.netmiko_mod.html#module-salt.modules.netmiko_mod +.. start_vyoslinter \ No newline at end of file diff --git a/docs/automation/terraform/index.md b/docs/automation/terraform/index.md new file mode 100644 index 00000000..dc787db1 --- /dev/null +++ b/docs/automation/terraform/index.md @@ -0,0 +1,29 @@ +--- +lastproofread: '2026-03-23' +--- + +# VyOS Terraform + +VyOS supports development infrastructure via Terraform and provisioning +via Ansible. +Terraform allows you to automate the deployment of instances on a number of +cloud and virtual platforms. This section shows how to deploy VyOS on +multiple platforms: AWS, Microsoft Azure, Google Cloud Platform (GCP), +and VMware vSphere. +For more information, see the +official documentation for [Terraform] and [Ansible]. + +```{toctree} +:caption: Guides +:maxdepth: 1 + +terraformvyos +terraformAWS +terraformAZ +terraformGoogle +terraformvSphere +``` + +[ansible]: https://docs.ansible.com +[install]: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli +[terraform]: https://developer.hashicorp.com/terraform/intro diff --git a/docs/automation/terraform/index.rst b/docs/automation/terraform/index.rst deleted file mode 100644 index f81820d2..00000000 --- a/docs/automation/terraform/index.rst +++ /dev/null @@ -1,33 +0,0 @@ -:lastproofread: 2026-03-23 - -############## -VyOS Terraform -############## - - -VyOS supports development infrastructure via Terraform and provisioning -via Ansible. -Terraform allows you to automate the deployment of instances on a number of -cloud and virtual platforms. This section shows how to deploy VyOS on -multiple platforms: AWS, Microsoft Azure, Google Cloud Platform (GCP), -and VMware vSphere. -For more information, see the -official documentation for Terraform_ and Ansible_. - - - -.. toctree:: - :maxdepth: 1 - :caption: Guides - - terraformvyos - terraformAWS - terraformAZ - terraformGoogle - terraformvSphere - -.. stop_vyoslinter -.. _Terraform: https://developer.hashicorp.com/terraform/intro -.. _Ansible: https://docs.ansible.com -.. _install: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli -.. start_vyoslinter \ No newline at end of file diff --git a/docs/automation/terraform/md-index.md b/docs/automation/terraform/md-index.md deleted file mode 100644 index dc787db1..00000000 --- a/docs/automation/terraform/md-index.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -lastproofread: '2026-03-23' ---- - -# VyOS Terraform - -VyOS supports development infrastructure via Terraform and provisioning -via Ansible. -Terraform allows you to automate the deployment of instances on a number of -cloud and virtual platforms. This section shows how to deploy VyOS on -multiple platforms: AWS, Microsoft Azure, Google Cloud Platform (GCP), -and VMware vSphere. -For more information, see the -official documentation for [Terraform] and [Ansible]. - -```{toctree} -:caption: Guides -:maxdepth: 1 - -terraformvyos -terraformAWS -terraformAZ -terraformGoogle -terraformvSphere -``` - -[ansible]: https://docs.ansible.com -[install]: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli -[terraform]: https://developer.hashicorp.com/terraform/intro diff --git a/docs/automation/terraform/md-terraformAWS.md b/docs/automation/terraform/md-terraformAWS.md deleted file mode 100644 index 488e7926..00000000 --- a/docs/automation/terraform/md-terraformAWS.md +++ /dev/null @@ -1,548 +0,0 @@ ---- -lastproofread: '2026-03-16' ---- - -(terraformaws)= - -# Deploy VyOS on AWS with Terraform and Ansible - -You can use Terraform to quickly deploy VyOS-based infrastructure -on AWS and remove infrastructure when it's no longer needed. -Additionally, you can use Ansible for provisioning. - -```{eval-rst} -.. image:: /_static/images/aws.webp - :width: 50% - :align: center - :alt: Network Topology Diagram -``` - -On this page you'll learn how to: -- Create the necessary files for Terraform and Ansible. -- Use Terraform to create a single instance on AWS and use Ansible for - provisioning. - -## Prepare to deploy VyOS with Terraform on AWS - -To create a single instance and install your configuration using -Terraform, Ansible, and AWS, follow these steps: - -### AWS - -1. Create an account with AWS and get your `access_key` and `secret_key`. -2. Create a key [pair] and download your `.pem` key. - -```{eval-rst} -.. image:: /_static/images/keypairs.webp - :width: 50% - :align: center - :alt: Network Topology Diagram -``` - -3. Create a security [group] for the new VyOS instance and open all traffic. - -```{eval-rst} -.. image:: /_static/images/sg.webp - :width: 50% - :align: center - :alt: Network Topology Diagram -``` - -```{eval-rst} -.. image:: /_static/images/traffic.webp - :width: 50% - :align: center - :alt: Network Topology Diagram -``` - - -### Terraform - -```{eval-rst} -1. Create an UNIX or Windows instance. - -2. Download and install - `Terraform `__. - -3. Create a folder, for example ``/root/awsterraform``: - - .. code-block:: none - - mkdir /root/awsterraform - -.. stop_vyoslinter - -4. Copy all files into your Terraform project - (``vyos.tf``, ``var.tf``, ``terraform.tfvars``, ``version.tf``). - See `Structure of files in Terraform for AWS <#structure-of-files-in-terraform-for-aws>`__ for more details. - -.. start_vyoslinter - -5. Run the following commands: - -.. code-block:: none - - cd / - terraform init -``` - -### Ansible - -```{eval-rst} -1. Create a UNIX instance whenever you need. - -2. Download and install Ansible - -3. Create a folder, for example ``/root/aws/``. - -.. stop_vyoslinter - -4. Copy all files into your Ansible project - (``ansible.cfg``, ``instance.yml``, - ``mykey.pem``, and ``all``). - See `Structure of files in Ansible for AWS <#structure-of-files-in-ansible-for-aws>`__ for more details. - You can obtain ``mykey.pem`` by creating a key `pair `__ in AWS and - downloading your ``.pem`` key. -``` - -### Deploy with Terraform - -Run the following commands on your Terraform instance: - -```none -cd / -terraform plan -terraform apply -yes -``` - -## Create an AWS instance and check its configuration - -```none -root@localhost:~/awsterraform# terraform apply - -Terraform used the selected providers to generate the following execution plan. -Resource actions are indicated with the following symbols: - + create - -Terraform will perform the following actions: - - # aws_instance.myVyOSec2 will be created - + resource "aws_instance" "myVyOSec2" { - + ami = "ami-************62c2d" - + arn = (known after apply) - + associate_public_ip_address = (known after apply) - + availability_zone = (known after apply) - + cpu_core_count = (known after apply) - + cpu_threads_per_core = (known after apply) - + disable_api_stop = (known after apply) - + disable_api_termination = (known after apply) - + ebs_optimized = (known after apply) - + get_password_data = false - + host_id = (known after apply) - + host_resource_group_arn = (known after apply) - + iam_instance_profile = (known after apply) - + id = (known after apply) - + instance_initiated_shutdown_behavior = (known after apply) - + instance_lifecycle = (known after apply) - + instance_state = (known after apply) - + instance_type = "t2.micro" - + ipv6_address_count = (known after apply) - + ipv6_addresses = (known after apply) - + key_name = "awsterraform" - + monitoring = (known after apply) - + outpost_arn = (known after apply) - + password_data = (known after apply) - + placement_group = (known after apply) - + placement_partition_number = (known after apply) - + primary_network_interface_id = (known after apply) - + private_dns = (known after apply) - + private_ip = (known after apply) - + public_dns = (known after apply) - + public_ip = (known after apply) - + secondary_private_ips = (known after apply) - + security_groups = [ - + "awsterraformsg", - ] - + source_dest_check = true - + spot_instance_request_id = (known after apply) - + subnet_id = (known after apply) - + tags = { - + "name" = "VyOS System" - } - + tags_all = { - + "name" = "VyOS System" - } - + tenancy = (known after apply) - + user_data = (known after apply) - + user_data_base64 = (known after apply) - + user_data_replace_on_change = false - + vpc_security_group_ids = (known after apply) - } - - # local_file.ip will be created - + resource "local_file" "ip" { - + content = (known after apply) - + content_base64sha256 = (known after apply) - + content_base64sha512 = (known after apply) - + content_md5 = (known after apply) - + content_sha1 = (known after apply) - + content_sha256 = (known after apply) - + content_sha512 = (known after apply) - + directory_permission = "0777" - + file_permission = "0777" - + filename = "ip.txt" - + id = (known after apply) - } - - # null_resource.SSHconnection1 will be created - + resource "null_resource" "SSHconnection1" { - + id = (known after apply) - } - - # null_resource.SSHconnection2 will be created - + resource "null_resource" "SSHconnection2" { - + id = (known after apply) - } - -Plan: 4 to add, 0 to change, 0 to destroy. - -Changes to Outputs: - + my_IP = (known after apply) - -Do you want to perform these actions? - Terraform will perform the actions described above. - Only 'yes' will be accepted to approve. - - Enter a value: yes - -aws_instance.myVyOSec2: Creating... -aws_instance.myVyOSec2: Still creating... [10s elapsed] -aws_instance.myVyOSec2: Still creating... [20s elapsed] -aws_instance.myVyOSec2: Still creating... [30s elapsed] -aws_instance.myVyOSec2: Still creating... [40s elapsed] -aws_instance.myVyOSec2: Creation complete after 44s [id=i-09edfca15aac2fe0a] -null_resource.SSHconnection1: Creating... -null_resource.SSHconnection2: Creating... -null_resource.SSHconnection1: Provisioning with 'file'... -null_resource.SSHconnection2: Provisioning with 'remote-exec'... -null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... -null_resource.SSHconnection2 (remote-exec): Host: 10.217.80.104 -null_resource.SSHconnection2 (remote-exec): User: root -null_resource.SSHconnection2 (remote-exec): Password: true -null_resource.SSHconnection2 (remote-exec): Private key: false -null_resource.SSHconnection2 (remote-exec): Certificate: false -null_resource.SSHconnection2 (remote-exec): SSH Agent: false -null_resource.SSHconnection2 (remote-exec): Checking Host Key: false -null_resource.SSHconnection2 (remote-exec): Target Platform: unix -local_file.ip: Creating... -local_file.ip: Creation complete after 0s [id=e8e91f2e24579cd28b92e2d152c0c24c3bf4b52c] -null_resource.SSHconnection2 (remote-exec): Connected! -null_resource.SSHconnection1: Creation complete after 0s [id=7070868940858935600] - -null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ - -null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** -null_resource.SSHconnection2: Still creating... [10s elapsed] -null_resource.SSHconnection2: Still creating... [20s elapsed] -null_resource.SSHconnection2: Still creating... [30s elapsed] -null_resource.SSHconnection2: Still creating... [40s elapsed] -null_resource.SSHconnection2: Still creating... [50s elapsed] -null_resource.SSHconnection2: Still creating... [1m0s elapsed] -null_resource.SSHconnection2 (remote-exec): ok: [54.xxx.xxx.xxx] - -null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* -null_resource.SSHconnection2: Still creating... [1m10s elapsed] -null_resource.SSHconnection2 (remote-exec): changed: [54.xxx.xxx.xxx] - -null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* -null_resource.SSHconnection2 (remote-exec): 54.xxx.xxx.xxx : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - -null_resource.SSHconnection2: Creation complete after 1m16s [id=4902256962410024771] - -Apply complete! Resources: 4 added, 0 changed, 0 destroyed. - -Outputs: - -my_IP = "54.xxx.xxx.xxx" -``` - -After running all the commands, your VyOS instance is deployed on -AWS with your specified configuration. -To delete the instance, type the following command: - -```none -terraform destroy -``` - -## Troubleshooting - -1. If Ansible doesn't connect via SSH to your AWS instance, verify that - your SSH key is in the path `/root/aws/`. You might need to - increase the timeout in `instance.yml` from 300 seconds to 500 - seconds or more, depending on your location. Make sure that the - security group allows access to the instance. -2. If Terraform doesn't connect via SSH to your Ansible instance, - verify the correct login and password in the `VyOS.tf` file. - -```{eval-rst} - .. code-block:: none - - connection { - type = "ssh" - user = "root" # open root access using login and password on your Ansible - password = var.password # check password in the file terraform.tfvars isn't empty - host = var.host # check the correct IP address of your Ansible host - } -``` - -Make sure Ansible can ping from Terraform. - -## Structure of files in Terraform for AWS - -```none -. -├── vyos.tf # The main script -├── var.tf # The file of all variables in "vyos.tf" -├── versions.tf # File for the changing version of Terraform. -└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) -``` - -## File contents of Terraform for AWS - -`vyos.tf` - -```none -############################################################################## -# Build a VyOS VM from the Marketplace. -# Find the necessary AMI image_ in AWS. -# -# The vyos.tf script uses default values (you can change them as -# needed) -# AWS Region = "us-east-1" -# AMI = "standard AMI of VyOS from AWS Marketplace" -# Size of VM = "t2.micro" -# AWS Region = "us-east-1" -# After deploying the AWS instance and getting an IP address, the IP address is copied into the file -#"ip.txt" and copied to the Ansible node for provisioning. -############################################################################## - -provider "aws" { - access_key = var.access - secret_key = var.secret - region = var.region -} - -variable "region" { - default = "us-east-1" - description = "AWS Region" -} - -variable "ami" { - default = "ami-**************3b3" # ami image please enter your details - description = "Amazon Machine Image ID for VyOS" -} - -variable "type" { - default = "t2.micro" - description = "Size of VM" -} - -# my resource for VyOS - -resource "aws_instance" "myVyOSec2" { - ami = var.ami - key_name = "awsterraform" # Please enter your details from 1.2 of Preparation steps for deploying VyOS on AWS - security_groups = ["awsterraformsg"] # Please enter your details from 1.3 of Preparation steps for deploying VyOS on AWS - instance_type = var.type - tags = { - name = "VyOS System" - } -} - -############################################################################## -# Specific variable (to getting type "terraform plan"): -# aws_instance.myVyOSec2.public_ip - the information about public IP address -# of our instance, needs for provisioning and SSH connection from Ansible -############################################################################## - -output "my_IP"{ -value = aws_instance.myVyOSec2.public_ip -} - -############################################################################## -# The IP address of the AWS instance is copied to the ip.txt file -# on the local Terraform system. The ip.txt file contains the public -# IP address in the format: xxx.xxx.xxx.xxx -############################################################################## - -resource "local_file" "ip" { - content = aws_instance.myVyOSec2.public_ip - filename = "ip.txt" -} - -#connecting to the Ansible control node using SSH connection - -############################################################################## -# The "SSHconnection1" and "SSHconnection2" steps retrieve ip.txt -# from the Terraform node and run the Ansible playbook remotely. -############################################################################## - -resource "null_resource" "SSHconnection1" { -depends_on = [aws_instance.myVyOSec2] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} - -# Copy the ip.txt file to the Ansible control node from the local -# system - provisioner "file" { - source = "ip.txt" - destination = "/root/aws/ip.txt" # The folder of your Ansible project - } -} - -resource "null_resource" "SSHconnection2" { -depends_on = [aws_instance.myVyOSec2] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} -# Run Ansible playbook on remote Linux OS -provisioner "remote-exec" { - inline = [ - "cd /root/aws/", - "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for AWS" -] -} -} -``` - -`var.tf` - -```none -variable "password" { - description = "pass for Ansible" - type = string - sensitive = true -} -variable "host"{ - description = "The IP of my Ansible" - type = string -} -variable "access" { - description = "my access_key for AWS" - type = string - sensitive = true -} -variable "secret" { - description = "my secret_key for AWS" - type = string - sensitive = true -} -``` - -`versions.tf` - -```none - terraform { - required_providers { - aws = { - source = "hashicorp/aws" - version = "~> 5.0" - } - } -} -``` - -`terraform.tfvars` - -```none -password = "" # password for Ansible SSH -host = "" # IP of my Ansible -access = "" # access_key for AWS -secret = "" # secret_key for AWS -``` - -## Structure of files in Ansible for AWS - -```none -. -├── group_vars - └── all -├── ansible.cfg -├── mykey.pem -└── instance.yml -``` - -## File contents of Ansible for AWS - -`ansible.cfg` - -```none -[defaults] -inventory = /root/aws/ip.txt -host_key_checking= False -private_key_file = /root/aws/awsterraform.pem # check the name -remote_user=vyos -``` - -`mykey.pem` - -```none -Copy your key.pem from AWS -``` - -`instance.yml` - -```none -############################################################################## -# About tasks: -# "Wait 300 seconds, but only start checking after 60 seconds" - -# attempts SSH connection every 60 seconds until 300 seconds -# "Configure general settings for the VyOS hosts group" - -# provisions the AWS VyOS node -# Add all necessary VyOS commands under the "lines:" block -############################################################################## - -- name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true -``` - -`group_vars/all` - -```none -ansible_connection: ansible.netcommon.network_cli -ansible_network_os: vyos.vyos.vyos -ansible_user: vyos -``` - - -## Source files on GitHub - -All files related to deploying VyOS on AWS with Terraform and Ansible -can be found in the [vyos-automation] repository. - -[group]: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html -[pair]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html -[vyos-automation]: diff --git a/docs/automation/terraform/md-terraformAZ.md b/docs/automation/terraform/md-terraformAZ.md deleted file mode 100644 index b1b8fac0..00000000 --- a/docs/automation/terraform/md-terraformAZ.md +++ /dev/null @@ -1,501 +0,0 @@ ---- -lastproofread: '2026-03-19' ---- - -(terraformaz)= - -# Deploy VyOS on Microsoft Azure with Terraform and Ansible - -You can use Terraform to quickly deploy VyOS-based infrastructure -on Microsoft Azure (hereafter referred to as *Azure*) and remove -infrastructure when it's no longer needed. -Additionally, you can use Ansible for provisioning. - -On this page you'll learn how to: - -- Create the necessary files for Terraform and Ansible. -- Use Terraform to create a single instance on Azure and use Ansible for - provisioning. - -## Prepare to deploy VyOS with Terraform on Azure - -To create a single instance and install your configuration using -Terraform, Ansible, and Azure, follow these steps: - -### Azure - -- Create an [Azure account](https://azure.microsoft.com/). - -### Terraform - -```{eval-rst} -1. Create an UNIX or Windows instance. - -2. Download and install - `Terraform `__. - -3. Create the folder for example ``/root/azvyos/``. - -.. code-block:: none - - mkdir /root/azvyos - -.. stop_vyoslinter - -4. Copy all files into your Terraform project "/root/azvyos" - (``vyos.tf``, ``var.tf``, ``terraform.tfvars``). For more details, see - `Structure of files in Terraform for Azure <#structure-of-files-in-terraform-for-azure>`_. - -.. start_vyoslinter - -5. Log in to Azure using the command: - - .. code-block:: none - - az login - -6. Run the following commands to initialize Terraform: - - .. code-block:: none - - cd / - terraform init -``` - - -### Ansible - -1. Create an UNIX instance either locally or in the cloud. - -2. Download and install Ansible - -3. Create a folder, for example `/root/az/`. - -4. Copy all files into your Ansible project `/root/az/` (`ansible.cfg`, - `instance.yml`, `all`). For more details, see - [Structure of files in Ansible for Azure](#structure-of-files-in-ansible-for-azure) - -### Deploy with Terraform - -Run the following commands on your Terraform instance: - -```none -cd / -terraform plan -terraform apply -yes -``` - -After executing all the commands, your VyOS instance is deployed to -Azure with your configuration. -If you need to delete the instance, run the following command: - -```none -terraform destroy -``` - - -## Structure of files in Terraform for Azure - -```none -. -├── vyos.tf # The main script -├── var.tf # File for the Terraform version. -└── terraform.tfvars # Values for all variables (passwords, - # login, IP addresses, etc.) -``` - - -## File contents of Terraform for Azure - -`vyos.tf` - -```none -############################################################################## -# HashiCorp Guide to Using Terraform on Azure -# This Terraform configuration will create the following: -# Resource group with a virtual network and subnet -# A VyOS server without SSH key (only login+password) -############################################################################## - -# Choose a provider - -provider "azurerm" { - features {} -} - -# Create a resource group. In Azure, every resource belongs to a -# resource group. - -resource "azurerm_resource_group" "azure_vyos" { - name = "${var.resource_group}" - location = "${var.location}" -} - -# The next resource is a Virtual Network. - -resource "azurerm_virtual_network" "vnet" { - name = "${var.virtual_network_name}" - location = "${var.location}" - address_space = ["${var.address_space}"] - resource_group_name = "${var.resource_group}" -} - -# Build a subnet to run your VMs. - -resource "azurerm_subnet" "subnet" { - name = "${var.prefix}subnet" - virtual_network_name = "${azurerm_virtual_network.vnet.name}" - resource_group_name = "${var.resource_group}" - address_prefixes = ["${var.subnet_prefix}"] -} - -############################################################################## -# Build a VyOS VM from the Marketplace. -# To find the necessary image, use the command: -# -# az vm image list --offer vyos --all -# -# Now that you have a network, you can deploy a VyOS server. -# An Azure Virtual Machine has several components. In this example, -# you build a security group, a network interface, a public IP -# address, a storage account, and finally the VM itself. Terraform -# handles all the dependencies automatically, and each resource is -# named with user-defined variables. -############################################################################## - - -# Security group to allow inbound access on port 22 (SSH) - -resource "azurerm_network_security_group" "vyos-sg" { - name = "${var.prefix}-sg" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - - security_rule { - name = "SSH" - priority = 100 - direction = "Inbound" - access = "Allow" - protocol = "Tcp" - source_port_range = "*" - destination_port_range = "22" - source_address_prefix = "${var.source_network}" - destination_address_prefix = "*" - } -} - -# A network interface. - -resource "azurerm_network_interface" "vyos-nic" { - name = "${var.prefix}vyos-nic" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - - ip_configuration { - name = "${var.prefix}ipconfig" - subnet_id = "${azurerm_subnet.subnet.id}" - private_ip_address_allocation = "Dynamic" - public_ip_address_id = "${azurerm_public_ip.vyos-pip.id}" - } -} - -# Add a public IP address. - -resource "azurerm_public_ip" "vyos-pip" { - name = "${var.prefix}-ip" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - allocation_method = "Dynamic" -} - -# Build a virtual machine. This is a standard VyOS instance from -# Marketplace. - -resource "azurerm_virtual_machine" "vyos" { - name = "${var.hostname}-vyos" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - vm_size = "${var.vm_size}" - - network_interface_ids = ["${azurerm_network_interface.vyos-nic.id}"] - delete_os_disk_on_termination = "true" - -# To find information about the plan, use the command: -# az vm image list --offer vyos --all - - plan { - publisher = "sentriumsl" - name = "vyos-1-3" - product = "vyos-1-2-lts-on-azure" - } - - storage_image_reference { - publisher = "${var.image_publisher}" - offer = "${var.image_offer}" - sku = "${var.image_sku}" - version = "${var.image_version}" - } - - storage_os_disk { - name = "${var.hostname}-osdisk" - managed_disk_type = "Standard_LRS" - caching = "ReadWrite" - create_option = "FromImage" - } - - os_profile { - computer_name = "${var.hostname}" - admin_username = "${var.admin_username}" - admin_password = "${var.admin_password}" - } - - os_profile_linux_config { - disable_password_authentication = false - } -} - -data "azurerm_public_ip" "example" { - depends_on = ["azurerm_virtual_machine.vyos"] - name = "vyos-ip" - resource_group_name = "${var.resource_group}" -} -output "public_ip_address" { - value = data.azurerm_public_ip.example.ip_address -} - -# IP of AZ instance copied to a file ip.txt in the local system. - -resource "local_file" "ip" { - content = data.azurerm_public_ip.example.ip_address - filename = "ip.txt" -} - -# Connect to the Ansible control node via SSH - -resource "null_resource" "nullremote1" { -depends_on = ["azurerm_virtual_machine.vyos"] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} - -# Copy the ip.txt file to the Ansible control node from the local -# system - - provisioner "file" { - source = "ip.txt" - destination = "/root/az/ip.txt" - } -} - -resource "null_resource" "nullremote2" { -depends_on = ["azurerm_virtual_machine.vyos"] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} - -# Run the Ansible playbook on the remote Linux OS - -provisioner "remote-exec" { - - inline = [ - "cd /root/az/", - "ansible-playbook instance.yml" -] -} -} -``` - -`var.tf` - -```none -############################################################################## -# Variables File -# -# Default values for all variables used in Terraform code. -############################################################################## - -variable "resource_group" { - description = "The name of your Azure Resource Group." - default = "my_resource_group" -} - -variable "prefix" { - description = "This prefix will be included in the name of some resources." - default = "vyos" -} - -variable "hostname" { - description = "Virtual machine hostname. Used for local hostname, DNS, and storage-related names." - default = "vyos_terraform" -} - -variable "location" { - description = "The region where the virtual network is created." - default = "centralus" -} - -variable "virtual_network_name" { - description = "The name for your virtual network." - default = "vnet" -} - -variable "address_space" { - description = "The address space that is used by the virtual network. You can supply more than one address space. Changing this forces a new resource to be created." - default = "10.0.0.0/16" -} - -variable "subnet_prefix" { - description = "The address prefix to use for the subnet." - default = "10.0.10.0/24" -} - -variable "storage_account_tier" { - description = "Defines the storage tier. Valid options are Standard and Premium." - default = "Standard" -} - -variable "storage_replication_type" { - description = "Defines the replication type to use for this storage account. Valid options include LRS, GRS etc." - default = "LRS" -} - -# The most cost-effective size - -variable "vm_size" { - description = "Specifies the size of the virtual machine." - default = "Standard_B1s" -} - -variable "image_publisher" { - description = "Name of the publisher of the image (az vm image list)" - default = "sentriumsl" -} - -variable "image_offer" { - description = "Name of the offer (az vm image list)" - default = "vyos-1-2-lts-on-azure" -} - -variable "image_sku" { - description = "Image SKU to apply (az vm image list)" - default = "vyos-1-3" -} - -variable "image_version" { - description = "Version of the image to apply (az vm image list)" - default = "1.3.3" -} - -variable "admin_username" { - description = "Administrator user name" - default = "vyos" -} - -variable "admin_password" { - description = "Administrator password" - type = string - sensitive = true -} - -variable "source_network" { - description = "Allow access from this network prefix. Defaults to '*'." - default = "*" -} - -variable "password" { - description = "pass for Ansible" - type = string - sensitive = true -} -variable "host"{ - description = "IP of my Ansible" -} -``` - -`terraform.tfvars` - -```none -password = "" # password for Ansible SSH -host = "" # IP of my Ansible -``` - - -## Structure of files in Ansible for Azure - -```none -. -├── group_vars - └── all -├── ansible.cfg -└── instance.yml -``` - - -## File contents of Ansible for Azure - -`ansible.cfg` - -```none -[defaults] -inventory = /root/az/ip.txt -host_key_checking= False -remote_user=vyos -``` - -`instance.yml` - -```none -############################################################################## -# About tasks: -# "Wait 300 seconds, but only start checking after 60 seconds" - Tries -# to make SSH connection every 60 seconds until 300 seconds. -# "Configure general settings for the VyOS hosts group" - Provision -# the Azure VyOS node. -# Add all necessary commands for VyOS under the block "lines:" -############################################################################## - - -- name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true -``` - -`group_vars/all` - -```none -ansible_connection: ansible.netcommon.network_cli -ansible_network_os: vyos.vyos.vyos - -# user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf -ansible_user: vyos -ansible_ssh_pass: "{{ vault_vyos_ssh_pass }}" -``` - - -## Source files on GitHub - -All files related to deploying VyOS on Azure with Terraform and Ansible -can be found in the [vyos-automation] repository. - -[vyos-automation]: diff --git a/docs/automation/terraform/md-terraformGoogle.md b/docs/automation/terraform/md-terraformGoogle.md deleted file mode 100644 index f9c002a7..00000000 --- a/docs/automation/terraform/md-terraformGoogle.md +++ /dev/null @@ -1,703 +0,0 @@ ---- -lastproofread: '2026-03-23' ---- - -(terraformgoogle)= - -# Deploy VyOS on Google Cloud with Terraform and Ansible - -Using Terraform, you can quickly deploy VyOS-based infrastructure on -Google Cloud Platform (GCP) and remove the -infrastructure when it's no longer needed. -Additionally, you can use Ansible for provisioning. - -On this page you'll learn how to: - -- Create the necessary files for Terraform and Ansible. -- Use Terraform to create a single instance on GCP and use Ansible for - provisioning. - -## Prepare to deploy VyOS with Terraform on GCP - -To create a single instance and install your configuration using -Terraform, Ansible, and GCP, follow these steps: - -### GCP - -1. Create an account with GCP and a new project. - -```{image} /_static/images/project.webp -:align: center -:alt: Network Topology Diagram -:width: 50% -``` - -2. Create a service account and download your key (a JSON file). - -```{image} /_static/images/service.webp -:align: center -:alt: Network Topology Diagram -:width: 50% -``` - -```{image} /_static/images/key.webp -:align: center -:alt: Network Topology Diagram -:width: 50% -``` - -The .JSON file downloads automatically after you create it and looks -like the following: - -```{image} /_static/images/json.webp -:align: center -:alt: Network Topology Diagram -:width: 50% -``` - -### Terraform - -1. Create an UNIX or Windows instance. - -2. Download and install - [Terraform](https://developer.hashicorp.com/terraform/install). - -3. Create the folder. For example, `/root/google`. - -```none -mkdir /root/google -``` - -4. Copy all files into your Terraform project `/root/google` - (`vyos.tf`, `var.tf`, `terraform.tfvars`, `mykey.json`). - For more details, - see [Structure of files Terraform for Google Cloud](#structure-of-files-in-terraform-for-google-cloud) - - - -5. Run the following commands: - -```none -cd / -terraform init -``` - -### Ansible - -1. Create an UNIX instance either locally or in the cloud. - -2. Download and install Ansible - -3. Create the folder for example /root/google/ - -4. Copy all files into your Ansible project `/root/google/` - (`ansible.cfg`, `instance.yml`, `mykey.json`, and `all`). For more - details, see [Structure of files in Ansible for Google Cloud](#structure-of-files-in-ansible-for-google-cloud) - -You obtain `mykey.json` when you create a service account in GCP -and download the key (a JSON file). - -### Deploy with Terraform - -Run the following commands on your Terraform instance: - -```none -cd / -terraform plan -terraform apply -yes -``` - -## Create a GCP instance and check its configuration - -```none -# terraform apply - -Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: - + create - -Terraform will perform the following actions: - - # google_compute_firewall.tcp_22[0] will be created - + resource "google_compute_firewall" "tcp_22" { - + creation_timestamp = (known after apply) - + destination_ranges = (known after apply) - + direction = (known after apply) - + enable_logging = (known after apply) - + id = (known after apply) - + name = "vyos-tcp-22" - + network = "default" - + priority = 1000 - + project = "vyosproject" - + self_link = (known after apply) - + source_ranges = [ - + "0.0.0.0/0", - ] - + target_tags = [ - + "vyos-deployment", - ] - - + allow { - + ports = [ - + "22", - ] - + protocol = "tcp" - } - } - - # google_compute_firewall.udp_500_4500[0] will be created - + resource "google_compute_firewall" "udp_500_4500" { - + creation_timestamp = (known after apply) - + destination_ranges = (known after apply) - + direction = (known after apply) - + enable_logging = (known after apply) - + id = (known after apply) - + name = "vyos-udp-500-4500" - + network = "default" - + priority = 1000 - + project = "vyosproject" - + self_link = (known after apply) - + source_ranges = [ - + "0.0.0.0/0", - ] - + target_tags = [ - + "vyos-deployment", - ] - - + allow { - + ports = [ - + "500", - + "4500", - ] - + protocol = "udp" - } - } - - # google_compute_instance.default will be created - + resource "google_compute_instance" "default" { - + can_ip_forward = true - + cpu_platform = (known after apply) - + current_status = (known after apply) - + deletion_protection = false - + effective_labels = (known after apply) - + guest_accelerator = (known after apply) - + id = (known after apply) - + instance_id = (known after apply) - + label_fingerprint = (known after apply) - + machine_type = "n2-highcpu-4" - + metadata = { - + "enable-oslogin" = "FALSE" - + "serial-port-enable" = "TRUE" - + "user-data" = "" - } - + metadata_fingerprint = (known after apply) - + min_cpu_platform = (known after apply) - + name = "vyos" - + project = "vyosproject" - + self_link = (known after apply) - + tags_fingerprint = (known after apply) - + terraform_labels = (known after apply) - + zone = "us-west1-a" - - + boot_disk { - + auto_delete = true - + device_name = (known after apply) - + disk_encryption_key_sha256 = (known after apply) - + kms_key_self_link = (known after apply) - + mode = "READ_WRITE" - + source = (known after apply) - - + initialize_params { - + image = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039" - + labels = (known after apply) - + provisioned_iops = (known after apply) - + provisioned_throughput = (known after apply) - + size = (known after apply) - + type = (known after apply) - } - } - - + network_interface { - + internal_ipv6_prefix_length = (known after apply) - + ipv6_access_type = (known after apply) - + ipv6_address = (known after apply) - + name = (known after apply) - + network = "default" - + network_ip = (known after apply) - + nic_type = "GVNIC" - + stack_type = (known after apply) - + subnetwork = "default" - + subnetwork_project = (known after apply) - - + access_config { - + nat_ip = (known after apply) - + network_tier = (known after apply) - } - } - } - - # local_file.ip will be created - + resource "local_file" "ip" { - + content = (known after apply) - + content_base64sha256 = (known after apply) - + content_base64sha512 = (known after apply) - + content_md5 = (known after apply) - + content_sha1 = (known after apply) - + content_sha256 = (known after apply) - + content_sha512 = (known after apply) - + directory_permission = "0777" - + file_permission = "0777" - + filename = "ip.txt" - + id = (known after apply) - } - - # null_resource.SSHconnection1 will be created - + resource "null_resource" "SSHconnection1" { - + id = (known after apply) - } - - # null_resource.SSHconnection2 will be created - + resource "null_resource" "SSHconnection2" { - + id = (known after apply) - } - -Plan: 6 to add, 0 to change, 0 to destroy. - -Changes to Outputs: - + public_ip_address = (known after apply) -╷ -│ Warning: Quoted references are deprecated -│ -│ on vyos.tf line 126, in resource "null_resource" "SSHconnection1": -│ 126: depends_on = ["google_compute_instance.default"] -│ -│ In this context, references are expected literally rather than in quotes. Terraform 0.11 and earlier required quotes, but quoted references are now deprecated and will be removed in a -│ future version of Terraform. Remove the quotes surrounding this reference to silence this warning. -│ -│ (and one more similar warning elsewhere) -╵ - -Do you want to perform these actions? - Terraform will perform the actions described above. - Only 'yes' will be accepted to approve. - - Enter a value: yes - -google_compute_firewall.udp_500_4500[0]: Creating... -google_compute_firewall.tcp_22[0]: Creating... -google_compute_instance.default: Creating... -google_compute_firewall.udp_500_4500[0]: Still creating... [10s elapsed] -google_compute_firewall.tcp_22[0]: Still creating... [10s elapsed] -google_compute_instance.default: Still creating... [10s elapsed] -google_compute_firewall.tcp_22[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-tcp-22] -google_compute_firewall.udp_500_4500[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-udp-500-4500] -google_compute_instance.default: Creation complete after 20s [id=projects/vyosproject/zones/us-west1-a/instances/vyos] -null_resource.SSHconnection1: Creating... -null_resource.SSHconnection2: Creating... -null_resource.SSHconnection1: Provisioning with 'file'... -null_resource.SSHconnection2: Provisioning with 'remote-exec'... -null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... -null_resource.SSHconnection2 (remote-exec): Host: 10.***.***.104 -null_resource.SSHconnection2 (remote-exec): User: root -null_resource.SSHconnection2 (remote-exec): Password: true -null_resource.SSHconnection2 (remote-exec): Private key: false -null_resource.SSHconnection2 (remote-exec): Certificate: false -null_resource.SSHconnection2 (remote-exec): SSH Agent: false -null_resource.SSHconnection2 (remote-exec): Checking Host Key: false -null_resource.SSHconnection2 (remote-exec): Target Platform: unix -local_file.ip: Creating... -local_file.ip: Creation complete after 0s [id=7d568c3b994a018c942a3cdb952ccbf3c729d0ca] -null_resource.SSHconnection2 (remote-exec): Connected! -null_resource.SSHconnection1: Creation complete after 4s [id=5175298735911137161] - -null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ - -null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** -null_resource.SSHconnection2: Still creating... [10s elapsed] -null_resource.SSHconnection2: Still creating... [20s elapsed] -null_resource.SSHconnection2: Still creating... [30s elapsed] -null_resource.SSHconnection2: Still creating... [40s elapsed] -null_resource.SSHconnection2: Still creating... [50s elapsed] -null_resource.SSHconnection2: Still creating... [1m0s elapsed] -null_resource.SSHconnection2: Still creating... [1m10s elapsed] -null_resource.SSHconnection2 (remote-exec): ok: [104.***.***.158] - -null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* -null_resource.SSHconnection2: Still creating... [1m20s elapsed] -null_resource.SSHconnection2 (remote-exec): changed: [104.***.***.158] - -null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* -null_resource.SSHconnection2 (remote-exec): 104.***.***.158 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - -null_resource.SSHconnection2: Creation complete after 1m22s [id=3355727070503709742] - -Apply complete! Resources: 6 added, 0 changed, 0 destroyed. - -Outputs: - -public_ip_address = "104.***.***.158" -``` - -After running all the commands, your VyOS instance is deployed on -GCP with your specified configuration. -To delete the instance, type the following command: - -```none -terraform destroy -``` - -## Troubleshooting - -- Increase the timeout value in `instance.yml` from 300 seconds to - 500 seconds or more (depends on your location). Ensure that the - security group allows access to the instance. -- If Terraform doesn't connect via SSH to your Ansible instance: - Check the correct login and password in the `VyOS.tf` file. - -```none -connection { - type = "ssh" - user = "root" # open root access using login and password on your Ansible - password = var.password # check password in the file terraform.tfvars isn't empty - host = var.host # check the correct IP address of your Ansible host -} -``` - -Verify that Ansible can ping from Terraform. - -## Structure of files in Terraform for Google Cloud - -```none -. -├── vyos.tf # The main script -├── ***.JSON # The credential file from GCP -├── var.tf # The file of all variables in "vyos.tf" -└── terraform.tfvars # The value of all variables (passwords, login, IP addresses and so on) -``` - -## File contents of Terraform for Google Cloud - -`vyos.tf` - -```none -############################################################################## -# Build a VyOS VM from the Marketplace -# -# After deploying the GCP instance and getting an IP address, the IP address is copied into the file -#"ip.txt" and copied to the Ansible node for provisioning. -############################################################################## - -terraform { - required_providers { - google = { - source = "hashicorp/google" - } - } -} - -provider "google" { - project = var.project_id - request_timeout = "60s" - credentials = file(var.gcp_auth_file) -} - -locals { - network_interfaces = [for i, n in var.networks : { - network = n, - subnetwork = length(var.sub_networks) > i ? element(var.sub_networks, i) : null - external_ip = length(var.external_ips) > i ? element(var.external_ips, i) : "NONE" - } - ] -} - -resource "google_compute_instance" "default" { - name = var.goog_cm_deployment_name - machine_type = var.machine_type - zone = var.zone - - metadata = { - enable-oslogin = "FALSE" - serial-port-enable = "TRUE" - user-data = var.vyos_user_data - } - boot_disk { - initialize_params { - image = var.image - } - } - - can_ip_forward = true - - dynamic "network_interface" { - for_each = local.network_interfaces - content { - network = network_interface.value.network - subnetwork = network_interface.value.subnetwork - nic_type = "GVNIC" - dynamic "access_config" { - for_each = network_interface.value.external_ip == "NONE" ? [] : [1] - content { - nat_ip = network_interface.value.external_ip == "EPHEMERAL" ? null : network_interface.value.external_ip - } - } - } - } -} - -resource "google_compute_firewall" "tcp_22" { - count = var.enable_tcp_22 ? 1 : 0 - - name = "${var.goog_cm_deployment_name}-tcp-22" - network = element(var.networks, 0) - - allow { - ports = ["22"] - protocol = "tcp" - } - - source_ranges = ["0.0.0.0/0"] - - target_tags = ["${var.goog_cm_deployment_name}-deployment"] -} - -resource "google_compute_firewall" "udp_500_4500" { - count = var.enable_udp_500_4500 ? 1 : 0 - - name = "${var.goog_cm_deployment_name}-udp-500-4500" - network = element(var.networks, 0) - - allow { - ports = ["500", "4500"] - protocol = "udp" - } - - source_ranges = ["0.0.0.0/0"] - - target_tags = ["${var.goog_cm_deployment_name}-deployment"] -} - -output "public_ip_address" { - value = google_compute_instance.default.network_interface[0].access_config[0].nat_ip -} - -############################################################################## -# -# IP of google instance copied to a file ip.txt in local system Terraform -# ip.txt looks like: -# cat ./ip.txt -# ххх.ххх.ххх.ххх -############################################################################## - -resource "local_file" "ip" { - content = google_compute_instance.default.network_interface[0].access_config[0].nat_ip - filename = "ip.txt" -} - -#connecting to the Ansible control node using SSH connection - -############################################################################## -# Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform node and start remotely the playbook of Ansible. -############################################################################## - -resource "null_resource" "SSHconnection1" { -depends_on = ["google_compute_instance.default"] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} - -#copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/google/ip.txt" # The folder of your Ansible project - } -} - -resource "null_resource" "SSHconnection2" { -depends_on = ["google_compute_instance.default"] -connection { - type = "ssh" - user = "root" - password = var.password - host = var.host -} - -#command to run Ansible playbook on remote Linux OS - -provisioner "remote-exec" { - inline = [ - "cd /root/google/", - "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for Google Cloud" -] -} -} -``` - -`var.tf` - -```none -variable "image" { - type = string - default = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039" -} - -variable "project_id" { - type = string -} - -variable "zone" { - type = string -} - -############################################################################## -# You can choose a lower cost machine type than n2-highcpu-4 -############################################################################## - -variable "machine_type" { - type = string - default = "n2-highcpu-4" -} - -variable "networks" { - description = "The network name to attach the VM instance." - type = list(string) - default = ["default"] -} - -variable "sub_networks" { - description = "The sub network name to attach the VM instance." - type = list(string) - default = ["default"] -} - -variable "external_ips" { - description = "The external IPs assigned to the VM for public access." - type = list(string) - default = ["EPHEMERAL"] -} - -variable "enable_tcp_22" { - description = "Allow SSH traffic from the Internet" - type = bool - default = true -} - -variable "enable_udp_500_4500" { - description = "Allow IKE/IPSec traffic from the Internet" - type = bool - default = true -} - -variable "vyos_user_data" { - type = string - default = "" -} - -// Marketplace requires this variable name to be declared -variable "goog_cm_deployment_name" { - description = "VyOS Universal Router Deployment" - type = string - default = "vyos" -} - -# GCP authentication file -variable "gcp_auth_file" { - type = string - description = "GCP authentication file" -} - -variable "password" { - description = "pass for Ansible" - type = string - sensitive = true -} -variable "host"{ - description = "The IP of my Ansible" - type = string -} -``` - -`terraform.tfvars` - -```none -############################################################################## -# Must be filled in -############################################################################## - -zone = "us-west1-a" -gcp_auth_file = "/root/***/***.json" # path of your .json file -project_id = "" # the google project -password = "" # password for Ansible SSH -host = "" # IP of my Ansible -``` - -## Structure of files in Ansible for Google Cloud - -```none -. -├── group_vars - └── all -├── ansible.cfg -└── instance.yml -``` - -## File contents of Ansible for Google Cloud - -`ansible.cfg` - -```none -[defaults] -inventory = /root/google/ip.txt -host_key_checking= False -remote_user=vyos -``` - -`instance.yml` - -```none -############################################################################## -# About tasks: -# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds -# "Configure general settings for the VyOS hosts group" - make provisioning into Google Cloud VyOS node -# Add all necessary VyOS commands under the "lines:" block -############################################################################## - - -- name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true -``` - -`group_vars/all` - -```none -ansible_connection: ansible.netcommon.network_cli -ansible_network_os: vyos.vyos.vyos -ansible_user: vyos -ansible_ssh_pass: vyos -``` - - -## Source files on GitHub - -All files related to deploying VyOS on Google Cloud Platform with -Terraform and Ansible can be found in the [vyos-automation] repository. - -[vyos-automation]: diff --git a/docs/automation/terraform/md-terraformvSphere.md b/docs/automation/terraform/md-terraformvSphere.md deleted file mode 100644 index abcef5fa..00000000 --- a/docs/automation/terraform/md-terraformvSphere.md +++ /dev/null @@ -1,388 +0,0 @@ ---- -lastproofread: '2026-03-23' ---- - -(terraformvSphere)= - -# Deploy VyOS on VMware vSphere with Terraform and Ansible - -You can use Terraform to quickly deploy VyOS-based infrastructure -on VMware vSphere (hereafter referred to as *vSphere*) and remove -infrastructure when it's no longer needed. -Additionally, you can use Ansible for provisioning. - -On this page you'll learn how to: - -- Create the necessary files for Terraform and Ansible. -- Use Terraform to create a single instance on vSphere and use Ansible for - provisioning. - -## Prepare to deploy VyOS with Terraform on vSphere - -To create a single instance and install your configuration using -Terraform, Ansible, and vSphere, follow these steps: - -### vSphere - -- Add all necessary data to the `terraform.tfvars` - [file]() - and create resources. - -### Terraform - -- Create an UNIX or Windows instance. -- Download and install - [Terraform](https://developer.hashicorp.com/terraform/install). -- Create the folder for example `/root/vsphereterraform`. - -```none -mkdir /root/vsphereterraform -``` - -- Copy all files into your Terraform project `/root/vsphereterraform` - (`vyos.tf`, `var.tf`, `terraform.tfvars`, `version.tf`). - For more details, - see [Structure of files in Terraform for vSphere](#structure-of-files-in-terraform-for-vsphere) -- Run the following commands: - -```none -cd / -terraform init -``` - - -### Ansible - -- Create an UNIX instance either locally or in the cloud. -- Download and install Ansible. -- Create the folder. For example, `/root/vsphereterraform/`. -- Copy all files into your Ansible project `/root/vsphereterraform/` - (`ansible.cfg`, `instance.yml`, `all`). For more details, see - [Structure of files in Ansible for vSphere](#structure-of-files-in-ansible-for-vsphere) - -### Deploy with Terraform - -Run the following commands on your Terraform instance: - -```none -cd / -terraform plan -terraform apply -yes -``` - -After executing these commands, your VyOS instance is deployed to -vSphere with your configuration. -If you need to delete the instance, run the following command: - -```none -terraform destroy -``` - -## Structure of files in Terraform for vSphere - -```none -. -├── vyos.tf # The main script. -├── versions.tf # File for Terraform version. -├── var.tf # File for Terraform version. -└── terraform.tfvars # Values for all variables (passwords, - # login, IP addresses, etc.). -``` - -## File contents of Terraform for vSphere - -`vyos.tf` - -```none -provider "vsphere" { - user = var.vsphere_user - password = var.vsphere_password - vsphere_server = var.vsphere_server - allow_unverified_ssl = true -} - -data "vsphere_datacenter" "datacenter" { - name = var.datacenter -} - -data "vsphere_datastore" "datastore" { - name = var.datastore - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -data "vsphere_compute_cluster" "cluster" { - name = var.cluster - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -data "vsphere_resource_pool" "default" { - name = format("%s%s", data.vsphere_compute_cluster.cluster.name, "/Resources/terraform") # set as you need - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -data "vsphere_host" "host" { - name = var.host - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -data "vsphere_network" "network" { - name = var.network_name - datacenter_id = data.vsphere_datacenter.datacenter.id -} - -# Deployment of VM from Remote OVF -resource "vsphere_virtual_machine" "vmFromRemoteOvf" { - name = var.remotename - datacenter_id = data.vsphere_datacenter.datacenter.id - datastore_id = data.vsphere_datastore.datastore.id - host_system_id = data.vsphere_host.host.id - resource_pool_id = data.vsphere_resource_pool.default.id - network_interface { - network_id = data.vsphere_network.network.id - } - wait_for_guest_net_timeout = 2 - wait_for_guest_ip_timeout = 2 - - ovf_deploy { - allow_unverified_ssl_cert = true - remote_ovf_url = var.url_ova - disk_provisioning = "thin" - ip_protocol = "IPv4" - ip_allocation_policy = "dhcpPolicy" - ovf_network_map = { - "Network 1" = data.vsphere_network.network.id - "Network 2" = data.vsphere_network.network.id - } - } - vapp { - properties = { - "password" = "12345678", - "local-hostname" = "terraform_vyos" - } - } -} - -output "ip" { - description = "default ip address of the deployed VM" - value = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address -} - -# IP of vSphere instance copied to a file ip.txt in local system - -resource "local_file" "ip" { - content = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address - filename = "ip.txt" -} - -#Connecting to the Ansible control node using SSH connection - -resource "null_resource" "nullremote1" { -depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] -connection { - type = "ssh" - user = "root" - password = var.ansiblepassword - host = var.ansiblehost - -} - -# Copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/vsphere/ip.txt" - } -} - -resource "null_resource" "nullremote2" { -depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] -connection { - type = "ssh" - user = "root" - password = var.ansiblepassword - host = var.ansiblehost -} - -# Command to run ansible playbook on remote Linux OS - -provisioner "remote-exec" { - - inline = [ - "cd /root/vsphere/", - "ansible-playbook instance.yml" -] -} -} -``` - -`versions.tf` - -```none -# Copyright (c) HashiCorp, Inc. -# SPDX-License-Identifier: MPL-2.0 - -terraform { - required_providers { - vsphere = { - source = "hashicorp/vsphere" - version = "2.4.0" - } - } -} -``` - -`var.tf` - -```none -# Copyright (c) HashiCorp, Inc. -# SPDX-License-Identifier: MPL-2.0 - -variable "vsphere_server" { - description = "vSphere server" - type = string -} - -variable "vsphere_user" { - description = "vSphere username" - type = string -} - -variable "vsphere_password" { - description = "vSphere password" - type = string - sensitive = true -} - -variable "datacenter" { - description = "vSphere data center" - type = string -} - -variable "cluster" { - description = "vSphere cluster" - type = string -} - -variable "datastore" { - description = "vSphere datastore" - type = string -} - -variable "network_name" { - description = "vSphere network name" - type = string -} - -variable "host" { - description = "Name of your host" - type = string -} - -variable "remotename" { - description = "The name of your VM" - type = string -} - -variable "url_ova" { - description = "The URL to the .OVA file or cloud storage" - type = string -} - -variable "ansiblepassword" { - description = "Ansible password" - type = string -} - -variable "ansiblehost" { - description = "Ansible host name or IP" - type = string -} -``` - -`terraform.tfvars` - -```none -vsphere_user = "" -vsphere_password = "" -vsphere_server = "" -datacenter = "" -datastore = "" -cluster = "" -network_name = "" -host = "" -url_ova = "" -ansiblepassword = "" -ansiblehost = "" -remotename = "" -``` - -## Structure of files in Ansible for vSphere - -```none -. -├── group_vars - └── all -├── ansible.cfg -└── instance.yml -``` - -## File contents of Ansible for vSphere - -`ansible.cfg` - -```none -[defaults] -inventory = /root/vsphere/ip.txt -host_key_checking= False -remote_user=vyos -``` - -`instance.yml` - -```none -############################################################################## -# About tasks: -# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds -# "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node -# You have to add all necessary commands of VyOS under the block "lines:" -############################################################################## - - -- name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server 192.0.2.1 - save: - true -``` - -`group_vars/all` - -```none -ansible_connection: ansible.netcommon.network_cli -ansible_network_os: vyos.vyos.vyos - -# user and password gets from terraform variables "admin_username" and "admin_password" -ansible_user: vyos -# get from vyos.tf "vapp" -ansible_ssh_pass: 12345678 -``` - - -## Source files on GitHub - -All files related to deploying VyOS on vSphere with Terraform and Ansible -can be found in the [vyos-automation] repository. - -[vyos-automation]: diff --git a/docs/automation/terraform/rst-index.rst b/docs/automation/terraform/rst-index.rst new file mode 100644 index 00000000..f81820d2 --- /dev/null +++ b/docs/automation/terraform/rst-index.rst @@ -0,0 +1,33 @@ +:lastproofread: 2026-03-23 + +############## +VyOS Terraform +############## + + +VyOS supports development infrastructure via Terraform and provisioning +via Ansible. +Terraform allows you to automate the deployment of instances on a number of +cloud and virtual platforms. This section shows how to deploy VyOS on +multiple platforms: AWS, Microsoft Azure, Google Cloud Platform (GCP), +and VMware vSphere. +For more information, see the +official documentation for Terraform_ and Ansible_. + + + +.. toctree:: + :maxdepth: 1 + :caption: Guides + + terraformvyos + terraformAWS + terraformAZ + terraformGoogle + terraformvSphere + +.. stop_vyoslinter +.. _Terraform: https://developer.hashicorp.com/terraform/intro +.. _Ansible: https://docs.ansible.com +.. _install: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli +.. start_vyoslinter \ No newline at end of file diff --git a/docs/automation/terraform/rst-terraformAWS.rst b/docs/automation/terraform/rst-terraformAWS.rst new file mode 100644 index 00000000..8156fac4 --- /dev/null +++ b/docs/automation/terraform/rst-terraformAWS.rst @@ -0,0 +1,576 @@ +:lastproofread: 2026-03-16 + +.. _terraformAWS: + +Deploy VyOS on AWS with Terraform and Ansible +============================================= + +You can use Terraform to quickly deploy VyOS-based infrastructure +on AWS and remove infrastructure when it's no longer needed. +Additionally, you can use Ansible for provisioning. + + +.. image:: /_static/images/aws.* + :width: 50% + :align: center + :alt: Network Topology Diagram + +On this page you'll learn how to: + +* Create the necessary files for Terraform and Ansible. +* Use Terraform to create a single instance on AWS and use Ansible for + provisioning. + + +Prepare to deploy VyOS with Terraform on AWS +-------------------------------------------- + +To create a single instance and install your configuration using +Terraform, Ansible, and AWS, follow these steps: + +AWS +^^^ + + +1. Create an account with AWS and get your ``access_key`` and ``secret_key``. + +2. Create a key pair_ and download your ``.pem`` key. + +.. image:: /_static/images/keypairs.* + :width: 50% + :align: center + :alt: Network Topology Diagram + +3. Create a security group_ for the new VyOS instance and open all traffic. + +.. image:: /_static/images/sg.* + :width: 50% + :align: center + :alt: Network Topology Diagram + + +.. image:: /_static/images/traffic.* + :width: 50% + :align: center + :alt: Network Topology Diagram + +Terraform +^^^^^^^^^ + +1. Create an UNIX or Windows instance. + +2. Download and install + `Terraform `__. + +3. Create a folder, for example ``/root/awsterraform``: + + .. code-block:: none + + mkdir /root/awsterraform + +.. stop_vyoslinter + +4. Copy all files into your Terraform project + (``vyos.tf``, ``var.tf``, ``terraform.tfvars``, ``version.tf``). + See `Structure of files in Terraform for AWS <#structure-of-files-in-terraform-for-aws>`__ for more details. + +.. start_vyoslinter + +5. Run the following commands: + +.. code-block:: none + + cd / + terraform init + +Ansible +^^^^^^^ + + +1. Create a UNIX instance whenever you need. + +2. Download and install Ansible + +3. Create a folder, for example ``/root/aws/``. + +.. stop_vyoslinter + +4. Copy all files into your Ansible project + (``ansible.cfg``, ``instance.yml``, + ``mykey.pem``, and ``all``). + See `Structure of files in Ansible for AWS <#structure-of-files-in-ansible-for-aws>`__ for more details. + You can obtain ``mykey.pem`` by creating a key pair_ in AWS and + downloading your ``.pem`` key. + +.. start_vyoslinter + +Deploy with Terraform +^^^^^^^^^^^^^^^^^^^^^ + + +Run the following commands on your Terraform instance: + +.. code-block:: none + + cd / + terraform plan + terraform apply + yes + + +Create an AWS instance and check its configuration +-------------------------------------------------- + +.. code-block:: none + + root@localhost:~/awsterraform# terraform apply + + Terraform used the selected providers to generate the following execution plan. + Resource actions are indicated with the following symbols: + + create + + Terraform will perform the following actions: + + # aws_instance.myVyOSec2 will be created + + resource "aws_instance" "myVyOSec2" { + + ami = "ami-************62c2d" + + arn = (known after apply) + + associate_public_ip_address = (known after apply) + + availability_zone = (known after apply) + + cpu_core_count = (known after apply) + + cpu_threads_per_core = (known after apply) + + disable_api_stop = (known after apply) + + disable_api_termination = (known after apply) + + ebs_optimized = (known after apply) + + get_password_data = false + + host_id = (known after apply) + + host_resource_group_arn = (known after apply) + + iam_instance_profile = (known after apply) + + id = (known after apply) + + instance_initiated_shutdown_behavior = (known after apply) + + instance_lifecycle = (known after apply) + + instance_state = (known after apply) + + instance_type = "t2.micro" + + ipv6_address_count = (known after apply) + + ipv6_addresses = (known after apply) + + key_name = "awsterraform" + + monitoring = (known after apply) + + outpost_arn = (known after apply) + + password_data = (known after apply) + + placement_group = (known after apply) + + placement_partition_number = (known after apply) + + primary_network_interface_id = (known after apply) + + private_dns = (known after apply) + + private_ip = (known after apply) + + public_dns = (known after apply) + + public_ip = (known after apply) + + secondary_private_ips = (known after apply) + + security_groups = [ + + "awsterraformsg", + ] + + source_dest_check = true + + spot_instance_request_id = (known after apply) + + subnet_id = (known after apply) + + tags = { + + "name" = "VyOS System" + } + + tags_all = { + + "name" = "VyOS System" + } + + tenancy = (known after apply) + + user_data = (known after apply) + + user_data_base64 = (known after apply) + + user_data_replace_on_change = false + + vpc_security_group_ids = (known after apply) + } + + # local_file.ip will be created + + resource "local_file" "ip" { + + content = (known after apply) + + content_base64sha256 = (known after apply) + + content_base64sha512 = (known after apply) + + content_md5 = (known after apply) + + content_sha1 = (known after apply) + + content_sha256 = (known after apply) + + content_sha512 = (known after apply) + + directory_permission = "0777" + + file_permission = "0777" + + filename = "ip.txt" + + id = (known after apply) + } + + # null_resource.SSHconnection1 will be created + + resource "null_resource" "SSHconnection1" { + + id = (known after apply) + } + + # null_resource.SSHconnection2 will be created + + resource "null_resource" "SSHconnection2" { + + id = (known after apply) + } + + Plan: 4 to add, 0 to change, 0 to destroy. + + Changes to Outputs: + + my_IP = (known after apply) + + Do you want to perform these actions? + Terraform will perform the actions described above. + Only 'yes' will be accepted to approve. + + Enter a value: yes + + aws_instance.myVyOSec2: Creating... + aws_instance.myVyOSec2: Still creating... [10s elapsed] + aws_instance.myVyOSec2: Still creating... [20s elapsed] + aws_instance.myVyOSec2: Still creating... [30s elapsed] + aws_instance.myVyOSec2: Still creating... [40s elapsed] + aws_instance.myVyOSec2: Creation complete after 44s [id=i-09edfca15aac2fe0a] + null_resource.SSHconnection1: Creating... + null_resource.SSHconnection2: Creating... + null_resource.SSHconnection1: Provisioning with 'file'... + null_resource.SSHconnection2: Provisioning with 'remote-exec'... + null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... + null_resource.SSHconnection2 (remote-exec): Host: 10.217.80.104 + null_resource.SSHconnection2 (remote-exec): User: root + null_resource.SSHconnection2 (remote-exec): Password: true + null_resource.SSHconnection2 (remote-exec): Private key: false + null_resource.SSHconnection2 (remote-exec): Certificate: false + null_resource.SSHconnection2 (remote-exec): SSH Agent: false + null_resource.SSHconnection2 (remote-exec): Checking Host Key: false + null_resource.SSHconnection2 (remote-exec): Target Platform: unix + local_file.ip: Creating... + local_file.ip: Creation complete after 0s [id=e8e91f2e24579cd28b92e2d152c0c24c3bf4b52c] + null_resource.SSHconnection2 (remote-exec): Connected! + null_resource.SSHconnection1: Creation complete after 0s [id=7070868940858935600] + + null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ + + null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** + null_resource.SSHconnection2: Still creating... [10s elapsed] + null_resource.SSHconnection2: Still creating... [20s elapsed] + null_resource.SSHconnection2: Still creating... [30s elapsed] + null_resource.SSHconnection2: Still creating... [40s elapsed] + null_resource.SSHconnection2: Still creating... [50s elapsed] + null_resource.SSHconnection2: Still creating... [1m0s elapsed] + null_resource.SSHconnection2 (remote-exec): ok: [54.xxx.xxx.xxx] + + null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* + null_resource.SSHconnection2: Still creating... [1m10s elapsed] + null_resource.SSHconnection2 (remote-exec): changed: [54.xxx.xxx.xxx] + + null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* + null_resource.SSHconnection2 (remote-exec): 54.xxx.xxx.xxx : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + + null_resource.SSHconnection2: Creation complete after 1m16s [id=4902256962410024771] + + Apply complete! Resources: 4 added, 0 changed, 0 destroyed. + + Outputs: + + my_IP = "54.xxx.xxx.xxx" + + + +After running all the commands, your VyOS instance is deployed on +AWS with your specified configuration. +To delete the instance, type the following command: + +.. code-block:: none + + terraform destroy + + +Troubleshooting +--------------- + +1. If Ansible doesn't connect via SSH to your AWS instance, verify that + your SSH key is in the path ``/root/aws/``. You might need to + increase the timeout in ``instance.yml`` from 300 seconds to 500 + seconds or more, depending on your location. Make sure that the + security group allows access to the instance. + +2. If Terraform doesn't connect via SSH to your Ansible instance, + verify the correct login and password in the ``VyOS.tf`` file. + + .. code-block:: none + + connection { + type = "ssh" + user = "root" # open root access using login and password on your Ansible + password = var.password # check password in the file terraform.tfvars isn't empty + host = var.host # check the correct IP address of your Ansible host + } + + +Make sure Ansible can ping from Terraform. + +Structure of files in Terraform for AWS +--------------------------------------- + +.. code-block:: none + + . + ├── vyos.tf # The main script + ├── var.tf # The file of all variables in "vyos.tf" + ├── versions.tf # File for the changing version of Terraform. + └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) + + +File contents of Terraform for AWS +---------------------------------- + +``vyos.tf`` + +.. code-block:: none + + + ############################################################################## + # Build a VyOS VM from the Marketplace. + # Find the necessary AMI image_ in AWS. + # + # The vyos.tf script uses default values (you can change them as + # needed) + # AWS Region = "us-east-1" + # AMI = "standard AMI of VyOS from AWS Marketplace" + # Size of VM = "t2.micro" + # AWS Region = "us-east-1" + # After deploying the AWS instance and getting an IP address, the IP address is copied into the file + #"ip.txt" and copied to the Ansible node for provisioning. + ############################################################################## + + provider "aws" { + access_key = var.access + secret_key = var.secret + region = var.region + } + + variable "region" { + default = "us-east-1" + description = "AWS Region" + } + + variable "ami" { + default = "ami-**************3b3" # ami image please enter your details + description = "Amazon Machine Image ID for VyOS" + } + + variable "type" { + default = "t2.micro" + description = "Size of VM" + } + + # my resource for VyOS + + resource "aws_instance" "myVyOSec2" { + ami = var.ami + key_name = "awsterraform" # Please enter your details from 1.2 of Preparation steps for deploying VyOS on AWS + security_groups = ["awsterraformsg"] # Please enter your details from 1.3 of Preparation steps for deploying VyOS on AWS + instance_type = var.type + tags = { + name = "VyOS System" + } + } + + ############################################################################## + # Specific variable (to getting type "terraform plan"): + # aws_instance.myVyOSec2.public_ip - the information about public IP address + # of our instance, needs for provisioning and SSH connection from Ansible + ############################################################################## + + output "my_IP"{ + value = aws_instance.myVyOSec2.public_ip + } + + ############################################################################## + # The IP address of the AWS instance is copied to the ip.txt file + # on the local Terraform system. The ip.txt file contains the public + # IP address in the format: xxx.xxx.xxx.xxx + ############################################################################## + + resource "local_file" "ip" { + content = aws_instance.myVyOSec2.public_ip + filename = "ip.txt" + } + + #connecting to the Ansible control node using SSH connection + + ############################################################################## + # The "SSHconnection1" and "SSHconnection2" steps retrieve ip.txt + # from the Terraform node and run the Ansible playbook remotely. + ############################################################################## + + resource "null_resource" "SSHconnection1" { + depends_on = [aws_instance.myVyOSec2] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + + # Copy the ip.txt file to the Ansible control node from the local + # system + provisioner "file" { + source = "ip.txt" + destination = "/root/aws/ip.txt" # The folder of your Ansible project + } + } + + resource "null_resource" "SSHconnection2" { + depends_on = [aws_instance.myVyOSec2] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + # Run Ansible playbook on remote Linux OS + provisioner "remote-exec" { + inline = [ + "cd /root/aws/", + "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for AWS" + ] + } + } + + +``var.tf`` + +.. code-block:: none + + variable "password" { + description = "pass for Ansible" + type = string + sensitive = true + } + variable "host"{ + description = "The IP of my Ansible" + type = string + } + variable "access" { + description = "my access_key for AWS" + type = string + sensitive = true + } + variable "secret" { + description = "my secret_key for AWS" + type = string + sensitive = true + } + +``versions.tf`` + +.. code-block:: none + + terraform { + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.0" + } + } + } + +``terraform.tfvars`` + +.. code-block:: none + + password = "" # password for Ansible SSH + host = "" # IP of my Ansible + access = "" # access_key for AWS + secret = "" # secret_key for AWS + + +Structure of files in Ansible for AWS +------------------------------------- + +.. code-block:: none + + . + ├── group_vars + └── all + ├── ansible.cfg + ├── mykey.pem + └── instance.yml + + +File contents of Ansible for AWS +-------------------------------- + +``ansible.cfg`` + +.. code-block:: none + + [defaults] + inventory = /root/aws/ip.txt + host_key_checking= False + private_key_file = /root/aws/awsterraform.pem # check the name + remote_user=vyos + +``mykey.pem`` + +.. code-block:: none + + Copy your key.pem from AWS + + +``instance.yml`` + + + +.. code-block:: none + + ############################################################################## + # About tasks: + # "Wait 300 seconds, but only start checking after 60 seconds" - + # attempts SSH connection every 60 seconds until 300 seconds + # "Configure general settings for the VyOS hosts group" - + # provisions the AWS VyOS node + # Add all necessary VyOS commands under the "lines:" block + ############################################################################## + + + - name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true + + +``group_vars/all`` + +.. code-block:: none + + ansible_connection: ansible.netcommon.network_cli + ansible_network_os: vyos.vyos.vyos + ansible_user: vyos + +Source files on GitHub +---------------------- + +All files related to deploying VyOS on AWS with Terraform and Ansible +can be found in the vyos-automation_ repository. + + +.. stop_vyoslinter +.. _link: https://developer.hashicorp.com/terraform/intro +.. _install: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli +.. _pair: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html +.. _group: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html +.. _image: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html +.. _vyos-automation: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/AWS_terraform_ansible_single_vyos_instance-main + +.. start_vyoslinter diff --git a/docs/automation/terraform/rst-terraformAZ.rst b/docs/automation/terraform/rst-terraformAZ.rst new file mode 100644 index 00000000..9e094aea --- /dev/null +++ b/docs/automation/terraform/rst-terraformAZ.rst @@ -0,0 +1,514 @@ +:lastproofread: 2026-03-19 + +.. _terraformAZ: + +Deploy VyOS on Microsoft Azure with Terraform and Ansible +========================================================= + +You can use Terraform to quickly deploy VyOS-based infrastructure +on Microsoft Azure (hereafter referred to as *Azure*) and remove +infrastructure when it's no longer needed. +Additionally, you can use Ansible for provisioning. + +On this page you'll learn how to: + +* Create the necessary files for Terraform and Ansible. +* Use Terraform to create a single instance on Azure and use Ansible for + provisioning. + +Prepare to deploy VyOS with Terraform on Azure +---------------------------------------------- + +To create a single instance and install your configuration using +Terraform, Ansible, and Azure, follow these steps: + +Azure +^^^^^ + +1. Create an `Azure account `__. + +Terraform +^^^^^^^^^ + + +1. Create an UNIX or Windows instance. + +2. Download and install + `Terraform `__. + +3. Create the folder for example ``/root/azvyos/``. + +.. code-block:: none + + mkdir /root/azvyos + +.. stop_vyoslinter + +4. Copy all files into your Terraform project "/root/azvyos" + (``vyos.tf``, ``var.tf``, ``terraform.tfvars``). For more details, see + `Structure of files in Terraform for Azure <#structure-of-files-in-terraform-for-azure>`_. + +.. start_vyoslinter + +5. Log in to Azure using the command: + + .. code-block:: none + + az login + +6. Run the following commands to initialize Terraform: + + .. code-block:: none + + cd / + terraform init + +Ansible +^^^^^^^ + + +1. Create an UNIX instance either locally or in the cloud. + +2. Download and install Ansible + +3. Create a folder, for example ``/root/az/``. + +4. Copy all files into your Ansible project ``/root/az/`` (``ansible.cfg``, + ``instance.yml``, ``all``). For more details, see + `Structure of files in Ansible for Azure`_ + + +Deploy with Terraform +^^^^^^^^^^^^^^^^^^^^^ + + +Run the following commands on your Terraform instance: + +.. code-block:: none + + cd / + terraform plan + terraform apply + yes + +After executing all the commands, your VyOS instance is deployed to +Azure with your configuration. +If you need to delete the instance, run the following command: + +.. code-block:: none + + terraform destroy + +Structure of files in Terraform for Azure +----------------------------------------- + +.. code-block:: none + + . + ├── vyos.tf # The main script + ├── var.tf # File for the Terraform version. + └── terraform.tfvars # Values for all variables (passwords, + # login, IP addresses, etc.) + +File contents of Terraform for Azure +------------------------------------ + +``vyos.tf`` + +.. code-block:: none + + + ############################################################################## + # HashiCorp Guide to Using Terraform on Azure + # This Terraform configuration will create the following: + # Resource group with a virtual network and subnet + # A VyOS server without SSH key (only login+password) + ############################################################################## + + # Choose a provider + + provider "azurerm" { + features {} + } + + # Create a resource group. In Azure, every resource belongs to a + # resource group. + + resource "azurerm_resource_group" "azure_vyos" { + name = "${var.resource_group}" + location = "${var.location}" + } + + # The next resource is a Virtual Network. + + resource "azurerm_virtual_network" "vnet" { + name = "${var.virtual_network_name}" + location = "${var.location}" + address_space = ["${var.address_space}"] + resource_group_name = "${var.resource_group}" + } + + # Build a subnet to run your VMs. + + resource "azurerm_subnet" "subnet" { + name = "${var.prefix}subnet" + virtual_network_name = "${azurerm_virtual_network.vnet.name}" + resource_group_name = "${var.resource_group}" + address_prefixes = ["${var.subnet_prefix}"] + } + + ############################################################################## + # Build a VyOS VM from the Marketplace. + # To find the necessary image, use the command: + # + # az vm image list --offer vyos --all + # + # Now that you have a network, you can deploy a VyOS server. + # An Azure Virtual Machine has several components. In this example, + # you build a security group, a network interface, a public IP + # address, a storage account, and finally the VM itself. Terraform + # handles all the dependencies automatically, and each resource is + # named with user-defined variables. + ############################################################################## + + + # Security group to allow inbound access on port 22 (SSH) + + resource "azurerm_network_security_group" "vyos-sg" { + name = "${var.prefix}-sg" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + + security_rule { + name = "SSH" + priority = 100 + direction = "Inbound" + access = "Allow" + protocol = "Tcp" + source_port_range = "*" + destination_port_range = "22" + source_address_prefix = "${var.source_network}" + destination_address_prefix = "*" + } + } + + # A network interface. + + resource "azurerm_network_interface" "vyos-nic" { + name = "${var.prefix}vyos-nic" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + + ip_configuration { + name = "${var.prefix}ipconfig" + subnet_id = "${azurerm_subnet.subnet.id}" + private_ip_address_allocation = "Dynamic" + public_ip_address_id = "${azurerm_public_ip.vyos-pip.id}" + } + } + + # Add a public IP address. + + resource "azurerm_public_ip" "vyos-pip" { + name = "${var.prefix}-ip" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + allocation_method = "Dynamic" + } + + # Build a virtual machine. This is a standard VyOS instance from + # Marketplace. + + resource "azurerm_virtual_machine" "vyos" { + name = "${var.hostname}-vyos" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + vm_size = "${var.vm_size}" + + network_interface_ids = ["${azurerm_network_interface.vyos-nic.id}"] + delete_os_disk_on_termination = "true" + + # To find information about the plan, use the command: + # az vm image list --offer vyos --all + + plan { + publisher = "sentriumsl" + name = "vyos-1-3" + product = "vyos-1-2-lts-on-azure" + } + + storage_image_reference { + publisher = "${var.image_publisher}" + offer = "${var.image_offer}" + sku = "${var.image_sku}" + version = "${var.image_version}" + } + + storage_os_disk { + name = "${var.hostname}-osdisk" + managed_disk_type = "Standard_LRS" + caching = "ReadWrite" + create_option = "FromImage" + } + + os_profile { + computer_name = "${var.hostname}" + admin_username = "${var.admin_username}" + admin_password = "${var.admin_password}" + } + + os_profile_linux_config { + disable_password_authentication = false + } + } + + data "azurerm_public_ip" "example" { + depends_on = ["azurerm_virtual_machine.vyos"] + name = "vyos-ip" + resource_group_name = "${var.resource_group}" + } + output "public_ip_address" { + value = data.azurerm_public_ip.example.ip_address + } + + # IP of AZ instance copied to a file ip.txt in the local system. + + resource "local_file" "ip" { + content = data.azurerm_public_ip.example.ip_address + filename = "ip.txt" + } + + # Connect to the Ansible control node via SSH + + resource "null_resource" "nullremote1" { + depends_on = ["azurerm_virtual_machine.vyos"] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + + # Copy the ip.txt file to the Ansible control node from the local + # system + + provisioner "file" { + source = "ip.txt" + destination = "/root/az/ip.txt" + } + } + + resource "null_resource" "nullremote2" { + depends_on = ["azurerm_virtual_machine.vyos"] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + + # Run the Ansible playbook on the remote Linux OS + + provisioner "remote-exec" { + + inline = [ + "cd /root/az/", + "ansible-playbook instance.yml" + ] + } + } + + +``var.tf`` + +.. code-block:: none + + ############################################################################## + # Variables File + # + # Default values for all variables used in Terraform code. + ############################################################################## + + variable "resource_group" { + description = "The name of your Azure Resource Group." + default = "my_resource_group" + } + + variable "prefix" { + description = "This prefix will be included in the name of some resources." + default = "vyos" + } + + variable "hostname" { + description = "Virtual machine hostname. Used for local hostname, DNS, and storage-related names." + default = "vyos_terraform" + } + + variable "location" { + description = "The region where the virtual network is created." + default = "centralus" + } + + variable "virtual_network_name" { + description = "The name for your virtual network." + default = "vnet" + } + + variable "address_space" { + description = "The address space that is used by the virtual network. You can supply more than one address space. Changing this forces a new resource to be created." + default = "10.0.0.0/16" + } + + variable "subnet_prefix" { + description = "The address prefix to use for the subnet." + default = "10.0.10.0/24" + } + + variable "storage_account_tier" { + description = "Defines the storage tier. Valid options are Standard and Premium." + default = "Standard" + } + + variable "storage_replication_type" { + description = "Defines the replication type to use for this storage account. Valid options include LRS, GRS etc." + default = "LRS" + } + + # The most cost-effective size + + variable "vm_size" { + description = "Specifies the size of the virtual machine." + default = "Standard_B1s" + } + + variable "image_publisher" { + description = "Name of the publisher of the image (az vm image list)" + default = "sentriumsl" + } + + variable "image_offer" { + description = "Name of the offer (az vm image list)" + default = "vyos-1-2-lts-on-azure" + } + + variable "image_sku" { + description = "Image SKU to apply (az vm image list)" + default = "vyos-1-3" + } + + variable "image_version" { + description = "Version of the image to apply (az vm image list)" + default = "1.3.3" + } + + variable "admin_username" { + description = "Administrator user name" + default = "vyos" + } + + variable "admin_password" { + description = "Administrator password" + default = "Vyos0!" + } + + variable "source_network" { + description = "Allow access from this network prefix. Defaults to '*'." + default = "*" + } + + variable "password" { + description = "pass for Ansible" + type = string + sensitive = true + } + variable "host"{ + description = "IP of my Ansible" + } + +``terraform.tfvars`` + +.. code-block:: none + + password = "" # password for Ansible SSH + host = "" # IP of my Ansible + + +Structure of files in Ansible for Azure +--------------------------------------- + +.. code-block:: none + + . + ├── group_vars + └── all + ├── ansible.cfg + └── instance.yml + + +File contents of Ansible for Azure +---------------------------------- + +``ansible.cfg`` + +.. code-block:: none + + [defaults] + inventory = /root/az/ip.txt + host_key_checking= False + remote_user=vyos + + +``instance.yml`` + + +.. code-block:: none + + ############################################################################## + # About tasks: + # "Wait 300 seconds, but only start checking after 60 seconds" - Tries + # to make SSH connection every 60 seconds until 300 seconds. + # "Configure general settings for the VyOS hosts group" - Provision + # the Azure VyOS node. + # Add all necessary commands for VyOS under the block "lines:" + ############################################################################## + + + - name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true + + +``group_vars/all`` + +.. code-block:: none + + ansible_connection: ansible.netcommon.network_cli + ansible_network_os: vyos.vyos.vyos + + # user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf + ansible_user: vyos + ansible_ssh_pass: Vyos0! + +Source files on GitHub +---------------------- + +All files related to deploying VyOS on Azure with Terraform and Ansible +can be found in the vyos-automation_ repository. + +.. stop_vyoslinter +.. _vyos-automation: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Azure_terraform_ansible_single_vyos_instance-main +.. start_vyoslinter diff --git a/docs/automation/terraform/rst-terraformGoogle.rst b/docs/automation/terraform/rst-terraformGoogle.rst new file mode 100644 index 00000000..eb7e01fe --- /dev/null +++ b/docs/automation/terraform/rst-terraformGoogle.rst @@ -0,0 +1,732 @@ +:lastproofread: 2026-03-23 + +.. _terraformgoogle: + +Deploy VyOS on Google Cloud with Terraform and Ansible +====================================================== + +Using Terraform, you can quickly deploy VyOS-based infrastructure on +Google Cloud Platform (GCP) and remove the +infrastructure when it's no longer needed. +Additionally, you can use Ansible for provisioning. + +On this page you'll learn how to: +* Create the necessary files for Terraform and Ansible. +* Use Terraform to create a single instance on GCP and use Ansible for +provisioning. + +Prepare to deploy VyOS with Terraform on GCP +-------------------------------------------- + +To create a single instance and install your configuration using +Terraform, Ansible, and GCP, follow these steps: + +GCP +^^^ + + +1. Create an account with GCP and a new project. + +.. image:: /_static/images/project.* + :width: 50% + :align: center + :alt: Network Topology Diagram + +2. Create a service account and download your key (a JSON file). + +.. image:: /_static/images/service.* + :width: 50% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/key.* + :width: 50% + :align: center + :alt: Network Topology Diagram + +The .JSON file downloads automatically after you create it and looks +like the following: + +.. image:: /_static/images/json.* + :width: 50% + :align: center + :alt: Network Topology Diagram + + +Terraform +^^^^^^^^^ + + +1. Create an UNIX or Windows instance. + +2. Download and install + `Terraform `__. + +3. Create the folder. For example, ``/root/google``. + +.. code-block:: none + + mkdir /root/google + +.. stop_vyoslinter +4. Copy all files into your Terraform project ``/root/google`` + (``vyos.tf``, ``var.tf``, ``terraform.tfvars``, ``mykey.json``). + For more details, + see `Structure of files Terraform for Google Cloud <#structure-of-files-in-terraform-for-google-cloud>`_ + +.. start_vyoslinter + +5. Run the following commands: + + +.. code-block:: none + + cd / + terraform init + + +Ansible +^^^^^^^ + +1. Create an UNIX instance either locally or in the cloud. + +2. Download and install Ansible + +3. Create the folder for example /root/google/ + +4. Copy all files into your Ansible project ``/root/google/`` + (``ansible.cfg``, ``instance.yml``, ``mykey.json``, and ``all``). For more + details, see `Structure of files in Ansible for Google Cloud`_ + +You obtain ``mykey.json`` when you create a service account in GCP +and download the key (a JSON file). + + +Deploy with Terraform +^^^^^^^^^^^^^^^^^^^^^ + + +Run the following commands on your Terraform instance: + +.. code-block:: none + + cd / + terraform plan + terraform apply + yes + + +Create a GCP instance and check its configuration +------------------------------------------------- + +.. code-block:: none + + # terraform apply + + Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + + create + + Terraform will perform the following actions: + + # google_compute_firewall.tcp_22[0] will be created + + resource "google_compute_firewall" "tcp_22" { + + creation_timestamp = (known after apply) + + destination_ranges = (known after apply) + + direction = (known after apply) + + enable_logging = (known after apply) + + id = (known after apply) + + name = "vyos-tcp-22" + + network = "default" + + priority = 1000 + + project = "vyosproject" + + self_link = (known after apply) + + source_ranges = [ + + "0.0.0.0/0", + ] + + target_tags = [ + + "vyos-deployment", + ] + + + allow { + + ports = [ + + "22", + ] + + protocol = "tcp" + } + } + + # google_compute_firewall.udp_500_4500[0] will be created + + resource "google_compute_firewall" "udp_500_4500" { + + creation_timestamp = (known after apply) + + destination_ranges = (known after apply) + + direction = (known after apply) + + enable_logging = (known after apply) + + id = (known after apply) + + name = "vyos-udp-500-4500" + + network = "default" + + priority = 1000 + + project = "vyosproject" + + self_link = (known after apply) + + source_ranges = [ + + "0.0.0.0/0", + ] + + target_tags = [ + + "vyos-deployment", + ] + + + allow { + + ports = [ + + "500", + + "4500", + ] + + protocol = "udp" + } + } + + # google_compute_instance.default will be created + + resource "google_compute_instance" "default" { + + can_ip_forward = true + + cpu_platform = (known after apply) + + current_status = (known after apply) + + deletion_protection = false + + effective_labels = (known after apply) + + guest_accelerator = (known after apply) + + id = (known after apply) + + instance_id = (known after apply) + + label_fingerprint = (known after apply) + + machine_type = "n2-highcpu-4" + + metadata = { + + "enable-oslogin" = "FALSE" + + "serial-port-enable" = "TRUE" + + "user-data" = "" + } + + metadata_fingerprint = (known after apply) + + min_cpu_platform = (known after apply) + + name = "vyos" + + project = "vyosproject" + + self_link = (known after apply) + + tags_fingerprint = (known after apply) + + terraform_labels = (known after apply) + + zone = "us-west1-a" + + + boot_disk { + + auto_delete = true + + device_name = (known after apply) + + disk_encryption_key_sha256 = (known after apply) + + kms_key_self_link = (known after apply) + + mode = "READ_WRITE" + + source = (known after apply) + + + initialize_params { + + image = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039" + + labels = (known after apply) + + provisioned_iops = (known after apply) + + provisioned_throughput = (known after apply) + + size = (known after apply) + + type = (known after apply) + } + } + + + network_interface { + + internal_ipv6_prefix_length = (known after apply) + + ipv6_access_type = (known after apply) + + ipv6_address = (known after apply) + + name = (known after apply) + + network = "default" + + network_ip = (known after apply) + + nic_type = "GVNIC" + + stack_type = (known after apply) + + subnetwork = "default" + + subnetwork_project = (known after apply) + + + access_config { + + nat_ip = (known after apply) + + network_tier = (known after apply) + } + } + } + + # local_file.ip will be created + + resource "local_file" "ip" { + + content = (known after apply) + + content_base64sha256 = (known after apply) + + content_base64sha512 = (known after apply) + + content_md5 = (known after apply) + + content_sha1 = (known after apply) + + content_sha256 = (known after apply) + + content_sha512 = (known after apply) + + directory_permission = "0777" + + file_permission = "0777" + + filename = "ip.txt" + + id = (known after apply) + } + + # null_resource.SSHconnection1 will be created + + resource "null_resource" "SSHconnection1" { + + id = (known after apply) + } + + # null_resource.SSHconnection2 will be created + + resource "null_resource" "SSHconnection2" { + + id = (known after apply) + } + + Plan: 6 to add, 0 to change, 0 to destroy. + + Changes to Outputs: + + public_ip_address = (known after apply) + ╷ + │ Warning: Quoted references are deprecated + │ + │ on vyos.tf line 126, in resource "null_resource" "SSHconnection1": + │ 126: depends_on = ["google_compute_instance.default"] + │ + │ In this context, references are expected literally rather than in quotes. Terraform 0.11 and earlier required quotes, but quoted references are now deprecated and will be removed in a + │ future version of Terraform. Remove the quotes surrounding this reference to silence this warning. + │ + │ (and one more similar warning elsewhere) + ╵ + + Do you want to perform these actions? + Terraform will perform the actions described above. + Only 'yes' will be accepted to approve. + + Enter a value: yes + + google_compute_firewall.udp_500_4500[0]: Creating... + google_compute_firewall.tcp_22[0]: Creating... + google_compute_instance.default: Creating... + google_compute_firewall.udp_500_4500[0]: Still creating... [10s elapsed] + google_compute_firewall.tcp_22[0]: Still creating... [10s elapsed] + google_compute_instance.default: Still creating... [10s elapsed] + google_compute_firewall.tcp_22[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-tcp-22] + google_compute_firewall.udp_500_4500[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-udp-500-4500] + google_compute_instance.default: Creation complete after 20s [id=projects/vyosproject/zones/us-west1-a/instances/vyos] + null_resource.SSHconnection1: Creating... + null_resource.SSHconnection2: Creating... + null_resource.SSHconnection1: Provisioning with 'file'... + null_resource.SSHconnection2: Provisioning with 'remote-exec'... + null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... + null_resource.SSHconnection2 (remote-exec): Host: 10.***.***.104 + null_resource.SSHconnection2 (remote-exec): User: root + null_resource.SSHconnection2 (remote-exec): Password: true + null_resource.SSHconnection2 (remote-exec): Private key: false + null_resource.SSHconnection2 (remote-exec): Certificate: false + null_resource.SSHconnection2 (remote-exec): SSH Agent: false + null_resource.SSHconnection2 (remote-exec): Checking Host Key: false + null_resource.SSHconnection2 (remote-exec): Target Platform: unix + local_file.ip: Creating... + local_file.ip: Creation complete after 0s [id=7d568c3b994a018c942a3cdb952ccbf3c729d0ca] + null_resource.SSHconnection2 (remote-exec): Connected! + null_resource.SSHconnection1: Creation complete after 4s [id=5175298735911137161] + + null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ + + null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** + null_resource.SSHconnection2: Still creating... [10s elapsed] + null_resource.SSHconnection2: Still creating... [20s elapsed] + null_resource.SSHconnection2: Still creating... [30s elapsed] + null_resource.SSHconnection2: Still creating... [40s elapsed] + null_resource.SSHconnection2: Still creating... [50s elapsed] + null_resource.SSHconnection2: Still creating... [1m0s elapsed] + null_resource.SSHconnection2: Still creating... [1m10s elapsed] + null_resource.SSHconnection2 (remote-exec): ok: [104.***.***.158] + + null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* + null_resource.SSHconnection2: Still creating... [1m20s elapsed] + null_resource.SSHconnection2 (remote-exec): changed: [104.***.***.158] + + null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* + null_resource.SSHconnection2 (remote-exec): 104.***.***.158 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + + null_resource.SSHconnection2: Creation complete after 1m22s [id=3355727070503709742] + + Apply complete! Resources: 6 added, 0 changed, 0 destroyed. + + Outputs: + + public_ip_address = "104.***.***.158" + + + +After running all the commands, your VyOS instance is deployed on +GCP with your specified configuration. +To delete the instance, type the following command: + +.. code-block:: none + + terraform destroy + + +Troubleshooting +--------------- + +1. Increase the timeout value in ``instance.yml`` from 300 seconds to + 500 seconds or more (depends on your location). Ensure that the + security group allows access to the instance. + +2. If Terraform doesn't connect via SSH to your Ansible instance: + Check the correct login and password in the ``VyOS.tf`` file. + +.. code-block:: none + + connection { + type = "ssh" + user = "root" # open root access using login and password on your Ansible + password = var.password # check password in the file terraform.tfvars isn't empty + host = var.host # check the correct IP address of your Ansible host + } + + +Verify that Ansible can ping from Terraform. + +Structure of files in Terraform for Google Cloud +------------------------------------------------ + +.. code-block:: none + + . + ├── vyos.tf # The main script + ├── ***.JSON # The credential file from GCP + ├── var.tf # The file of all variables in "vyos.tf" + └── terraform.tfvars # The value of all variables (passwords, login, IP addresses and so on) + + + +File contents of Terraform for Google Cloud +------------------------------------------- + +``vyos.tf`` + +.. code-block:: none + + + ############################################################################## + # Build a VyOS VM from the Marketplace + # + # After deploying the GCP instance and getting an IP address, the IP address is copied into the file + #"ip.txt" and copied to the Ansible node for provisioning. + ############################################################################## + + terraform { + required_providers { + google = { + source = "hashicorp/google" + } + } + } + + provider "google" { + project = var.project_id + request_timeout = "60s" + credentials = file(var.gcp_auth_file) + } + + locals { + network_interfaces = [for i, n in var.networks : { + network = n, + subnetwork = length(var.sub_networks) > i ? element(var.sub_networks, i) : null + external_ip = length(var.external_ips) > i ? element(var.external_ips, i) : "NONE" + } + ] + } + + resource "google_compute_instance" "default" { + name = var.goog_cm_deployment_name + machine_type = var.machine_type + zone = var.zone + + metadata = { + enable-oslogin = "FALSE" + serial-port-enable = "TRUE" + user-data = var.vyos_user_data + } + boot_disk { + initialize_params { + image = var.image + } + } + + can_ip_forward = true + + dynamic "network_interface" { + for_each = local.network_interfaces + content { + network = network_interface.value.network + subnetwork = network_interface.value.subnetwork + nic_type = "GVNIC" + dynamic "access_config" { + for_each = network_interface.value.external_ip == "NONE" ? [] : [1] + content { + nat_ip = network_interface.value.external_ip == "EPHEMERAL" ? null : network_interface.value.external_ip + } + } + } + } + } + + resource "google_compute_firewall" "tcp_22" { + count = var.enable_tcp_22 ? 1 : 0 + + name = "${var.goog_cm_deployment_name}-tcp-22" + network = element(var.networks, 0) + + allow { + ports = ["22"] + protocol = "tcp" + } + + source_ranges = ["0.0.0.0/0"] + + target_tags = ["${var.goog_cm_deployment_name}-deployment"] + } + + resource "google_compute_firewall" "udp_500_4500" { + count = var.enable_udp_500_4500 ? 1 : 0 + + name = "${var.goog_cm_deployment_name}-udp-500-4500" + network = element(var.networks, 0) + + allow { + ports = ["500", "4500"] + protocol = "udp" + } + + source_ranges = ["0.0.0.0/0"] + + target_tags = ["${var.goog_cm_deployment_name}-deployment"] + } + + output "public_ip_address" { + value = google_compute_instance.default.network_interface[0].access_config[0].nat_ip + } + + ############################################################################## + # + # IP of google instance copied to a file ip.txt in local system Terraform + # ip.txt looks like: + # cat ./ip.txt + # ххх.ххх.ххх.ххх + ############################################################################## + + resource "local_file" "ip" { + content = google_compute_instance.default.network_interface[0].access_config[0].nat_ip + filename = "ip.txt" + } + + #connecting to the Ansible control node using SSH connection + + ############################################################################## + # Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform node and start remotely the playbook of Ansible. + ############################################################################## + + resource "null_resource" "SSHconnection1" { + depends_on = ["google_compute_instance.default"] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + + #copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/google/ip.txt" # The folder of your Ansible project + } + } + + resource "null_resource" "SSHconnection2" { + depends_on = ["google_compute_instance.default"] + connection { + type = "ssh" + user = "root" + password = var.password + host = var.host + } + + #command to run Ansible playbook on remote Linux OS + + provisioner "remote-exec" { + inline = [ + "cd /root/google/", + "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for Google Cloud" + ] + } + } + + +``var.tf`` + +.. code-block:: none + + variable "image" { + type = string + default = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039" + } + + variable "project_id" { + type = string + } + + variable "zone" { + type = string + } + + ############################################################################## + # You can choose a lower cost machine type than n2-highcpu-4 + ############################################################################## + + variable "machine_type" { + type = string + default = "n2-highcpu-4" + } + + variable "networks" { + description = "The network name to attach the VM instance." + type = list(string) + default = ["default"] + } + + variable "sub_networks" { + description = "The sub network name to attach the VM instance." + type = list(string) + default = ["default"] + } + + variable "external_ips" { + description = "The external IPs assigned to the VM for public access." + type = list(string) + default = ["EPHEMERAL"] + } + + variable "enable_tcp_22" { + description = "Allow SSH traffic from the Internet" + type = bool + default = true + } + + variable "enable_udp_500_4500" { + description = "Allow IKE/IPSec traffic from the Internet" + type = bool + default = true + } + + variable "vyos_user_data" { + type = string + default = "" + } + + // Marketplace requires this variable name to be declared + variable "goog_cm_deployment_name" { + description = "VyOS Universal Router Deployment" + type = string + default = "vyos" + } + + # GCP authentication file + variable "gcp_auth_file" { + type = string + description = "GCP authentication file" + } + + variable "password" { + description = "pass for Ansible" + type = string + sensitive = true + } + variable "host"{ + description = "The IP of my Ansible" + type = string + } + + +``terraform.tfvars`` + +.. code-block:: none + + ############################################################################## + # Must be filled in + ############################################################################## + + zone = "us-west1-a" + gcp_auth_file = "/root/***/***.json" # path of your .json file + project_id = "" # the google project + password = "" # password for Ansible SSH + host = "" # IP of my Ansible + + +Structure of files in Ansible for Google Cloud +---------------------------------------------- + +.. code-block:: none + + . + ├── group_vars + └── all + ├── ansible.cfg + └── instance.yml + + +File contents of Ansible for Google Cloud +----------------------------------------- + +``ansible.cfg`` + +.. code-block:: none + + [defaults] + inventory = /root/google/ip.txt + host_key_checking= False + remote_user=vyos + +``instance.yml`` + +.. code-block:: none + + ############################################################################## + # About tasks: + # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds + # "Configure general settings for the VyOS hosts group" - make provisioning into Google Cloud VyOS node + # Add all necessary VyOS commands under the "lines:" block + ############################################################################## + + + - name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true + + +``group_vars/all`` + +.. code-block:: none + + ansible_connection: ansible.netcommon.network_cli + ansible_network_os: vyos.vyos.vyos + ansible_user: vyos + ansible_ssh_pass: vyos + +Source files on GitHub +---------------------- + +All files related to deploying VyOS on Google Cloud Platform with +Terraform and Ansible can be found in the vyos-automation_ repository. + +.. stop_vyoslinter +.. _vyos-automation: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Google_terraform_ansible_single_vyos_instance-main +.. start_vyoslinter diff --git a/docs/automation/terraform/rst-terraformvSphere.rst b/docs/automation/terraform/rst-terraformvSphere.rst new file mode 100644 index 00000000..1866fa8e --- /dev/null +++ b/docs/automation/terraform/rst-terraformvSphere.rst @@ -0,0 +1,426 @@ +:lastproofread: 2026-03-23 + +.. _terraformvSphere: + +Deploy VyOS on VMware vSphere with Terraform and Ansible +======================================================== + +You can use Terraform to quickly deploy VyOS-based infrastructure +on VMware vSphere (hereafter referred to as *vSphere*) and remove +infrastructure when it's no longer needed. +Additionally, you can use Ansible for provisioning. + +On this page you'll learn how to: + +* Create the necessary files for Terraform and Ansible. +* Use Terraform to create a single instance on Azure and use Ansible for + provisioning. + +Prepare to deploy VyOS with Terraform on vSphere +------------------------------------------------ + +To create a single instance and install your configuration using +Terraform, Ansible, and vSphere, follow these steps: + +vSphere +^^^^^^^ + + +.. stop_vyoslinter + +1. Add all necessary data to the ``terraform.tfvars`` + `file `__ + and create resources. + +.. start_vyoslinter + +Terraform +^^^^^^^^^ + + +1. Create an UNIX or Windows instance. + +2. Download and install + `Terraform `__. + +3. Create the folder for example ``/root/vsphereterraform``. + +.. code-block:: none + + mkdir /root/vsphereterraform + + +4. Copy all files into your Terraform project ``/root/vsphereterraform`` + (``vyos.tf``, ``var.tf``, ``terraform.tfvars``, ``version.tf``). + For more details, + see `Structure of files in Terraform for vSphere`_ + +5. Run the following commands: + +.. code-block:: none + + cd / + terraform init + + +Ansible +^^^^^^^ + + +1. Create an UNIX instance either locally or in the cloud. + +2. Download and install Ansible. + +3. Create the folder. For example, ``/root/vsphereterraform/``. + +4. Copy all files into your Ansible project ``/root/vsphereterraform/`` + (``ansible.cfg``, ``instance.yml``, ``all``). For more details, see + `Structure of files in Ansible for vSphere`_ + + +Deploy with Terraform +^^^^^^^^^^^^^^^^^^^^^ + + +Run the following commands on your Terraform instance: + +.. code-block:: none + + cd / + terraform plan + terraform apply + yes + + +After executing these commands, your VyOS instance is deployed to +vSphere with your configuration. +If you need to delete the instance, run the following command: +.. code-block:: none + + terraform destroy + + +Structure of files in Terraform for vSphere +------------------------------------------- + +.. code-block:: none + + . + ├── vyos.tf # The main script. + ├── versions.tf # File for Terraform version. + ├── var.tf # File for Terraform version. + └── terraform.tfvars # Values for all variables (passwords, + # login, IP addresses, etc.). + + +File contents of Terraform for vSphere +-------------------------------------- + +``vyos.tf`` + +.. code-block:: none + + provider "vsphere" { + user = var.vsphere_user + password = var.vsphere_password + vsphere_server = var.vsphere_server + allow_unverified_ssl = true + } + + data "vsphere_datacenter" "datacenter" { + name = var.datacenter + } + + data "vsphere_datastore" "datastore" { + name = var.datastore + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + data "vsphere_compute_cluster" "cluster" { + name = var.cluster + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + data "vsphere_resource_pool" "default" { + name = format("%s%s", data.vsphere_compute_cluster.cluster.name, "/Resources/terraform") # set as you need + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + data "vsphere_host" "host" { + name = var.host + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + data "vsphere_network" "network" { + name = var.network_name + datacenter_id = data.vsphere_datacenter.datacenter.id + } + + # Deployment of VM from Remote OVF + resource "vsphere_virtual_machine" "vmFromRemoteOvf" { + name = var.remotename + datacenter_id = data.vsphere_datacenter.datacenter.id + datastore_id = data.vsphere_datastore.datastore.id + host_system_id = data.vsphere_host.host.id + resource_pool_id = data.vsphere_resource_pool.default.id + network_interface { + network_id = data.vsphere_network.network.id + } + wait_for_guest_net_timeout = 2 + wait_for_guest_ip_timeout = 2 + + ovf_deploy { + allow_unverified_ssl_cert = true + remote_ovf_url = var.url_ova + disk_provisioning = "thin" + ip_protocol = "IPv4" + ip_allocation_policy = "dhcpPolicy" + ovf_network_map = { + "Network 1" = data.vsphere_network.network.id + "Network 2" = data.vsphere_network.network.id + } + } + vapp { + properties = { + "password" = "12345678", + "local-hostname" = "terraform_vyos" + } + } + } + + output "ip" { + description = "default ip address of the deployed VM" + value = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address + } + + # IP of vSphere instance copied to a file ip.txt in local system + + resource "local_file" "ip" { + content = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address + filename = "ip.txt" + } + + #Connecting to the Ansible control node using SSH connection + + resource "null_resource" "nullremote1" { + depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] + connection { + type = "ssh" + user = "root" + password = var.ansiblepassword + host = var.ansiblehost + + } + + # Copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/vsphere/ip.txt" + } + } + + resource "null_resource" "nullremote2" { + depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] + connection { + type = "ssh" + user = "root" + password = var.ansiblepassword + host = var.ansiblehost + } + + # Command to run ansible playbook on remote Linux OS + + provisioner "remote-exec" { + + inline = [ + "cd /root/vsphere/", + "ansible-playbook instance.yml" + ] + } + } + + +``versions.tf`` + +.. code-block:: none + + # Copyright (c) HashiCorp, Inc. + # SPDX-License-Identifier: MPL-2.0 + + terraform { + required_providers { + vsphere = { + source = "hashicorp/vsphere" + version = "2.4.0" + } + } + } + +``var.tf`` + +.. code-block:: none + + # Copyright (c) HashiCorp, Inc. + # SPDX-License-Identifier: MPL-2.0 + + variable "vsphere_server" { + description = "vSphere server" + type = string + } + + variable "vsphere_user" { + description = "vSphere username" + type = string + } + + variable "vsphere_password" { + description = "vSphere password" + type = string + sensitive = true + } + + variable "datacenter" { + description = "vSphere data center" + type = string + } + + variable "cluster" { + description = "vSphere cluster" + type = string + } + + variable "datastore" { + description = "vSphere datastore" + type = string + } + + variable "network_name" { + description = "vSphere network name" + type = string + } + + variable "host" { + description = "Name of your host" + type = string + } + + variable "remotename" { + description = "The name of your VM" + type = string + } + + variable "url_ova" { + description = "The URL to the .OVA file or cloud storage" + type = string + } + + variable "ansiblepassword" { + description = "Ansible password" + type = string + } + + variable "ansiblehost" { + description = "Ansible host name or IP" + type = string + } + +``terraform.tfvars`` + +.. code-block:: none + + vsphere_user = "" + vsphere_password = "" + vsphere_server = "" + datacenter = "" + datastore = "" + cluster = "" + network_name = "" + host = "" + url_ova = "" + ansiblepassword = "" + ansiblehost = "" + remotename = "" + + +Structure of files in Ansible for vSphere +----------------------------------------- + +.. code-block:: none + + . + ├── group_vars + └── all + ├── ansible.cfg + └── instance.yml + + +File contents of Ansible for vSphere +------------------------------------ + +``ansible.cfg`` + +.. code-block:: none + + [defaults] + inventory = /root/vsphere/ip.txt + host_key_checking= False + remote_user=vyos + + +``instance.yml`` + +.. code-block:: none + + ############################################################################## + # About tasks: + # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds + # "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node + # You have to add all necessary cammans of VyOS under the block "lines:" + ############################################################################## + + + - name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server 192.0.2.1 + - set system name-server 192.0.2.1 + save: + true + + +``group_vars/all`` + +.. code-block:: none + + ansible_connection: ansible.netcommon.network_cli + ansible_network_os: vyos.vyos.vyos + + # user and password gets from terraform variables "admin_username" and "admin_password" + ansible_user: vyos + # get from vyos.tf "vapp" + ansible_ssh_pass: 12345678 + + +Source files on GitHub +---------------------- + +All files related to deploying VyOS on vSpherewith Terraform and Ansible +can be found in the vyos-automation_ repository. + + +.. stop_vyoslinter +.. _vyos-automation: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Vsphere_terraform_ansible_single_vyos_instance-main + +.. start_vyoslinter diff --git a/docs/automation/terraform/terraformAWS.md b/docs/automation/terraform/terraformAWS.md new file mode 100644 index 00000000..488e7926 --- /dev/null +++ b/docs/automation/terraform/terraformAWS.md @@ -0,0 +1,548 @@ +--- +lastproofread: '2026-03-16' +--- + +(terraformaws)= + +# Deploy VyOS on AWS with Terraform and Ansible + +You can use Terraform to quickly deploy VyOS-based infrastructure +on AWS and remove infrastructure when it's no longer needed. +Additionally, you can use Ansible for provisioning. + +```{eval-rst} +.. image:: /_static/images/aws.webp + :width: 50% + :align: center + :alt: Network Topology Diagram +``` + +On this page you'll learn how to: +- Create the necessary files for Terraform and Ansible. +- Use Terraform to create a single instance on AWS and use Ansible for + provisioning. + +## Prepare to deploy VyOS with Terraform on AWS + +To create a single instance and install your configuration using +Terraform, Ansible, and AWS, follow these steps: + +### AWS + +1. Create an account with AWS and get your `access_key` and `secret_key`. +2. Create a key [pair] and download your `.pem` key. + +```{eval-rst} +.. image:: /_static/images/keypairs.webp + :width: 50% + :align: center + :alt: Network Topology Diagram +``` + +3. Create a security [group] for the new VyOS instance and open all traffic. + +```{eval-rst} +.. image:: /_static/images/sg.webp + :width: 50% + :align: center + :alt: Network Topology Diagram +``` + +```{eval-rst} +.. image:: /_static/images/traffic.webp + :width: 50% + :align: center + :alt: Network Topology Diagram +``` + + +### Terraform + +```{eval-rst} +1. Create an UNIX or Windows instance. + +2. Download and install + `Terraform `__. + +3. Create a folder, for example ``/root/awsterraform``: + + .. code-block:: none + + mkdir /root/awsterraform + +.. stop_vyoslinter + +4. Copy all files into your Terraform project + (``vyos.tf``, ``var.tf``, ``terraform.tfvars``, ``version.tf``). + See `Structure of files in Terraform for AWS <#structure-of-files-in-terraform-for-aws>`__ for more details. + +.. start_vyoslinter + +5. Run the following commands: + +.. code-block:: none + + cd / + terraform init +``` + +### Ansible + +```{eval-rst} +1. Create a UNIX instance whenever you need. + +2. Download and install Ansible + +3. Create a folder, for example ``/root/aws/``. + +.. stop_vyoslinter + +4. Copy all files into your Ansible project + (``ansible.cfg``, ``instance.yml``, + ``mykey.pem``, and ``all``). + See `Structure of files in Ansible for AWS <#structure-of-files-in-ansible-for-aws>`__ for more details. + You can obtain ``mykey.pem`` by creating a key `pair `__ in AWS and + downloading your ``.pem`` key. +``` + +### Deploy with Terraform + +Run the following commands on your Terraform instance: + +```none +cd / +terraform plan +terraform apply +yes +``` + +## Create an AWS instance and check its configuration + +```none +root@localhost:~/awsterraform# terraform apply + +Terraform used the selected providers to generate the following execution plan. +Resource actions are indicated with the following symbols: + + create + +Terraform will perform the following actions: + + # aws_instance.myVyOSec2 will be created + + resource "aws_instance" "myVyOSec2" { + + ami = "ami-************62c2d" + + arn = (known after apply) + + associate_public_ip_address = (known after apply) + + availability_zone = (known after apply) + + cpu_core_count = (known after apply) + + cpu_threads_per_core = (known after apply) + + disable_api_stop = (known after apply) + + disable_api_termination = (known after apply) + + ebs_optimized = (known after apply) + + get_password_data = false + + host_id = (known after apply) + + host_resource_group_arn = (known after apply) + + iam_instance_profile = (known after apply) + + id = (known after apply) + + instance_initiated_shutdown_behavior = (known after apply) + + instance_lifecycle = (known after apply) + + instance_state = (known after apply) + + instance_type = "t2.micro" + + ipv6_address_count = (known after apply) + + ipv6_addresses = (known after apply) + + key_name = "awsterraform" + + monitoring = (known after apply) + + outpost_arn = (known after apply) + + password_data = (known after apply) + + placement_group = (known after apply) + + placement_partition_number = (known after apply) + + primary_network_interface_id = (known after apply) + + private_dns = (known after apply) + + private_ip = (known after apply) + + public_dns = (known after apply) + + public_ip = (known after apply) + + secondary_private_ips = (known after apply) + + security_groups = [ + + "awsterraformsg", + ] + + source_dest_check = true + + spot_instance_request_id = (known after apply) + + subnet_id = (known after apply) + + tags = { + + "name" = "VyOS System" + } + + tags_all = { + + "name" = "VyOS System" + } + + tenancy = (known after apply) + + user_data = (known after apply) + + user_data_base64 = (known after apply) + + user_data_replace_on_change = false + + vpc_security_group_ids = (known after apply) + } + + # local_file.ip will be created + + resource "local_file" "ip" { + + content = (known after apply) + + content_base64sha256 = (known after apply) + + content_base64sha512 = (known after apply) + + content_md5 = (known after apply) + + content_sha1 = (known after apply) + + content_sha256 = (known after apply) + + content_sha512 = (known after apply) + + directory_permission = "0777" + + file_permission = "0777" + + filename = "ip.txt" + + id = (known after apply) + } + + # null_resource.SSHconnection1 will be created + + resource "null_resource" "SSHconnection1" { + + id = (known after apply) + } + + # null_resource.SSHconnection2 will be created + + resource "null_resource" "SSHconnection2" { + + id = (known after apply) + } + +Plan: 4 to add, 0 to change, 0 to destroy. + +Changes to Outputs: + + my_IP = (known after apply) + +Do you want to perform these actions? + Terraform will perform the actions described above. + Only 'yes' will be accepted to approve. + + Enter a value: yes + +aws_instance.myVyOSec2: Creating... +aws_instance.myVyOSec2: Still creating... [10s elapsed] +aws_instance.myVyOSec2: Still creating... [20s elapsed] +aws_instance.myVyOSec2: Still creating... [30s elapsed] +aws_instance.myVyOSec2: Still creating... [40s elapsed] +aws_instance.myVyOSec2: Creation complete after 44s [id=i-09edfca15aac2fe0a] +null_resource.SSHconnection1: Creating... +null_resource.SSHconnection2: Creating... +null_resource.SSHconnection1: Provisioning with 'file'... +null_resource.SSHconnection2: Provisioning with 'remote-exec'... +null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... +null_resource.SSHconnection2 (remote-exec): Host: 10.217.80.104 +null_resource.SSHconnection2 (remote-exec): User: root +null_resource.SSHconnection2 (remote-exec): Password: true +null_resource.SSHconnection2 (remote-exec): Private key: false +null_resource.SSHconnection2 (remote-exec): Certificate: false +null_resource.SSHconnection2 (remote-exec): SSH Agent: false +null_resource.SSHconnection2 (remote-exec): Checking Host Key: false +null_resource.SSHconnection2 (remote-exec): Target Platform: unix +local_file.ip: Creating... +local_file.ip: Creation complete after 0s [id=e8e91f2e24579cd28b92e2d152c0c24c3bf4b52c] +null_resource.SSHconnection2 (remote-exec): Connected! +null_resource.SSHconnection1: Creation complete after 0s [id=7070868940858935600] + +null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ + +null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** +null_resource.SSHconnection2: Still creating... [10s elapsed] +null_resource.SSHconnection2: Still creating... [20s elapsed] +null_resource.SSHconnection2: Still creating... [30s elapsed] +null_resource.SSHconnection2: Still creating... [40s elapsed] +null_resource.SSHconnection2: Still creating... [50s elapsed] +null_resource.SSHconnection2: Still creating... [1m0s elapsed] +null_resource.SSHconnection2 (remote-exec): ok: [54.xxx.xxx.xxx] + +null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* +null_resource.SSHconnection2: Still creating... [1m10s elapsed] +null_resource.SSHconnection2 (remote-exec): changed: [54.xxx.xxx.xxx] + +null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* +null_resource.SSHconnection2 (remote-exec): 54.xxx.xxx.xxx : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +null_resource.SSHconnection2: Creation complete after 1m16s [id=4902256962410024771] + +Apply complete! Resources: 4 added, 0 changed, 0 destroyed. + +Outputs: + +my_IP = "54.xxx.xxx.xxx" +``` + +After running all the commands, your VyOS instance is deployed on +AWS with your specified configuration. +To delete the instance, type the following command: + +```none +terraform destroy +``` + +## Troubleshooting + +1. If Ansible doesn't connect via SSH to your AWS instance, verify that + your SSH key is in the path `/root/aws/`. You might need to + increase the timeout in `instance.yml` from 300 seconds to 500 + seconds or more, depending on your location. Make sure that the + security group allows access to the instance. +2. If Terraform doesn't connect via SSH to your Ansible instance, + verify the correct login and password in the `VyOS.tf` file. + +```{eval-rst} + .. code-block:: none + + connection { + type = "ssh" + user = "root" # open root access using login and password on your Ansible + password = var.password # check password in the file terraform.tfvars isn't empty + host = var.host # check the correct IP address of your Ansible host + } +``` + +Make sure Ansible can ping from Terraform. + +## Structure of files in Terraform for AWS + +```none +. +├── vyos.tf # The main script +├── var.tf # The file of all variables in "vyos.tf" +├── versions.tf # File for the changing version of Terraform. +└── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) +``` + +## File contents of Terraform for AWS + +`vyos.tf` + +```none +############################################################################## +# Build a VyOS VM from the Marketplace. +# Find the necessary AMI image_ in AWS. +# +# The vyos.tf script uses default values (you can change them as +# needed) +# AWS Region = "us-east-1" +# AMI = "standard AMI of VyOS from AWS Marketplace" +# Size of VM = "t2.micro" +# AWS Region = "us-east-1" +# After deploying the AWS instance and getting an IP address, the IP address is copied into the file +#"ip.txt" and copied to the Ansible node for provisioning. +############################################################################## + +provider "aws" { + access_key = var.access + secret_key = var.secret + region = var.region +} + +variable "region" { + default = "us-east-1" + description = "AWS Region" +} + +variable "ami" { + default = "ami-**************3b3" # ami image please enter your details + description = "Amazon Machine Image ID for VyOS" +} + +variable "type" { + default = "t2.micro" + description = "Size of VM" +} + +# my resource for VyOS + +resource "aws_instance" "myVyOSec2" { + ami = var.ami + key_name = "awsterraform" # Please enter your details from 1.2 of Preparation steps for deploying VyOS on AWS + security_groups = ["awsterraformsg"] # Please enter your details from 1.3 of Preparation steps for deploying VyOS on AWS + instance_type = var.type + tags = { + name = "VyOS System" + } +} + +############################################################################## +# Specific variable (to getting type "terraform plan"): +# aws_instance.myVyOSec2.public_ip - the information about public IP address +# of our instance, needs for provisioning and SSH connection from Ansible +############################################################################## + +output "my_IP"{ +value = aws_instance.myVyOSec2.public_ip +} + +############################################################################## +# The IP address of the AWS instance is copied to the ip.txt file +# on the local Terraform system. The ip.txt file contains the public +# IP address in the format: xxx.xxx.xxx.xxx +############################################################################## + +resource "local_file" "ip" { + content = aws_instance.myVyOSec2.public_ip + filename = "ip.txt" +} + +#connecting to the Ansible control node using SSH connection + +############################################################################## +# The "SSHconnection1" and "SSHconnection2" steps retrieve ip.txt +# from the Terraform node and run the Ansible playbook remotely. +############################################################################## + +resource "null_resource" "SSHconnection1" { +depends_on = [aws_instance.myVyOSec2] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} + +# Copy the ip.txt file to the Ansible control node from the local +# system + provisioner "file" { + source = "ip.txt" + destination = "/root/aws/ip.txt" # The folder of your Ansible project + } +} + +resource "null_resource" "SSHconnection2" { +depends_on = [aws_instance.myVyOSec2] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} +# Run Ansible playbook on remote Linux OS +provisioner "remote-exec" { + inline = [ + "cd /root/aws/", + "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for AWS" +] +} +} +``` + +`var.tf` + +```none +variable "password" { + description = "pass for Ansible" + type = string + sensitive = true +} +variable "host"{ + description = "The IP of my Ansible" + type = string +} +variable "access" { + description = "my access_key for AWS" + type = string + sensitive = true +} +variable "secret" { + description = "my secret_key for AWS" + type = string + sensitive = true +} +``` + +`versions.tf` + +```none + terraform { + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.0" + } + } +} +``` + +`terraform.tfvars` + +```none +password = "" # password for Ansible SSH +host = "" # IP of my Ansible +access = "" # access_key for AWS +secret = "" # secret_key for AWS +``` + +## Structure of files in Ansible for AWS + +```none +. +├── group_vars + └── all +├── ansible.cfg +├── mykey.pem +└── instance.yml +``` + +## File contents of Ansible for AWS + +`ansible.cfg` + +```none +[defaults] +inventory = /root/aws/ip.txt +host_key_checking= False +private_key_file = /root/aws/awsterraform.pem # check the name +remote_user=vyos +``` + +`mykey.pem` + +```none +Copy your key.pem from AWS +``` + +`instance.yml` + +```none +############################################################################## +# About tasks: +# "Wait 300 seconds, but only start checking after 60 seconds" - +# attempts SSH connection every 60 seconds until 300 seconds +# "Configure general settings for the VyOS hosts group" - +# provisions the AWS VyOS node +# Add all necessary VyOS commands under the "lines:" block +############################################################################## + +- name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true +``` + +`group_vars/all` + +```none +ansible_connection: ansible.netcommon.network_cli +ansible_network_os: vyos.vyos.vyos +ansible_user: vyos +``` + + +## Source files on GitHub + +All files related to deploying VyOS on AWS with Terraform and Ansible +can be found in the [vyos-automation] repository. + +[group]: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html +[pair]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html +[vyos-automation]: diff --git a/docs/automation/terraform/terraformAWS.rst b/docs/automation/terraform/terraformAWS.rst deleted file mode 100644 index 8156fac4..00000000 --- a/docs/automation/terraform/terraformAWS.rst +++ /dev/null @@ -1,576 +0,0 @@ -:lastproofread: 2026-03-16 - -.. _terraformAWS: - -Deploy VyOS on AWS with Terraform and Ansible -============================================= - -You can use Terraform to quickly deploy VyOS-based infrastructure -on AWS and remove infrastructure when it's no longer needed. -Additionally, you can use Ansible for provisioning. - - -.. image:: /_static/images/aws.* - :width: 50% - :align: center - :alt: Network Topology Diagram - -On this page you'll learn how to: - -* Create the necessary files for Terraform and Ansible. -* Use Terraform to create a single instance on AWS and use Ansible for - provisioning. - - -Prepare to deploy VyOS with Terraform on AWS --------------------------------------------- - -To create a single instance and install your configuration using -Terraform, Ansible, and AWS, follow these steps: - -AWS -^^^ - - -1. Create an account with AWS and get your ``access_key`` and ``secret_key``. - -2. Create a key pair_ and download your ``.pem`` key. - -.. image:: /_static/images/keypairs.* - :width: 50% - :align: center - :alt: Network Topology Diagram - -3. Create a security group_ for the new VyOS instance and open all traffic. - -.. image:: /_static/images/sg.* - :width: 50% - :align: center - :alt: Network Topology Diagram - - -.. image:: /_static/images/traffic.* - :width: 50% - :align: center - :alt: Network Topology Diagram - -Terraform -^^^^^^^^^ - -1. Create an UNIX or Windows instance. - -2. Download and install - `Terraform `__. - -3. Create a folder, for example ``/root/awsterraform``: - - .. code-block:: none - - mkdir /root/awsterraform - -.. stop_vyoslinter - -4. Copy all files into your Terraform project - (``vyos.tf``, ``var.tf``, ``terraform.tfvars``, ``version.tf``). - See `Structure of files in Terraform for AWS <#structure-of-files-in-terraform-for-aws>`__ for more details. - -.. start_vyoslinter - -5. Run the following commands: - -.. code-block:: none - - cd / - terraform init - -Ansible -^^^^^^^ - - -1. Create a UNIX instance whenever you need. - -2. Download and install Ansible - -3. Create a folder, for example ``/root/aws/``. - -.. stop_vyoslinter - -4. Copy all files into your Ansible project - (``ansible.cfg``, ``instance.yml``, - ``mykey.pem``, and ``all``). - See `Structure of files in Ansible for AWS <#structure-of-files-in-ansible-for-aws>`__ for more details. - You can obtain ``mykey.pem`` by creating a key pair_ in AWS and - downloading your ``.pem`` key. - -.. start_vyoslinter - -Deploy with Terraform -^^^^^^^^^^^^^^^^^^^^^ - - -Run the following commands on your Terraform instance: - -.. code-block:: none - - cd / - terraform plan - terraform apply - yes - - -Create an AWS instance and check its configuration --------------------------------------------------- - -.. code-block:: none - - root@localhost:~/awsterraform# terraform apply - - Terraform used the selected providers to generate the following execution plan. - Resource actions are indicated with the following symbols: - + create - - Terraform will perform the following actions: - - # aws_instance.myVyOSec2 will be created - + resource "aws_instance" "myVyOSec2" { - + ami = "ami-************62c2d" - + arn = (known after apply) - + associate_public_ip_address = (known after apply) - + availability_zone = (known after apply) - + cpu_core_count = (known after apply) - + cpu_threads_per_core = (known after apply) - + disable_api_stop = (known after apply) - + disable_api_termination = (known after apply) - + ebs_optimized = (known after apply) - + get_password_data = false - + host_id = (known after apply) - + host_resource_group_arn = (known after apply) - + iam_instance_profile = (known after apply) - + id = (known after apply) - + instance_initiated_shutdown_behavior = (known after apply) - + instance_lifecycle = (known after apply) - + instance_state = (known after apply) - + instance_type = "t2.micro" - + ipv6_address_count = (known after apply) - + ipv6_addresses = (known after apply) - + key_name = "awsterraform" - + monitoring = (known after apply) - + outpost_arn = (known after apply) - + password_data = (known after apply) - + placement_group = (known after apply) - + placement_partition_number = (known after apply) - + primary_network_interface_id = (known after apply) - + private_dns = (known after apply) - + private_ip = (known after apply) - + public_dns = (known after apply) - + public_ip = (known after apply) - + secondary_private_ips = (known after apply) - + security_groups = [ - + "awsterraformsg", - ] - + source_dest_check = true - + spot_instance_request_id = (known after apply) - + subnet_id = (known after apply) - + tags = { - + "name" = "VyOS System" - } - + tags_all = { - + "name" = "VyOS System" - } - + tenancy = (known after apply) - + user_data = (known after apply) - + user_data_base64 = (known after apply) - + user_data_replace_on_change = false - + vpc_security_group_ids = (known after apply) - } - - # local_file.ip will be created - + resource "local_file" "ip" { - + content = (known after apply) - + content_base64sha256 = (known after apply) - + content_base64sha512 = (known after apply) - + content_md5 = (known after apply) - + content_sha1 = (known after apply) - + content_sha256 = (known after apply) - + content_sha512 = (known after apply) - + directory_permission = "0777" - + file_permission = "0777" - + filename = "ip.txt" - + id = (known after apply) - } - - # null_resource.SSHconnection1 will be created - + resource "null_resource" "SSHconnection1" { - + id = (known after apply) - } - - # null_resource.SSHconnection2 will be created - + resource "null_resource" "SSHconnection2" { - + id = (known after apply) - } - - Plan: 4 to add, 0 to change, 0 to destroy. - - Changes to Outputs: - + my_IP = (known after apply) - - Do you want to perform these actions? - Terraform will perform the actions described above. - Only 'yes' will be accepted to approve. - - Enter a value: yes - - aws_instance.myVyOSec2: Creating... - aws_instance.myVyOSec2: Still creating... [10s elapsed] - aws_instance.myVyOSec2: Still creating... [20s elapsed] - aws_instance.myVyOSec2: Still creating... [30s elapsed] - aws_instance.myVyOSec2: Still creating... [40s elapsed] - aws_instance.myVyOSec2: Creation complete after 44s [id=i-09edfca15aac2fe0a] - null_resource.SSHconnection1: Creating... - null_resource.SSHconnection2: Creating... - null_resource.SSHconnection1: Provisioning with 'file'... - null_resource.SSHconnection2: Provisioning with 'remote-exec'... - null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... - null_resource.SSHconnection2 (remote-exec): Host: 10.217.80.104 - null_resource.SSHconnection2 (remote-exec): User: root - null_resource.SSHconnection2 (remote-exec): Password: true - null_resource.SSHconnection2 (remote-exec): Private key: false - null_resource.SSHconnection2 (remote-exec): Certificate: false - null_resource.SSHconnection2 (remote-exec): SSH Agent: false - null_resource.SSHconnection2 (remote-exec): Checking Host Key: false - null_resource.SSHconnection2 (remote-exec): Target Platform: unix - local_file.ip: Creating... - local_file.ip: Creation complete after 0s [id=e8e91f2e24579cd28b92e2d152c0c24c3bf4b52c] - null_resource.SSHconnection2 (remote-exec): Connected! - null_resource.SSHconnection1: Creation complete after 0s [id=7070868940858935600] - - null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ - - null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** - null_resource.SSHconnection2: Still creating... [10s elapsed] - null_resource.SSHconnection2: Still creating... [20s elapsed] - null_resource.SSHconnection2: Still creating... [30s elapsed] - null_resource.SSHconnection2: Still creating... [40s elapsed] - null_resource.SSHconnection2: Still creating... [50s elapsed] - null_resource.SSHconnection2: Still creating... [1m0s elapsed] - null_resource.SSHconnection2 (remote-exec): ok: [54.xxx.xxx.xxx] - - null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* - null_resource.SSHconnection2: Still creating... [1m10s elapsed] - null_resource.SSHconnection2 (remote-exec): changed: [54.xxx.xxx.xxx] - - null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* - null_resource.SSHconnection2 (remote-exec): 54.xxx.xxx.xxx : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - - null_resource.SSHconnection2: Creation complete after 1m16s [id=4902256962410024771] - - Apply complete! Resources: 4 added, 0 changed, 0 destroyed. - - Outputs: - - my_IP = "54.xxx.xxx.xxx" - - - -After running all the commands, your VyOS instance is deployed on -AWS with your specified configuration. -To delete the instance, type the following command: - -.. code-block:: none - - terraform destroy - - -Troubleshooting ---------------- - -1. If Ansible doesn't connect via SSH to your AWS instance, verify that - your SSH key is in the path ``/root/aws/``. You might need to - increase the timeout in ``instance.yml`` from 300 seconds to 500 - seconds or more, depending on your location. Make sure that the - security group allows access to the instance. - -2. If Terraform doesn't connect via SSH to your Ansible instance, - verify the correct login and password in the ``VyOS.tf`` file. - - .. code-block:: none - - connection { - type = "ssh" - user = "root" # open root access using login and password on your Ansible - password = var.password # check password in the file terraform.tfvars isn't empty - host = var.host # check the correct IP address of your Ansible host - } - - -Make sure Ansible can ping from Terraform. - -Structure of files in Terraform for AWS ---------------------------------------- - -.. code-block:: none - - . - ├── vyos.tf # The main script - ├── var.tf # The file of all variables in "vyos.tf" - ├── versions.tf # File for the changing version of Terraform. - └── terraform.tfvars # The value of all variables (passwords, login, ip adresses and so on) - - -File contents of Terraform for AWS ----------------------------------- - -``vyos.tf`` - -.. code-block:: none - - - ############################################################################## - # Build a VyOS VM from the Marketplace. - # Find the necessary AMI image_ in AWS. - # - # The vyos.tf script uses default values (you can change them as - # needed) - # AWS Region = "us-east-1" - # AMI = "standard AMI of VyOS from AWS Marketplace" - # Size of VM = "t2.micro" - # AWS Region = "us-east-1" - # After deploying the AWS instance and getting an IP address, the IP address is copied into the file - #"ip.txt" and copied to the Ansible node for provisioning. - ############################################################################## - - provider "aws" { - access_key = var.access - secret_key = var.secret - region = var.region - } - - variable "region" { - default = "us-east-1" - description = "AWS Region" - } - - variable "ami" { - default = "ami-**************3b3" # ami image please enter your details - description = "Amazon Machine Image ID for VyOS" - } - - variable "type" { - default = "t2.micro" - description = "Size of VM" - } - - # my resource for VyOS - - resource "aws_instance" "myVyOSec2" { - ami = var.ami - key_name = "awsterraform" # Please enter your details from 1.2 of Preparation steps for deploying VyOS on AWS - security_groups = ["awsterraformsg"] # Please enter your details from 1.3 of Preparation steps for deploying VyOS on AWS - instance_type = var.type - tags = { - name = "VyOS System" - } - } - - ############################################################################## - # Specific variable (to getting type "terraform plan"): - # aws_instance.myVyOSec2.public_ip - the information about public IP address - # of our instance, needs for provisioning and SSH connection from Ansible - ############################################################################## - - output "my_IP"{ - value = aws_instance.myVyOSec2.public_ip - } - - ############################################################################## - # The IP address of the AWS instance is copied to the ip.txt file - # on the local Terraform system. The ip.txt file contains the public - # IP address in the format: xxx.xxx.xxx.xxx - ############################################################################## - - resource "local_file" "ip" { - content = aws_instance.myVyOSec2.public_ip - filename = "ip.txt" - } - - #connecting to the Ansible control node using SSH connection - - ############################################################################## - # The "SSHconnection1" and "SSHconnection2" steps retrieve ip.txt - # from the Terraform node and run the Ansible playbook remotely. - ############################################################################## - - resource "null_resource" "SSHconnection1" { - depends_on = [aws_instance.myVyOSec2] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - - # Copy the ip.txt file to the Ansible control node from the local - # system - provisioner "file" { - source = "ip.txt" - destination = "/root/aws/ip.txt" # The folder of your Ansible project - } - } - - resource "null_resource" "SSHconnection2" { - depends_on = [aws_instance.myVyOSec2] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - # Run Ansible playbook on remote Linux OS - provisioner "remote-exec" { - inline = [ - "cd /root/aws/", - "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for AWS" - ] - } - } - - -``var.tf`` - -.. code-block:: none - - variable "password" { - description = "pass for Ansible" - type = string - sensitive = true - } - variable "host"{ - description = "The IP of my Ansible" - type = string - } - variable "access" { - description = "my access_key for AWS" - type = string - sensitive = true - } - variable "secret" { - description = "my secret_key for AWS" - type = string - sensitive = true - } - -``versions.tf`` - -.. code-block:: none - - terraform { - required_providers { - aws = { - source = "hashicorp/aws" - version = "~> 5.0" - } - } - } - -``terraform.tfvars`` - -.. code-block:: none - - password = "" # password for Ansible SSH - host = "" # IP of my Ansible - access = "" # access_key for AWS - secret = "" # secret_key for AWS - - -Structure of files in Ansible for AWS -------------------------------------- - -.. code-block:: none - - . - ├── group_vars - └── all - ├── ansible.cfg - ├── mykey.pem - └── instance.yml - - -File contents of Ansible for AWS --------------------------------- - -``ansible.cfg`` - -.. code-block:: none - - [defaults] - inventory = /root/aws/ip.txt - host_key_checking= False - private_key_file = /root/aws/awsterraform.pem # check the name - remote_user=vyos - -``mykey.pem`` - -.. code-block:: none - - Copy your key.pem from AWS - - -``instance.yml`` - - - -.. code-block:: none - - ############################################################################## - # About tasks: - # "Wait 300 seconds, but only start checking after 60 seconds" - - # attempts SSH connection every 60 seconds until 300 seconds - # "Configure general settings for the VyOS hosts group" - - # provisions the AWS VyOS node - # Add all necessary VyOS commands under the "lines:" block - ############################################################################## - - - - name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true - - -``group_vars/all`` - -.. code-block:: none - - ansible_connection: ansible.netcommon.network_cli - ansible_network_os: vyos.vyos.vyos - ansible_user: vyos - -Source files on GitHub ----------------------- - -All files related to deploying VyOS on AWS with Terraform and Ansible -can be found in the vyos-automation_ repository. - - -.. stop_vyoslinter -.. _link: https://developer.hashicorp.com/terraform/intro -.. _install: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli -.. _pair: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/create-key-pairs.html -.. _group: https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-sg.html -.. _image: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html -.. _vyos-automation: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/AWS_terraform_ansible_single_vyos_instance-main - -.. start_vyoslinter diff --git a/docs/automation/terraform/terraformAZ.md b/docs/automation/terraform/terraformAZ.md new file mode 100644 index 00000000..b1b8fac0 --- /dev/null +++ b/docs/automation/terraform/terraformAZ.md @@ -0,0 +1,501 @@ +--- +lastproofread: '2026-03-19' +--- + +(terraformaz)= + +# Deploy VyOS on Microsoft Azure with Terraform and Ansible + +You can use Terraform to quickly deploy VyOS-based infrastructure +on Microsoft Azure (hereafter referred to as *Azure*) and remove +infrastructure when it's no longer needed. +Additionally, you can use Ansible for provisioning. + +On this page you'll learn how to: + +- Create the necessary files for Terraform and Ansible. +- Use Terraform to create a single instance on Azure and use Ansible for + provisioning. + +## Prepare to deploy VyOS with Terraform on Azure + +To create a single instance and install your configuration using +Terraform, Ansible, and Azure, follow these steps: + +### Azure + +- Create an [Azure account](https://azure.microsoft.com/). + +### Terraform + +```{eval-rst} +1. Create an UNIX or Windows instance. + +2. Download and install + `Terraform `__. + +3. Create the folder for example ``/root/azvyos/``. + +.. code-block:: none + + mkdir /root/azvyos + +.. stop_vyoslinter + +4. Copy all files into your Terraform project "/root/azvyos" + (``vyos.tf``, ``var.tf``, ``terraform.tfvars``). For more details, see + `Structure of files in Terraform for Azure <#structure-of-files-in-terraform-for-azure>`_. + +.. start_vyoslinter + +5. Log in to Azure using the command: + + .. code-block:: none + + az login + +6. Run the following commands to initialize Terraform: + + .. code-block:: none + + cd / + terraform init +``` + + +### Ansible + +1. Create an UNIX instance either locally or in the cloud. + +2. Download and install Ansible + +3. Create a folder, for example `/root/az/`. + +4. Copy all files into your Ansible project `/root/az/` (`ansible.cfg`, + `instance.yml`, `all`). For more details, see + [Structure of files in Ansible for Azure](#structure-of-files-in-ansible-for-azure) + +### Deploy with Terraform + +Run the following commands on your Terraform instance: + +```none +cd / +terraform plan +terraform apply +yes +``` + +After executing all the commands, your VyOS instance is deployed to +Azure with your configuration. +If you need to delete the instance, run the following command: + +```none +terraform destroy +``` + + +## Structure of files in Terraform for Azure + +```none +. +├── vyos.tf # The main script +├── var.tf # File for the Terraform version. +└── terraform.tfvars # Values for all variables (passwords, + # login, IP addresses, etc.) +``` + + +## File contents of Terraform for Azure + +`vyos.tf` + +```none +############################################################################## +# HashiCorp Guide to Using Terraform on Azure +# This Terraform configuration will create the following: +# Resource group with a virtual network and subnet +# A VyOS server without SSH key (only login+password) +############################################################################## + +# Choose a provider + +provider "azurerm" { + features {} +} + +# Create a resource group. In Azure, every resource belongs to a +# resource group. + +resource "azurerm_resource_group" "azure_vyos" { + name = "${var.resource_group}" + location = "${var.location}" +} + +# The next resource is a Virtual Network. + +resource "azurerm_virtual_network" "vnet" { + name = "${var.virtual_network_name}" + location = "${var.location}" + address_space = ["${var.address_space}"] + resource_group_name = "${var.resource_group}" +} + +# Build a subnet to run your VMs. + +resource "azurerm_subnet" "subnet" { + name = "${var.prefix}subnet" + virtual_network_name = "${azurerm_virtual_network.vnet.name}" + resource_group_name = "${var.resource_group}" + address_prefixes = ["${var.subnet_prefix}"] +} + +############################################################################## +# Build a VyOS VM from the Marketplace. +# To find the necessary image, use the command: +# +# az vm image list --offer vyos --all +# +# Now that you have a network, you can deploy a VyOS server. +# An Azure Virtual Machine has several components. In this example, +# you build a security group, a network interface, a public IP +# address, a storage account, and finally the VM itself. Terraform +# handles all the dependencies automatically, and each resource is +# named with user-defined variables. +############################################################################## + + +# Security group to allow inbound access on port 22 (SSH) + +resource "azurerm_network_security_group" "vyos-sg" { + name = "${var.prefix}-sg" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + + security_rule { + name = "SSH" + priority = 100 + direction = "Inbound" + access = "Allow" + protocol = "Tcp" + source_port_range = "*" + destination_port_range = "22" + source_address_prefix = "${var.source_network}" + destination_address_prefix = "*" + } +} + +# A network interface. + +resource "azurerm_network_interface" "vyos-nic" { + name = "${var.prefix}vyos-nic" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + + ip_configuration { + name = "${var.prefix}ipconfig" + subnet_id = "${azurerm_subnet.subnet.id}" + private_ip_address_allocation = "Dynamic" + public_ip_address_id = "${azurerm_public_ip.vyos-pip.id}" + } +} + +# Add a public IP address. + +resource "azurerm_public_ip" "vyos-pip" { + name = "${var.prefix}-ip" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + allocation_method = "Dynamic" +} + +# Build a virtual machine. This is a standard VyOS instance from +# Marketplace. + +resource "azurerm_virtual_machine" "vyos" { + name = "${var.hostname}-vyos" + location = "${var.location}" + resource_group_name = "${var.resource_group}" + vm_size = "${var.vm_size}" + + network_interface_ids = ["${azurerm_network_interface.vyos-nic.id}"] + delete_os_disk_on_termination = "true" + +# To find information about the plan, use the command: +# az vm image list --offer vyos --all + + plan { + publisher = "sentriumsl" + name = "vyos-1-3" + product = "vyos-1-2-lts-on-azure" + } + + storage_image_reference { + publisher = "${var.image_publisher}" + offer = "${var.image_offer}" + sku = "${var.image_sku}" + version = "${var.image_version}" + } + + storage_os_disk { + name = "${var.hostname}-osdisk" + managed_disk_type = "Standard_LRS" + caching = "ReadWrite" + create_option = "FromImage" + } + + os_profile { + computer_name = "${var.hostname}" + admin_username = "${var.admin_username}" + admin_password = "${var.admin_password}" + } + + os_profile_linux_config { + disable_password_authentication = false + } +} + +data "azurerm_public_ip" "example" { + depends_on = ["azurerm_virtual_machine.vyos"] + name = "vyos-ip" + resource_group_name = "${var.resource_group}" +} +output "public_ip_address" { + value = data.azurerm_public_ip.example.ip_address +} + +# IP of AZ instance copied to a file ip.txt in the local system. + +resource "local_file" "ip" { + content = data.azurerm_public_ip.example.ip_address + filename = "ip.txt" +} + +# Connect to the Ansible control node via SSH + +resource "null_resource" "nullremote1" { +depends_on = ["azurerm_virtual_machine.vyos"] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} + +# Copy the ip.txt file to the Ansible control node from the local +# system + + provisioner "file" { + source = "ip.txt" + destination = "/root/az/ip.txt" + } +} + +resource "null_resource" "nullremote2" { +depends_on = ["azurerm_virtual_machine.vyos"] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} + +# Run the Ansible playbook on the remote Linux OS + +provisioner "remote-exec" { + + inline = [ + "cd /root/az/", + "ansible-playbook instance.yml" +] +} +} +``` + +`var.tf` + +```none +############################################################################## +# Variables File +# +# Default values for all variables used in Terraform code. +############################################################################## + +variable "resource_group" { + description = "The name of your Azure Resource Group." + default = "my_resource_group" +} + +variable "prefix" { + description = "This prefix will be included in the name of some resources." + default = "vyos" +} + +variable "hostname" { + description = "Virtual machine hostname. Used for local hostname, DNS, and storage-related names." + default = "vyos_terraform" +} + +variable "location" { + description = "The region where the virtual network is created." + default = "centralus" +} + +variable "virtual_network_name" { + description = "The name for your virtual network." + default = "vnet" +} + +variable "address_space" { + description = "The address space that is used by the virtual network. You can supply more than one address space. Changing this forces a new resource to be created." + default = "10.0.0.0/16" +} + +variable "subnet_prefix" { + description = "The address prefix to use for the subnet." + default = "10.0.10.0/24" +} + +variable "storage_account_tier" { + description = "Defines the storage tier. Valid options are Standard and Premium." + default = "Standard" +} + +variable "storage_replication_type" { + description = "Defines the replication type to use for this storage account. Valid options include LRS, GRS etc." + default = "LRS" +} + +# The most cost-effective size + +variable "vm_size" { + description = "Specifies the size of the virtual machine." + default = "Standard_B1s" +} + +variable "image_publisher" { + description = "Name of the publisher of the image (az vm image list)" + default = "sentriumsl" +} + +variable "image_offer" { + description = "Name of the offer (az vm image list)" + default = "vyos-1-2-lts-on-azure" +} + +variable "image_sku" { + description = "Image SKU to apply (az vm image list)" + default = "vyos-1-3" +} + +variable "image_version" { + description = "Version of the image to apply (az vm image list)" + default = "1.3.3" +} + +variable "admin_username" { + description = "Administrator user name" + default = "vyos" +} + +variable "admin_password" { + description = "Administrator password" + type = string + sensitive = true +} + +variable "source_network" { + description = "Allow access from this network prefix. Defaults to '*'." + default = "*" +} + +variable "password" { + description = "pass for Ansible" + type = string + sensitive = true +} +variable "host"{ + description = "IP of my Ansible" +} +``` + +`terraform.tfvars` + +```none +password = "" # password for Ansible SSH +host = "" # IP of my Ansible +``` + + +## Structure of files in Ansible for Azure + +```none +. +├── group_vars + └── all +├── ansible.cfg +└── instance.yml +``` + + +## File contents of Ansible for Azure + +`ansible.cfg` + +```none +[defaults] +inventory = /root/az/ip.txt +host_key_checking= False +remote_user=vyos +``` + +`instance.yml` + +```none +############################################################################## +# About tasks: +# "Wait 300 seconds, but only start checking after 60 seconds" - Tries +# to make SSH connection every 60 seconds until 300 seconds. +# "Configure general settings for the VyOS hosts group" - Provision +# the Azure VyOS node. +# Add all necessary commands for VyOS under the block "lines:" +############################################################################## + + +- name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true +``` + +`group_vars/all` + +```none +ansible_connection: ansible.netcommon.network_cli +ansible_network_os: vyos.vyos.vyos + +# user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf +ansible_user: vyos +ansible_ssh_pass: "{{ vault_vyos_ssh_pass }}" +``` + + +## Source files on GitHub + +All files related to deploying VyOS on Azure with Terraform and Ansible +can be found in the [vyos-automation] repository. + +[vyos-automation]: diff --git a/docs/automation/terraform/terraformAZ.rst b/docs/automation/terraform/terraformAZ.rst deleted file mode 100644 index 9e094aea..00000000 --- a/docs/automation/terraform/terraformAZ.rst +++ /dev/null @@ -1,514 +0,0 @@ -:lastproofread: 2026-03-19 - -.. _terraformAZ: - -Deploy VyOS on Microsoft Azure with Terraform and Ansible -========================================================= - -You can use Terraform to quickly deploy VyOS-based infrastructure -on Microsoft Azure (hereafter referred to as *Azure*) and remove -infrastructure when it's no longer needed. -Additionally, you can use Ansible for provisioning. - -On this page you'll learn how to: - -* Create the necessary files for Terraform and Ansible. -* Use Terraform to create a single instance on Azure and use Ansible for - provisioning. - -Prepare to deploy VyOS with Terraform on Azure ----------------------------------------------- - -To create a single instance and install your configuration using -Terraform, Ansible, and Azure, follow these steps: - -Azure -^^^^^ - -1. Create an `Azure account `__. - -Terraform -^^^^^^^^^ - - -1. Create an UNIX or Windows instance. - -2. Download and install - `Terraform `__. - -3. Create the folder for example ``/root/azvyos/``. - -.. code-block:: none - - mkdir /root/azvyos - -.. stop_vyoslinter - -4. Copy all files into your Terraform project "/root/azvyos" - (``vyos.tf``, ``var.tf``, ``terraform.tfvars``). For more details, see - `Structure of files in Terraform for Azure <#structure-of-files-in-terraform-for-azure>`_. - -.. start_vyoslinter - -5. Log in to Azure using the command: - - .. code-block:: none - - az login - -6. Run the following commands to initialize Terraform: - - .. code-block:: none - - cd / - terraform init - -Ansible -^^^^^^^ - - -1. Create an UNIX instance either locally or in the cloud. - -2. Download and install Ansible - -3. Create a folder, for example ``/root/az/``. - -4. Copy all files into your Ansible project ``/root/az/`` (``ansible.cfg``, - ``instance.yml``, ``all``). For more details, see - `Structure of files in Ansible for Azure`_ - - -Deploy with Terraform -^^^^^^^^^^^^^^^^^^^^^ - - -Run the following commands on your Terraform instance: - -.. code-block:: none - - cd / - terraform plan - terraform apply - yes - -After executing all the commands, your VyOS instance is deployed to -Azure with your configuration. -If you need to delete the instance, run the following command: - -.. code-block:: none - - terraform destroy - -Structure of files in Terraform for Azure ------------------------------------------ - -.. code-block:: none - - . - ├── vyos.tf # The main script - ├── var.tf # File for the Terraform version. - └── terraform.tfvars # Values for all variables (passwords, - # login, IP addresses, etc.) - -File contents of Terraform for Azure ------------------------------------- - -``vyos.tf`` - -.. code-block:: none - - - ############################################################################## - # HashiCorp Guide to Using Terraform on Azure - # This Terraform configuration will create the following: - # Resource group with a virtual network and subnet - # A VyOS server without SSH key (only login+password) - ############################################################################## - - # Choose a provider - - provider "azurerm" { - features {} - } - - # Create a resource group. In Azure, every resource belongs to a - # resource group. - - resource "azurerm_resource_group" "azure_vyos" { - name = "${var.resource_group}" - location = "${var.location}" - } - - # The next resource is a Virtual Network. - - resource "azurerm_virtual_network" "vnet" { - name = "${var.virtual_network_name}" - location = "${var.location}" - address_space = ["${var.address_space}"] - resource_group_name = "${var.resource_group}" - } - - # Build a subnet to run your VMs. - - resource "azurerm_subnet" "subnet" { - name = "${var.prefix}subnet" - virtual_network_name = "${azurerm_virtual_network.vnet.name}" - resource_group_name = "${var.resource_group}" - address_prefixes = ["${var.subnet_prefix}"] - } - - ############################################################################## - # Build a VyOS VM from the Marketplace. - # To find the necessary image, use the command: - # - # az vm image list --offer vyos --all - # - # Now that you have a network, you can deploy a VyOS server. - # An Azure Virtual Machine has several components. In this example, - # you build a security group, a network interface, a public IP - # address, a storage account, and finally the VM itself. Terraform - # handles all the dependencies automatically, and each resource is - # named with user-defined variables. - ############################################################################## - - - # Security group to allow inbound access on port 22 (SSH) - - resource "azurerm_network_security_group" "vyos-sg" { - name = "${var.prefix}-sg" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - - security_rule { - name = "SSH" - priority = 100 - direction = "Inbound" - access = "Allow" - protocol = "Tcp" - source_port_range = "*" - destination_port_range = "22" - source_address_prefix = "${var.source_network}" - destination_address_prefix = "*" - } - } - - # A network interface. - - resource "azurerm_network_interface" "vyos-nic" { - name = "${var.prefix}vyos-nic" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - - ip_configuration { - name = "${var.prefix}ipconfig" - subnet_id = "${azurerm_subnet.subnet.id}" - private_ip_address_allocation = "Dynamic" - public_ip_address_id = "${azurerm_public_ip.vyos-pip.id}" - } - } - - # Add a public IP address. - - resource "azurerm_public_ip" "vyos-pip" { - name = "${var.prefix}-ip" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - allocation_method = "Dynamic" - } - - # Build a virtual machine. This is a standard VyOS instance from - # Marketplace. - - resource "azurerm_virtual_machine" "vyos" { - name = "${var.hostname}-vyos" - location = "${var.location}" - resource_group_name = "${var.resource_group}" - vm_size = "${var.vm_size}" - - network_interface_ids = ["${azurerm_network_interface.vyos-nic.id}"] - delete_os_disk_on_termination = "true" - - # To find information about the plan, use the command: - # az vm image list --offer vyos --all - - plan { - publisher = "sentriumsl" - name = "vyos-1-3" - product = "vyos-1-2-lts-on-azure" - } - - storage_image_reference { - publisher = "${var.image_publisher}" - offer = "${var.image_offer}" - sku = "${var.image_sku}" - version = "${var.image_version}" - } - - storage_os_disk { - name = "${var.hostname}-osdisk" - managed_disk_type = "Standard_LRS" - caching = "ReadWrite" - create_option = "FromImage" - } - - os_profile { - computer_name = "${var.hostname}" - admin_username = "${var.admin_username}" - admin_password = "${var.admin_password}" - } - - os_profile_linux_config { - disable_password_authentication = false - } - } - - data "azurerm_public_ip" "example" { - depends_on = ["azurerm_virtual_machine.vyos"] - name = "vyos-ip" - resource_group_name = "${var.resource_group}" - } - output "public_ip_address" { - value = data.azurerm_public_ip.example.ip_address - } - - # IP of AZ instance copied to a file ip.txt in the local system. - - resource "local_file" "ip" { - content = data.azurerm_public_ip.example.ip_address - filename = "ip.txt" - } - - # Connect to the Ansible control node via SSH - - resource "null_resource" "nullremote1" { - depends_on = ["azurerm_virtual_machine.vyos"] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - - # Copy the ip.txt file to the Ansible control node from the local - # system - - provisioner "file" { - source = "ip.txt" - destination = "/root/az/ip.txt" - } - } - - resource "null_resource" "nullremote2" { - depends_on = ["azurerm_virtual_machine.vyos"] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - - # Run the Ansible playbook on the remote Linux OS - - provisioner "remote-exec" { - - inline = [ - "cd /root/az/", - "ansible-playbook instance.yml" - ] - } - } - - -``var.tf`` - -.. code-block:: none - - ############################################################################## - # Variables File - # - # Default values for all variables used in Terraform code. - ############################################################################## - - variable "resource_group" { - description = "The name of your Azure Resource Group." - default = "my_resource_group" - } - - variable "prefix" { - description = "This prefix will be included in the name of some resources." - default = "vyos" - } - - variable "hostname" { - description = "Virtual machine hostname. Used for local hostname, DNS, and storage-related names." - default = "vyos_terraform" - } - - variable "location" { - description = "The region where the virtual network is created." - default = "centralus" - } - - variable "virtual_network_name" { - description = "The name for your virtual network." - default = "vnet" - } - - variable "address_space" { - description = "The address space that is used by the virtual network. You can supply more than one address space. Changing this forces a new resource to be created." - default = "10.0.0.0/16" - } - - variable "subnet_prefix" { - description = "The address prefix to use for the subnet." - default = "10.0.10.0/24" - } - - variable "storage_account_tier" { - description = "Defines the storage tier. Valid options are Standard and Premium." - default = "Standard" - } - - variable "storage_replication_type" { - description = "Defines the replication type to use for this storage account. Valid options include LRS, GRS etc." - default = "LRS" - } - - # The most cost-effective size - - variable "vm_size" { - description = "Specifies the size of the virtual machine." - default = "Standard_B1s" - } - - variable "image_publisher" { - description = "Name of the publisher of the image (az vm image list)" - default = "sentriumsl" - } - - variable "image_offer" { - description = "Name of the offer (az vm image list)" - default = "vyos-1-2-lts-on-azure" - } - - variable "image_sku" { - description = "Image SKU to apply (az vm image list)" - default = "vyos-1-3" - } - - variable "image_version" { - description = "Version of the image to apply (az vm image list)" - default = "1.3.3" - } - - variable "admin_username" { - description = "Administrator user name" - default = "vyos" - } - - variable "admin_password" { - description = "Administrator password" - default = "Vyos0!" - } - - variable "source_network" { - description = "Allow access from this network prefix. Defaults to '*'." - default = "*" - } - - variable "password" { - description = "pass for Ansible" - type = string - sensitive = true - } - variable "host"{ - description = "IP of my Ansible" - } - -``terraform.tfvars`` - -.. code-block:: none - - password = "" # password for Ansible SSH - host = "" # IP of my Ansible - - -Structure of files in Ansible for Azure ---------------------------------------- - -.. code-block:: none - - . - ├── group_vars - └── all - ├── ansible.cfg - └── instance.yml - - -File contents of Ansible for Azure ----------------------------------- - -``ansible.cfg`` - -.. code-block:: none - - [defaults] - inventory = /root/az/ip.txt - host_key_checking= False - remote_user=vyos - - -``instance.yml`` - - -.. code-block:: none - - ############################################################################## - # About tasks: - # "Wait 300 seconds, but only start checking after 60 seconds" - Tries - # to make SSH connection every 60 seconds until 300 seconds. - # "Configure general settings for the VyOS hosts group" - Provision - # the Azure VyOS node. - # Add all necessary commands for VyOS under the block "lines:" - ############################################################################## - - - - name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true - - -``group_vars/all`` - -.. code-block:: none - - ansible_connection: ansible.netcommon.network_cli - ansible_network_os: vyos.vyos.vyos - - # user and password gets from terraform variables "admin_username" and "admin_password" in the file /root/azvyos/var.tf - ansible_user: vyos - ansible_ssh_pass: Vyos0! - -Source files on GitHub ----------------------- - -All files related to deploying VyOS on Azure with Terraform and Ansible -can be found in the vyos-automation_ repository. - -.. stop_vyoslinter -.. _vyos-automation: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Azure_terraform_ansible_single_vyos_instance-main -.. start_vyoslinter diff --git a/docs/automation/terraform/terraformGoogle.md b/docs/automation/terraform/terraformGoogle.md new file mode 100644 index 00000000..f9c002a7 --- /dev/null +++ b/docs/automation/terraform/terraformGoogle.md @@ -0,0 +1,703 @@ +--- +lastproofread: '2026-03-23' +--- + +(terraformgoogle)= + +# Deploy VyOS on Google Cloud with Terraform and Ansible + +Using Terraform, you can quickly deploy VyOS-based infrastructure on +Google Cloud Platform (GCP) and remove the +infrastructure when it's no longer needed. +Additionally, you can use Ansible for provisioning. + +On this page you'll learn how to: + +- Create the necessary files for Terraform and Ansible. +- Use Terraform to create a single instance on GCP and use Ansible for + provisioning. + +## Prepare to deploy VyOS with Terraform on GCP + +To create a single instance and install your configuration using +Terraform, Ansible, and GCP, follow these steps: + +### GCP + +1. Create an account with GCP and a new project. + +```{image} /_static/images/project.webp +:align: center +:alt: Network Topology Diagram +:width: 50% +``` + +2. Create a service account and download your key (a JSON file). + +```{image} /_static/images/service.webp +:align: center +:alt: Network Topology Diagram +:width: 50% +``` + +```{image} /_static/images/key.webp +:align: center +:alt: Network Topology Diagram +:width: 50% +``` + +The .JSON file downloads automatically after you create it and looks +like the following: + +```{image} /_static/images/json.webp +:align: center +:alt: Network Topology Diagram +:width: 50% +``` + +### Terraform + +1. Create an UNIX or Windows instance. + +2. Download and install + [Terraform](https://developer.hashicorp.com/terraform/install). + +3. Create the folder. For example, `/root/google`. + +```none +mkdir /root/google +``` + +4. Copy all files into your Terraform project `/root/google` + (`vyos.tf`, `var.tf`, `terraform.tfvars`, `mykey.json`). + For more details, + see [Structure of files Terraform for Google Cloud](#structure-of-files-in-terraform-for-google-cloud) + + + +5. Run the following commands: + +```none +cd / +terraform init +``` + +### Ansible + +1. Create an UNIX instance either locally or in the cloud. + +2. Download and install Ansible + +3. Create the folder for example /root/google/ + +4. Copy all files into your Ansible project `/root/google/` + (`ansible.cfg`, `instance.yml`, `mykey.json`, and `all`). For more + details, see [Structure of files in Ansible for Google Cloud](#structure-of-files-in-ansible-for-google-cloud) + +You obtain `mykey.json` when you create a service account in GCP +and download the key (a JSON file). + +### Deploy with Terraform + +Run the following commands on your Terraform instance: + +```none +cd / +terraform plan +terraform apply +yes +``` + +## Create a GCP instance and check its configuration + +```none +# terraform apply + +Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + + create + +Terraform will perform the following actions: + + # google_compute_firewall.tcp_22[0] will be created + + resource "google_compute_firewall" "tcp_22" { + + creation_timestamp = (known after apply) + + destination_ranges = (known after apply) + + direction = (known after apply) + + enable_logging = (known after apply) + + id = (known after apply) + + name = "vyos-tcp-22" + + network = "default" + + priority = 1000 + + project = "vyosproject" + + self_link = (known after apply) + + source_ranges = [ + + "0.0.0.0/0", + ] + + target_tags = [ + + "vyos-deployment", + ] + + + allow { + + ports = [ + + "22", + ] + + protocol = "tcp" + } + } + + # google_compute_firewall.udp_500_4500[0] will be created + + resource "google_compute_firewall" "udp_500_4500" { + + creation_timestamp = (known after apply) + + destination_ranges = (known after apply) + + direction = (known after apply) + + enable_logging = (known after apply) + + id = (known after apply) + + name = "vyos-udp-500-4500" + + network = "default" + + priority = 1000 + + project = "vyosproject" + + self_link = (known after apply) + + source_ranges = [ + + "0.0.0.0/0", + ] + + target_tags = [ + + "vyos-deployment", + ] + + + allow { + + ports = [ + + "500", + + "4500", + ] + + protocol = "udp" + } + } + + # google_compute_instance.default will be created + + resource "google_compute_instance" "default" { + + can_ip_forward = true + + cpu_platform = (known after apply) + + current_status = (known after apply) + + deletion_protection = false + + effective_labels = (known after apply) + + guest_accelerator = (known after apply) + + id = (known after apply) + + instance_id = (known after apply) + + label_fingerprint = (known after apply) + + machine_type = "n2-highcpu-4" + + metadata = { + + "enable-oslogin" = "FALSE" + + "serial-port-enable" = "TRUE" + + "user-data" = "" + } + + metadata_fingerprint = (known after apply) + + min_cpu_platform = (known after apply) + + name = "vyos" + + project = "vyosproject" + + self_link = (known after apply) + + tags_fingerprint = (known after apply) + + terraform_labels = (known after apply) + + zone = "us-west1-a" + + + boot_disk { + + auto_delete = true + + device_name = (known after apply) + + disk_encryption_key_sha256 = (known after apply) + + kms_key_self_link = (known after apply) + + mode = "READ_WRITE" + + source = (known after apply) + + + initialize_params { + + image = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039" + + labels = (known after apply) + + provisioned_iops = (known after apply) + + provisioned_throughput = (known after apply) + + size = (known after apply) + + type = (known after apply) + } + } + + + network_interface { + + internal_ipv6_prefix_length = (known after apply) + + ipv6_access_type = (known after apply) + + ipv6_address = (known after apply) + + name = (known after apply) + + network = "default" + + network_ip = (known after apply) + + nic_type = "GVNIC" + + stack_type = (known after apply) + + subnetwork = "default" + + subnetwork_project = (known after apply) + + + access_config { + + nat_ip = (known after apply) + + network_tier = (known after apply) + } + } + } + + # local_file.ip will be created + + resource "local_file" "ip" { + + content = (known after apply) + + content_base64sha256 = (known after apply) + + content_base64sha512 = (known after apply) + + content_md5 = (known after apply) + + content_sha1 = (known after apply) + + content_sha256 = (known after apply) + + content_sha512 = (known after apply) + + directory_permission = "0777" + + file_permission = "0777" + + filename = "ip.txt" + + id = (known after apply) + } + + # null_resource.SSHconnection1 will be created + + resource "null_resource" "SSHconnection1" { + + id = (known after apply) + } + + # null_resource.SSHconnection2 will be created + + resource "null_resource" "SSHconnection2" { + + id = (known after apply) + } + +Plan: 6 to add, 0 to change, 0 to destroy. + +Changes to Outputs: + + public_ip_address = (known after apply) +╷ +│ Warning: Quoted references are deprecated +│ +│ on vyos.tf line 126, in resource "null_resource" "SSHconnection1": +│ 126: depends_on = ["google_compute_instance.default"] +│ +│ In this context, references are expected literally rather than in quotes. Terraform 0.11 and earlier required quotes, but quoted references are now deprecated and will be removed in a +│ future version of Terraform. Remove the quotes surrounding this reference to silence this warning. +│ +│ (and one more similar warning elsewhere) +╵ + +Do you want to perform these actions? + Terraform will perform the actions described above. + Only 'yes' will be accepted to approve. + + Enter a value: yes + +google_compute_firewall.udp_500_4500[0]: Creating... +google_compute_firewall.tcp_22[0]: Creating... +google_compute_instance.default: Creating... +google_compute_firewall.udp_500_4500[0]: Still creating... [10s elapsed] +google_compute_firewall.tcp_22[0]: Still creating... [10s elapsed] +google_compute_instance.default: Still creating... [10s elapsed] +google_compute_firewall.tcp_22[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-tcp-22] +google_compute_firewall.udp_500_4500[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-udp-500-4500] +google_compute_instance.default: Creation complete after 20s [id=projects/vyosproject/zones/us-west1-a/instances/vyos] +null_resource.SSHconnection1: Creating... +null_resource.SSHconnection2: Creating... +null_resource.SSHconnection1: Provisioning with 'file'... +null_resource.SSHconnection2: Provisioning with 'remote-exec'... +null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... +null_resource.SSHconnection2 (remote-exec): Host: 10.***.***.104 +null_resource.SSHconnection2 (remote-exec): User: root +null_resource.SSHconnection2 (remote-exec): Password: true +null_resource.SSHconnection2 (remote-exec): Private key: false +null_resource.SSHconnection2 (remote-exec): Certificate: false +null_resource.SSHconnection2 (remote-exec): SSH Agent: false +null_resource.SSHconnection2 (remote-exec): Checking Host Key: false +null_resource.SSHconnection2 (remote-exec): Target Platform: unix +local_file.ip: Creating... +local_file.ip: Creation complete after 0s [id=7d568c3b994a018c942a3cdb952ccbf3c729d0ca] +null_resource.SSHconnection2 (remote-exec): Connected! +null_resource.SSHconnection1: Creation complete after 4s [id=5175298735911137161] + +null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ + +null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** +null_resource.SSHconnection2: Still creating... [10s elapsed] +null_resource.SSHconnection2: Still creating... [20s elapsed] +null_resource.SSHconnection2: Still creating... [30s elapsed] +null_resource.SSHconnection2: Still creating... [40s elapsed] +null_resource.SSHconnection2: Still creating... [50s elapsed] +null_resource.SSHconnection2: Still creating... [1m0s elapsed] +null_resource.SSHconnection2: Still creating... [1m10s elapsed] +null_resource.SSHconnection2 (remote-exec): ok: [104.***.***.158] + +null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* +null_resource.SSHconnection2: Still creating... [1m20s elapsed] +null_resource.SSHconnection2 (remote-exec): changed: [104.***.***.158] + +null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* +null_resource.SSHconnection2 (remote-exec): 104.***.***.158 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +null_resource.SSHconnection2: Creation complete after 1m22s [id=3355727070503709742] + +Apply complete! Resources: 6 added, 0 changed, 0 destroyed. + +Outputs: + +public_ip_address = "104.***.***.158" +``` + +After running all the commands, your VyOS instance is deployed on +GCP with your specified configuration. +To delete the instance, type the following command: + +```none +terraform destroy +``` + +## Troubleshooting + +- Increase the timeout value in `instance.yml` from 300 seconds to + 500 seconds or more (depends on your location). Ensure that the + security group allows access to the instance. +- If Terraform doesn't connect via SSH to your Ansible instance: + Check the correct login and password in the `VyOS.tf` file. + +```none +connection { + type = "ssh" + user = "root" # open root access using login and password on your Ansible + password = var.password # check password in the file terraform.tfvars isn't empty + host = var.host # check the correct IP address of your Ansible host +} +``` + +Verify that Ansible can ping from Terraform. + +## Structure of files in Terraform for Google Cloud + +```none +. +├── vyos.tf # The main script +├── ***.JSON # The credential file from GCP +├── var.tf # The file of all variables in "vyos.tf" +└── terraform.tfvars # The value of all variables (passwords, login, IP addresses and so on) +``` + +## File contents of Terraform for Google Cloud + +`vyos.tf` + +```none +############################################################################## +# Build a VyOS VM from the Marketplace +# +# After deploying the GCP instance and getting an IP address, the IP address is copied into the file +#"ip.txt" and copied to the Ansible node for provisioning. +############################################################################## + +terraform { + required_providers { + google = { + source = "hashicorp/google" + } + } +} + +provider "google" { + project = var.project_id + request_timeout = "60s" + credentials = file(var.gcp_auth_file) +} + +locals { + network_interfaces = [for i, n in var.networks : { + network = n, + subnetwork = length(var.sub_networks) > i ? element(var.sub_networks, i) : null + external_ip = length(var.external_ips) > i ? element(var.external_ips, i) : "NONE" + } + ] +} + +resource "google_compute_instance" "default" { + name = var.goog_cm_deployment_name + machine_type = var.machine_type + zone = var.zone + + metadata = { + enable-oslogin = "FALSE" + serial-port-enable = "TRUE" + user-data = var.vyos_user_data + } + boot_disk { + initialize_params { + image = var.image + } + } + + can_ip_forward = true + + dynamic "network_interface" { + for_each = local.network_interfaces + content { + network = network_interface.value.network + subnetwork = network_interface.value.subnetwork + nic_type = "GVNIC" + dynamic "access_config" { + for_each = network_interface.value.external_ip == "NONE" ? [] : [1] + content { + nat_ip = network_interface.value.external_ip == "EPHEMERAL" ? null : network_interface.value.external_ip + } + } + } + } +} + +resource "google_compute_firewall" "tcp_22" { + count = var.enable_tcp_22 ? 1 : 0 + + name = "${var.goog_cm_deployment_name}-tcp-22" + network = element(var.networks, 0) + + allow { + ports = ["22"] + protocol = "tcp" + } + + source_ranges = ["0.0.0.0/0"] + + target_tags = ["${var.goog_cm_deployment_name}-deployment"] +} + +resource "google_compute_firewall" "udp_500_4500" { + count = var.enable_udp_500_4500 ? 1 : 0 + + name = "${var.goog_cm_deployment_name}-udp-500-4500" + network = element(var.networks, 0) + + allow { + ports = ["500", "4500"] + protocol = "udp" + } + + source_ranges = ["0.0.0.0/0"] + + target_tags = ["${var.goog_cm_deployment_name}-deployment"] +} + +output "public_ip_address" { + value = google_compute_instance.default.network_interface[0].access_config[0].nat_ip +} + +############################################################################## +# +# IP of google instance copied to a file ip.txt in local system Terraform +# ip.txt looks like: +# cat ./ip.txt +# ххх.ххх.ххх.ххх +############################################################################## + +resource "local_file" "ip" { + content = google_compute_instance.default.network_interface[0].access_config[0].nat_ip + filename = "ip.txt" +} + +#connecting to the Ansible control node using SSH connection + +############################################################################## +# Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform node and start remotely the playbook of Ansible. +############################################################################## + +resource "null_resource" "SSHconnection1" { +depends_on = ["google_compute_instance.default"] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} + +#copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/google/ip.txt" # The folder of your Ansible project + } +} + +resource "null_resource" "SSHconnection2" { +depends_on = ["google_compute_instance.default"] +connection { + type = "ssh" + user = "root" + password = var.password + host = var.host +} + +#command to run Ansible playbook on remote Linux OS + +provisioner "remote-exec" { + inline = [ + "cd /root/google/", + "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for Google Cloud" +] +} +} +``` + +`var.tf` + +```none +variable "image" { + type = string + default = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039" +} + +variable "project_id" { + type = string +} + +variable "zone" { + type = string +} + +############################################################################## +# You can choose a lower cost machine type than n2-highcpu-4 +############################################################################## + +variable "machine_type" { + type = string + default = "n2-highcpu-4" +} + +variable "networks" { + description = "The network name to attach the VM instance." + type = list(string) + default = ["default"] +} + +variable "sub_networks" { + description = "The sub network name to attach the VM instance." + type = list(string) + default = ["default"] +} + +variable "external_ips" { + description = "The external IPs assigned to the VM for public access." + type = list(string) + default = ["EPHEMERAL"] +} + +variable "enable_tcp_22" { + description = "Allow SSH traffic from the Internet" + type = bool + default = true +} + +variable "enable_udp_500_4500" { + description = "Allow IKE/IPSec traffic from the Internet" + type = bool + default = true +} + +variable "vyos_user_data" { + type = string + default = "" +} + +// Marketplace requires this variable name to be declared +variable "goog_cm_deployment_name" { + description = "VyOS Universal Router Deployment" + type = string + default = "vyos" +} + +# GCP authentication file +variable "gcp_auth_file" { + type = string + description = "GCP authentication file" +} + +variable "password" { + description = "pass for Ansible" + type = string + sensitive = true +} +variable "host"{ + description = "The IP of my Ansible" + type = string +} +``` + +`terraform.tfvars` + +```none +############################################################################## +# Must be filled in +############################################################################## + +zone = "us-west1-a" +gcp_auth_file = "/root/***/***.json" # path of your .json file +project_id = "" # the google project +password = "" # password for Ansible SSH +host = "" # IP of my Ansible +``` + +## Structure of files in Ansible for Google Cloud + +```none +. +├── group_vars + └── all +├── ansible.cfg +└── instance.yml +``` + +## File contents of Ansible for Google Cloud + +`ansible.cfg` + +```none +[defaults] +inventory = /root/google/ip.txt +host_key_checking= False +remote_user=vyos +``` + +`instance.yml` + +```none +############################################################################## +# About tasks: +# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds +# "Configure general settings for the VyOS hosts group" - make provisioning into Google Cloud VyOS node +# Add all necessary VyOS commands under the "lines:" block +############################################################################## + + +- name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server xxx.xxx.xxx.xxx + save: + true +``` + +`group_vars/all` + +```none +ansible_connection: ansible.netcommon.network_cli +ansible_network_os: vyos.vyos.vyos +ansible_user: vyos +ansible_ssh_pass: vyos +``` + + +## Source files on GitHub + +All files related to deploying VyOS on Google Cloud Platform with +Terraform and Ansible can be found in the [vyos-automation] repository. + +[vyos-automation]: diff --git a/docs/automation/terraform/terraformGoogle.rst b/docs/automation/terraform/terraformGoogle.rst deleted file mode 100644 index eb7e01fe..00000000 --- a/docs/automation/terraform/terraformGoogle.rst +++ /dev/null @@ -1,732 +0,0 @@ -:lastproofread: 2026-03-23 - -.. _terraformgoogle: - -Deploy VyOS on Google Cloud with Terraform and Ansible -====================================================== - -Using Terraform, you can quickly deploy VyOS-based infrastructure on -Google Cloud Platform (GCP) and remove the -infrastructure when it's no longer needed. -Additionally, you can use Ansible for provisioning. - -On this page you'll learn how to: -* Create the necessary files for Terraform and Ansible. -* Use Terraform to create a single instance on GCP and use Ansible for -provisioning. - -Prepare to deploy VyOS with Terraform on GCP --------------------------------------------- - -To create a single instance and install your configuration using -Terraform, Ansible, and GCP, follow these steps: - -GCP -^^^ - - -1. Create an account with GCP and a new project. - -.. image:: /_static/images/project.* - :width: 50% - :align: center - :alt: Network Topology Diagram - -2. Create a service account and download your key (a JSON file). - -.. image:: /_static/images/service.* - :width: 50% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/key.* - :width: 50% - :align: center - :alt: Network Topology Diagram - -The .JSON file downloads automatically after you create it and looks -like the following: - -.. image:: /_static/images/json.* - :width: 50% - :align: center - :alt: Network Topology Diagram - - -Terraform -^^^^^^^^^ - - -1. Create an UNIX or Windows instance. - -2. Download and install - `Terraform `__. - -3. Create the folder. For example, ``/root/google``. - -.. code-block:: none - - mkdir /root/google - -.. stop_vyoslinter -4. Copy all files into your Terraform project ``/root/google`` - (``vyos.tf``, ``var.tf``, ``terraform.tfvars``, ``mykey.json``). - For more details, - see `Structure of files Terraform for Google Cloud <#structure-of-files-in-terraform-for-google-cloud>`_ - -.. start_vyoslinter - -5. Run the following commands: - - -.. code-block:: none - - cd / - terraform init - - -Ansible -^^^^^^^ - -1. Create an UNIX instance either locally or in the cloud. - -2. Download and install Ansible - -3. Create the folder for example /root/google/ - -4. Copy all files into your Ansible project ``/root/google/`` - (``ansible.cfg``, ``instance.yml``, ``mykey.json``, and ``all``). For more - details, see `Structure of files in Ansible for Google Cloud`_ - -You obtain ``mykey.json`` when you create a service account in GCP -and download the key (a JSON file). - - -Deploy with Terraform -^^^^^^^^^^^^^^^^^^^^^ - - -Run the following commands on your Terraform instance: - -.. code-block:: none - - cd / - terraform plan - terraform apply - yes - - -Create a GCP instance and check its configuration -------------------------------------------------- - -.. code-block:: none - - # terraform apply - - Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: - + create - - Terraform will perform the following actions: - - # google_compute_firewall.tcp_22[0] will be created - + resource "google_compute_firewall" "tcp_22" { - + creation_timestamp = (known after apply) - + destination_ranges = (known after apply) - + direction = (known after apply) - + enable_logging = (known after apply) - + id = (known after apply) - + name = "vyos-tcp-22" - + network = "default" - + priority = 1000 - + project = "vyosproject" - + self_link = (known after apply) - + source_ranges = [ - + "0.0.0.0/0", - ] - + target_tags = [ - + "vyos-deployment", - ] - - + allow { - + ports = [ - + "22", - ] - + protocol = "tcp" - } - } - - # google_compute_firewall.udp_500_4500[0] will be created - + resource "google_compute_firewall" "udp_500_4500" { - + creation_timestamp = (known after apply) - + destination_ranges = (known after apply) - + direction = (known after apply) - + enable_logging = (known after apply) - + id = (known after apply) - + name = "vyos-udp-500-4500" - + network = "default" - + priority = 1000 - + project = "vyosproject" - + self_link = (known after apply) - + source_ranges = [ - + "0.0.0.0/0", - ] - + target_tags = [ - + "vyos-deployment", - ] - - + allow { - + ports = [ - + "500", - + "4500", - ] - + protocol = "udp" - } - } - - # google_compute_instance.default will be created - + resource "google_compute_instance" "default" { - + can_ip_forward = true - + cpu_platform = (known after apply) - + current_status = (known after apply) - + deletion_protection = false - + effective_labels = (known after apply) - + guest_accelerator = (known after apply) - + id = (known after apply) - + instance_id = (known after apply) - + label_fingerprint = (known after apply) - + machine_type = "n2-highcpu-4" - + metadata = { - + "enable-oslogin" = "FALSE" - + "serial-port-enable" = "TRUE" - + "user-data" = "" - } - + metadata_fingerprint = (known after apply) - + min_cpu_platform = (known after apply) - + name = "vyos" - + project = "vyosproject" - + self_link = (known after apply) - + tags_fingerprint = (known after apply) - + terraform_labels = (known after apply) - + zone = "us-west1-a" - - + boot_disk { - + auto_delete = true - + device_name = (known after apply) - + disk_encryption_key_sha256 = (known after apply) - + kms_key_self_link = (known after apply) - + mode = "READ_WRITE" - + source = (known after apply) - - + initialize_params { - + image = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039" - + labels = (known after apply) - + provisioned_iops = (known after apply) - + provisioned_throughput = (known after apply) - + size = (known after apply) - + type = (known after apply) - } - } - - + network_interface { - + internal_ipv6_prefix_length = (known after apply) - + ipv6_access_type = (known after apply) - + ipv6_address = (known after apply) - + name = (known after apply) - + network = "default" - + network_ip = (known after apply) - + nic_type = "GVNIC" - + stack_type = (known after apply) - + subnetwork = "default" - + subnetwork_project = (known after apply) - - + access_config { - + nat_ip = (known after apply) - + network_tier = (known after apply) - } - } - } - - # local_file.ip will be created - + resource "local_file" "ip" { - + content = (known after apply) - + content_base64sha256 = (known after apply) - + content_base64sha512 = (known after apply) - + content_md5 = (known after apply) - + content_sha1 = (known after apply) - + content_sha256 = (known after apply) - + content_sha512 = (known after apply) - + directory_permission = "0777" - + file_permission = "0777" - + filename = "ip.txt" - + id = (known after apply) - } - - # null_resource.SSHconnection1 will be created - + resource "null_resource" "SSHconnection1" { - + id = (known after apply) - } - - # null_resource.SSHconnection2 will be created - + resource "null_resource" "SSHconnection2" { - + id = (known after apply) - } - - Plan: 6 to add, 0 to change, 0 to destroy. - - Changes to Outputs: - + public_ip_address = (known after apply) - ╷ - │ Warning: Quoted references are deprecated - │ - │ on vyos.tf line 126, in resource "null_resource" "SSHconnection1": - │ 126: depends_on = ["google_compute_instance.default"] - │ - │ In this context, references are expected literally rather than in quotes. Terraform 0.11 and earlier required quotes, but quoted references are now deprecated and will be removed in a - │ future version of Terraform. Remove the quotes surrounding this reference to silence this warning. - │ - │ (and one more similar warning elsewhere) - ╵ - - Do you want to perform these actions? - Terraform will perform the actions described above. - Only 'yes' will be accepted to approve. - - Enter a value: yes - - google_compute_firewall.udp_500_4500[0]: Creating... - google_compute_firewall.tcp_22[0]: Creating... - google_compute_instance.default: Creating... - google_compute_firewall.udp_500_4500[0]: Still creating... [10s elapsed] - google_compute_firewall.tcp_22[0]: Still creating... [10s elapsed] - google_compute_instance.default: Still creating... [10s elapsed] - google_compute_firewall.tcp_22[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-tcp-22] - google_compute_firewall.udp_500_4500[0]: Creation complete after 16s [id=projects/vyosproject/global/firewalls/vyos-udp-500-4500] - google_compute_instance.default: Creation complete after 20s [id=projects/vyosproject/zones/us-west1-a/instances/vyos] - null_resource.SSHconnection1: Creating... - null_resource.SSHconnection2: Creating... - null_resource.SSHconnection1: Provisioning with 'file'... - null_resource.SSHconnection2: Provisioning with 'remote-exec'... - null_resource.SSHconnection2 (remote-exec): Connecting to remote host via SSH... - null_resource.SSHconnection2 (remote-exec): Host: 10.***.***.104 - null_resource.SSHconnection2 (remote-exec): User: root - null_resource.SSHconnection2 (remote-exec): Password: true - null_resource.SSHconnection2 (remote-exec): Private key: false - null_resource.SSHconnection2 (remote-exec): Certificate: false - null_resource.SSHconnection2 (remote-exec): SSH Agent: false - null_resource.SSHconnection2 (remote-exec): Checking Host Key: false - null_resource.SSHconnection2 (remote-exec): Target Platform: unix - local_file.ip: Creating... - local_file.ip: Creation complete after 0s [id=7d568c3b994a018c942a3cdb952ccbf3c729d0ca] - null_resource.SSHconnection2 (remote-exec): Connected! - null_resource.SSHconnection1: Creation complete after 4s [id=5175298735911137161] - - null_resource.SSHconnection2 (remote-exec): PLAY [integration of terraform and ansible] ************************************ - - null_resource.SSHconnection2 (remote-exec): TASK [Wait 300 seconds, but only start checking after 60 seconds] ************** - null_resource.SSHconnection2: Still creating... [10s elapsed] - null_resource.SSHconnection2: Still creating... [20s elapsed] - null_resource.SSHconnection2: Still creating... [30s elapsed] - null_resource.SSHconnection2: Still creating... [40s elapsed] - null_resource.SSHconnection2: Still creating... [50s elapsed] - null_resource.SSHconnection2: Still creating... [1m0s elapsed] - null_resource.SSHconnection2: Still creating... [1m10s elapsed] - null_resource.SSHconnection2 (remote-exec): ok: [104.***.***.158] - - null_resource.SSHconnection2 (remote-exec): TASK [Configure general settings for the vyos hosts group] ********************* - null_resource.SSHconnection2: Still creating... [1m20s elapsed] - null_resource.SSHconnection2 (remote-exec): changed: [104.***.***.158] - - null_resource.SSHconnection2 (remote-exec): PLAY RECAP ********************************************************************* - null_resource.SSHconnection2 (remote-exec): 104.***.***.158 : ok=2 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - - null_resource.SSHconnection2: Creation complete after 1m22s [id=3355727070503709742] - - Apply complete! Resources: 6 added, 0 changed, 0 destroyed. - - Outputs: - - public_ip_address = "104.***.***.158" - - - -After running all the commands, your VyOS instance is deployed on -GCP with your specified configuration. -To delete the instance, type the following command: - -.. code-block:: none - - terraform destroy - - -Troubleshooting ---------------- - -1. Increase the timeout value in ``instance.yml`` from 300 seconds to - 500 seconds or more (depends on your location). Ensure that the - security group allows access to the instance. - -2. If Terraform doesn't connect via SSH to your Ansible instance: - Check the correct login and password in the ``VyOS.tf`` file. - -.. code-block:: none - - connection { - type = "ssh" - user = "root" # open root access using login and password on your Ansible - password = var.password # check password in the file terraform.tfvars isn't empty - host = var.host # check the correct IP address of your Ansible host - } - - -Verify that Ansible can ping from Terraform. - -Structure of files in Terraform for Google Cloud ------------------------------------------------- - -.. code-block:: none - - . - ├── vyos.tf # The main script - ├── ***.JSON # The credential file from GCP - ├── var.tf # The file of all variables in "vyos.tf" - └── terraform.tfvars # The value of all variables (passwords, login, IP addresses and so on) - - - -File contents of Terraform for Google Cloud -------------------------------------------- - -``vyos.tf`` - -.. code-block:: none - - - ############################################################################## - # Build a VyOS VM from the Marketplace - # - # After deploying the GCP instance and getting an IP address, the IP address is copied into the file - #"ip.txt" and copied to the Ansible node for provisioning. - ############################################################################## - - terraform { - required_providers { - google = { - source = "hashicorp/google" - } - } - } - - provider "google" { - project = var.project_id - request_timeout = "60s" - credentials = file(var.gcp_auth_file) - } - - locals { - network_interfaces = [for i, n in var.networks : { - network = n, - subnetwork = length(var.sub_networks) > i ? element(var.sub_networks, i) : null - external_ip = length(var.external_ips) > i ? element(var.external_ips, i) : "NONE" - } - ] - } - - resource "google_compute_instance" "default" { - name = var.goog_cm_deployment_name - machine_type = var.machine_type - zone = var.zone - - metadata = { - enable-oslogin = "FALSE" - serial-port-enable = "TRUE" - user-data = var.vyos_user_data - } - boot_disk { - initialize_params { - image = var.image - } - } - - can_ip_forward = true - - dynamic "network_interface" { - for_each = local.network_interfaces - content { - network = network_interface.value.network - subnetwork = network_interface.value.subnetwork - nic_type = "GVNIC" - dynamic "access_config" { - for_each = network_interface.value.external_ip == "NONE" ? [] : [1] - content { - nat_ip = network_interface.value.external_ip == "EPHEMERAL" ? null : network_interface.value.external_ip - } - } - } - } - } - - resource "google_compute_firewall" "tcp_22" { - count = var.enable_tcp_22 ? 1 : 0 - - name = "${var.goog_cm_deployment_name}-tcp-22" - network = element(var.networks, 0) - - allow { - ports = ["22"] - protocol = "tcp" - } - - source_ranges = ["0.0.0.0/0"] - - target_tags = ["${var.goog_cm_deployment_name}-deployment"] - } - - resource "google_compute_firewall" "udp_500_4500" { - count = var.enable_udp_500_4500 ? 1 : 0 - - name = "${var.goog_cm_deployment_name}-udp-500-4500" - network = element(var.networks, 0) - - allow { - ports = ["500", "4500"] - protocol = "udp" - } - - source_ranges = ["0.0.0.0/0"] - - target_tags = ["${var.goog_cm_deployment_name}-deployment"] - } - - output "public_ip_address" { - value = google_compute_instance.default.network_interface[0].access_config[0].nat_ip - } - - ############################################################################## - # - # IP of google instance copied to a file ip.txt in local system Terraform - # ip.txt looks like: - # cat ./ip.txt - # ххх.ххх.ххх.ххх - ############################################################################## - - resource "local_file" "ip" { - content = google_compute_instance.default.network_interface[0].access_config[0].nat_ip - filename = "ip.txt" - } - - #connecting to the Ansible control node using SSH connection - - ############################################################################## - # Steps "SSHconnection1" and "SSHconnection2" need to get file ip.txt from the terraform node and start remotely the playbook of Ansible. - ############################################################################## - - resource "null_resource" "SSHconnection1" { - depends_on = ["google_compute_instance.default"] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - - #copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/google/ip.txt" # The folder of your Ansible project - } - } - - resource "null_resource" "SSHconnection2" { - depends_on = ["google_compute_instance.default"] - connection { - type = "ssh" - user = "root" - password = var.password - host = var.host - } - - #command to run Ansible playbook on remote Linux OS - - provisioner "remote-exec" { - inline = [ - "cd /root/google/", - "ansible-playbook instance.yml" # more detailed in "File contents of Ansible for Google Cloud" - ] - } - } - - -``var.tf`` - -.. code-block:: none - - variable "image" { - type = string - default = "projects/sentrium-public/global/images/vyos-1-3-5-20231222143039" - } - - variable "project_id" { - type = string - } - - variable "zone" { - type = string - } - - ############################################################################## - # You can choose a lower cost machine type than n2-highcpu-4 - ############################################################################## - - variable "machine_type" { - type = string - default = "n2-highcpu-4" - } - - variable "networks" { - description = "The network name to attach the VM instance." - type = list(string) - default = ["default"] - } - - variable "sub_networks" { - description = "The sub network name to attach the VM instance." - type = list(string) - default = ["default"] - } - - variable "external_ips" { - description = "The external IPs assigned to the VM for public access." - type = list(string) - default = ["EPHEMERAL"] - } - - variable "enable_tcp_22" { - description = "Allow SSH traffic from the Internet" - type = bool - default = true - } - - variable "enable_udp_500_4500" { - description = "Allow IKE/IPSec traffic from the Internet" - type = bool - default = true - } - - variable "vyos_user_data" { - type = string - default = "" - } - - // Marketplace requires this variable name to be declared - variable "goog_cm_deployment_name" { - description = "VyOS Universal Router Deployment" - type = string - default = "vyos" - } - - # GCP authentication file - variable "gcp_auth_file" { - type = string - description = "GCP authentication file" - } - - variable "password" { - description = "pass for Ansible" - type = string - sensitive = true - } - variable "host"{ - description = "The IP of my Ansible" - type = string - } - - -``terraform.tfvars`` - -.. code-block:: none - - ############################################################################## - # Must be filled in - ############################################################################## - - zone = "us-west1-a" - gcp_auth_file = "/root/***/***.json" # path of your .json file - project_id = "" # the google project - password = "" # password for Ansible SSH - host = "" # IP of my Ansible - - -Structure of files in Ansible for Google Cloud ----------------------------------------------- - -.. code-block:: none - - . - ├── group_vars - └── all - ├── ansible.cfg - └── instance.yml - - -File contents of Ansible for Google Cloud ------------------------------------------ - -``ansible.cfg`` - -.. code-block:: none - - [defaults] - inventory = /root/google/ip.txt - host_key_checking= False - remote_user=vyos - -``instance.yml`` - -.. code-block:: none - - ############################################################################## - # About tasks: - # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds - # "Configure general settings for the VyOS hosts group" - make provisioning into Google Cloud VyOS node - # Add all necessary VyOS commands under the "lines:" block - ############################################################################## - - - - name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server xxx.xxx.xxx.xxx - save: - true - - -``group_vars/all`` - -.. code-block:: none - - ansible_connection: ansible.netcommon.network_cli - ansible_network_os: vyos.vyos.vyos - ansible_user: vyos - ansible_ssh_pass: vyos - -Source files on GitHub ----------------------- - -All files related to deploying VyOS on Google Cloud Platform with -Terraform and Ansible can be found in the vyos-automation_ repository. - -.. stop_vyoslinter -.. _vyos-automation: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Google_terraform_ansible_single_vyos_instance-main -.. start_vyoslinter diff --git a/docs/automation/terraform/terraformvSphere.md b/docs/automation/terraform/terraformvSphere.md new file mode 100644 index 00000000..abcef5fa --- /dev/null +++ b/docs/automation/terraform/terraformvSphere.md @@ -0,0 +1,388 @@ +--- +lastproofread: '2026-03-23' +--- + +(terraformvSphere)= + +# Deploy VyOS on VMware vSphere with Terraform and Ansible + +You can use Terraform to quickly deploy VyOS-based infrastructure +on VMware vSphere (hereafter referred to as *vSphere*) and remove +infrastructure when it's no longer needed. +Additionally, you can use Ansible for provisioning. + +On this page you'll learn how to: + +- Create the necessary files for Terraform and Ansible. +- Use Terraform to create a single instance on vSphere and use Ansible for + provisioning. + +## Prepare to deploy VyOS with Terraform on vSphere + +To create a single instance and install your configuration using +Terraform, Ansible, and vSphere, follow these steps: + +### vSphere + +- Add all necessary data to the `terraform.tfvars` + [file]() + and create resources. + +### Terraform + +- Create an UNIX or Windows instance. +- Download and install + [Terraform](https://developer.hashicorp.com/terraform/install). +- Create the folder for example `/root/vsphereterraform`. + +```none +mkdir /root/vsphereterraform +``` + +- Copy all files into your Terraform project `/root/vsphereterraform` + (`vyos.tf`, `var.tf`, `terraform.tfvars`, `version.tf`). + For more details, + see [Structure of files in Terraform for vSphere](#structure-of-files-in-terraform-for-vsphere) +- Run the following commands: + +```none +cd / +terraform init +``` + + +### Ansible + +- Create an UNIX instance either locally or in the cloud. +- Download and install Ansible. +- Create the folder. For example, `/root/vsphereterraform/`. +- Copy all files into your Ansible project `/root/vsphereterraform/` + (`ansible.cfg`, `instance.yml`, `all`). For more details, see + [Structure of files in Ansible for vSphere](#structure-of-files-in-ansible-for-vsphere) + +### Deploy with Terraform + +Run the following commands on your Terraform instance: + +```none +cd / +terraform plan +terraform apply +yes +``` + +After executing these commands, your VyOS instance is deployed to +vSphere with your configuration. +If you need to delete the instance, run the following command: + +```none +terraform destroy +``` + +## Structure of files in Terraform for vSphere + +```none +. +├── vyos.tf # The main script. +├── versions.tf # File for Terraform version. +├── var.tf # File for Terraform version. +└── terraform.tfvars # Values for all variables (passwords, + # login, IP addresses, etc.). +``` + +## File contents of Terraform for vSphere + +`vyos.tf` + +```none +provider "vsphere" { + user = var.vsphere_user + password = var.vsphere_password + vsphere_server = var.vsphere_server + allow_unverified_ssl = true +} + +data "vsphere_datacenter" "datacenter" { + name = var.datacenter +} + +data "vsphere_datastore" "datastore" { + name = var.datastore + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +data "vsphere_compute_cluster" "cluster" { + name = var.cluster + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +data "vsphere_resource_pool" "default" { + name = format("%s%s", data.vsphere_compute_cluster.cluster.name, "/Resources/terraform") # set as you need + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +data "vsphere_host" "host" { + name = var.host + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +data "vsphere_network" "network" { + name = var.network_name + datacenter_id = data.vsphere_datacenter.datacenter.id +} + +# Deployment of VM from Remote OVF +resource "vsphere_virtual_machine" "vmFromRemoteOvf" { + name = var.remotename + datacenter_id = data.vsphere_datacenter.datacenter.id + datastore_id = data.vsphere_datastore.datastore.id + host_system_id = data.vsphere_host.host.id + resource_pool_id = data.vsphere_resource_pool.default.id + network_interface { + network_id = data.vsphere_network.network.id + } + wait_for_guest_net_timeout = 2 + wait_for_guest_ip_timeout = 2 + + ovf_deploy { + allow_unverified_ssl_cert = true + remote_ovf_url = var.url_ova + disk_provisioning = "thin" + ip_protocol = "IPv4" + ip_allocation_policy = "dhcpPolicy" + ovf_network_map = { + "Network 1" = data.vsphere_network.network.id + "Network 2" = data.vsphere_network.network.id + } + } + vapp { + properties = { + "password" = "12345678", + "local-hostname" = "terraform_vyos" + } + } +} + +output "ip" { + description = "default ip address of the deployed VM" + value = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address +} + +# IP of vSphere instance copied to a file ip.txt in local system + +resource "local_file" "ip" { + content = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address + filename = "ip.txt" +} + +#Connecting to the Ansible control node using SSH connection + +resource "null_resource" "nullremote1" { +depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] +connection { + type = "ssh" + user = "root" + password = var.ansiblepassword + host = var.ansiblehost + +} + +# Copying the ip.txt file to the Ansible control node from local system + + provisioner "file" { + source = "ip.txt" + destination = "/root/vsphere/ip.txt" + } +} + +resource "null_resource" "nullremote2" { +depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] +connection { + type = "ssh" + user = "root" + password = var.ansiblepassword + host = var.ansiblehost +} + +# Command to run ansible playbook on remote Linux OS + +provisioner "remote-exec" { + + inline = [ + "cd /root/vsphere/", + "ansible-playbook instance.yml" +] +} +} +``` + +`versions.tf` + +```none +# Copyright (c) HashiCorp, Inc. +# SPDX-License-Identifier: MPL-2.0 + +terraform { + required_providers { + vsphere = { + source = "hashicorp/vsphere" + version = "2.4.0" + } + } +} +``` + +`var.tf` + +```none +# Copyright (c) HashiCorp, Inc. +# SPDX-License-Identifier: MPL-2.0 + +variable "vsphere_server" { + description = "vSphere server" + type = string +} + +variable "vsphere_user" { + description = "vSphere username" + type = string +} + +variable "vsphere_password" { + description = "vSphere password" + type = string + sensitive = true +} + +variable "datacenter" { + description = "vSphere data center" + type = string +} + +variable "cluster" { + description = "vSphere cluster" + type = string +} + +variable "datastore" { + description = "vSphere datastore" + type = string +} + +variable "network_name" { + description = "vSphere network name" + type = string +} + +variable "host" { + description = "Name of your host" + type = string +} + +variable "remotename" { + description = "The name of your VM" + type = string +} + +variable "url_ova" { + description = "The URL to the .OVA file or cloud storage" + type = string +} + +variable "ansiblepassword" { + description = "Ansible password" + type = string +} + +variable "ansiblehost" { + description = "Ansible host name or IP" + type = string +} +``` + +`terraform.tfvars` + +```none +vsphere_user = "" +vsphere_password = "" +vsphere_server = "" +datacenter = "" +datastore = "" +cluster = "" +network_name = "" +host = "" +url_ova = "" +ansiblepassword = "" +ansiblehost = "" +remotename = "" +``` + +## Structure of files in Ansible for vSphere + +```none +. +├── group_vars + └── all +├── ansible.cfg +└── instance.yml +``` + +## File contents of Ansible for vSphere + +`ansible.cfg` + +```none +[defaults] +inventory = /root/vsphere/ip.txt +host_key_checking= False +remote_user=vyos +``` + +`instance.yml` + +```none +############################################################################## +# About tasks: +# "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds +# "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node +# You have to add all necessary commands of VyOS under the block "lines:" +############################################################################## + + +- name: integration of terraform and ansible + hosts: all + gather_facts: 'no' + + tasks: + + - name: "Wait 300 seconds, but only start checking after 60 seconds" + wait_for_connection: + delay: 60 + timeout: 300 + - name: "Configure general settings for the VyOS hosts group" + vyos_config: + lines: + - set system name-server 192.0.2.1 + save: + true +``` + +`group_vars/all` + +```none +ansible_connection: ansible.netcommon.network_cli +ansible_network_os: vyos.vyos.vyos + +# user and password gets from terraform variables "admin_username" and "admin_password" +ansible_user: vyos +# get from vyos.tf "vapp" +ansible_ssh_pass: 12345678 +``` + + +## Source files on GitHub + +All files related to deploying VyOS on vSphere with Terraform and Ansible +can be found in the [vyos-automation] repository. + +[vyos-automation]: diff --git a/docs/automation/terraform/terraformvSphere.rst b/docs/automation/terraform/terraformvSphere.rst deleted file mode 100644 index 1866fa8e..00000000 --- a/docs/automation/terraform/terraformvSphere.rst +++ /dev/null @@ -1,426 +0,0 @@ -:lastproofread: 2026-03-23 - -.. _terraformvSphere: - -Deploy VyOS on VMware vSphere with Terraform and Ansible -======================================================== - -You can use Terraform to quickly deploy VyOS-based infrastructure -on VMware vSphere (hereafter referred to as *vSphere*) and remove -infrastructure when it's no longer needed. -Additionally, you can use Ansible for provisioning. - -On this page you'll learn how to: - -* Create the necessary files for Terraform and Ansible. -* Use Terraform to create a single instance on Azure and use Ansible for - provisioning. - -Prepare to deploy VyOS with Terraform on vSphere ------------------------------------------------- - -To create a single instance and install your configuration using -Terraform, Ansible, and vSphere, follow these steps: - -vSphere -^^^^^^^ - - -.. stop_vyoslinter - -1. Add all necessary data to the ``terraform.tfvars`` - `file `__ - and create resources. - -.. start_vyoslinter - -Terraform -^^^^^^^^^ - - -1. Create an UNIX or Windows instance. - -2. Download and install - `Terraform `__. - -3. Create the folder for example ``/root/vsphereterraform``. - -.. code-block:: none - - mkdir /root/vsphereterraform - - -4. Copy all files into your Terraform project ``/root/vsphereterraform`` - (``vyos.tf``, ``var.tf``, ``terraform.tfvars``, ``version.tf``). - For more details, - see `Structure of files in Terraform for vSphere`_ - -5. Run the following commands: - -.. code-block:: none - - cd / - terraform init - - -Ansible -^^^^^^^ - - -1. Create an UNIX instance either locally or in the cloud. - -2. Download and install Ansible. - -3. Create the folder. For example, ``/root/vsphereterraform/``. - -4. Copy all files into your Ansible project ``/root/vsphereterraform/`` - (``ansible.cfg``, ``instance.yml``, ``all``). For more details, see - `Structure of files in Ansible for vSphere`_ - - -Deploy with Terraform -^^^^^^^^^^^^^^^^^^^^^ - - -Run the following commands on your Terraform instance: - -.. code-block:: none - - cd / - terraform plan - terraform apply - yes - - -After executing these commands, your VyOS instance is deployed to -vSphere with your configuration. -If you need to delete the instance, run the following command: -.. code-block:: none - - terraform destroy - - -Structure of files in Terraform for vSphere -------------------------------------------- - -.. code-block:: none - - . - ├── vyos.tf # The main script. - ├── versions.tf # File for Terraform version. - ├── var.tf # File for Terraform version. - └── terraform.tfvars # Values for all variables (passwords, - # login, IP addresses, etc.). - - -File contents of Terraform for vSphere --------------------------------------- - -``vyos.tf`` - -.. code-block:: none - - provider "vsphere" { - user = var.vsphere_user - password = var.vsphere_password - vsphere_server = var.vsphere_server - allow_unverified_ssl = true - } - - data "vsphere_datacenter" "datacenter" { - name = var.datacenter - } - - data "vsphere_datastore" "datastore" { - name = var.datastore - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - data "vsphere_compute_cluster" "cluster" { - name = var.cluster - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - data "vsphere_resource_pool" "default" { - name = format("%s%s", data.vsphere_compute_cluster.cluster.name, "/Resources/terraform") # set as you need - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - data "vsphere_host" "host" { - name = var.host - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - data "vsphere_network" "network" { - name = var.network_name - datacenter_id = data.vsphere_datacenter.datacenter.id - } - - # Deployment of VM from Remote OVF - resource "vsphere_virtual_machine" "vmFromRemoteOvf" { - name = var.remotename - datacenter_id = data.vsphere_datacenter.datacenter.id - datastore_id = data.vsphere_datastore.datastore.id - host_system_id = data.vsphere_host.host.id - resource_pool_id = data.vsphere_resource_pool.default.id - network_interface { - network_id = data.vsphere_network.network.id - } - wait_for_guest_net_timeout = 2 - wait_for_guest_ip_timeout = 2 - - ovf_deploy { - allow_unverified_ssl_cert = true - remote_ovf_url = var.url_ova - disk_provisioning = "thin" - ip_protocol = "IPv4" - ip_allocation_policy = "dhcpPolicy" - ovf_network_map = { - "Network 1" = data.vsphere_network.network.id - "Network 2" = data.vsphere_network.network.id - } - } - vapp { - properties = { - "password" = "12345678", - "local-hostname" = "terraform_vyos" - } - } - } - - output "ip" { - description = "default ip address of the deployed VM" - value = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address - } - - # IP of vSphere instance copied to a file ip.txt in local system - - resource "local_file" "ip" { - content = vsphere_virtual_machine.vmFromRemoteOvf.default_ip_address - filename = "ip.txt" - } - - #Connecting to the Ansible control node using SSH connection - - resource "null_resource" "nullremote1" { - depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] - connection { - type = "ssh" - user = "root" - password = var.ansiblepassword - host = var.ansiblehost - - } - - # Copying the ip.txt file to the Ansible control node from local system - - provisioner "file" { - source = "ip.txt" - destination = "/root/vsphere/ip.txt" - } - } - - resource "null_resource" "nullremote2" { - depends_on = ["vsphere_virtual_machine.vmFromRemoteOvf"] - connection { - type = "ssh" - user = "root" - password = var.ansiblepassword - host = var.ansiblehost - } - - # Command to run ansible playbook on remote Linux OS - - provisioner "remote-exec" { - - inline = [ - "cd /root/vsphere/", - "ansible-playbook instance.yml" - ] - } - } - - -``versions.tf`` - -.. code-block:: none - - # Copyright (c) HashiCorp, Inc. - # SPDX-License-Identifier: MPL-2.0 - - terraform { - required_providers { - vsphere = { - source = "hashicorp/vsphere" - version = "2.4.0" - } - } - } - -``var.tf`` - -.. code-block:: none - - # Copyright (c) HashiCorp, Inc. - # SPDX-License-Identifier: MPL-2.0 - - variable "vsphere_server" { - description = "vSphere server" - type = string - } - - variable "vsphere_user" { - description = "vSphere username" - type = string - } - - variable "vsphere_password" { - description = "vSphere password" - type = string - sensitive = true - } - - variable "datacenter" { - description = "vSphere data center" - type = string - } - - variable "cluster" { - description = "vSphere cluster" - type = string - } - - variable "datastore" { - description = "vSphere datastore" - type = string - } - - variable "network_name" { - description = "vSphere network name" - type = string - } - - variable "host" { - description = "Name of your host" - type = string - } - - variable "remotename" { - description = "The name of your VM" - type = string - } - - variable "url_ova" { - description = "The URL to the .OVA file or cloud storage" - type = string - } - - variable "ansiblepassword" { - description = "Ansible password" - type = string - } - - variable "ansiblehost" { - description = "Ansible host name or IP" - type = string - } - -``terraform.tfvars`` - -.. code-block:: none - - vsphere_user = "" - vsphere_password = "" - vsphere_server = "" - datacenter = "" - datastore = "" - cluster = "" - network_name = "" - host = "" - url_ova = "" - ansiblepassword = "" - ansiblehost = "" - remotename = "" - - -Structure of files in Ansible for vSphere ------------------------------------------ - -.. code-block:: none - - . - ├── group_vars - └── all - ├── ansible.cfg - └── instance.yml - - -File contents of Ansible for vSphere ------------------------------------- - -``ansible.cfg`` - -.. code-block:: none - - [defaults] - inventory = /root/vsphere/ip.txt - host_key_checking= False - remote_user=vyos - - -``instance.yml`` - -.. code-block:: none - - ############################################################################## - # About tasks: - # "Wait 300 seconds, but only start checking after 60 seconds" - try to make ssh connection every 60 seconds until 300 seconds - # "Configure general settings for the VyOS hosts group" - make provisioning into vSphere VyOS node - # You have to add all necessary cammans of VyOS under the block "lines:" - ############################################################################## - - - - name: integration of terraform and ansible - hosts: all - gather_facts: 'no' - - tasks: - - - name: "Wait 300 seconds, but only start checking after 60 seconds" - wait_for_connection: - delay: 60 - timeout: 300 - - - name: "Configure general settings for the VyOS hosts group" - vyos_config: - lines: - - set system name-server 192.0.2.1 - - set system name-server 192.0.2.1 - save: - true - - -``group_vars/all`` - -.. code-block:: none - - ansible_connection: ansible.netcommon.network_cli - ansible_network_os: vyos.vyos.vyos - - # user and password gets from terraform variables "admin_username" and "admin_password" - ansible_user: vyos - # get from vyos.tf "vapp" - ansible_ssh_pass: 12345678 - - -Source files on GitHub ----------------------- - -All files related to deploying VyOS on vSpherewith Terraform and Ansible -can be found in the vyos-automation_ repository. - - -.. stop_vyoslinter -.. _vyos-automation: https://github.com/vyos/vyos-automation/tree/main/TerraformCloud/Vsphere_terraform_ansible_single_vyos_instance-main - -.. start_vyoslinter diff --git a/docs/automation/vyos-ansible.md b/docs/automation/vyos-ansible.md new file mode 100644 index 00000000..8e94b251 --- /dev/null +++ b/docs/automation/vyos-ansible.md @@ -0,0 +1,101 @@ +--- +lastproofread: '2026-04-13' +--- + +(vyos-ansible)= + +# Ansible + +VyOS can be configured using Ansible. To use it, install the `ansible` +package and the `python3-paramiko` module. + +## Directory structure + +Arrange your Ansible project directory as follows: + +```none +. +├── ansible.cfg +├── files +│ └── id_rsa_docker.pub +├── hosts +└── main.yml +``` + + +## File contents + +- `ansible.cfg` + +```none +[defaults] +host_key_checking = no +retry_files_enabled = False +ANSIBLE_INVENTORY_UNPARSED_FAILED = true +``` + +- `id_rsa_docker.pub` + +Contains only the SSH public key. + +```none +AAAAB3NzaC1yc2EAAAADAQABAAABAQCoDgfhQJuJRFWJijHn7ZinZ3NWp4hWVrt7HFcvn0kgtP/5PeCtMt +``` + +- `hosts` + +Defines the target VyOS devices and the connection parameters required to reach +them. + +```none +[vyos_hosts] +r11 ansible_ssh_host=192.0.2.11 + +[vyos_hosts:vars] +ansible_python_interpreter=/usr/bin/python3 +ansible_user=vyos +ansible_ssh_pass=vyos +ansible_network_os=vyos +ansible_connection=network_cli +``` + +- `main.yml` + +Defines the configuration tasks to be applied to the target VyOS devices. + +```none +--- + +- hosts: r11 + + connection: network_cli + gather_facts: 'no' + + tasks: + - name: Configure remote r11 + vyos_config: + lines: + - set system host-name r11 + - set system name-server 203.0.113.254 + - set service ssh disable-host-validation + - set system login user vyos authentication public-keys docker@work type ssh-rsa + - set system login user vyos authentication public-keys docker@work key "{{ lookup('file', 'id_rsa_docker.pub') }}" + - set system time-zone America/Los_Angeles + - set interfaces ethernet eth0 description WAN +``` + + +## Run Ansible + +To apply the configuration, use the following command: + +```none +$ ansible-playbook -i hosts main.yml + +PLAY [r11] ************************************************************************************************** + +TASK [Configure remote r11] ********************************************************************************* + +PLAY RECAP ************************************************************************************************** +r11 : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +``` diff --git a/docs/automation/vyos-ansible.rst b/docs/automation/vyos-ansible.rst deleted file mode 100644 index 12d4e9fb..00000000 --- a/docs/automation/vyos-ansible.rst +++ /dev/null @@ -1,105 +0,0 @@ -:lastproofread: 2026-04-13 - -.. _vyos-ansible: - -####### -Ansible -####### - -VyOS can be configured using Ansible. To use it, install the ``ansible`` -package and the ``python3-paramiko`` module. - -Directory structure -------------------- - -Arrange your Ansible project directory as follows: - -.. code-block:: none - - . - ├── ansible.cfg - ├── files - │   └── id_rsa_docker.pub - ├── hosts - └── main.yml - - -File contents -------------- - -* ``ansible.cfg`` - -.. code-block:: none - - [defaults] - host_key_checking = no - retry_files_enabled = False - ANSIBLE_INVENTORY_UNPARSED_FAILED = true - -* ``id_rsa_docker.pub`` - -Contains only the SSH public key. - -.. code-block:: none - - AAAAB3NzaC1yc2EAAAADAQABAAABAQCoDgfhQJuJRFWJijHn7ZinZ3NWp4hWVrt7HFcvn0kgtP/5PeCtMt - - -* ``hosts`` - -Defines the target VyOS devices and the connection parameters required to reach -them. - -.. code-block:: none - - [vyos_hosts] - r11 ansible_ssh_host=192.0.2.11 - - [vyos_hosts:vars] - ansible_python_interpreter=/usr/bin/python3 - ansible_user=vyos - ansible_ssh_pass=vyos - ansible_network_os=vyos - ansible_connection=network_cli - -* ``main.yml`` - -Defines the configuration tasks to be applied to the target VyOS devices. - -.. code-block:: none - - --- - - - hosts: r11 - - connection: network_cli - gather_facts: 'no' - - tasks: - - name: Configure remote r11 - vyos_config: - lines: - - set system host-name r11 - - set system name-server 203.0.113.254 - - set service ssh disable-host-validation - - set system login user vyos authentication public-keys docker@work type ssh-rsa - - set system login user vyos authentication public-keys docker@work key "{{ lookup('file', 'id_rsa_docker.pub') }}" - - set system time-zone America/Los_Angeles - - set interfaces ethernet eth0 description WAN - -Run Ansible ------------ - -To apply the configuration, use the following command: - -.. code-block:: none - - $ ansible-playbook -i hosts main.yml - - PLAY [r11] ************************************************************************************************************** - - TASK [Configure remote r11] ********************************************************************************************* - - PLAY RECAP ************************************************************************************************************** - r11 : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - diff --git a/docs/automation/vyos-api.md b/docs/automation/vyos-api.md new file mode 100644 index 00000000..66e8250c --- /dev/null +++ b/docs/automation/vyos-api.md @@ -0,0 +1,587 @@ +--- +lastproofread: '2026-04-13' +--- + +(vyosapi)= + +# VyOS API + +For instructions on configuring and enabling the API, see {ref}`http-api`. + +## Authentication + +All endpoints, except one, accept HTTP POST requests. The API key must be +provided as the `key` field in the form data. The only public endpoint +accepts HTTP GET requests and supports optional query parameters. + +Below are examples of API requests in cURL and Python. All other code examples +in this documentation use cURL. + +```none +curl --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "showConfig", "path": []}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' +``` + +```python +import requests +url = "https://vyos/retrieve" +payload={'data': '{"op": "showConfig", "path": []}', + 'key': 'MY-HTTPS-API-PLAINTEXT-KEY' + } +headers = {} +response = requests.request("POST", url, headers=headers, data=payload) +print(response.text) +``` + + +## API endpoints + +### /info + +This is the only API endpoint that does not require authentication and can be +accessed by anonymous users. The info endpoint returns general system +information, including the VyOS version, system hostname, and a welcome banner. + +This endpoint accepts **only** HTTP GET requests. + +```none +curl --location --request GET 'https://vyos/info' + +response +{ + "success": true, + "data": { + "version": "1.5-rolling", + "hostname": "vyos", + "banner": "Welcome to VyOS" + }, + "error": null +} +``` + +**Query parameters** + +This endpoint accepts two optional query parameters, version and hostname. Each +parameter accepts values convertible to Boolean (e.g., `yes/no`, `1/0`, or +`true/false`) to control the inclusion of related fields in the response. + +If no query parameters are provided, both parameters default to `true`. + +```none +curl --location --request GET 'https://vyos/info?version=1&hostname=1' + +response { + "success": true, + "data": { + "version": "1.5-rolling", + "hostname": "vyos", + "banner": "Welcome to VyOS" + }, + "error": null +} +``` + +If either parameter is set to a value corresponding to false, its field is +returned as an empty string in the response: + +```none +curl --location --request GET 'https://vyos/info?version=0&hostname=1' + +response { + "success": true, + "data": { + "version": "", + "hostname": "vyos", + "banner": "Welcome to VyOS" + }, + "error": null +} +``` + +You do not need to specify both parameters if you want to hide only one. Any +missing query parameter defaults to true. + +```none +curl --location --request GET 'https://vyos/info?hostname=no' + +response { + "success": true, + "data": { + "version": "1.5-rolling", + "hostname": "", + "banner": "Welcome to VyOS" + }, + "error": null +} +``` + +Note that while you can disable output for both `hostname` and `version`, +the `banner` is always included in the response. + +:::{Important} +The endpoint accepts **ONLY** `hostname` and `version` query +parameters. Including any other parameters results in an HTTP 400 Bad Request. +::: + +```none +curl --location --request GET \ + 'https://192.168.56.119/info?hostname=1&url=https://evilsite.com' + +response { + "success": false, + "error": "{'type': 'extra_forbidden', 'loc': ('query', 'url'), 'msg': 'Extra inputs are not permitted', 'input': 'https://evilsite.com'}", + "data": null +} +``` + +Values passed to the query string are validated to ensure they are strictly +Boolean. Other data types are not accepted. + +```none +curl --location --request GET 'https://vyos/info?hostname=1; eval"sudo rm -rf /"' + +response +{ + "success": false, + "error": "{'type': 'bool_parsing', 'loc': ('query', 'hostname'), 'msg': 'Input should be a valid boolean, unable to interpret input', 'input': '1; eval \"sudo rm -rf /\"'}", + "data": null +} +``` + + +### /retrieve + +The `/retrieve` endpoint returns either specific parts or the entire +configuration. + +To retrieve the entire configuration, pass an empty list to the `path` field. + +```none +curl --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "showConfig", "path": []}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + + +response (shortened) +{ + "success": true, + "data": { + "interfaces": { + "ethernet": { + "eth0": { + "address": "dhcp", + "duplex": "auto", + "hw-id": "50:00:00:01:00:00", + "speed": "auto" + }, + "eth1": { + "duplex": "auto", + "hw-id": "50:00:00:01:00:01", + "speed": "auto" + ... + }, + "error": null +} +``` + +To retrieve a specific configuration part, such as `system syslog`, specify +the desired path. + +```none +curl -k --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "showConfig", "path": ["system", "syslog"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + + +response: +{ + "success": true, + "data": { + "global": { + "facility": { + "all": { + "level": "info" + }, + "protocols": { + "level": "debug" + } + } + } + }, + "error": null +} +``` + +If you only need the value of a multi-valued node, use the `returnValues` +operation. + +For example, to get the addresses of a `dum0` interface: + +```none +curl -k --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "returnValues", "path": ["interfaces","dummy","dum0","address"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": [ + "10.10.10.10/24", + "10.10.10.11/24", + "10.10.10.12/24" + ], + "error": null +} +``` + +To check whether a configuration path exists, use the `exists` operation. It +returns `true` for an existing path: + +```none +curl -k --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "exists", "path": ["service","https","api"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": true, + "error": null +} +``` + +It returns `false` for a non-existing path: + +```none +curl -k --location --request POST 'https://vyos/retrieve' \ +--form data='{"op": "exists", "path": ["service","non","existent","path"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": false, + "error": null +} +``` + + +### /reset + +The `/reset` endpoint runs the `reset` command. + +```none +curl --location --request POST 'https://vyos/reset' \ +--form data='{"op": "reset", "path": ["ip", "bgp", "192.0.2.11"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "", + "error": null +} +``` + + +### /reboot + +To initiate a reboot, use the `/reboot` endpoint. + +```none +curl --location --request POST 'https://vyos/reboot' \ +--form data='{"op": "reboot", "path": ["now"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "", + "error": null +} +``` + + +### /poweroff + +To power off the system, use the `/poweroff` endpoint. + +```none +curl --location --request POST 'https://vyos/poweroff' \ +--form data='{"op": "poweroff", "path": ["now"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "", + "error": null +} +``` + + +### /image + +To add or delete an image, use the `/image` endpoint. + +To add an image: + +```none +curl -k --location --request POST 'https://vyos/image' \ +--form data='{"op": "add", "url": "https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response (shortened): +{ + "success": true, + "data": "Trying to fetch ISO file from https://downloads.vyos.io/rolling-latest.iso\n + ... + Setting up grub configuration...\nDone.\n", + "error": null +} +``` + +To delete an image, for example `1.3-rolling-202006070117`: + +```none +curl -k --location --request POST 'https://vyos/image' \ +--form data='{"op": "delete", "name": "1.3-rolling-202006070117"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "Deleting the \"1.3-rolling-202006070117\" image...\nDone\n", + "error": null +} +``` + + +### /show + +The `/show` endpoint runs operational mode commands and returns the resulting +output. + +For example, to show the installed images: + +```none +curl -k --location --request POST 'https://vyos/show' \ +--form data='{"op": "show", "path": ["system", "image"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "The system currently has the following image(s) installed:\n\n + 1: 1.4-rolling-202102280559 (default boot)\n + 2: 1.4-rolling-202102230218\n + 3: 1.3-beta-202102210443\n\n", + "error": null +} +``` + + +### /generate + +The `/generate` endpoint runs a `generate` command. + +```none +curl -k --location --request POST 'https://vyos/generate' \ +--form data='{"op": "generate", "path": ["pki", "wireguard", "key-pair"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "Private key: CFZR2eyhoVZwk4n3JFPMJx3E145f1EYgDM+ubytXYVY=\n + Public key: jjtpPT8ycI1Q0bNtrWuxAkO4k88Xwzg5VHV9xGZ58lU=\n\n", + "error": null +} +``` + + +### /configure + +The `/configure` endpoint accepts `set`, `delete`, and `comment` commands. + +To apply a `set` command: + +```none +curl -k --location --request POST 'https://vyos/configure' \ +--form data='{"op": "set", "path": ["interfaces", "dummy", "dum1", "address", "10.11.0.1/32"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` + +To apply a `delete` command: + +```none +curl -k --location --request POST 'https://vyos/configure' \ +--form data='{"op": "delete", "path": ["interfaces", "dummy", "dum1", "address", "10.11.0.1/32"]}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` + +The API processes each request in a session and commits it. For components such +as DHCP and PPPoE servers, IPsec, VXLAN, and other tunnels, VyOS requires the +entire configuration block for a commit. + +The endpoint can process multiple commands if you pass them as a list to +the `data` field. + +```none +curl -k --location --request POST 'https://vyos/configure' \ +--form data='[{"op": "set","path":["interfaces","vxlan","vxlan1","remote","203.0.113.99"]}, {"op": "set","path":["interfaces","vxlan","vxlan1","vni","1"]}]' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` + + +### /config-file + +The `/config-file` endpoint allows you to save, load, or merge a +configuration. + +If you do not specify a file during the `save` operation, the configuration +is automatically saved to `/config/config.boot`. + +```none +curl -k --location --request POST 'https://vyos/config-file' \ +--form data='{"op": "save"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "Saving configuration to '/config/config.boot'...\nDone\n", + "error": null +} +``` + +To save a running configuration to a file: + +```none +curl -k --location --request POST 'https://vyos/config-file' \ +--form data='{"op": "save", "file": "/config/test.config"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": "Saving configuration to '/config/test.config'...\nDone\n", + "error": null +} +``` + +To load a configuration file: + +```none +curl -k --location --request POST 'https://vyos/config-file' \ +--form data='{"op": "load", "file": "/config/test.config"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` + +To merge a configuration file: + +```none +curl -k --location --request POST 'https://vyos/config-file' \ +--form data='{"op": "merge", "file": "/config/test.config"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` + +For both `load` and `merge` operations, you can pass a string in the +request body. For example: + +```none +curl -k --location --request POST 'https://vyos/config-file' \ +--form data='{"op": "merge", "string": "interfaces {\nethernet eth1 {\naddress \"192.168.2.137/24\"\ndescription \"test\"\n}\n}\n"}' \ +--form key='MY-HTTPS-API-PLAINTEXT-KEY' + +response: +{ + "success": true, + "data": null, + "error": null +} +``` + + +## Commit-confirm + +For the previous two endpoints, a `commit` command is executed automatically +after a successful request operation (`set`, `delete`, `load`, `merge`, +or a list of `set` and `delete` operations). + +Alternatively, you can initiate a `commit-confirm`. Include the +`confirm_time` field in your request and set it to an integer greater than +`0`. + +The following example uses the JSON format for brevity, though the standard +form data format is equally valid: + +```none +curl -k -X POST -d '{"key": "MY-HTTPS-API-PLAINTEXT-KEY", "op": "merge", "string": "interfaces {\nethernet eth1 {\naddress \"192.168.137.1/24\"\ndescription \"internal\"\n}\n}\n", "confirm_time": 1}' https://vyos/config-file + +response: +{ + "success": true, + "data": "Initialized commit-confirm; 1 minutes to confirm before reload\n", + "error": null +} +``` + +If not confirmed within the specified time, the committed changes will be +reverted. To confirm and keep the changes: + +```none +curl -k -X POST -d '{"key": "MY-HTTPS-API-PLAINTEXT-KEY", "op": "confirm"}' https://vyos/config-file + +response: +{ + "success": true, + "data": "Reload timer stopped\n", + "error": null +} +``` + +If the commit is not confirmed, the revert behavior is controlled by: + +```none +vyos@vyos# set system config-management commit-confirm action +Possible completions: + reload Reload previous configuration if not confirmed + reboot Reboot to saved configuration if not confirmed (default) +``` diff --git a/docs/automation/vyos-api.rst b/docs/automation/vyos-api.rst deleted file mode 100644 index e96723e6..00000000 --- a/docs/automation/vyos-api.rst +++ /dev/null @@ -1,601 +0,0 @@ -:lastproofread: 2026-04-13 - -.. _vyosapi: - -######## -VyOS API -######## - -For instructions on configuring and enabling the API, see :ref:`http-api`. - -************** -Authentication -************** - -All endpoints, except one, accept HTTP POST requests. The API key must be -provided as the ``key`` field in the form data. The only public endpoint -accepts HTTP GET requests and supports optional query parameters. - -Below are examples of API requests in cURL and Python. All other code examples -in this documentation use cURL. - -.. code-block:: none - - curl --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "showConfig", "path": []}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - -.. code-block:: python - - import requests - url = "https://vyos/retrieve" - payload={'data': '{"op": "showConfig", "path": []}', - 'key': 'MY-HTTPS-API-PLAINTEXT-KEY' - } - headers = {} - response = requests.request("POST", url, headers=headers, data=payload) - print(response.text) - - -************* -API endpoints -************* -/info -========= - -This is the only API endpoint that does not require authentication and can be -accessed by anonymous users. The info endpoint returns general system -information, including the VyOS version, system hostname, and a welcome banner. - -This endpoint accepts **only** HTTP GET requests. - -.. code-block:: none - - curl --location --request GET 'https://vyos/info' - - response - { - "success": true, - "data": { - "version": "1.5-rolling", - "hostname": "vyos", - "banner": "Welcome to VyOS" - }, - "error": null - } - -**Query parameters** - -This endpoint accepts two optional query parameters, version and hostname. Each -parameter accepts values convertible to Boolean (e.g., ``yes/no``, ``1/0``, or -``true/false``) to control the inclusion of related fields in the response. - -If no query parameters are provided, both parameters default to ``true``. - -.. code-block:: none - - curl --location --request GET 'https://vyos/info?version=1&hostname=1' - - response { - "success": true, - "data": { - "version": "1.5-rolling", - "hostname": "vyos", - "banner": "Welcome to VyOS" - }, - "error": null - } - -If either parameter is set to a value corresponding to false, its field is -returned as an empty string in the response: - -.. code-block:: none - - curl --location --request GET 'https://vyos/info?version=0&hostname=1' - - response { - "success": true, - "data": { - "version": "", - "hostname": "vyos", - "banner": "Welcome to VyOS" - }, - "error": null - } - -You do not need to specify both parameters if you want to hide only one. Any -missing query parameter defaults to true. - -.. code-block:: none - - curl --location --request GET 'https://vyos/info?hostname=no' - - response { - "success": true, - "data": { - "version": "1.5-rolling", - "hostname": "", - "banner": "Welcome to VyOS" - }, - "error": null - } - -Note that while you can disable output for both ``hostname`` and ``version``, -the ``banner`` is always included in the response. - -.. Important:: - - The endpoint accepts **ONLY** ``hostname`` and ``version`` query - parameters. Including any other parameters results in an HTTP 400 Bad Request. - -.. code-block:: none - - curl --location --request GET \ - 'https://192.168.56.119/info?hostname=1&url=https://evilsite.com' - - response { - "success": false, - "error": "{'type': 'extra_forbidden', 'loc': ('query', 'url'), 'msg': 'Extra inputs are not permitted', 'input': 'https://evilsite.com'}", - "data": null - } - -Values passed to the query string are validated to ensure they are strictly -Boolean. Other data types are not accepted. - -.. code-block:: none - - curl --location --request GET 'https://vyos/info?hostname=1; eval"sudo rm -rf /"' - - response - { - "success": false, - "error": "{'type': 'bool_parsing', 'loc': ('query', 'hostname'), 'msg': 'Input should be a valid boolean, unable to interpret input', 'input': '1; eval \"sudo rm -rf /\"'}", - "data": null - } - -/retrieve -========= - -The ``/retrieve`` endpoint returns either specific parts or the entire -configuration. - -To retrieve the entire configuration, pass an empty list to the ``path`` field. - -.. code-block:: none - - curl --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "showConfig", "path": []}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - - response (shortened) - { - "success": true, - "data": { - "interfaces": { - "ethernet": { - "eth0": { - "address": "dhcp", - "duplex": "auto", - "hw-id": "50:00:00:01:00:00", - "speed": "auto" - }, - "eth1": { - "duplex": "auto", - "hw-id": "50:00:00:01:00:01", - "speed": "auto" - ... - }, - "error": null - } - - -To retrieve a specific configuration part, such as ``system syslog``, specify -the desired path. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "showConfig", "path": ["system", "syslog"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - - response: - { - "success": true, - "data": { - "global": { - "facility": { - "all": { - "level": "info" - }, - "protocols": { - "level": "debug" - } - } - } - }, - "error": null - } - -If you only need the value of a multi-valued node, use the ``returnValues`` -operation. - -For example, to get the addresses of a ``dum0`` interface: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "returnValues", "path": ["interfaces","dummy","dum0","address"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": [ - "10.10.10.10/24", - "10.10.10.11/24", - "10.10.10.12/24" - ], - "error": null - } - -To check whether a configuration path exists, use the ``exists`` operation. It -returns ``true`` for an existing path: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "exists", "path": ["service","https","api"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": true, - "error": null - } - -It returns ``false`` for a non-existing path: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/retrieve' \ - --form data='{"op": "exists", "path": ["service","non","existent","path"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": false, - "error": null - } - -/reset -====== - -The ``/reset`` endpoint runs the ``reset`` command. - -.. code-block:: none - - curl --location --request POST 'https://vyos/reset' \ - --form data='{"op": "reset", "path": ["ip", "bgp", "192.0.2.11"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "", - "error": null - } - -/reboot -======= - -To initiate a reboot, use the ``/reboot`` endpoint. - -.. code-block:: none - - curl --location --request POST 'https://vyos/reboot' \ - --form data='{"op": "reboot", "path": ["now"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "", - "error": null - } - -/poweroff -========= - -To power off the system, use the ``/poweroff`` endpoint. - -.. code-block:: none - - curl --location --request POST 'https://vyos/poweroff' \ - --form data='{"op": "poweroff", "path": ["now"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "", - "error": null - } - - -/image -====== - -To add or delete an image, use the ``/image`` endpoint. - -To add an image: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/image' \ - --form data='{"op": "add", "url": "https://downloads.vyos.io/rolling/current/amd64/vyos-rolling-latest.iso"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response (shortened): - { - "success": true, - "data": "Trying to fetch ISO file from https://downloads.vyos.io/rolling-latest.iso\n - ... - Setting up grub configuration...\nDone.\n", - "error": null - } - -To delete an image, for example ``1.3-rolling-202006070117``: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/image' \ - --form data='{"op": "delete", "name": "1.3-rolling-202006070117"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "Deleting the \"1.3-rolling-202006070117\" image...\nDone\n", - "error": null - } - - -/show -===== - -The ``/show`` endpoint runs operational mode commands and returns the resulting -output. - -For example, to show the installed images: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/show' \ - --form data='{"op": "show", "path": ["system", "image"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "The system currently has the following image(s) installed:\n\n - 1: 1.4-rolling-202102280559 (default boot)\n - 2: 1.4-rolling-202102230218\n - 3: 1.3-beta-202102210443\n\n", - "error": null - } - - -/generate -========= - -The ``/generate`` endpoint runs a ``generate`` command. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/generate' \ - --form data='{"op": "generate", "path": ["pki", "wireguard", "key-pair"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "Private key: CFZR2eyhoVZwk4n3JFPMJx3E145f1EYgDM+ubytXYVY=\n - Public key: jjtpPT8ycI1Q0bNtrWuxAkO4k88Xwzg5VHV9xGZ58lU=\n\n", - "error": null - } - - -/configure -========== - -The ``/configure`` endpoint accepts ``set``, ``delete``, and ``comment`` commands. - -To apply a ``set`` command: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/configure' \ - --form data='{"op": "set", "path": ["interfaces", "dummy", "dum1", "address", "10.11.0.1/32"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } - - -To apply a ``delete`` command: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/configure' \ - --form data='{"op": "delete", "path": ["interfaces", "dummy", "dum1", "address", "10.11.0.1/32"]}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } - -The API processes each request in a session and commits it. For components such -as DHCP and PPPoE servers, IPsec, VXLAN, and other tunnels, VyOS requires the -entire configuration block for a commit. - -The endpoint can process multiple commands if you pass them as a list to -the ``data`` field. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/configure' \ - --form data='[{"op": "set","path":["interfaces","vxlan","vxlan1","remote","203.0.113.99"]}, {"op": "set","path":["interfaces","vxlan","vxlan1","vni","1"]}]' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } - - -/config-file -============ - -The ``/config-file`` endpoint allows you to save, load, or merge a -configuration. - -If you do not specify a file during the ``save`` operation, the configuration -is automatically saved to ``/config/config.boot``. - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/config-file' \ - --form data='{"op": "save"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "Saving configuration to '/config/config.boot'...\nDone\n", - "error": null - } - - -To save a running configuration to a file: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/config-file' \ - --form data='{"op": "save", "file": "/config/test.config"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": "Saving configuration to '/config/test.config'...\nDone\n", - "error": null - } - - -To load a configuration file: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/config-file' \ - --form data='{"op": "load", "file": "/config/test.config"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } - -To merge a configuration file: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/config-file' \ - --form data='{"op": "merge", "file": "/config/test.config"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } - -For both ``load`` and ``merge`` operations, you can pass a string in the -request body. For example: - -.. code-block:: none - - curl -k --location --request POST 'https://vyos/config-file' \ - --form data='{"op": "merge", "string": "interfaces {\nethernet eth1 {\naddress "192.168.2.137/24"\ndescription "test"\n}\n}\n"}' \ - --form key='MY-HTTPS-API-PLAINTEXT-KEY' - - response: - { - "success": true, - "data": null, - "error": null - } - -************** -Commit-confirm -************** - -For the previous two endpoints, a ``commit`` command is executed automatically -after a successful request operation (``set``, ``delete``, ``load``, ``merge``, -or a list of ``set`` and ``delete`` operations). - -Alternatively, you can initiate a ``commit-confirm``. Include the -``confirm_time`` field in your request and set it to an integer greater than -``0``. - -The following example uses the JSON format for brevity, though the standard -form data format is equally valid: - -.. code-block:: none - - curl -k -X POST -d '{"key": "MY-HTTPS-API-PLAINTEXT-KEY", "op": "merge", "string": "interfaces {\nethernet eth1 {\naddress '192.168.137.1/24'\ndescription 'internal'\n}\n}\n", "confirm_time": 1}' https://vyos/config-file - - response: - { - "success": true, - "data": "Initialized commit-confirm; 1 minutes to confirm before reload\n", - "error": null - } - -If not confirmed within the specified time, the committed changes will be -reverted. To confirm and keep the changes: - -.. code-block:: none - - curl -k -X POST -d '{"key": "MY-HTTPS-API-PLAINTEXT-KEY", "op": "confirm"}' https://vyos/config-file - - response: - { - "success": true, - "data": "Reload timer stopped\n", - "error": null - } - -If the commit is not confirmed, the revert behavior is controlled by: - -.. code-block:: none - - vyos@vyos# set system config-management commit-confirm action - Possible completions: - reload Reload previous configuration if not confirmed - reboot Reboot to saved configuration if not confirmed (default) diff --git a/docs/automation/vyos-govyos.md b/docs/automation/vyos-govyos.md new file mode 100644 index 00000000..c1d0b24a --- /dev/null +++ b/docs/automation/vyos-govyos.md @@ -0,0 +1,197 @@ +--- +lastproofread: '2026-04-14' +--- + +(vyos-govyos)= + +# Go-VyOS + +Go-VyOS is a Go library for configuring and managing VyOS devices through +their API. + +- [GitHub repository](https://github.com/ganawaj/go-vyos): Hosts the source + code. +- [Documentation](https://pkg.go.dev/github.com/ganawaj/go-vyos@v0.1.0/vyos): + Provides the complete API reference, including available types, functions, and + methods. + +## Installation + +To install Go-VyOS, run: + +```bash +go install "github.com/ganawaj/go-vyos/vyos" +``` + + +## Getting started + +### Import and disable TLS verification + +```none +import "github.com/ganawaj/go-vyos/vyos" +client := vyos.NewClient(nil).WithToken("AUTH_KEY").WithURL("https://192.168.0.1").Insecure() +``` + + +### Initialize a VyDevice object + +```none +import ( + "github.com/ganawaj/go-vyos/vyos" + "os" +) + +hostname := os.Getenv("VYDEVICE_HOSTNAME") +port := os.Getenv("VYDEVICE_PORT") +url := fmt.Sprintf("https://%s:%s", hostname, port) + +apikey := os.Getenv("VYDEVICE_APIKEY") +verify_ssl := os.Getenv("VYDEVICE_VERIFY_SSL") + +client := vyos.NewClient(nil).WithToken(apikey).WithURL(url) + +if verify_ssl == "false" { + client = client.Insecure() +} +``` + + +## Use Go-VyOS + +### Configure, then set + +```none +out, resp, err := c.Conf.Set(ctx, "interfaces ethernet eth0 address 192.168.1.1/24") +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +``` + + +### Show a single object value + +```none +out, resp, err := c.Show.Do(ctx, "interfaces dummy dum1 address") +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +fmt.Printf("Data: %v\n", out.Data) +``` + + +### Configure, then show object + +```none +out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", nil) +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +fmt.Printf("Data: %v\n", out.Data) +``` + + +### Configure, then show multivalue object + +```none +options := RetrieveOptions{ + Multivalue: true, +} + +out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", options) +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +``` + + +### Configure, then delete object + +```none +out, resp, err := c.Conf.Delete(ctx, "interfaces dummy dum1") +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +``` + + +### Configure, then save + +```none +out, resp, err := c.Conf.Save(ctx, "") + +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +``` + + +### Configure, then save file + +```none +out, resp, err := c.Conf.Save(ctx, "/config/test300.config") + +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +``` + + +### Show object + +```none +out, resp, err := c.Show.Do(ctx, "system image") +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +fmt.Printf("Data: %v\n", out.Data) +``` + + +### Generate object + +```none +out, resp, err := c.Generate.Do(ctx, "pki wireguard key-pair") +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +fmt.Printf("Data: %v\n", out.Data) +``` + + +### Reset object + +```none +out, resp, err := c.Reset.Do(ctx, "ip bgp 192.0.2.11") +if err != nil { + panic(fmt.Sprintf("Error: %v", err)) +} + +fmt.Println(out.Success) +fmt.Printf("Data: %v\n", out.Data) +``` + + +### Configure, then load file + +```none +out, resp, err := c.ConfigFile.Load(ctx, "/config/test300.config") +``` diff --git a/docs/automation/vyos-govyos.rst b/docs/automation/vyos-govyos.rst deleted file mode 100644 index 17e15b0e..00000000 --- a/docs/automation/vyos-govyos.rst +++ /dev/null @@ -1,212 +0,0 @@ -:lastproofread: 2026-04-14 - -.. _vyos-govyos: - -####### -Go-VyOS -####### - -Go-VyOS is a Go library for configuring and managing VyOS devices through -their API. - -- `GitHub repository `_: Hosts the source - code. -- `Documentation `_: - Provides the complete API reference, including available types, functions, and - methods. - - -Installation ------------- - -To install Go-VyOS, run: - -.. code-block:: bash - - go install "github.com/ganawaj/go-vyos/vyos" - -Getting started ---------------- - -Import and disable TLS verification -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. stop_vyoslinter - -.. code-block:: none - - import "github.com/ganawaj/go-vyos/vyos" - client := vyos.NewClient(nil).WithToken("AUTH_KEY").WithURL("https://192.168.0.1").Insecure() - -.. start_vyoslinter - -Initialize a VyDevice object -^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - import ( - "github.com/ganawaj/go-vyos/vyos" - "os" - ) - - hostname := os.Getenv('VYDEVICE_HOSTNAME') - port := os.Getenv('VYDEVICE_PORT') - url := fmt.Sprintf("https://%s:%s", hostname, port) - - apikey := os.Getenv('VYDEVICE_APIKEY') - verify_ssl := os.Getenv('VYDEVICE_VERIFY_SSL') - - client := vyos.NewClient(nil).WithToken(apikey).WithURL(url) - - if verify_ssl == "false" { - client = client.Insecure() - } - -Use Go-VyOS ------------ - -Configure, then set -^^^^^^^^^^^^^^^^^^^ - -.. stop_vyoslinter - -.. code-block:: none - - out, resp, err := c.Conf.Set(ctx, "interfaces ethernet eth0 address 192.168.1.1/24") - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - -.. start_vyoslinter - -Show a single object value -^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - out, resp, err := c.Show.Do(ctx, "interfaces dummy dum1 address") - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - fmt.Printf("Data: %v\n", out.Data) - -Configure, then show object -^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", nil) - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - fmt.Printf("Data: %v\n", out.Data) - -Configure, then show multivalue object -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - options := RetrieveOptions{ - Multivalue: true, - } - - out, resp, err := c.Conf.Get(ctx, "interfaces dummy dum1", options) - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - - -Configure, then delete object -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - out, resp, err := c.Conf.Delete(ctx, "interfaces dummy dum1") - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - -Configure, then save -^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - out, resp, err := c.Conf.Save(ctx, "") - - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - -Configure, then save file -^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - out, resp, err := c.Conf.Save(ctx, "/config/test300.config") - - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - -Show object -^^^^^^^^^^^ - -.. code-block:: none - - out, resp, err := c.Show.Do(ctx, "system image") - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - fmt.Printf("Data: %v\n", out.Data) - -Generate object -^^^^^^^^^^^^^^^ - -.. code-block:: none - - out, resp, err := c.Generate.Do(ctx, "pki wireguard key-pair") - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - fmt.Printf("Data: %v\n", out.Data) - -Reset object -^^^^^^^^^^^^ - -.. code-block:: none - - out, resp, err := c.Reset.Do(ctx, "ip bgp 192.0.2.11") - if err != nil { - panic("Error: %v", err) - } - - fmt.Println(out.Success) - fmt.Printf("Data: %v\n", out.Data) - -Configure, then load file -^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - out, resp, err := c.ConfigFile.Load(ctx, "/config/test300.config") - -.. _go-vyos: https://github.com/ganawaj/go-vyos \ No newline at end of file diff --git a/docs/automation/vyos-napalm.md b/docs/automation/vyos-napalm.md new file mode 100644 index 00000000..d656c7c2 --- /dev/null +++ b/docs/automation/vyos-napalm.md @@ -0,0 +1,152 @@ +--- +lastproofread: '2026-04-13' +--- + +(vyos-napalm)= + +# NAPALM VyOS driver + +VyOS can be configured using the [NAPALM VyOS driver], which enables you to +retrieve device data and apply configurations via SSH. + +:::{note} +The `napalm-vyos` module is currently in testing. +::: + +To use the NAPALM VyOS driver, install the following packages: + +```none +apt install python3-pip +pip3 install napalm +pip3 install napalm-vyos +``` + + +## Retrieve device data + +The following script connects to a VyOS device, retrieves device facts and +the ARP table, and prints the output in JSON format. + +```none +#!/usr/bin/env python3 + +import json +from napalm import get_network_driver + +driver = get_network_driver('vyos') + +vyos_router = driver( + hostname="192.0.2.1", + username="vyos", + password="vyospass", + optional_args={"port": 22}, +) + +vyos_router.open() +output = vyos_router.get_facts() +print(json.dumps(output, indent=4)) + +output = vyos_router.get_arp_table() +print(json.dumps(output, indent=4)) + +vyos_router.close() +``` + +Output: + +```none +$ ./vyos-napalm.py +{ + "uptime": 7185, + "vendor": "VyOS", + "os_version": "1.3.0-rc5", + "serial_number": "", + "model": "Standard PC (Q35 + ICH9, 2009)", + "hostname": "r4-1.3", + "fqdn": "vyos.local", + "interface_list": [ + "eth0", + "eth1", + "eth2", + "lo", + "vtun10" + ] +} +[ + { + "interface": "eth1", + "mac": "52:54:00:b2:38:2c", + "ip": "192.0.2.2", + "age": 0.0 + }, + { + "interface": "eth0", + "mac": "52:54:00:a2:b9:5b", + "ip": "203.0.113.11", + "age": 0.0 + } +] +``` + + +## Apply a configuration + +To apply a configuration using NAPALM VyOS driver, you will need a file with +configuration commands (`commands.conf`) and a script that executes and +commits them (`vyos-napalm.py`). + +- `commands.conf` + +```none +set service ssh disable-host-validation +set service ssh port '2222' +set system name-server '192.0.2.8' +set system name-server '203.0.113.8' +set interfaces ethernet eth1 description 'FOO' +``` + +- `vyos-napalm.py` + +```none +#!/usr/bin/env python3 + +from napalm import get_network_driver + +driver = get_network_driver('vyos') + +vyos_router = driver( + hostname="192.0.2.1", + username="vyos", + password="vyospass", + optional_args={"port": 22}, +) + +vyos_router.open() +vyos_router.load_merge_candidate(filename='commands.conf') +diffs = vyos_router.compare_config() + +if bool(diffs) == True: + print(diffs) + vyos_router.commit_config() +else: + print('No configuration changes to commit') + vyos_router.discard_config() + +vyos_router.close() +``` + +Output: + +```none +$./vyos-napalm.py +[edit interfaces ethernet eth1] ++description FOO +[edit service ssh] ++disable-host-validation ++port 2222 +[edit system] ++name-server 192.0.2.8 ++name-server 203.0.113.8 +[edit] +``` +[NAPALM VyOS driver]: https://github.com/napalm-automation-community/napalm-vyos diff --git a/docs/automation/vyos-napalm.rst b/docs/automation/vyos-napalm.rst deleted file mode 100644 index f2f27124..00000000 --- a/docs/automation/vyos-napalm.rst +++ /dev/null @@ -1,155 +0,0 @@ -:lastproofread: 2026-04-13 - -.. _vyos-napalm: - -################## -NAPALM VyOS driver -################## - -VyOS can be configured using the `NAPALM VyOS driver`_, which enables you to -retrieve device data and apply configurations via SSH. - -.. note:: - - The ``napalm-vyos`` module is currently in testing. - -To use the NAPALM VyOS driver, install the following packages: - -.. code-block:: none - - apt install python3-pip - pip3 install napalm - pip3 install napalm-vyos - - -Retrieve device data --------------------- - -The following script connects to a VyOS device, retrieves device facts and -the ARP table, and prints the output in JSON format. - -.. code-block:: none - - #!/usr/bin/env python3 - - import json - from napalm import get_network_driver - - driver = get_network_driver('vyos') - - vyos_router = driver( - hostname="192.0.2.1", - username="vyos", - password="vyospass", - optional_args={"port": 22}, - ) - - vyos_router.open() - output = vyos_router.get_facts() - print(json.dumps(output, indent=4)) - - output = vyos_router.get_arp_table() - print(json.dumps(output, indent=4)) - - vyos_router.close() - -Output: - -.. code-block:: none - - $ ./vyos-napalm.py - { - "uptime": 7185, - "vendor": "VyOS", - "os_version": "1.3.0-rc5", - "serial_number": "", - "model": "Standard PC (Q35 + ICH9, 2009)", - "hostname": "r4-1.3", - "fqdn": "vyos.local", - "interface_list": [ - "eth0", - "eth1", - "eth2", - "lo", - "vtun10" - ] - } - [ - { - "interface": "eth1", - "mac": "52:54:00:b2:38:2c", - "ip": "192.0.2.2", - "age": 0.0 - }, - { - "interface": "eth0", - "mac": "52:54:00:a2:b9:5b", - "ip": "203.0.113.11", - "age": 0.0 - } - ] - -Apply a configuration ---------------------- - -To apply a configuration using NAPALM VyOS driver, you will need a file with -configuration commands (``commands.conf``) and a script that executes and -commits them (``vyos-napalm.py``). - -* ``commands.conf`` - -.. code-block:: none - - set service ssh disable-host-validation - set service ssh port '2222' - set system name-server '192.0.2.8' - set system name-server '203.0.113.8' - set interfaces ethernet eth1 description 'FOO' - -* ``vyos-napalm.py`` - -.. code-block:: none - - #!/usr/bin/env python3 - - from napalm import get_network_driver - - driver = get_network_driver('vyos') - - vyos_router = driver( - hostname="192.0.2.1", - username="vyos", - password="vyospass", - optional_args={"port": 22}, - ) - - vyos_router.open() - vyos_router.load_merge_candidate(filename='commands.conf') - diffs = vyos_router.compare_config() - - if bool(diffs) == True: - print(diffs) - vyos_router.commit_config() - else: - print('No configuration changes to commit') - vyos_router.discard_config() - - vyos_router.close() - -Output: - -.. code-block:: none - - $./vyos-napalm.py - [edit interfaces ethernet eth1] - +description FOO - [edit service ssh] - +disable-host-validation - +port 2222 - [edit system] - +name-server 192.0.2.8 - +name-server 203.0.113.8 - [edit] - -.. _napalm: https://napalm.readthedocs.io/en/latest/base.html -.. _NAPALM VyOS driver: https://github.com/napalm-automation-community/napalm-vyos \ No newline at end of file diff --git a/docs/automation/vyos-netmiko.md b/docs/automation/vyos-netmiko.md new file mode 100644 index 00000000..2e947b6a --- /dev/null +++ b/docs/automation/vyos-netmiko.md @@ -0,0 +1,76 @@ +--- +lastproofread: '2026-04-13' +--- + +(vyos-netmiko)= + +# Netmiko + +VyOS can be configured using [Netmiko]. To use Netmiko, install the +`python3-netmiko` module. + +## Example + +The following script connects to a VyOS device, applies configuration changes, +commits them, and runs an operational mode command to verify the updated +configuration. + +```none +#!/usr/bin/env python3 + +from netmiko import ConnectHandler + +vyos_router = { + "device_type": "vyos", + "host": "192.0.2.1", + "username": "vyos", + "password": "vyospass", + "port": 22, + } + +net_connect = ConnectHandler(**vyos_router) + +config_commands = [ + 'set interfaces ethernet eth0 description WAN', + 'set interfaces ethernet eth1 description LAN', + ] + +# set configuration +output = net_connect.send_config_set(config_commands, exit_config_mode=False) +print(output) + +# commit configuration +output = net_connect.commit() +print(output) + +# operational mode commands +output = net_connect.send_command("run show interfaces") +print(output) +``` + +Output + +```none +$ ./vyos-netmiko.py +configure +set interfaces ethernet eth0 description WAN +[edit] +vyos@r4-1.5# set interfaces ethernet eth1 description LAN +[edit] +vyos@r4-1.5# +commit +[edit] +vyos@r4-1.5# +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 203.0.113.1/24 u/u WAN +eth1 192.0.2.1/30 u/u LAN +eth2 - u/u +lo 127.0.0.1/8 u/u + ::1/128 +vtun10 10.10.0.1/24 u/u +[edit] +``` + +[netmiko]: https://github.com/ktbyers/netmiko diff --git a/docs/automation/vyos-netmiko.rst b/docs/automation/vyos-netmiko.rst deleted file mode 100644 index b94b0129..00000000 --- a/docs/automation/vyos-netmiko.rst +++ /dev/null @@ -1,76 +0,0 @@ -:lastproofread: 2026-04-13 - -.. _vyos-netmiko: - -####### -Netmiko -####### - -VyOS can be configured using Netmiko_. To use Netmiko, install the -``python3-netmiko`` module. - -Example -------- -The following script connects to a VyOS device, applies configuration changes, -commits them, and runs an operational mode command to verify the updated -configuration. - -.. code-block:: none - - #!/usr/bin/env python3 - - from netmiko import ConnectHandler - - vyos_router = { - "device_type": "vyos", - "host": "192.0.2.1", - "username": "vyos", - "password": "vyospass", - "port": 22, - } - - net_connect = ConnectHandler(**vyos_router) - - config_commands = [ - 'set interfaces ethernet eth0 description WAN', - 'set interfaces ethernet eth1 description LAN', - ] - - # set configuration - output = net_connect.send_config_set(config_commands, exit_config_mode=False) - print(output) - - # commit configuration - output = net_connect.commit() - print(output) - - # operational mode commands - output = net_connect.send_command("run show interfaces") - print(output) - -Output - -.. code-block:: none - - $ ./vyos-netmiko.py - configure - set interfaces ethernet eth0 description WAN - [edit] - vyos@r4-1.5# set interfaces ethernet eth1 description LAN - [edit] - vyos@r4-1.5# - commit - [edit] - vyos@r4-1.5# - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 203.0.113.1/24 u/u WAN - eth1 192.0.2.1/30 u/u LAN - eth2 - u/u - lo 127.0.0.1/8 u/u - ::1/128 - vtun10 10.10.0.1/24 u/u - [edit] - -.. _netmiko: https://github.com/ktbyers/netmiko diff --git a/docs/automation/vyos-pyvyos.md b/docs/automation/vyos-pyvyos.md new file mode 100644 index 00000000..1a6a09fd --- /dev/null +++ b/docs/automation/vyos-pyvyos.md @@ -0,0 +1,149 @@ +--- +lastproofread: '2026-04-14' +--- + +(vyos-pyvyos)= + +# PyVyOS + +PyVyOS is a Python library for configuring and managing VyOS devices through +their API. + +**Key resources:** + +- [Documentation](https://pyvyos.readthedocs.io/en/latest/): Provides + installation, configuration, and usage instructions. +- [GitHub repository](https://github.com/robertoberto/pyvyos): Hosts the + source code. +- [PyPI](https://pypi.org/project/pyvyos/): Hosts distribution packages for + installation via the Python package installer (`pip`). + +## Installation + +To install PyVyOS via `pip`, run: + +```bash +pip install pyvyos +``` + + +## Getting started + +### Import and disable warnings for verify=false + +```none +import urllib3 +urllib3.disable_warnings() +``` + + +### Use API response class + +```none +@dataclass +class ApiResponse: + status: int + request: dict + result: dict + error: str +``` + + +### Initialize a VyDevice object + +```none +from dotenv import load_dotenv +load_dotenv() + +hostname = os.getenv('VYDEVICE_HOSTNAME') +apikey = os.getenv('VYDEVICE_APIKEY') +port = os.getenv('VYDEVICE_PORT') +protocol = os.getenv('VYDEVICE_PROTOCOL') +verify_ssl = os.getenv('VYDEVICE_VERIFY_SSL') + +verify = verify_ssl.lower() == "true" if verify_ssl else True + +device = VyDevice(hostname=hostname, apikey=apikey, port=port, protocol=protocol, verify=verify) +``` + + +## Use PyVyOS + +### Configure, then set + +```none +response = device.configure_set(path=["interfaces", "ethernet", "eth0", "address", "192.168.1.1/24"]) +if not response.error: + print(response.result) +``` + + +### Configure, then show a single object value + +```none +response = device.retrieve_return_values(path=["interfaces", "dummy", "dum1", "address"]) +print(response.result) +``` + + +### Configure, then show object + +```none +response = device.retrieve_show_config(path=[]) +if not response.error: + print(response.result) +``` + + +### Configure, then delete object + +```none +response = device.configure_delete(path=["interfaces", "dummy", "dum1"]) +``` + + +### Configure, then save + +```none +response = device.config_file_save() +``` + + +### Configure, then save file + +```none +response = device.config_file_save(file="/config/test300.config") +``` + + +### Show object + +```none +response = device.show(path=["system", "image"]) +print(response.result) +``` + + +### Generate object + +```none +randstring = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(20)) +keyrand = f'/tmp/key_{randstring}' +response = device.generate(path=["ssh", "client-key", keyrand]) +``` + + +### Reset object + +```none +response = device.reset(path=["conntrack-sync", "internal-cache"]) +if not response.error: + print(response.result) +``` + + +### Configure, then load file + +```none +response = device.config_file_load(file="/config/test300.config") +``` diff --git a/docs/automation/vyos-pyvyos.rst b/docs/automation/vyos-pyvyos.rst deleted file mode 100644 index cbd315e5..00000000 --- a/docs/automation/vyos-pyvyos.rst +++ /dev/null @@ -1,156 +0,0 @@ -:lastproofread: 2026-04-14 - -.. _vyos-pyvyos: - -###### -PyVyOS -###### - -PyVyOS is a Python library for configuring and managing VyOS devices through -their API. - -**Key resources:** - -- `Documentation `_: Provides - installation, configuration, and usage instructions. -- `GitHub repository `_: Hosts the - source code. -- `PyPI `_: Hosts distribution packages for - installation via the Python package installer (``pip``). - - -Installation ------------- - -To install PyVyOS via ``pip``, run: - -.. code-block:: bash - - pip install pyvyos - -Getting started ---------------- - -Import and disable warnings for verify=false -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - import urllib3 - urllib3.disable_warnings() - -Use API response class -^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - @dataclass - class ApiResponse: - status: int - request: dict - result: dict - error: str - -Initialize a VyDevice object -^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - from dotenv import load_dotenv - load_dotenv() - - hostname = os.getenv('VYDEVICE_HOSTNAME') - apikey = os.getenv('VYDEVICE_APIKEY') - port = os.getenv('VYDEVICE_PORT') - protocol = os.getenv('VYDEVICE_PROTOCOL') - verify_ssl = os.getenv('VYDEVICE_VERIFY_SSL') - - verify = verify_ssl.lower() == "true" if verify_ssl else True - - device = VyDevice(hostname=hostname, apikey=apikey, port=port, protocol=protocol, verify=verify) - -Use PyVyOS ----------- - -Configure, then set -^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - response = device.configure_set(path=["interfaces", "ethernet", "eth0", "address", "192.168.1.1/24"]) - if not response.error: - print(response.result) - -Configure, then show a single object value -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - response = device.retrieve_return_values(path=["interfaces", "dummy", "dum1", "address"]) - print(response.result) - -Configure, then show object -^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - response = device.retrieve_show_config(path=[]) - if not response.error: - print(response.result) - -Configure, then delete object -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - response = device.configure_delete(path=["interfaces", "dummy", "dum1"]) - -Configure, then save -^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - response = device.config_file_save() - -Configure, then save file -^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - response = device.config_file_save(file="/config/test300.config") - -Show object -^^^^^^^^^^^ - -.. code-block:: none - - response = device.show(path=["system", "image"]) - print(response.result) - -Generate object -^^^^^^^^^^^^^^^ - -.. code-block:: none - - randstring = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(20)) - keyrand = f'/tmp/key_{randstring}' - response = device.generate(path=["ssh", "client-key", keyrand]) - -Reset object -^^^^^^^^^^^^ - -.. code-block:: none - - response = device.reset(path=["conntrack-sync", "internal-cache"]) - if not response.error: - print(response.result) - -Configure, then load file -^^^^^^^^^^^^^^^^^^^^^^^^^ - -.. code-block:: none - - response = device.config_file_load(file="/config/test300.config") - - -.. _pyvyos: https://github.com/robertoberto/pyvyos diff --git a/docs/automation/vyos-salt.md b/docs/automation/vyos-salt.md new file mode 100644 index 00000000..7b306cb8 --- /dev/null +++ b/docs/automation/vyos-salt.md @@ -0,0 +1,211 @@ +--- +lastproofread: '2023-01-16' +--- + +(vyos-salt)= + +```{include} /_include/need_improvement.txt +``` + + +# Salt + +VyOS supports op-mode and configuration via [salt]. + +Without proxy it requires VyOS minion configuration +and supports op-mode data: + +```none +set service salt-minion id 'r14' +set service salt-minion master '192.0.2.250' +``` + +Check salt-keys on the salt master + +```none +/ # salt-key --list-all +Accepted Keys: +r11 +Denied Keys: +Unaccepted Keys: +r14 +Rejected Keys: +``` + +Accept minion key + +```none +/ # salt-key --accept r14 +The following keys are going to be accepted: +Unaccepted Keys: +r14 +Proceed? [n/Y] y +Key for minion r14 accepted. +``` + +Check that salt master can communicate with minions + +```none +/ # salt '*' test.ping +r14: + True +r11: + True +``` + +At this step we can get some op-mode information from VyOS nodes: + +```none +/ # salt '*' network.interface eth0 +r11: + |_ + ---------- + address: + 192.0.2.11 + broadcast: + 192.0.2.255 + label: + eth0 + netmask: + 255.255.255.0 +r14: + |_ + ---------- + address: + 192.0.2.14 + broadcast: + 192.0.2.255 + label: + eth0 + netmask: + 255.255.255.0 + + +/ # salt r14 network.arp +r14: + ---------- + aa:bb:cc:dd:f3:db: + 192.0.2.1 + aa:bb:cc:dd:2e:80: + 203.0.113.1 +``` + +## Netmiko-proxy + +It is possible to configure VyOS via [netmiko] proxy module. +It requires a minion with installed packet `python3-netmiko` module +who has a connection to VyOS nodes. Salt-minion have to communicate +with salt master + +### Configuration + +Salt master configuration: + +```none +/ # cat /etc/salt/master +file_roots: + base: + - /srv/salt/states + +pillar_roots: + base: + - /srv/salt/pillars +``` + +Structure of /srv/salt: + +```none +/ # tree /srv/salt/ +/srv/salt/ +|___ pillars +| |__ r11-proxy.sls +| |__ top.sls +|___ states + |__ commands.txt +``` + +top.sls + +```none +/ # cat /srv/salt/pillars/top.sls +base: + r11-proxy: + - r11-proxy +``` + +r11-proxy.sls Includes parameters for connecting to salt-proxy minion + +```none +/ # cat /srv/salt/pillars/r11-proxy.sls +proxy: + proxytype: netmiko # how to connect to proxy minion, change it + device_type: vyos # + host: 192.0.2.250 + username: user + password: secret_passwd +``` + +commands.txt + +```none +/ # cat /srv/salt/states/commands.txt +set interfaces ethernet eth0 description 'WAN' +set interfaces ethernet eth1 description 'LAN' +``` + +Check that proxy minion is alive: + +```none +/ # salt r11-proxy test.ping +r11-proxy: + True +/ # +``` + +### Examples + +Example of op-mode: + +```none +/ # salt r11-proxy netmiko.send_command 'show interfaces ethernet eth0 brief' host=192.0.2.14 device_type=vyos username=vyos password=vyos +r11-proxy: + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 192.0.2.14/24 u/u Upstream +/ # +``` + +Example of configuration: + +```none +/ # salt r11-proxy netmiko.send_config config_commands=['set interfaces ethernet eth0 description Link_to_WAN'] commit=True host=192.0.2.14 device_type=vyos username=vyos password=vyos +r11-proxy: + configure + set interfaces ethernet eth0 description Link_to_WAN + [edit] + vyos@r14# commit + [edit] + vyos@r14# +/ # +``` + +Example of configuration commands from the file +"/srv/salt/states/commands.txt" + +```none +/ # salt r11-proxy netmiko.send_config config_file=salt://commands.txt commit=True host=192.0.2.11 device_type=vyos username=vyos password=vyos +r11-proxy: + configure + set interfaces ethernet eth0 description 'WAN' + [edit] + vyos@r1# set interfaces ethernet eth1 description 'LAN' + [edit] + vyos@r1# commit + [edit] + vyos@r1# +/ # +``` + +[netmiko]: +[salt]: https://docs.saltproject.io/en/latest/contents.html diff --git a/docs/automation/vyos-salt.rst b/docs/automation/vyos-salt.rst deleted file mode 100644 index 3a5b17d7..00000000 --- a/docs/automation/vyos-salt.rst +++ /dev/null @@ -1,232 +0,0 @@ -:lastproofread: 2023-01-16 - -.. _vyos-salt: - -.. include:: /_include/need_improvement.txt - -#### -Salt -#### - -VyOS supports op-mode and configuration via salt_. - -Without proxy it requires VyOS minion configuration -and supports op-mode data: - -.. code-block:: none - - set service salt-minion id 'r14' - set service salt-minion master '192.0.2.250' - -Check salt-keys on the salt master - -.. code-block:: none - - / # salt-key --list-all - Accepted Keys: - r11 - Denied Keys: - Unaccepted Keys: - r14 - Rejected Keys: - -Accept minion key - -.. code-block:: none - - / # salt-key --accept r14 - The following keys are going to be accepted: - Unaccepted Keys: - r14 - Proceed? [n/Y] y - Key for minion r14 accepted. - - - -Check that salt master can communicate with minions - -.. code-block:: none - - / # salt '*' test.ping - r14: - True - r11: - True - -At this step we can get some op-mode information from VyOS nodes: - -.. code-block:: none - - / # salt '*' network.interface eth0 - r11: - |_ - ---------- - address: - 192.0.2.11 - broadcast: - 192.0.2.255 - label: - eth0 - netmask: - 255.255.255.0 - r14: - |_ - ---------- - address: - 192.0.2.14 - broadcast: - 192.0.2.255 - label: - eth0 - netmask: - 255.255.255.0 - - - / # salt r14 network.arp - r14: - ---------- - aa:bb:cc:dd:f3:db: - 192.0.2.1 - aa:bb:cc:dd:2e:80: - 203.0.113.1 - - - - -Netmiko-proxy -------------- - -It is possible to configure VyOS via netmiko_ proxy module. -It requires a minion with installed packet ``python3-netmiko`` module -who has a connection to VyOS nodes. Salt-minion have to communicate -with salt master - -Configuration -^^^^^^^^^^^^^ - -Salt master configuration: - -.. code-block:: none - - / # cat /etc/salt/master - file_roots: - base: - - /srv/salt/states - - pillar_roots: - base: - - /srv/salt/pillars - -Structure of /srv/salt: - -.. code-block:: none - - / # tree /srv/salt/ - /srv/salt/ - |___ pillars - | |__ r11-proxy.sls - | |__ top.sls - |___ states - |__ commands.txt - -top.sls - -.. code-block:: none - - / # cat /srv/salt/pillars/top.sls - base: - r11-proxy: - - r11-proxy - - -r11-proxy.sls Includes parameters for connecting to salt-proxy minion - -.. code-block:: none - - / # cat /srv/salt/pillars/r11-proxy.sls - proxy: - proxytype: netmiko # how to connect to proxy minion, change it - device_type: vyos # - host: 192.0.2.250 - username: user - password: secret_passwd - -commands.txt - -.. code-block:: none - - / # cat /srv/salt/states/commands.txt - set interfaces ethernet eth0 description 'WAN' - set interfaces ethernet eth1 description 'LAN' - -Check that proxy minion is alive: - -.. code-block:: none - - / # salt r11-proxy test.ping - r11-proxy: - True - / # - -Examples -^^^^^^^^ - -Example of op-mode: - -.. stop_vyoslinter - -.. code-block:: none - - / # salt r11-proxy netmiko.send_command 'show interfaces ethernet eth0 brief' host=192.0.2.14 device_type=vyos username=vyos password=vyos - r11-proxy: - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 192.0.2.14/24 u/u Upstream - / # - -.. start_vyoslinter - -Example of configuration: - -.. stop_vyoslinter - -.. code-block:: none - - / # salt r11-proxy netmiko.send_config config_commands=['set interfaces ethernet eth0 description Link_to_WAN'] commit=True host=192.0.2.14 device_type=vyos username=vyos password=vyos - r11-proxy: - configure - set interfaces ethernet eth0 description Link_to_WAN - [edit] - vyos@r14# commit - [edit] - vyos@r14# - / # - -.. start_vyoslinter - -Example of configuration commands from the file -"/srv/salt/states/commands.txt" - -.. stop_vyoslinter - -.. code-block:: none - - / # salt r11-proxy netmiko.send_config config_file=salt://commands.txt commit=True host=192.0.2.11 device_type=vyos username=vyos password=vyos - r11-proxy: - configure - set interfaces ethernet eth0 description 'WAN' - [edit] - vyos@r1# set interfaces ethernet eth1 description 'LAN' - [edit] - vyos@r1# commit - [edit] - vyos@r1# - / # - -.. start_vyoslinter - -.. _salt: https://docs.saltproject.io/en/latest/contents.html -.. stop_vyoslinter -.. _netmiko: https://docs.saltproject.io/en/latest/ref/modules/all/salt.modules.netmiko_mod.html#module-salt.modules.netmiko_mod -.. start_vyoslinter \ No newline at end of file diff --git a/docs/cli.md b/docs/cli.md new file mode 100644 index 00000000..e961c790 --- /dev/null +++ b/docs/cli.md @@ -0,0 +1,868 @@ +(cli)= + +# Command Line Interface + +The VyOS {abbr}`CLI (Command-Line Interface)` comprises an operational and a configuration mode. + +## Operational Mode + +Operational mode allows for commands to perform operational system tasks and view system and service status, while configuration mode allows for the modification of system configuration. + +The CLI provides a built-in help system. In the CLI the `?` key may be used to display available commands. The `TAB` key can be used to auto-complete commands and will present the help system upon a conflict or unknown value. + +For example typing `sh` followed by the `TAB` key will complete to `show`. Pressing `TAB` a second time will display the possible sub-commands of the `show` command. + +``` none +vyos@vyos:~$ s[tab] +set show +``` + +Example showing possible show commands: + +``` none +vyos@vyos:~$ show [tab] +Possible completions: + arp Show Address Resolution Protocol (ARP) information + bridge Show bridging information + cluster Show clustering information + configuration Show running configuration + conntrack Show conntrack entries in the conntrack table + conntrack-sync + Show connection syncing information + date Show system date and time + dhcp Show Dynamic Host Configuration Protocol (DHCP) information + dhcpv6 Show status related to DHCPv6 + disk Show status of disk device + dns Show Domain Name Server (DNS) information + file Show files for a particular image + firewall Show firewall information + flow-accounting + Show flow accounting statistics + hardware Show system hardware details + history show command history + host Show host information + incoming Show ethernet input-policy information +: q +``` + +You can scroll up with the keys `[Shift]+[PageUp]` and scroll down with `[Shift]+[PageDown]`. + +When the output of a command results in more lines than can be displayed on the terminal screen the output is paginated as indicated by a `:` prompt. + +When viewing in page mode the following commands are available: +: - `q` key can be used to cancel output + - `space` will scroll down one page + - `b` will scroll back one page + - `return` will scroll down one line + - `up-arrow` and `down-arrow` will scroll up or down one line at a time + respectively + - `left-arrow` and `right-arrow` can be used to scroll left or right in + the event that the output has lines which exceed the terminal size. + +### Operational mode command families + +Many operational mode commands in VyOS are placed in families such as `show`, `clear`, or `reset`. Every such family has a specific meaning to allow the user to guess how the command is going to behave --- in particular, whether it will be disruptive to the system or not. + +Note that this convention was not always followed with perfect consistency and some commands may still be in wrong families, so you should always check the command help and documentation if you are not sure what exactly it does. + +#### clear + +\"Clear\" commands are completely non-disruptive to any system operations. Generally, they can be used freely without hesitation. + +Most often their purpose is to remove or reset various debug and diagnostic information such as system logs and packet counters. + +Examples: +- `clear console` --- clears the screen. +- `clear interfaces ethernet eth0 counters` --- zeroes packet counters on `eth0`. +- `clear log` --- deletes all system log entries. + +#### reset + +\"Reset\" commands can be locally-disruptive. They may, for example, terminate a single user session or a session with a dynamic routing protocol peer. + +They should be used with caution since they may have a significant impact on a particular users in the network. +- `reset pppoe-server username jsmith` --- terminate all PPPoE sessions from user `jsmith`. +- `reset bgp 192.0.2.54` --- terminates the BGP session with neighbor 192.0.2.54. +- `reset vpn ipsec site-to-site peer vpn.example.com` --- terminates IPsec tunnels to `vpn.example.com`. +- `reset session tty1` --- terminates the TTY user session `tty1` + +#### restart + +\"Restart\" operations may disrupt an entire subsystem. Most often they initiate a restart of a server process, which causes it to be unavailable for a brief period and resets all the process state. + +They should be used with extreme caution. +- `restart dhcp server` --- restarts the IPv4 DHCP server process (DHCP requests are not served while it is restarting). +- `restart ipsec` --- restarts the IPsec process (which forces all sessions and all IPsec process state to reset). + +#### force + +\"Force\" commands force the system to perform an action that it might perform by itself at a later point. + +Examples: +- `force arp request interface eth1 address 10.3.0.2` --- send a gratuitous ARP request. +- `force root-partition-auto-resize` --- grow the root filesystem to the size of the system partition (this is also done on startup, but this command can do it without a reboot). + +#### execute + +\"Execute\" commands are for executing various diagnostic and auxiliary actions that the system would never perform by itself. + +Examples: +- `execute wake-on-lan interface host ` --- send a Wake-On-LAN packet to a host. + +#### show + +\"Show\" commands display various system information. They may occasionally use a pager for long outputs, that you can quit by pressing the Q button. Their output is always finite, however. + +Examples: +- `show system login` --- displays current system users. +- `show ip route` --- displays the IPv4 routing table. + +#### monitor + +\"Monitor\" commands initiate various monitoring operations that may output information continuously, until terminated with `Ctrl-C` or disabled. + +Examples: +- `monitor log` --- continuously outputs latest system logs. + +## Configuration Mode + +To enter configuration mode use the `configure` command: + +``` none +vyos@vyos:~$ configure +[edit] +vyos@vyos:~# +``` + +::::{note} +Prompt changes from `$` to `#`. To exit configuration mode, type `exit`. +:::: + +``` none +vyos@vyos:~# exit +exit +vyos@vyos:~$ +``` + +See the configuration section of this document for more information on configuration mode. + +(configuration-overview)= + +# Configuration Overview + +VyOS makes use of a unified configuration file for the entire system\'s configuration: `/config/config.boot`. This allows easy template creation, backup, and replication of system configuration. A system can thus also be easily cloned by simply copying the required configuration files. + +## Terminology + +A VyOS system has three major types of configurations: +- **Active** or **running configuration** is the system configuration that is loaded and currently active (used by VyOS). Any change in the configuration will have to be committed to belong to the active/running configuration. +- **Working configuration** is the one that is currently being modified in configuration mode. Changes made to the working configuration do not go into effect until the changes are committed with the {cfgcmd}`commit` command. At which time the working configuration will become the active or running configuration. +- **Saved configuration** is the one saved to a file using the {cfgcmd}`save` command. It allows you to keep safe a configuration for future uses. There can be multiple configuration files. The default or \"boot\" configuration is saved and loaded from the file `/config/config.boot`. + +## Seeing and navigating the configuration + +```{opcmd} show configuration + +View the current active configuration, also known as the running configuration, from the operational mode. + +:::{code-block} none +vyos@vyos:~$ show configuration +interfaces { + ethernet eth0 { + address dhcp + hw-id 00:53:00:00:aa:01 + } + loopback lo { + } +} +service { + ssh { + port 22 + } +} +system { + config-management { + commit-revisions 20 + } + console { + device ttyS0 { + speed 9600 + } + } + login { + user vyos { + authentication { + encrypted-password **************** + } + level admin + } + } + ntp { + server 0.pool.ntp.org { + } + server 1.pool.ntp.org { + } + server 2.pool.ntp.org { + } + } + syslog { + global { + facility all { + level notice + } + facility protocols { + level debug + } + } + } +} +::: +``` + +By default, the configuration is displayed in a hierarchy like the above example, this is only one of the possible ways to display the configuration. When the configuration is generated and the device is configured, changes are added through a collection of {cfgcmd}`set` and {cfgcmd}`delete` commands. + +```{opcmd} show configuration commands + +Get a collection of all the set commands required which led to the running configuration. + +:::{code-block} none +vyos@vyos:~$ show configuration commands +set interfaces ethernet eth0 address 'dhcp' +set interfaces ethernet eth0 hw-id '00:53:dd:44:3b:0f' +set interfaces loopback 'lo' +set service ssh port '22' +set system config-management commit-revisions '20' +set system console device ttyS0 speed '9600' +set system login user vyos authentication encrypted-password '$6$Vt68...QzF0' +set system login user vyos level 'admin' +set system ntp server '0.pool.ntp.org' +set system ntp server '1.pool.ntp.org' +set system ntp server '2.pool.ntp.org' +set system syslog global facility all level 'notice' +set system syslog global facility protocols level 'debug' +::: +``` + +Both these `show` commands should be executed when in operational mode, they do not work directly in configuration mode. There is a special way on how to {ref}`run_opmode_from_config_mode`. + +::::{hint} + +Use the `show configuration commands | strip-private` command when you want to hide private data. You may want to do so if you want to share your configuration on the [forum](https://forum.vyos.io). +:::: + +```{opcmd} show configuration json + +View the current active configuration in JSON format. + +:::{code-block} none +{"interfaces": {"ethernet": {"eth0": {"address": ["192.0.2.11/24", "192.0.2.35/24"], "hw-id": "52:54:00:48:a0:c6"}, "eth1": {"address": ["203.0.113.1/24"], "hw-id": "52:54:00:fc:50:0b"}}, "loopback": {"lo": {}}}, "protocols": {"static": {"route": {"0.0.0.0/0": {"next-hop": {"192.0.2.254": {}}}}}}, "service": {"ssh": {"disable-host-validation": {}}}, "system": {"config-management": {"commit-revisions": "100"}, "console": {"device": {"ttyS0": {"speed": "115200"}}}, "host-name": "r11-vyos", "login": {"user": {"vyos": {"authentication": {"encrypted-password": "$6$Vt68...F0", "plaintext-password": "", "public-keys": {"vyos@vyos": {"key": "AAAAxxx=", "type": "ssh-rsa"}}}}}}, "name-server": ["203.0.113.254"], "ntp": {"server": {"time1.vyos.net": {}, "time2.vyos.net": {}, "time3.vyos.net": {}}}, "syslog": {"global": {"facility": {"all": {"level": "info"}, "protocols": {"level": "debug"}}}}, "time-zone": "America/New_York"}} +::: +``` + +```{opcmd} show configuration json pretty + +View the current active configuration in readable JSON format. + +:::{code-block} none +{ + "interfaces": { + "ethernet": { + "eth0": { + "address": [ + "192.0.2.11/24", + "192.0.2.35/24" + ], + "hw-id": "52:54:00:48:a0:c6" + }, + "eth1": { + "address": [ + "203.0.113.1/24" + ], + "hw-id": "52:54:00:fc:50:0b" + } + }, + "loopback": { + "lo": {} + } + }, + "protocols": { + "static": { + "route": { + "0.0.0.0/0": { + "next-hop": { + "192.0.2.254": {} + } + } + } + } + }, + "service": { + "ssh": { + "disable-host-validation": {} + } + }, + "system": { + "config-management": { + "commit-revisions": "100" + }, + "console": { + "device": { + "ttyS0": { + "speed": "115200" + } + } + }, + "host-name": "r11-vyos", + "login": { + "user": { + "vyos": { + "authentication": { + "encrypted-password": "$6$Vt68...F0", + "plaintext-password": "", + "public-keys": { + "vyos@vyos": { + "key": "AAAAxxx=", + "type": "ssh-rsa" + } + } + } + } + } + }, + "name-server": [ + "203.0.113.254" + ], + "ntp": { + "server": { + "time1.vyos.net": {}, + "time2.vyos.net": {}, + "time3.vyos.net": {} + } + }, + "syslog": { + "global": { + "facility": { + "all": { + "level": "info" + }, + "protocols": { + "level": "debug" + } + } + } + }, + "time-zone": "America/New_York" + } +} +::: +``` + + +### The config mode + +When entering the configuration mode you are navigating inside a tree structure, to enter configuration mode enter the command {opcmd}`configure` when in operational mode. + +``` none +vyos@vyos$ configure +[edit] +vyos@vyos# +``` + +::::{note} +When going into configuration mode, prompt changes from `$` to `#`. +:::: + +All commands executed here are relative to the configuration level you have entered. You can do everything from the top level, but commands will be quite lengthy when manually typing them. + +The current hierarchy level can be changed by the {cfgcmd}`edit` command. + +``` none +[edit] +vyos@vyos# edit interfaces ethernet eth0 + +[edit interfaces ethernet eth0] +vyos@vyos# +``` + +You are now in a sublevel relative to `interfaces ethernet eth0`, all commands executed from this point on are relative to this sublevel. Use either the {cfgcmd}`top` or {cfgcmd}`exit` command to go back to the top of the hierarchy. You can also use the {cfgcmd}`up` command to move only one level up at a time. + +```{cfgcmd} show +``` + +The {cfgcmd}`show` command within configuration mode will show the working configuration indicating line changes with `+` for additions, `>` for replacements and `-` for deletions. +**Example:** + +``` none +vyos@vyos:~$ configure +[edit] +vyos@vyos# show interfaces + ethernet eth0 { + description MY_OLD_DESCRIPTION + disable + hw-id 00:53:dd:44:3b:03 + } + loopback lo { + } +[edit] +vyos@vyos# set interfaces ethernet eth0 address dhcp +[edit] +vyos@vyos# set interfaces ethernet eth0 description MY_NEW_DESCRIPTION +[edit] +vyos@vyos# delete interfaces ethernet eth0 disable +[edit] +vyos@vyos# show interfaces + ethernet eth0 { ++ address dhcp +> description MY_NEW_DESCRIPTION +- disable + hw-id 00:53:dd:44:3b:03 + } + loopback lo { + } +``` + +It is also possible to display all {cfgcmd}`set` commands within configuration mode using {cfgcmd}`show | commands` + +``` none +vyos@vyos# show interfaces ethernet eth0 | commands +set address dhcp +set hw-id 00:53:ad:44:3b:03 +``` + +These commands are also relative to the level you are inside and only relevant configuration blocks will be displayed when entering a sub-level. + +``` none +[edit interfaces ethernet eth0] +vyos@vyos# show + address dhcp + hw-id 00:53:ad:44:3b:03 +``` + +Exiting from the configuration mode is done via the {cfgcmd}`exit` command from the top level, executing {cfgcmd}`exit` from within a sub-level takes you back to the top level. + +``` none +[edit interfaces ethernet eth0] +vyos@vyos# exit +[edit] +vyos@vyos# exit +Warning: configuration changes have not been saved. +``` + +## Editing the configuration + +The configuration can be edited by the use of {cfgcmd}`set` and {cfgcmd}`delete` commands from within configuration mode. + +```{cfgcmd} set + +Use this command to set the value of a parameter or to create a new element. +``` + +Configuration commands are flattened from the tree into \'one-liner\' commands shown in {opcmd}`show configuration commands` from operation mode. Commands are relative to the level where they are executed and all redundant information from the current level is removed from the command entered. + +``` none +[edit] +vyos@vyos# set interface ethernet eth0 address 192.0.2.100/24 +``` + +``` none +[edit interfaces ethernet eth0] +vyos@vyos# set address 203.0.113.6/24 +``` + +These two commands above are essentially the same, just executed from different levels in the hierarchy. + +```{cfgcmd} delete + +To delete a configuration entry use the {cfgcmd}`delete` command, this also deletes all sub-levels under the current level you\'ve specified in the {cfgcmd}`delete` command. Deleting an entry will also result in the element reverting back to its default value if one exists. + +:::{code-block} none +[edit interfaces ethernet eth0] +vyos@vyos# delete address 192.0.2.100/24 +::: +``` + +```{cfgcmd} commit + +Any change you do on the configuration, will not take effect until committed using the {cfgcmd}`commit` command in configuration mode. + +:::{code-block} none +vyos@vyos# commit +[edit] +vyos@vyos# exit +Warning: configuration changes have not been saved. +vyos@vyos:~$ +::: +``` +::::{hint} + +You can specify a commit message with {cfgcmd}`commit comment `. +:::: + +(save)= + +```{cfgcmd} save + +Use this command to preserve configuration changes upon reboot. By default it is stored at */config/config.boot*. In the case you want to store the configuration file somewhere else, you can add a local path, a SCP address, a FTP address or a TFTP address. +``` + +``` none +vyos@vyos# save +Saving configuration to '/config/config.boot'... +Done +``` + +``` none +vyos@vyos# save [tab] +Possible completions: + Save to system config file + Save to file on local machine + scp://:@:/ Save to file on remote machine + ftp://:@/ Save to file on remote machine + tftp:/// Save to file on remote machine +vyos@vyos# save tftp://192.168.0.100/vyos-test.config.boot +Saving configuration to 'tftp://192.168.0.100/vyos-test.config.boot'... + +Done +``` +::: +:::: +```{cfgcmd} exit \[discard\] + +Configuration mode can not be exited while uncommitted changes exist. To exit configuration mode without applying changes, the {cfgcmd}`exit discard` command must be used. + +All changes in the working config will thus be lost. + +:::{code-block} none +vyos@vyos# exit +Cannot exit: configuration modified. + +Use 'exit discard' to discard the changes and exit. +[edit] +vyos@vyos# exit discard +::: +``` + +```{cfgcmd} commit-confirm \ + +Use this command to temporarily commit your changes and set the number of minutes available for confirmation. `confirm` must be entered within those minutes, otherwise the system will revert into a previous configuration. The default value is 10 minutes. + +The definition of \'revert\' and \'a previous configuration\' depends on the setting: + +:::{code-block} none +vyos@vyos# set system config-management commit-confirm action +Possible completions: +reload Reload previous configuration if not confirmed +reboot Reboot to saved configuration if not confirmed (default) +::: + +Note that \'reload\' loads the most recent completed configuration and does not require a reboot. + +What if you are doing something dangerous? Suppose you want to setup a firewall, and you are not sure there are no mistakes that will lock you out of your system. You can use confirmed commit. If you issue the `commit-confirm` command, your changes will be committed, and if you don\'t issue the `confirm` command in 10 minutes, your system will reboot into previous config revision. + +:::{code-block} none +vyos@router# set firewall interface eth0 local name FromWorld +vyos@router# commit-confirm +commit confirm will be automatically reboot in 10 minutes unless confirmed +Proceed? [confirm]y +[edit] +vyos@router# confirm +[edit] +::: +``` + +```{cfgcmd} copy + +Copy a configuration element. + +You can copy and remove configuration subtrees. Suppose you set up a firewall ruleset `FromWorld` with one rule that allows traffic from specific subnet. Now you want to setup a similar rule, but for different subnet. Change your edit level to `firewall name FromWorld` and use `copy rule 10 to rule 20`, then modify rule 20. + +:::{code-block} none +vyos@router# show firewall name FromWorld + default-action drop + rule 10 { + action accept + source { + address 203.0.113.0/24 + } + } +[edit] +vyos@router# edit firewall name FromWorld +[edit firewall name FromWorld] +vyos@router# copy rule 10 to rule 20 +[edit firewall name FromWorld] +vyos@router# set rule 20 source address 198.51.100.0/24 +[edit firewall name FromWorld] +vyos@router# commit +[edit firewall name FromWorld] +::: +``` + +```{cfgcmd} rename + +Rename a configuration element. + +You can also rename config subtrees: + +:::{code-block} none +vyos@router# rename rule 10 to rule 5 +[edit firewall name FromWorld] +vyos@router# commit +[edit firewall name FromWorld] +::: +Note that `show` command respects your edit level and from this level you can view the modified firewall ruleset with just `show` with no parameters. + +:::{code-block} none +vyos@router# show + default-action drop + rule 5 { + action accept + source { + address 203.0.113.0/24 + } + } + rule 20 { + action accept + source { + address 198.51.100.0/24 + } + } +::: +``` + +```{cfgcmd} comment \ "comment text" + +Add comment as an annotation to a configuration node. + +The `comment` command allows you to insert a comment above the `` configuration section. When shown, comments are enclosed with `/*` and `*/` as open/close delimiters. Comments need to be committed, just like other config changes. + +To remove an existing comment from your current configuration, specify an empty string enclosed in double quote marks (`""`) as the comment text. + +Example: + +:::{code-block} none +vyos@vyos# comment firewall all-ping "Yes I know this VyOS is cool" +vyos@vyos# commit +vyos@vyos# show + firewall { + /* Yes I know this VyOS is cool */ + all-ping enable + broadcast-ping disable + ... + } +::: +:::{note} +An important thing to note is that since the comment is added on top of the section, it will not appear if the `show
` command is used. With the above example, the ``show firewall`` command would return starting after the `firewall {` line, hiding the comment. +::: +``` + +(run_opmode_from_config_mode)= + +## Access opmode from config mode + +When inside configuration mode you are not directly able to execute operational commands. + +```{cfgcmd} run + +Access to these commands are possible through the use of the `run [command]` command. From this command you will have access to everything accessible from operational mode. + +Command completion and syntax help with `?` and `[tab]` will also work. + +:::{code-block} none +[edit] +vyos@vyos# run show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 0.0.0.0/0 u/u +::: +``` + +## Managing configurations + +VyOS comes with an integrated versioning system for the system configuration. It automatically maintains a backup of every previous configuration which has been committed to the system. The configurations are versioned locally for rollback but they can also be stored on a remote host for archiving/backup reasons. + +### Local Archive + +Revisions are stored on disk. You can view, compare and rollback them to any previous revisions if something goes wrong. + +```{opcmd} show system commit + +View all existing revisions on the local system. + +:::{code-block} none +vyos@vyos:~$ show system commit +0 2015-03-30 08:53:03 by vyos via cli +1 2015-03-30 08:52:20 by vyos via cli +2 2015-03-26 21:26:01 by root via boot-config-loader +3 2015-03-26 20:43:18 by root via boot-config-loader +4 2015-03-25 11:06:14 by root via boot-config-loader +5 2015-03-25 01:04:28 by root via boot-config-loader +6 2015-03-25 00:16:47 by vyos via cli +7 2015-03-24 23:43:45 by root via boot-config-loader +::: +``` + +```{cfgcmd} set system config-management commit-revisions \ + +You can specify the number of revisions stored on disk. N can be in the range of 0 - 65535. When the number of revisions exceeds the configured value, the oldest revision is removed. The default setting for this value is to store 100 revisions locally. +``` + +### Compare configurations + +VyOS lets you compare different configurations. + +```{cfgcmd} compare \ \ + +Use this command to spot what the differences are between different configurations. + +:::{code-block} none +vyos@vyos# compare [tab] +Possible completions: + Compare working & active configurations +saved Compare working & saved configurations + Compare working with revision N + Compare revision N with M +Revisions: + 0 2013-12-17 20:01:37 root by boot-config-loader + 1 2013-12-13 15:59:31 root by boot-config-loader + 2 2013-12-12 21:56:22 vyos by cli + 3 2013-12-12 21:55:11 vyos by cli + 4 2013-12-12 21:27:54 vyos by cli + 5 2013-12-12 21:23:29 vyos by cli + 6 2013-12-12 21:13:59 root by boot-config-loader + 7 2013-12-12 16:25:19 vyos by cli + 8 2013-12-12 15:44:36 vyos by cli + 9 2013-12-12 15:42:07 root by boot-config-loader + 10 2013-12-12 15:42:06 root by init +::: +The command {cfgcmd}`compare` allows you to compare different type of configurations. It also lets you compare different revisions through the {cfgcmd}`compare N M` command, where N and M are revision numbers. The output will describe how the configuration N is when compared to M indicating with a plus sign (`+`) the additional parts N has when compared to M, and indicating with a minus sign (`-`) the lacking parts N misses when compared to M. + +:::{code-block} none +vyos@vyos# compare 0 6 +[edit interfaces] ++dummy dum1 { ++ address 10.189.0.1/31 ++} +[edit interfaces ethernet eth0] ++vif 99 { ++ address 10.199.0.1/31 ++} +-vif 900 { +- address 192.0.2.4/24 +-} +::: +``` + +```{opcmd} show system commit diff \ + +Show commit revision difference. +``` + +The command above also lets you see the difference between two commits. By default the difference with the running config is shown. + +``` none +vyos@router# run show system commit diff 4 +[edit system] ++ipv6 { ++ disable-forwarding ++} +``` + +This means four commits ago we did `set system ipv6 disable-forwarding`. + +### Rollback Changes + +You can rollback configuration changes using the rollback command. This will apply the selected revision and trigger a system reboot. + +```{cfgcmd} rollback \ + +Rollback to revision N (currently requires reboot) + +:::{code-block} none +vyos@vyos# compare 1 +[edit system] +>host-name vyos-1 +[edit] +vyos@vyos# rollback 1 +Proceed with reboot? [confirm][y] +Broadcast message from root@vyos-1 (pts/0) (Tue Dec 17 21:07:45 2013): + +The system is going down for reboot NOW! +::: +``` + +### Remote Archive + +VyOS can upload the configuration to a remote location after each call to {cfgcmd}`commit`. You will have to set the commit-archive location. TFTP, FTP, SCP and SFTP servers are supported. Every time a {cfgcmd}`commit` is successful the `config.boot` file will be copied to the defined destination(s). The filename used on the remote host will be `config.boot-hostname.YYYYMMDD_HHMMSS`. + +```{cfgcmd} set system config-management commit-archive location \ + +Specify remote location of commit archive as any of the below {abbr}`URI (Uniform Resource Identifier)` +- `http://:@:/` +- `https://:@:/` +- `ftp://:@/` +- `sftp://:@/` +- `scp://:@:/` +- `tftp:///` +- `git+https://:@/` + +Since username and password are part of the URI, they need to be properly url encoded if containing special characters. + +:::{note} +The number of revisions don\'t affect the commit-archive. + +When using Git as destination for the commit archive the `source-address` CLI option has no effect. + +You may find VyOS not allowing the secure connection because it cannot verify the legitimacy of the remote server. You can use the workaround below to quickly add the remote host\'s SSH fingerprint to your `~/.ssh/known_hosts` file: +::: +:::{code-block} none +vyos@vyos# ssh-keyscan >> ~/.ssh/known_hosts +::: +``` + +```{cfgcmd} set system config-management commit-archive vrf \ + +Specify name of the {abbr}`VRF (Virtual Routing and Forwarding)` instance used to upload the configuration to the remote system. +``` + +### Saving and loading manually + +You can use the `save` and `load` commands if you want to manually manage specific configuration files. + +When using the [save](#save) command, you can add a specific location where to store your configuration file. And, when needed it, you will be able to load it with the `load` command: + +```{cfgcmd} load \ + +Use this command to load a configuration which will replace the running configuration. Define the location of the configuration file to be loaded. You can use a path to a local file, an SCP address, an SFTP address, an FTP address, an HTTP address, an HTTPS address or a TFTP address. + +:::{code-block} none +vyos@vyos# load +Possible completions: + Load from system config file + Load from file on local machine +scp://:@:/ Load from file on remote machine +sftp://:@/ Load from file on remote machine +ftp://:@/ Load from file on remote machine +http:/// Load from file on remote machine +https:/// Load from file on remote machine +tftp:/// Load from file on remote machine +::: + +If you are remotely connected, you will lose your connection. You may want to copy first the config, edit it to ensure connectivity, and load the edited config. +``` + +### Restore Default + +In the case you want to completely delete your configuration and restore the default one, you can enter the following command in configuration mode: + +``` none +load /opt/vyatta/etc/config.boot.default +``` + +You will be asked if you want to continue. If you accept, you will have to use {cfgcmd}`commit` if you want to make the changes active. + +Then you may want to {cfgcmd}`save` in order to delete the saved configuration too. + +::::{note} +Prompt changes from `$` to `#`. To exit configuration mode, type `exit`. +:::: diff --git a/docs/cli.rst b/docs/cli.rst deleted file mode 100644 index 778d3954..00000000 --- a/docs/cli.rst +++ /dev/null @@ -1,1060 +0,0 @@ -.. _cli: - -###################### -Command Line Interface -###################### - -The VyOS :abbr:`CLI (Command-Line Interface)` comprises an operational and a -configuration mode. - -Operational Mode -################ - -Operational mode allows for commands to perform operational system tasks and -view system and service status, while configuration mode allows for the -modification of system configuration. - -The CLI provides a built-in help system. In the CLI the ``?`` key may be used -to display available commands. The ``TAB`` key can be used to auto-complete -commands and will present the help system upon a conflict or unknown value. - -For example typing ``sh`` followed by the ``TAB`` key will complete to -``show``. Pressing ``TAB`` a second time will display the possible -sub-commands of the ``show`` command. - -.. code-block:: none - - vyos@vyos:~$ s[tab] - set show - -Example showing possible show commands: - -.. code-block:: none - - vyos@vyos:~$ show [tab] - Possible completions: - arp Show Address Resolution Protocol (ARP) information - bridge Show bridging information - cluster Show clustering information - configuration Show running configuration - conntrack Show conntrack entries in the conntrack table - conntrack-sync - Show connection syncing information - date Show system date and time - dhcp Show Dynamic Host Configuration Protocol (DHCP) information - dhcpv6 Show status related to DHCPv6 - disk Show status of disk device - dns Show Domain Name Server (DNS) information - file Show files for a particular image - firewall Show firewall information - flow-accounting - Show flow accounting statistics - hardware Show system hardware details - history show command history - host Show host information - incoming Show ethernet input-policy information - : q - -You can scroll up with the keys ``[Shift]+[PageUp]`` and scroll down with -``[Shift]+[PageDown]``. - -When the output of a command results in more lines than can be displayed on the -terminal screen the output is paginated as indicated by a ``:`` prompt. - -When viewing in page mode the following commands are available: - * ``q`` key can be used to cancel output - * ``space`` will scroll down one page - * ``b`` will scroll back one page - * ``return`` will scroll down one line - * ``up-arrow`` and ``down-arrow`` will scroll up or down one line at a - time respectively - * ``left-arrow`` and ``right-arrow`` can be used to scroll left or right - in the event that the output has lines which exceed the terminal size. - -Operational mode command families -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Many operational mode commands in VyOS are placed in families such as -``show``, ``clear``, or ``reset``. Every such family has a specific -meaning to allow the user to guess how the command is going to behave — -in particular, whether it will be disruptive to the system or not. - -Note that this convention was not always followed with perfect -consistency and some commands may still be in wrong families, so you -should always check the command help and documentation if you are not -sure what exactly it does. - -clear -''''' - -"Clear" commands are completely non-disruptive to any system operations. -Generally, they can be used freely without hesitation. - -Most often their purpose is to remove or reset various debug and -diagnostic information such as system logs and packet counters. - -Examples: - -- ``clear console`` — clears the screen. -- ``clear interfaces ethernet eth0 counters`` — zeroes packet counters - on ``eth0``. -- ``clear log`` — deletes all system log entries. - -reset -''''' - -"Reset" commands can be locally-disruptive. They may, for example, -terminate a single user session or a session with a dynamic routing -protocol peer. - -They should be used with caution since they may have a significant -impact on a particular users in the network. - -- ``reset pppoe-server username jsmith`` — terminate all PPPoE sessions - from user ``jsmith``. -- ``reset bgp 192.0.2.54`` — terminates the BGP session with neighbor - 192.0.2.54. -- ``reset vpn ipsec site-to-site peer vpn.example.com`` — terminates - IPsec tunnels to ``vpn.example.com``. -- ``reset session tty1`` — terminates the TTY user session ``tty1`` - -restart -''''''' - -"Restart" operations may disrupt an entire subsystem. Most often they -initiate a restart of a server process, which causes it to be -unavailable for a brief period and resets all the process state. - -They should be used with extreme caution. - -- ``restart dhcp server`` — restarts the IPv4 DHCP server process (DHCP - requests are not served while it is restarting). -- ``restart ipsec`` — restarts the IPsec process (which forces all - sessions and all IPsec process state to reset). - -force -''''' - -"Force" commands force the system to perform an action that it might -perform by itself at a later point. - -Examples: - -- ``force arp request interface eth1 address 10.3.0.2`` — send a - gratuitious ARP request. -- ``force root-partition-auto-resize`` — grow the root filesystem to - the size of the system partition (this is also done on startup, but - this command can do it without a reboot). - -execute -''''''' - -"Execute" commands are for executing various diagnostic and auxilliary -actions that the system would never perform by itself. - -Examples: - -- ``execute wake-on-lan interface host `` — send a - Wake-On-LAN packet to a host. - -show -'''' - -"Show" commands display various system information. They may -occasionally use a pager for long outputs, that you can quit by pressing -the Q button. Their output is always finite, however. - -Examples: - -- ``show system login`` — displays current system users. -- ``show ip route`` — displays the IPv4 routing table. - -monitor -''''''' - -"Monitor" commands initiate various monitoring operations that may -output information continuously, until terminated with ``Ctrl-C`` or -disabled. - -Examples: - -- ``monitor log`` — continuously outputs latest system logs. - - -Configuration Mode -################## - -To enter configuration mode use the ``configure`` command: - -.. code-block:: none - - vyos@vyos:~$ configure - [edit] - vyos@vyos:~# - -.. note:: Prompt changes from ``$`` to ``#``. To exit configuration mode, - type ``exit``. - -.. code-block:: none - - vyos@vyos:~# exit - exit - vyos@vyos:~$ - -See the configuration section of this document for more information on -configuration mode. - - -.. _configuration-overview: - -###################### -Configuration Overview -###################### - -VyOS makes use of a unified configuration file for the entire system's -configuration: ``/config/config.boot``. This allows easy template -creation, backup, and replication of system configuration. A system can -thus also be easily cloned by simply copying the required configuration -files. - -Terminology -########### - -A VyOS system has three major types of configurations: - -* **Active** or **running configuration** is the system configuration - that is loaded and currently active (used by VyOS). Any change in - the configuration will have to be committed to belong to the - active/running configuration. - -* **Working configuration** is the one that is currently being modified - in configuration mode. Changes made to the working configuration do - not go into effect until the changes are committed with the - :cfgcmd:`commit` command. At which time the working configuration will - become the active or running configuration. - -* **Saved configuration** is the one saved to a file using the - :cfgcmd:`save` command. It allows you to keep safe a configuration for - future uses. There can be multiple configuration files. The default or - "boot" configuration is saved and loaded from the file - ``/config/config.boot``. - -Seeing and navigating the configuration -======================================= - -.. opcmd:: show configuration - - View the current active configuration, also known as the running - configuration, from the operational mode. - - .. code-block:: none - - vyos@vyos:~$ show configuration - interfaces { - ethernet eth0 { - address dhcp - hw-id 00:53:00:00:aa:01 - } - loopback lo { - } - } - service { - ssh { - port 22 - } - } - system { - config-management { - commit-revisions 20 - } - console { - device ttyS0 { - speed 9600 - } - } - login { - user vyos { - authentication { - encrypted-password **************** - } - level admin - } - } - ntp { - server 0.pool.ntp.org { - } - server 1.pool.ntp.org { - } - server 2.pool.ntp.org { - } - } - syslog { - global { - facility all { - level notice - } - facility protocols { - level debug - } - } - } - } - -By default, the configuration is displayed in a hierarchy like the above -example, this is only one of the possible ways to display the -configuration. When the configuration is generated and the device is -configured, changes are added through a collection of :cfgcmd:`set` and -:cfgcmd:`delete` commands. - -.. opcmd:: show configuration commands - - Get a collection of all the set commands required which led to the - running configuration. - - .. code-block:: none - - vyos@vyos:~$ show configuration commands - set interfaces ethernet eth0 address 'dhcp' - set interfaces ethernet eth0 hw-id '00:53:dd:44:3b:0f' - set interfaces loopback 'lo' - set service ssh port '22' - set system config-management commit-revisions '20' - set system console device ttyS0 speed '9600' - set system login user vyos authentication encrypted-password '$6$Vt68...QzF0' - set system login user vyos level 'admin' - set system ntp server '0.pool.ntp.org' - set system ntp server '1.pool.ntp.org' - set system ntp server '2.pool.ntp.org' - set system syslog global facility all level 'notice' - set system syslog global facility protocols level 'debug' - -Both these ``show`` commands should be executed when in operational -mode, they do not work directly in configuration mode. There is a -special way on how to :ref:run_opmode_from_config_mode. - -.. hint:: Use the ``show configuration commands | strip-private`` - command when you want to hide private data. You may want to do so if - you want to share your configuration on the `forum`_. - -.. _`forum`: https://forum.vyos.io - -.. opcmd:: show configuration json - - View the current active configuration in JSON format. - - .. code-block:: none - - {"interfaces": {"ethernet": {"eth0": {"address": ["192.0.2.11/24", "192.0.2.35/24"], "hw-id": "52:54:00:48:a0:c6"}, "eth1": {"address": ["203.0.113.1/24"], "hw-id": "52:54:00:fc:50:0b"}}, "loopback": {"lo": {}}}, "protocols": {"static": {"route": {"0.0.0.0/0": {"next-hop": {"192.0.2.254": {}}}}}}, "service": {"ssh": {"disable-host-validation": {}}}, "system": {"config-management": {"commit-revisions": "100"}, "console": {"device": {"ttyS0": {"speed": "115200"}}}, "host-name": "r11-vyos", "login": {"user": {"vyos": {"authentication": {"encrypted-password": "$6$Vt68...F0", "plaintext-password": "", "public-keys": {"vyos@vyos": {"key": "AAAAxxx=", "type": "ssh-rsa"}}}}}}, "name-server": ["203.0.113.254"], "ntp": {"server": {"time1.vyos.net": {}, "time2.vyos.net": {}, "time3.vyos.net": {}}}, "syslog": {"global": {"facility": {"all": {"level": "info"}, "protocols": {"level": "debug"}}}}, "time-zone": "America/New_York"}} - -.. opcmd:: show configuration json pretty - - View the current active configuration in readable JSON format. - - .. code-block:: none - - { - "interfaces": { - "ethernet": { - "eth0": { - "address": [ - "192.0.2.11/24", - "192.0.2.35/24" - ], - "hw-id": "52:54:00:48:a0:c6" - }, - "eth1": { - "address": [ - "203.0.113.1/24" - ], - "hw-id": "52:54:00:fc:50:0b" - } - }, - "loopback": { - "lo": {} - } - }, - "protocols": { - "static": { - "route": { - "0.0.0.0/0": { - "next-hop": { - "192.0.2.254": {} - } - } - } - } - }, - "service": { - "ssh": { - "disable-host-validation": {} - } - }, - "system": { - "config-management": { - "commit-revisions": "100" - }, - "console": { - "device": { - "ttyS0": { - "speed": "115200" - } - } - }, - "host-name": "r11-vyos", - "login": { - "user": { - "vyos": { - "authentication": { - "encrypted-password": "$6$Vt68...F0", - "plaintext-password": "", - "public-keys": { - "vyos@vyos": { - "key": "AAAAxxx=", - "type": "ssh-rsa" - } - } - } - } - } - }, - "name-server": [ - "203.0.113.254" - ], - "ntp": { - "server": { - "time1.vyos.net": {}, - "time2.vyos.net": {}, - "time3.vyos.net": {} - } - }, - "syslog": { - "global": { - "facility": { - "all": { - "level": "info" - }, - "protocols": { - "level": "debug" - } - } - } - }, - "time-zone": "America/New_York" - } - } - - -The config mode ---------------- - -When entering the configuration mode you are navigating inside a tree -structure, to enter configuration mode enter the command -:opcmd:`configure` when in operational mode. - -.. code-block:: none - - vyos@vyos$ configure - [edit] - vyos@vyos# - - -.. note:: When going into configuration mode, prompt changes from - ``$`` to ``#``. - - -All commands executed here are relative to the configuration level you -have entered. You can do everything from the top level, but commands -will be quite lengthy when manually typing them. - -The current hierarchy level can be changed by the :cfgcmd:`edit` -command. - -.. code-block:: none - - [edit] - vyos@vyos# edit interfaces ethernet eth0 - - [edit interfaces ethernet eth0] - vyos@vyos# - -You are now in a sublevel relative to ``interfaces ethernet eth0``, all -commands executed from this point on are relative to this sublevel. Use -either the :cfgcmd:`top` or :cfgcmd:`exit` command to go back to the top -of the hierarchy. You can also use the :cfgcmd:`up` command to move only -one level up at a time. - -.. cfgcmd:: show - -The :cfgcmd:`show` command within configuration mode will show the -working configuration indicating line changes with ``+`` for additions, -``>`` for replacements and ``-`` for deletions. - -**Example:** - -.. code-block:: none - - vyos@vyos:~$ configure - [edit] - vyos@vyos# show interfaces - ethernet eth0 { - description MY_OLD_DESCRIPTION - disable - hw-id 00:53:dd:44:3b:03 - } - loopback lo { - } - [edit] - vyos@vyos# set interfaces ethernet eth0 address dhcp - [edit] - vyos@vyos# set interfaces ethernet eth0 description MY_NEW_DESCRIPTION - [edit] - vyos@vyos# delete interfaces ethernet eth0 disable - [edit] - vyos@vyos# show interfaces - ethernet eth0 { - + address dhcp - > description MY_NEW_DESCRIPTION - - disable - hw-id 00:53:dd:44:3b:03 - } - loopback lo { - } - -It is also possible to display all :cfgcmd:`set` commands within configuration -mode using :cfgcmd:`show | commands` - -.. code-block:: none - - vyos@vyos# show interfaces ethernet eth0 | commands - set address dhcp - set hw-id 00:53:ad:44:3b:03 - -These commands are also relative to the level you are inside and only -relevant configuration blocks will be displayed when entering a -sub-level. - -.. code-block:: none - - [edit interfaces ethernet eth0] - vyos@vyos# show - address dhcp - hw-id 00:53:ad:44:3b:03 - -Exiting from the configuration mode is done via the :cfgcmd:`exit` -command from the top level, executing :cfgcmd:`exit` from within a -sub-level takes you back to the top level. - -.. code-block:: none - - [edit interfaces ethernet eth0] - vyos@vyos# exit - [edit] - vyos@vyos# exit - Warning: configuration changes have not been saved. - - -Editing the configuration -========================= - -The configuration can be edited by the use of :cfgcmd:`set` and -:cfgcmd:`delete` commands from within configuration mode. - -.. cfgcmd:: set - - Use this command to set the value of a parameter or to create a new - element. - -Configuration commands are flattened from the tree into 'one-liner' -commands shown in :opcmd:`show configuration commands` from operation -mode. Commands are relative to the level where they are executed and all -redundant information from the current level is removed from the command -entered. - -.. code-block:: none - - [edit] - vyos@vyos# set interface ethernet eth0 address 192.0.2.100/24 - - -.. code-block:: none - - [edit interfaces ethernet eth0] - vyos@vyos# set address 203.0.113.6/24 - - -These two commands above are essentially the same, just executed from -different levels in the hierarchy. - -.. cfgcmd:: delete - - To delete a configuration entry use the :cfgcmd:`delete` command, - this also deletes all sub-levels under the current level you've - specified in the :cfgcmd:`delete` command. Deleting an entry will - also result in the element reverting back to its default value if one - exists. - - .. code-block:: none - - [edit interfaces ethernet eth0] - vyos@vyos# delete address 192.0.2.100/24 - -.. cfgcmd:: commit - - Any change you do on the configuration, will not take effect until - committed using the :cfgcmd:`commit` command in configuration mode. - - .. code-block:: none - - vyos@vyos# commit - [edit] - vyos@vyos# exit - Warning: configuration changes have not been saved. - vyos@vyos:~$ - -.. hint:: You can specify a commit message with - :cfgcmd:`commit comment `. - -.. _save: - -.. cfgcmd:: save - - Use this command to preserve configuration changes upon reboot. By - default it is stored at */config/config.boot*. In the case you want - to store the configuration file somewhere else, you can add a local - path, a SCP address, a FTP address or a TFTP address. - - .. code-block:: none - - vyos@vyos# save - Saving configuration to '/config/config.boot'... - Done - - .. code-block:: none - - vyos@vyos# save [tab] - Possible completions: - Save to system config file - Save to file on local machine - scp://:@:/ Save to file on remote machine - ftp://:@/ Save to file on remote machine - tftp:/// Save to file on remote machine - vyos@vyos# save tftp://192.168.0.100/vyos-test.config.boot - Saving configuration to 'tftp://192.168.0.100/vyos-test.config.boot'... - ######################################################################## 100.0% - Done - -.. cfgcmd:: exit [discard] - - Configuration mode can not be exited while uncommitted changes exist. - To exit configuration mode without applying changes, the - :cfgcmd:`exit discard` command must be used. - - All changes in the working config will thus be lost. - - .. code-block:: none - - vyos@vyos# exit - Cannot exit: configuration modified. - Use 'exit discard' to discard the changes and exit. - [edit] - vyos@vyos# exit discard - - -.. cfgcmd:: commit-confirm - - Use this command to temporarily commit your changes and set the - number of minutes available for confirmation. ``confirm`` must - be entered within those minutes, otherwise the system will revert - into a previous configuration. The default value is 10 minutes. - - The definition of 'revert' and 'a previous configuration' depends on - the setting: - - .. code-block:: none - - vyos@vyos# set system config-management commit-confirm action - Possible completions: - reload Reload previous configuration if not confirmed - reboot Reboot to saved configuration if not confirmed (default) - - Note that 'reload' loads the most recent completed configuration and does - not require a reboot. - - What if you are doing something dangerous? Suppose you want to setup - a firewall, and you are not sure there are no mistakes that will lock - you out of your system. You can use confirmed commit. If you issue - the ``commit-confirm`` command, your changes will be committed, and if - you don't issue the ``confirm`` command in 10 minutes, your - system will reboot into previous config revision. - - .. code-block:: none - - vyos@router# set firewall interface eth0 local name FromWorld - vyos@router# commit-confirm - commit confirm will be automatically reboot in 10 minutes unless confirmed - Proceed? [confirm]y - [edit] - vyos@router# confirm - [edit] - -.. cfgcmd:: copy - - Copy a configuration element. - - You can copy and remove configuration subtrees. Suppose you set up a - firewall ruleset ``FromWorld`` with one rule that allows traffic from - specific subnet. Now you want to setup a similar rule, but for - different subnet. Change your edit level to - ``firewall name FromWorld`` and use ``copy rule 10 to rule 20``, then - modify rule 20. - - - .. code-block:: none - - vyos@router# show firewall name FromWorld - default-action drop - rule 10 { - action accept - source { - address 203.0.113.0/24 - } - } - [edit] - vyos@router# edit firewall name FromWorld - [edit firewall name FromWorld] - vyos@router# copy rule 10 to rule 20 - [edit firewall name FromWorld] - vyos@router# set rule 20 source address 198.51.100.0/24 - [edit firewall name FromWorld] - vyos@router# commit - [edit firewall name FromWorld] - - -.. cfgcmd:: rename - - Rename a configuration element. - - You can also rename config subtrees: - - .. code-block:: none - - vyos@router# rename rule 10 to rule 5 - [edit firewall name FromWorld] - vyos@router# commit - [edit firewall name FromWorld] - - Note that ``show`` command respects your edit level and from this - level you can view the modified firewall ruleset with just ``show`` - with no parameters. - - .. code-block:: none - - vyos@router# show - default-action drop - rule 5 { - action accept - source { - address 203.0.113.0/24 - } - } - rule 20 { - action accept - source { - address 198.51.100.0/24 - } - } - - -.. cfgcmd:: comment "comment text" - - Add comment as an annotation to a configuration node. - - The ``comment`` command allows you to insert a comment above the - ```` configuration section. When shown, comments are - enclosed with ``/*`` and ``*/`` as open/close delimiters. Comments - need to be committed, just like other config changes. - - To remove an existing comment from your current configuration, - specify an empty string enclosed in double quote marks (``""``) as - the comment text. - - Example: - - .. code-block:: none - - vyos@vyos# comment firewall all-ping "Yes I know this VyOS is cool" - vyos@vyos# commit - vyos@vyos# show - firewall { - /* Yes I know this VyOS is cool */ - all-ping enable - broadcast-ping disable - ... - } - - .. note:: An important thing to note is that since the comment is - added on top of the section, it will not appear if the ``show -
`` command is used. With the above example, the `show - firewall` command would return starting after the ``firewall - {`` line, hiding the comment. - -.. _run_opmode_from_config_mode: - -Access opmode from config mode -============================== - -When inside configuration mode you are not directly able to execute -operational commands. - -.. cfgcmd:: run - - Access to these commands are possible through the use of the - ``run [command]`` command. From this command you will have access to - everything accessible from operational mode. - - Command completion and syntax help with ``?`` and ``[tab]`` will also - work. - - .. code-block:: none - - [edit] - vyos@vyos# run show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 0.0.0.0/0 u/u - -Managing configurations -======================= - -VyOS comes with an integrated versioning system for the system -configuration. It automatically maintains a backup of every previous -configuration which has been committed to the system. The configurations -are versioned locally for rollback but they can also be stored on a -remote host for archiving/backup reasons. - -Local Archive -------------- - -Revisions are stored on disk. You can view, compare and rollback them to -any previous revisions if something goes wrong. - -.. opcmd:: show system commit - - View all existing revisions on the local system. - - .. code-block:: none - - vyos@vyos:~$ show system commit - 0 2015-03-30 08:53:03 by vyos via cli - 1 2015-03-30 08:52:20 by vyos via cli - 2 2015-03-26 21:26:01 by root via boot-config-loader - 3 2015-03-26 20:43:18 by root via boot-config-loader - 4 2015-03-25 11:06:14 by root via boot-config-loader - 5 2015-03-25 01:04:28 by root via boot-config-loader - 6 2015-03-25 00:16:47 by vyos via cli - 7 2015-03-24 23:43:45 by root via boot-config-loader - - -.. cfgcmd:: set system config-management commit-revisions - - You can specify the number of revisions stored on disk. N can be in - the range of 0 - 65535. When the number of revisions exceeds the - configured value, the oldest revision is removed. The default setting - for this value is to store 100 revisions locally. - - -Compare configurations ----------------------- - -VyOS lets you compare different configurations. - -.. cfgcmd:: compare - - Use this command to spot what the differences are between different - configurations. - - .. code-block:: none - - vyos@vyos# compare [tab] - Possible completions: - Compare working & active configurations - saved Compare working & saved configurations - Compare working with revision N - Compare revision N with M - Revisions: - 0 2013-12-17 20:01:37 root by boot-config-loader - 1 2013-12-13 15:59:31 root by boot-config-loader - 2 2013-12-12 21:56:22 vyos by cli - 3 2013-12-12 21:55:11 vyos by cli - 4 2013-12-12 21:27:54 vyos by cli - 5 2013-12-12 21:23:29 vyos by cli - 6 2013-12-12 21:13:59 root by boot-config-loader - 7 2013-12-12 16:25:19 vyos by cli - 8 2013-12-12 15:44:36 vyos by cli - 9 2013-12-12 15:42:07 root by boot-config-loader - 10 2013-12-12 15:42:06 root by init - - The command :cfgcmd:`compare` allows you to compare different type of - configurations. It also lets you compare different revisions through - the :cfgcmd:`compare N M` command, where N and M are revision - numbers. The output will describe how the configuration N is when - compared to M indicating with a plus sign (``+``) the additional - parts N has when compared to M, and indicating with a minus sign - (``-``) the lacking parts N misses when compared to M. - - .. code-block:: none - - vyos@vyos# compare 0 6 - [edit interfaces] - +dummy dum1 { - + address 10.189.0.1/31 - +} - [edit interfaces ethernet eth0] - +vif 99 { - + address 10.199.0.1/31 - +} - -vif 900 { - - address 192.0.2.4/24 - -} - - -.. opcmd:: show system commit diff - - Show commit revision difference. - - -The command above also lets you see the difference between two commits. -By default the difference with the running config is shown. - -.. code-block:: none - - vyos@router# run show system commit diff 4 - [edit system] - +ipv6 { - + disable-forwarding - +} - -This means four commits ago we did ``set system ipv6 disable-forwarding``. - - -Rollback Changes ----------------- - -You can rollback configuration changes using the rollback command. This -will apply the selected revision and trigger a system reboot. - -.. cfgcmd:: rollback - - Rollback to revision N (currently requires reboot) - - .. code-block:: none - - vyos@vyos# compare 1 - [edit system] - >host-name vyos-1 - [edit] - - vyos@vyos# rollback 1 - Proceed with reboot? [confirm][y] - Broadcast message from root@vyos-1 (pts/0) (Tue Dec 17 21:07:45 2013): - The system is going down for reboot NOW! - -Remote Archive --------------- - -VyOS can upload the configuration to a remote location after each call -to :cfgcmd:`commit`. You will have to set the commit-archive location. -TFTP, FTP, SCP and SFTP servers are supported. Every time a -:cfgcmd:`commit` is successful the ``config.boot`` file will be copied -to the defined destination(s). The filename used on the remote host will -be ``config.boot-hostname.YYYYMMDD_HHMMSS``. - -.. cfgcmd:: set system config-management commit-archive location - - Specify remote location of commit archive as any of the below - :abbr:`URI (Uniform Resource Identifier)` - - * ``http://:@:/`` - * ``https://:@:/`` - * ``ftp://:@/`` - * ``sftp://:@/`` - * ``scp://:@:/`` - * ``tftp:///`` - * ``git+https://:@/`` - - Since username and password are part of the URI, they need to be - properly url encoded if containing special characters. - - .. note:: The number of revisions don't affect the commit-archive. - - .. note:: When using Git as destination for the commit archive the - ``source-address`` CLI option has no effect. - - .. note:: You may find VyOS not allowing the secure connection because - it cannot verify the legitimacy of the remote server. You can use - the workaround below to quickly add the remote host's SSH - fingerprint to your ``~/.ssh/known_hosts`` file: - - .. code-block:: none - - vyos@vyos# ssh-keyscan >> ~/.ssh/known_hosts - -.. cfgcmd:: set system config-management commit-archive vrf - - Specify name of the :abbr:`VRF (Virtual Routing and Forwarding)` instance - used to upload the configuration to the remote system. - -Saving and loading manually ---------------------------- - -You can use the ``save`` and ``load`` commands if you want to manually -manage specific configuration files. - -When using the save_ command, you can add a specific location where -to store your configuration file. And, when needed it, you will be able -to load it with the ``load`` command: - -.. cfgcmd:: load - - Use this command to load a configuration which will replace the - running configuration. Define the location of the configuration file - to be loaded. You can use a path to a local file, an SCP address, an - SFTP address, an FTP address, an HTTP address, an HTTPS address or a - TFTP address. - - .. code-block:: none - - vyos@vyos# load - Possible completions: - Load from system config file - Load from file on local machine - scp://:@:/ Load from file on remote machine - sftp://:@/ Load from file on remote machine - ftp://:@/ Load from file on remote machine - http:/// Load from file on remote machine - https:/// Load from file on remote machine - tftp:/// Load from file on remote machine - - - -Restore Default ---------------- - -In the case you want to completely delete your configuration and restore -the default one, you can enter the following command in configuration -mode: - -.. code-block:: none - - load /opt/vyatta/etc/config.boot.default - -You will be asked if you want to continue. If you accept, you will have -to use :cfgcmd:`commit` if you want to make the changes active. - -Then you may want to :cfgcmd:`save` in order to delete the saved -configuration too. - -.. note:: If you are remotely connected, you will lose your connection. - You may want to copy first the config, edit it to ensure - connectivity, and load the edited config. diff --git a/docs/configexamples/ansible.md b/docs/configexamples/ansible.md new file mode 100644 index 00000000..8bbd9306 --- /dev/null +++ b/docs/configexamples/ansible.md @@ -0,0 +1,212 @@ +--- +lastproofread: '2024-04-09' +--- + +(examples-ansible)= + +# Ansible example + +## Setting up Ansible on a server running the Debian operating system. + +In this example, we will set up a simple use of Ansible to configure +multiple VyOS routers. +We have four pre-configured routers with this configuration: + +Using the general schema for example: + +```{image} /_static/images/ansible.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +We have four pre-configured routers with this configuration: + +```none +set interfaces ethernet eth0 address dhcp +set service ssh +commit +save +``` + +- vyos7 - 192.0.2.105 +- vyos8 - 192.0.2.106 +- vyos9 - 192.0.2.107 +- vyos10 - 192.0.2.108 + +## Install Ansible: + +```none +# apt-get install ansible +Do you want to continue? [Y/n] y +``` + + +## Install Paramiko: + +```none +#apt-get install -y python3-paramiko +``` + + +## Check the version: + +```none +# ansible --version +ansible 2.10.8 +config file = None +configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] +ansible python module location = /usr/lib/python3/dist-packages/ansible +executable location = /usr/bin/ansible +python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110] +``` + + +## Basic configuration of ansible.cfg: + +```none +# nano /root/ansible.cfg +[defaults] +host_key_checking = no +``` + + +## Add all the VyOS hosts: + +```none +# nano /root/hosts +[vyos_hosts] +vyos7 ansible_ssh_host=192.0.2.105 +vyos8 ansible_ssh_host=192.0.2.106 +vyos9 ansible_ssh_host=192.0.2.107 +vyos10 ansible_ssh_host=192.0.2.108 +``` + + +## Add general variables: + +```none +# mkdir /root/group_vars/ +# nano /root/group_vars/vyos_hosts +ansible_python_interpreter: /usr/bin/python3 +ansible_network_os: vyos +ansible_connection: network_cli +ansible_user: vyos +ansible_ssh_pass: vyos +``` + + +## Add a simple playbook with the tasks for each router: + +```none +# nano /root/main.yml + +--- +- hosts: vyos_hosts + gather_facts: 'no' + tasks: + - name: Configure general settings for the vyos hosts group + vyos_config: + lines: + - set system name-server 192.0.2.1 + - set interfaces ethernet eth0 description '#WAN#' + - set interfaces ethernet eth1 description '#LAN#' + - set interfaces ethernet eth2 disable + - set interfaces ethernet eth3 disable + - set system host-name {{ inventory_hostname }} + save: true +``` + + +## Start the playbook: + +```none +ansible-playbook -i hosts main.yml +PLAY [vyos_hosts] ************************************************************** + +TASK [Configure general settings for the vyos hosts group] ********************* +ok: [vyos9] +ok: [vyos10] +ok: [vyos7] +ok: [vyos8] + +PLAY RECAP ********************************************************************* +vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +``` + + +## Check the result on the vyos10 router: + +```none +vyos@vyos10:~$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 192.0.2.108/24 u/u WAN +eth1 - u/u LAN +eth2 - A/D +eth3 - A/D +lo 127.0.0.1/8 u/u + ::1/128 + +vyos@vyos10:~$ sh configuration commands | grep 192.0.2.1 +set system name-server '192.0.2.1' +``` + + +## The simple way without configuration of the hostname (one task for all routers): + +```none +# nano /root/hosts_v2 +[vyos_hosts_group] +vyos7 ansible_ssh_host=192.0.2.105 +vyos8 ansible_ssh_host=192.0.2.106 +vyos9 ansible_ssh_host=192.0.2.107 +vyos10 ansible_ssh_host=192.0.2.108 +[vyos_hosts_group:vars] +ansible_python_interpreter=/usr/bin/python3 +ansible_user=vyos +ansible_ssh_pass=vyos +ansible_network_os=vyos +ansible_connection=network_cli + +# nano /root/main_v2.yml +--- +- hosts: vyos_hosts_group + connection: network_cli + gather_facts: 'no' + tasks: + - name: Configure remote vyos_hosts_group + vyos_config: + lines: + - set system name-server 192.0.2.1 + - set interfaces ethernet eth0 description WAN + - set interfaces ethernet eth1 description LAN + - set interfaces ethernet eth2 disable + - set interfaces ethernet eth3 disable + save: true +``` + +```none +# ansible-playbook -i hosts_v2 main_v2.yml + +PLAY [vyos_hosts_group] ******************************************************** + +TASK [Configure remote vyos_hosts_group] *************************************** +ok: [vyos8] +ok: [vyos7] +ok: [vyos9] +ok: [vyos10] + +PLAY RECAP ********************************************************************* +vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 +``` + +In the next chapter of the example, we'll use Ansible with jinja2 +templates and variables. diff --git a/docs/configexamples/ansible.rst b/docs/configexamples/ansible.rst deleted file mode 100644 index ee865076..00000000 --- a/docs/configexamples/ansible.rst +++ /dev/null @@ -1,226 +0,0 @@ -:lastproofread: 2024-04-09 - -.. _examples-ansible: - -############### -Ansible example -############### - -Setting up Ansible on a server running the Debian operating system. -=================================================================== - -In this example, we will set up a simple use of Ansible to configure -multiple VyOS routers. -We have four pre-configured routers with this configuration: - -Using the general schema for example: - -.. image:: /_static/images/ansible.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -We have four pre-configured routers with this configuration: - -.. code-block:: none - - set interfaces ethernet eth0 address dhcp - set service ssh - commit - save - -* vyos7 - 192.0.2.105 -* vyos8 - 192.0.2.106 -* vyos9 - 192.0.2.107 -* vyos10 - 192.0.2.108 - -Install Ansible: -==================== -.. code-block:: none - - # apt-get install ansible - Do you want to continue? [Y/n] y - -Install Paramiko: -===================== - -.. code-block:: none - - #apt-get install -y python3-paramiko - -Check the version: -================== - -.. stop_vyoslinter - -.. code-block:: none - - # ansible --version - ansible 2.10.8 - config file = None - configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] - ansible python module location = /usr/lib/python3/dist-packages/ansible - executable location = /usr/bin/ansible - python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110] - -.. start_vyoslinter - -Basic configuration of ansible.cfg: -======================================= - -.. code-block:: none - - # nano /root/ansible.cfg - [defaults] - host_key_checking = no - -Add all the VyOS hosts: -======================= - -.. code-block:: none - - # nano /root/hosts - [vyos_hosts] - vyos7 ansible_ssh_host=192.0.2.105 - vyos8 ansible_ssh_host=192.0.2.106 - vyos9 ansible_ssh_host=192.0.2.107 - vyos10 ansible_ssh_host=192.0.2.108 - -Add general variables: -====================== - -.. code-block:: none - - # mkdir /root/group_vars/ - # nano /root/group_vars/vyos_hosts - ansible_python_interpreter: /usr/bin/python3 - ansible_network_os: vyos - ansible_connection: network_cli - ansible_user: vyos - ansible_ssh_pass: vyos - - -Add a simple playbook with the tasks for each router: -===================================================== - -.. code-block:: none - - # nano /root/main.yml - - --- - - hosts: vyos_hosts - gather_facts: 'no' - tasks: - - name: Configure general settings for the vyos hosts group - vyos_config: - lines: - - set system name-server 192.0.2.1 - - set interfaces ethernet eth0 description '#WAN#' - - set interfaces ethernet eth1 description '#LAN#' - - set interfaces ethernet eth2 disable - - set interfaces ethernet eth3 disable - - set system host-name {{ inventory_hostname }} - save: true - -Start the playbook: -=================== - -.. stop_vyoslinter - -.. code-block:: none - - ansible-playbook -i hosts main.yml - PLAY [vyos_hosts] ************************************************************** - - TASK [Configure general settings for the vyos hosts group] ********************* - ok: [vyos9] - ok: [vyos10] - ok: [vyos7] - ok: [vyos8] - - PLAY RECAP ********************************************************************* - vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - -.. start_vyoslinter - -Check the result on the vyos10 router: -====================================== - -.. code-block:: none - - vyos@vyos10:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 192.0.2.108/24 u/u WAN - eth1 - u/u LAN - eth2 - A/D - eth3 - A/D - lo 127.0.0.1/8 u/u - ::1/128 - - vyos@vyos10:~$ sh configuration commands | grep 192.0.2.1 - set system name-server '192.0.2.1' - -The simple way without configuration of the hostname (one task for all routers): -================================================================================ - -.. code-block:: none - - # nano /root/hosts_v2 - [vyos_hosts_group] - vyos7 ansible_ssh_host=192.0.2.105 - vyos8 ansible_ssh_host=192.0.2.106 - vyos9 ansible_ssh_host=192.0.2.107 - vyos10 ansible_ssh_host=192.0.2.108 - [vyos_hosts_group:vars] - ansible_python_interpreter=/usr/bin/python3 - ansible_user=vyos - ansible_ssh_pass=vyos - ansible_network_os=vyos - ansible_connection=network_cli - - # nano /root/main_v2.yml - --- - - hosts: vyos_hosts_group - connection: network_cli - gather_facts: 'no' - tasks: - - name: Configure remote vyos_hosts_group - vyos_config: - lines: - - set system name-server 192.0.2.1 - - set interfaces ethernet eth0 description WAN - - set interfaces ethernet eth1 description LAN - - set interfaces ethernet eth2 disable - - set interfaces ethernet eth3 disable - save: true - - -.. stop_vyoslinter - -.. code-block:: none - - # ansible-playbook -i hosts_v2 main_v2.yml - - PLAY [vyos_hosts_group] ******************************************************** - - TASK [Configure remote vyos_hosts_group] *************************************** - ok: [vyos8] - ok: [vyos7] - ok: [vyos9] - ok: [vyos10] - - PLAY RECAP ********************************************************************* - vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 - -.. start_vyoslinter - -In the next chapter of the example, we'll use Ansible with jinja2 -templates and variables. diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md new file mode 100644 index 00000000..1633b349 --- /dev/null +++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.md @@ -0,0 +1,89 @@ +# DHCP Relay through GRE-Bridge + +```{eval-rst} +| Testdate: 2023-05-11 +| Version: 1.4-rolling-202305100734 +``` + +This simple structure shows how to configure a DHCP Relay over a GRE Bridge +interface. + +## Topology + +The topology has 3 VyOS routers and one client. Between the DHCP Server and +the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large +Network. + +```{image} _include/topology.webp +:alt: Ansible Example topology image +``` + + +## Configuration + +First, we configure the transport network and the Tunnel interface. + +Transport: + +```{literalinclude} _include/transport.conf +:language: none +``` + +DHCP-Server + +```{literalinclude} _include/dhcp-server.conf +:language: none +:lines: 1-8 +``` + +DHCP-Relay + +```{literalinclude} _include/dhcp-relay.conf +:language: none +:lines: 1-8 +``` + +After this, we need the DHCP-Server and Relay configuration. +To get a testable result, we just have one IP in the DHCP range. +Expand it as you need it. + +DHCP-Server + +```{literalinclude} _include/dhcp-server.conf +:language: none +:lines: 9-13 +``` + +DHCP-Relay + +```{literalinclude} _include/dhcp-relay.conf +:language: none +:lines: 9-10 +``` + + +## Test the result + +Ping the Client from the DHCP Server. + +```none +vyos@dhcp-server:~$ ping 192.168.0.30 count 4 +PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data. +64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms +64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms +64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms +64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms + +--- 192.168.0.30 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3004ms +rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms +``` + +And show all DHCP Leases + +```none +vyos@dhcp-server:~$ show dhcp server leases +IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname +------------ ----------------- ------- ------------------- ------------------- ----------- ---------- ---------- +192.168.0.30 00:50:79:66:68:05 active 2023/05/11 13:08:50 2023/05/12 13:08:50 23:59:16 DHCPTun100 VPCS +``` diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst b/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst deleted file mode 100644 index f2a98479..00000000 --- a/docs/configexamples/autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE.rst +++ /dev/null @@ -1,98 +0,0 @@ -############################ -DHCP Relay trough GRE-Bridge -############################ - - -| Testdate: 2023-05-11 -| Version: 1.4-rolling-202305100734 - - -This simple structure shows how to configure a DHCP Relay over a GRE Bridge -interface. - -******** -Topology -******** - -The topology has 3 VyOS routers and one client. Between the DHCP Server and -the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large -Network. - -.. image:: _include/topology.* - :alt: Ansible Example topology image - -************* -Configuration -************* - -First, we configure the transport network and the Tunnel interface. - - -Transport: - -.. literalinclude:: _include/transport.conf - :language: none - - -DHCP-Server - -.. literalinclude:: _include/dhcp-server.conf - :language: none - :lines: 1-8 - - -DHCP-Relay - -.. literalinclude:: _include/dhcp-relay.conf - :language: none - :lines: 1-8 - - -After this, we need the DHCP-Server and Relay configuration. -To get a testable result, we just have one IP in the DHCP range. -Expand it as you need it. - -DHCP-Server - -.. literalinclude:: _include/dhcp-server.conf - :language: none - :lines: 9-13 - - -DHCP-Relay - -.. literalinclude:: _include/dhcp-relay.conf - :language: none - :lines: 9-10 - - -*************** -Test the result -*************** - -Ping the Client from the DHCP Server. - - -.. code-block:: none - - vyos@dhcp-server:~$ ping 192.168.0.30 count 4 - PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data. - 64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms - 64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms - 64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms - 64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms - - --- 192.168.0.30 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3004ms - rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms - - -And show all DHCP Leases - - -.. code-block:: none - - vyos@dhcp-server:~$ show dhcp server leases - IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname - ------------ ----------------- ------- ------------------- ------------------- ----------- ---------- ---------- - 192.168.0.30 00:50:79:66:68:05 active 2023/05/11 13:08:50 2023/05/12 13:08:50 23:59:16 DHCPTun100 VPCS diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md b/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md deleted file mode 100644 index 1633b349..00000000 --- a/docs/configexamples/autotest/DHCPRelay_through_GRE/md-DHCPRelay_through_GRE.md +++ /dev/null @@ -1,89 +0,0 @@ -# DHCP Relay through GRE-Bridge - -```{eval-rst} -| Testdate: 2023-05-11 -| Version: 1.4-rolling-202305100734 -``` - -This simple structure shows how to configure a DHCP Relay over a GRE Bridge -interface. - -## Topology - -The topology has 3 VyOS routers and one client. Between the DHCP Server and -the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large -Network. - -```{image} _include/topology.webp -:alt: Ansible Example topology image -``` - - -## Configuration - -First, we configure the transport network and the Tunnel interface. - -Transport: - -```{literalinclude} _include/transport.conf -:language: none -``` - -DHCP-Server - -```{literalinclude} _include/dhcp-server.conf -:language: none -:lines: 1-8 -``` - -DHCP-Relay - -```{literalinclude} _include/dhcp-relay.conf -:language: none -:lines: 1-8 -``` - -After this, we need the DHCP-Server and Relay configuration. -To get a testable result, we just have one IP in the DHCP range. -Expand it as you need it. - -DHCP-Server - -```{literalinclude} _include/dhcp-server.conf -:language: none -:lines: 9-13 -``` - -DHCP-Relay - -```{literalinclude} _include/dhcp-relay.conf -:language: none -:lines: 9-10 -``` - - -## Test the result - -Ping the Client from the DHCP Server. - -```none -vyos@dhcp-server:~$ ping 192.168.0.30 count 4 -PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data. -64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms -64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms -64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms -64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms - ---- 192.168.0.30 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3004ms -rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms -``` - -And show all DHCP Leases - -```none -vyos@dhcp-server:~$ show dhcp server leases -IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname ------------- ----------------- ------- ------------------- ------------------- ----------- ---------- ---------- -192.168.0.30 00:50:79:66:68:05 active 2023/05/11 13:08:50 2023/05/12 13:08:50 23:59:16 DHCPTun100 VPCS -``` diff --git a/docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst b/docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst new file mode 100644 index 00000000..f2a98479 --- /dev/null +++ b/docs/configexamples/autotest/DHCPRelay_through_GRE/rst-DHCPRelay_through_GRE.rst @@ -0,0 +1,98 @@ +############################ +DHCP Relay trough GRE-Bridge +############################ + + +| Testdate: 2023-05-11 +| Version: 1.4-rolling-202305100734 + + +This simple structure shows how to configure a DHCP Relay over a GRE Bridge +interface. + +******** +Topology +******** + +The topology has 3 VyOS routers and one client. Between the DHCP Server and +the DHCP Relay is a GRE tunnel. The `transport` VyOS represent a large +Network. + +.. image:: _include/topology.* + :alt: Ansible Example topology image + +************* +Configuration +************* + +First, we configure the transport network and the Tunnel interface. + + +Transport: + +.. literalinclude:: _include/transport.conf + :language: none + + +DHCP-Server + +.. literalinclude:: _include/dhcp-server.conf + :language: none + :lines: 1-8 + + +DHCP-Relay + +.. literalinclude:: _include/dhcp-relay.conf + :language: none + :lines: 1-8 + + +After this, we need the DHCP-Server and Relay configuration. +To get a testable result, we just have one IP in the DHCP range. +Expand it as you need it. + +DHCP-Server + +.. literalinclude:: _include/dhcp-server.conf + :language: none + :lines: 9-13 + + +DHCP-Relay + +.. literalinclude:: _include/dhcp-relay.conf + :language: none + :lines: 9-10 + + +*************** +Test the result +*************** + +Ping the Client from the DHCP Server. + + +.. code-block:: none + + vyos@dhcp-server:~$ ping 192.168.0.30 count 4 + PING 192.168.0.30 (192.168.0.30) 56(84) bytes of data. + 64 bytes from 192.168.0.30: icmp_seq=1 ttl=63 time=1.02 ms + 64 bytes from 192.168.0.30: icmp_seq=2 ttl=63 time=1.06 ms + 64 bytes from 192.168.0.30: icmp_seq=3 ttl=63 time=1.21 ms + 64 bytes from 192.168.0.30: icmp_seq=4 ttl=63 time=1.16 ms + + --- 192.168.0.30 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3004ms + rtt min/avg/max/mdev = 1.016/1.112/1.214/0.077 ms + + +And show all DHCP Leases + + +.. code-block:: none + + vyos@dhcp-server:~$ show dhcp server leases + IP Address MAC address State Lease start Lease expiration Remaining Pool Hostname + ------------ ----------------- ------- ------------------- ------------------- ----------- ---------- ---------- + 192.168.0.30 00:50:79:66:68:05 active 2023/05/11 13:08:50 2023/05/12 13:08:50 23:59:16 DHCPTun100 VPCS diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md new file mode 100644 index 00000000..b74452e1 --- /dev/null +++ b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.md @@ -0,0 +1,246 @@ +# L3VPN EVPN with VyOS + +```{eval-rst} +| Testdate: 2023-05-11 +| Version: 1.4-rolling-202305100734 +``` + +I spun up a new lab in EVE-NG, which represents this as the +"Foo Bar - Service Provider Inc." that has 3 points of presence (PoP) in random +datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two +customers. + +I named the customers blue, red and green which is common practice in +VRF (Virtual Routing and Forwarding) documentation scenarios. + +- PE1 is located in an industrial area that holds multiple office buildings. + All customers have a site in this area. +- PE2 is located in a smaller area where by coincidence two customers + (blue and red) share an office building. +- PE3 is located in a smaller area where by coincidence two customers + (blue and green) are located. + +## Management VRF + +A brief excursion into VRFs: This has been one of the longest-standing feature +requests of VyOS (dating back to 2016) which can be described as +"a VLAN for layer 2 is what a VRF is for layer 3". +With VRFs, a router/system can hold multiple, isolated routing tables on the +same system. If you wonder what's the difference between multiple tables that +people used for policy-based routing since forever, it's that a VRF also +isolates connected routes rather than just static and dynamically learned +routes, so it allows NICs in different VRFs to use conflicting network +ranges without issues. + +VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing) +and VyOS 1.4 now enables full dynamic routing protocol support for +OSPF, IS-IS, and BGP for individual VRFs. + +The lab I built is using a VRF (called **mgmt**) to provide out-of-band +SSH access to the PE (Provider Edge) routers. + +```{literalinclude} _include/PE1.conf +:language: none +:lines: 1-6 +``` + + +## Topology + +We use the following network topology in this example: + +```{image} _include/topology.webp +:alt: L3VPN EVPN with VyOS topology image +``` + + +## Core network + +I chose to run OSPF as the IGP (Interior Gateway Protocol). +All required BGP sessions are established via a dummy interfaces +(similar to the loopback, but in Linux you can have only one loopback, +while there can be many dummy interfaces) on the PE routers. In case of a link +failure, traffic is diverted in the other direction in this triangle setup and +BGP sessions will not go down. One could even enable +BFD (Bidirectional Forwarding Detection) on the links for a faster +failover and resilience in the network. + +Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from +even the prior post about this subject. This is due to T1711, where it was +finally decided to get rid of the redundant BGP ASN (Autonomous System Number) +specification on the CLI and move it to a single leaf node +(set protocols bgp local-as). + +It's important to note that all your existing configurations will be migrated +automatically on image upgrade. Nothing to do on your side. + +PE1 + +```{literalinclude} _include/PE1.conf +:language: none +:lines: 8-38 +``` + +PE2 + +```{literalinclude} _include/PE2.conf +:language: none +:lines: 8-38 +``` + +PE3 + +```{literalinclude} _include/PE3.conf +:language: none +:lines: 8-38 +``` + + +## Tenant networks (VRFs) + +Once all routers can be safely remotely managed and the core network is +operational, we can now setup the tenant networks. + +Every tenant is assigned an individual VRF that would support overlapping +address ranges for customers blue, red and green. In our example, +we do not use overlapping ranges to make it easier when showing debug commands. + +Thus you can easily match it to one of the devices/networks below. + +Every router that provides access to a customer network needs to have the +customer network (VRF + VNI) configured. To make our own lives easier, +we utilize the same VRF table id (local routing table number) and +VNI (Virtual Network Identifier) per tenant on all our routers. + +- blue uses local routing table id and VNI 2000 +- red uses local routing table id and VNI 3000 +- green uses local routing table id and VNI 4000 + +PE1 + +```{literalinclude} _include/PE1.conf +:language: none +:lines: 40-96 +``` + +PE2 + +```{literalinclude} _include/PE2.conf +:language: none +:lines: 40-89 +``` + +PE3 + +```{literalinclude} _include/PE3.conf +:language: none +:lines: 40-89 +``` + + +## Testing and debugging + +You managed to come this far, now we want to see the network and routing +tables in action. + +Show routes for all VRFs + +```none +vyos@PE1:~$ show ip route vrf all +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF blue: +C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13 +B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49 +B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49 + +VRF default: +O 172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09 +C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12 +O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46 + * via 172.29.0.7, eth3, weight 1, 00:00:46 +O 172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09 +C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12 +C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14 +O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50 +O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45 + +VRF green: +C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13 +B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49 + +VRF mgmt: +S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45 +C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45 + +VRF red: +C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13 +B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49 +``` + +Information about Ethernet Virtual Private Networks + +```none +vyos@PE1:~$ show bgp l2vpn evpn +BGP table version is 1, local router ID is 172.29.255.1 +Status codes: s suppressed, d damped, h history, * valid, > best, i - internal +Origin codes: i - IGP, e - EGP, ? - incomplete +EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id] +EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP] +EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP] +EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP] +EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP] + + Network Next Hop Metric LocPrf Weight Path +Route Distinguisher: 10.1.1.1:5 +*> [5]:[0]:[24]:[10.1.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6 +Route Distinguisher: 10.1.2.1:4 +*>i[5]:[0]:[24]:[10.1.2.0] + 172.29.255.2 0 100 0 ? + RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea +Route Distinguisher: 10.1.3.1:4 +*>i[5]:[0]:[24]:[10.1.3.0] + 172.29.255.3 0 100 0 ? + RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54 +Route Distinguisher: 10.2.1.1:6 +*> [5]:[0]:[24]:[10.2.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:3000 Rmac:50:00:00:01:00:05 +Route Distinguisher: 10.2.2.1:5 +*>i[5]:[0]:[24]:[10.2.2.0] + 172.29.255.2 0 100 0 ? + RT:100:3000 ET:8 Rmac:50:00:00:02:00:05 +Route Distinguisher: 10.3.1.1:7 +*> [5]:[0]:[24]:[10.3.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:4000 Rmac:50:00:00:01:00:06 +Route Distinguisher: 10.3.3.1:6 +*>i[5]:[0]:[24]:[10.3.3.0] + 172.29.255.3 0 100 0 ? + RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a + +Displayed 7 out of 7 total prefixes +``` + +If we need to retrieve information about a specific host/network inside +the EVPN network we need to run + +```none +vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10 +BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0] +Paths: (1 available, best #1) + Not advertised to any peer + Route [5]:[0]:[24]:[10.3.1.0] VNI 4000 + Local + 172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06 + Last update: Thu May 11 13:31:13 2023 +``` diff --git a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst b/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst deleted file mode 100644 index 6092199b..00000000 --- a/docs/configexamples/autotest/L3VPN_EVPN/L3VPN_EVPN.rst +++ /dev/null @@ -1,251 +0,0 @@ - -#################### -L3VPN EVPN with VyOS -#################### - -| Testdate: 2023-05-11 -| Version: 1.4-rolling-202305100734 - -I spun up a new lab in EVE-NG, which represents this as the -"Foo Bar - Service Provider Inc." that has 3 points of presence (PoP) in random -datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two -customers. - -I named the customers blue, red and green which is common practice in -VRF (Virtual Routing and Forwarding) documentation scenarios. - -* PE1 is located in an industrial area that holds multiple office buildings. - All customers have a site in this area. -* PE2 is located in a smaller area where by coincidence two customers - (blue and red) share an office building. -* PE3 is located in a smaller area where by coincidence two customers - (blue and green) are located. - -************** -Management VRF -************** - -A brief excursion into VRFs: This has been one of the longest-standing feature -requests of VyOS (dating back to 2016) which can be described as -"a VLAN for layer 2 is what a VRF is for layer 3". -With VRFs, a router/system can hold multiple, isolated routing tables on the -same system. If you wonder what's the difference between multiple tables that -people used for policy-based routing since forever, it's that a VRF also -isolates connected routes rather than just static and dynamically learned -routes, so it allows NICs in different VRFs to use conflicting network -ranges without issues. - -VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing) -and VyOS 1.4 now enables full dynamic routing protocol support for -OSPF, IS-IS, and BGP for individual VRFs. - -The lab I built is using a VRF (called **mgmt**) to provide out-of-band -SSH access to the PE (Provider Edge) routers. - -.. literalinclude:: _include/PE1.conf - :language: none - :lines: 1-6 - - -******** -Topology -******** - -We use the following network topology in this example: - -.. image:: _include/topology.* - :alt: L3VPN EVPN with VyOS topology image - - -************ -Core network -************ - -I chose to run OSPF as the IGP (Interior Gateway Protocol). -All required BGP sessions are established via a dummy interfaces -(similar to the loopback, but in Linux you can have only one loopback, -while there can be many dummy interfaces) on the PE routers. In case of a link -failure, traffic is diverted in the other direction in this triangle setup and -BGP sessions will not go down. One could even enable -BFD (Bidirectional Forwarding Detection) on the links for a faster -failover and resilience in the network. - -Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from -even the prior post about this subject. This is due to T1711, where it was -finally decided to get rid of the redundant BGP ASN (Autonomous System Number) -specification on the CLI and move it to a single leaf node -(set protocols bgp local-as). - -It's important to note that all your existing configurations will be migrated -automatically on image upgrade. Nothing to do on your side. - -PE1 - -.. literalinclude:: _include/PE1.conf - :language: none - :lines: 8-38 - -PE2 - -.. literalinclude:: _include/PE2.conf - :language: none - :lines: 8-38 - -PE3 - -.. literalinclude:: _include/PE3.conf - :language: none - :lines: 8-38 - - -********************** -Tenant networks (VRFs) -********************** - -Once all routers can be safely remotely managed and the core network is -operational, we can now setup the tenant networks. - -Every tenant is assigned an individual VRF that would support overlapping -address ranges for customers blue, red and green. In our example, -we do not use overlapping ranges to make it easier when showing debug commands. - -Thus you can easily match it to one of the devices/networks below. - -Every router that provides access to a customer network needs to have the -customer network (VRF + VNI) configured. To make our own lives easier, -we utilize the same VRF table id (local routing table number) and -VNI (Virtual Network Identifier) per tenant on all our routers. - -* blue uses local routing table id and VNI 2000 -* red uses local routing table id and VNI 3000 -* green uses local routing table id and VNI 4000 - -PE1 - -.. literalinclude:: _include/PE1.conf - :language: none - :lines: 40-96 - -PE2 - -.. literalinclude:: _include/PE2.conf - :language: none - :lines: 40-89 - -PE3 - -.. literalinclude:: _include/PE3.conf - :language: none - :lines: 40-89 - -********************* -Testing and debugging -********************* - -You managed to come this far, now we want to see the network and routing -tables in action. - -Show routes for all VRFs - - -.. code-block:: none - - vyos@PE1:~$ show ip route vrf all - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF blue: - C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13 - B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49 - B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49 - - VRF default: - O 172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09 - C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12 - O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46 - * via 172.29.0.7, eth3, weight 1, 00:00:46 - O 172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09 - C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12 - C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14 - O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50 - O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45 - - VRF green: - C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13 - B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49 - - VRF mgmt: - S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45 - C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45 - - VRF red: - C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13 - B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49 - -Information about Ethernet Virtual Private Networks - - -.. code-block:: none - - vyos@PE1:~$ show bgp l2vpn evpn - BGP table version is 1, local router ID is 172.29.255.1 - Status codes: s suppressed, d damped, h history, * valid, > best, i - internal - Origin codes: i - IGP, e - EGP, ? - incomplete - EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id] - EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP] - EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP] - EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP] - EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP] - - Network Next Hop Metric LocPrf Weight Path - Route Distinguisher: 10.1.1.1:5 - *> [5]:[0]:[24]:[10.1.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6 - Route Distinguisher: 10.1.2.1:4 - *>i[5]:[0]:[24]:[10.1.2.0] - 172.29.255.2 0 100 0 ? - RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea - Route Distinguisher: 10.1.3.1:4 - *>i[5]:[0]:[24]:[10.1.3.0] - 172.29.255.3 0 100 0 ? - RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54 - Route Distinguisher: 10.2.1.1:6 - *> [5]:[0]:[24]:[10.2.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:3000 Rmac:50:00:00:01:00:05 - Route Distinguisher: 10.2.2.1:5 - *>i[5]:[0]:[24]:[10.2.2.0] - 172.29.255.2 0 100 0 ? - RT:100:3000 ET:8 Rmac:50:00:00:02:00:05 - Route Distinguisher: 10.3.1.1:7 - *> [5]:[0]:[24]:[10.3.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:4000 Rmac:50:00:00:01:00:06 - Route Distinguisher: 10.3.3.1:6 - *>i[5]:[0]:[24]:[10.3.3.0] - 172.29.255.3 0 100 0 ? - RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a - - Displayed 7 out of 7 total prefixes - -If we need to retrieve information about a specific host/network inside -the EVPN network we need to run - - -.. code-block:: none - - vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10 - BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0] - Paths: (1 available, best #1) - Not advertised to any peer - Route [5]:[0]:[24]:[10.3.1.0] VNI 4000 - Local - 172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06 - Last update: Thu May 11 13:31:13 2023 diff --git a/docs/configexamples/autotest/L3VPN_EVPN/md-L3VPN_EVPN.md b/docs/configexamples/autotest/L3VPN_EVPN/md-L3VPN_EVPN.md deleted file mode 100644 index b74452e1..00000000 --- a/docs/configexamples/autotest/L3VPN_EVPN/md-L3VPN_EVPN.md +++ /dev/null @@ -1,246 +0,0 @@ -# L3VPN EVPN with VyOS - -```{eval-rst} -| Testdate: 2023-05-11 -| Version: 1.4-rolling-202305100734 -``` - -I spun up a new lab in EVE-NG, which represents this as the -"Foo Bar - Service Provider Inc." that has 3 points of presence (PoP) in random -datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two -customers. - -I named the customers blue, red and green which is common practice in -VRF (Virtual Routing and Forwarding) documentation scenarios. - -- PE1 is located in an industrial area that holds multiple office buildings. - All customers have a site in this area. -- PE2 is located in a smaller area where by coincidence two customers - (blue and red) share an office building. -- PE3 is located in a smaller area where by coincidence two customers - (blue and green) are located. - -## Management VRF - -A brief excursion into VRFs: This has been one of the longest-standing feature -requests of VyOS (dating back to 2016) which can be described as -"a VLAN for layer 2 is what a VRF is for layer 3". -With VRFs, a router/system can hold multiple, isolated routing tables on the -same system. If you wonder what's the difference between multiple tables that -people used for policy-based routing since forever, it's that a VRF also -isolates connected routes rather than just static and dynamically learned -routes, so it allows NICs in different VRFs to use conflicting network -ranges without issues. - -VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing) -and VyOS 1.4 now enables full dynamic routing protocol support for -OSPF, IS-IS, and BGP for individual VRFs. - -The lab I built is using a VRF (called **mgmt**) to provide out-of-band -SSH access to the PE (Provider Edge) routers. - -```{literalinclude} _include/PE1.conf -:language: none -:lines: 1-6 -``` - - -## Topology - -We use the following network topology in this example: - -```{image} _include/topology.webp -:alt: L3VPN EVPN with VyOS topology image -``` - - -## Core network - -I chose to run OSPF as the IGP (Interior Gateway Protocol). -All required BGP sessions are established via a dummy interfaces -(similar to the loopback, but in Linux you can have only one loopback, -while there can be many dummy interfaces) on the PE routers. In case of a link -failure, traffic is diverted in the other direction in this triangle setup and -BGP sessions will not go down. One could even enable -BFD (Bidirectional Forwarding Detection) on the links for a faster -failover and resilience in the network. - -Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from -even the prior post about this subject. This is due to T1711, where it was -finally decided to get rid of the redundant BGP ASN (Autonomous System Number) -specification on the CLI and move it to a single leaf node -(set protocols bgp local-as). - -It's important to note that all your existing configurations will be migrated -automatically on image upgrade. Nothing to do on your side. - -PE1 - -```{literalinclude} _include/PE1.conf -:language: none -:lines: 8-38 -``` - -PE2 - -```{literalinclude} _include/PE2.conf -:language: none -:lines: 8-38 -``` - -PE3 - -```{literalinclude} _include/PE3.conf -:language: none -:lines: 8-38 -``` - - -## Tenant networks (VRFs) - -Once all routers can be safely remotely managed and the core network is -operational, we can now setup the tenant networks. - -Every tenant is assigned an individual VRF that would support overlapping -address ranges for customers blue, red and green. In our example, -we do not use overlapping ranges to make it easier when showing debug commands. - -Thus you can easily match it to one of the devices/networks below. - -Every router that provides access to a customer network needs to have the -customer network (VRF + VNI) configured. To make our own lives easier, -we utilize the same VRF table id (local routing table number) and -VNI (Virtual Network Identifier) per tenant on all our routers. - -- blue uses local routing table id and VNI 2000 -- red uses local routing table id and VNI 3000 -- green uses local routing table id and VNI 4000 - -PE1 - -```{literalinclude} _include/PE1.conf -:language: none -:lines: 40-96 -``` - -PE2 - -```{literalinclude} _include/PE2.conf -:language: none -:lines: 40-89 -``` - -PE3 - -```{literalinclude} _include/PE3.conf -:language: none -:lines: 40-89 -``` - - -## Testing and debugging - -You managed to come this far, now we want to see the network and routing -tables in action. - -Show routes for all VRFs - -```none -vyos@PE1:~$ show ip route vrf all -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF blue: -C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13 -B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49 -B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49 - -VRF default: -O 172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09 -C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12 -O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46 - * via 172.29.0.7, eth3, weight 1, 00:00:46 -O 172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09 -C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12 -C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14 -O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50 -O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45 - -VRF green: -C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13 -B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49 - -VRF mgmt: -S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45 -C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45 - -VRF red: -C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13 -B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49 -``` - -Information about Ethernet Virtual Private Networks - -```none -vyos@PE1:~$ show bgp l2vpn evpn -BGP table version is 1, local router ID is 172.29.255.1 -Status codes: s suppressed, d damped, h history, * valid, > best, i - internal -Origin codes: i - IGP, e - EGP, ? - incomplete -EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id] -EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP] -EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP] -EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP] -EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP] - - Network Next Hop Metric LocPrf Weight Path -Route Distinguisher: 10.1.1.1:5 -*> [5]:[0]:[24]:[10.1.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6 -Route Distinguisher: 10.1.2.1:4 -*>i[5]:[0]:[24]:[10.1.2.0] - 172.29.255.2 0 100 0 ? - RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea -Route Distinguisher: 10.1.3.1:4 -*>i[5]:[0]:[24]:[10.1.3.0] - 172.29.255.3 0 100 0 ? - RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54 -Route Distinguisher: 10.2.1.1:6 -*> [5]:[0]:[24]:[10.2.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:3000 Rmac:50:00:00:01:00:05 -Route Distinguisher: 10.2.2.1:5 -*>i[5]:[0]:[24]:[10.2.2.0] - 172.29.255.2 0 100 0 ? - RT:100:3000 ET:8 Rmac:50:00:00:02:00:05 -Route Distinguisher: 10.3.1.1:7 -*> [5]:[0]:[24]:[10.3.1.0] - 172.29.255.1 0 32768 ? - ET:8 RT:100:4000 Rmac:50:00:00:01:00:06 -Route Distinguisher: 10.3.3.1:6 -*>i[5]:[0]:[24]:[10.3.3.0] - 172.29.255.3 0 100 0 ? - RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a - -Displayed 7 out of 7 total prefixes -``` - -If we need to retrieve information about a specific host/network inside -the EVPN network we need to run - -```none -vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10 -BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0] -Paths: (1 available, best #1) - Not advertised to any peer - Route [5]:[0]:[24]:[10.3.1.0] VNI 4000 - Local - 172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06 - Last update: Thu May 11 13:31:13 2023 -``` diff --git a/docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst b/docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst new file mode 100644 index 00000000..6092199b --- /dev/null +++ b/docs/configexamples/autotest/L3VPN_EVPN/rst-L3VPN_EVPN.rst @@ -0,0 +1,251 @@ + +#################### +L3VPN EVPN with VyOS +#################### + +| Testdate: 2023-05-11 +| Version: 1.4-rolling-202305100734 + +I spun up a new lab in EVE-NG, which represents this as the +"Foo Bar - Service Provider Inc." that has 3 points of presence (PoP) in random +datacenters/sites named PE1, PE2, and PE3. Each PoP aggregates at least two +customers. + +I named the customers blue, red and green which is common practice in +VRF (Virtual Routing and Forwarding) documentation scenarios. + +* PE1 is located in an industrial area that holds multiple office buildings. + All customers have a site in this area. +* PE2 is located in a smaller area where by coincidence two customers + (blue and red) share an office building. +* PE3 is located in a smaller area where by coincidence two customers + (blue and green) are located. + +************** +Management VRF +************** + +A brief excursion into VRFs: This has been one of the longest-standing feature +requests of VyOS (dating back to 2016) which can be described as +"a VLAN for layer 2 is what a VRF is for layer 3". +With VRFs, a router/system can hold multiple, isolated routing tables on the +same system. If you wonder what's the difference between multiple tables that +people used for policy-based routing since forever, it's that a VRF also +isolates connected routes rather than just static and dynamically learned +routes, so it allows NICs in different VRFs to use conflicting network +ranges without issues. + +VyOS 1.3 added initial support for VRFs (including IPv4/IPv6 static routing) +and VyOS 1.4 now enables full dynamic routing protocol support for +OSPF, IS-IS, and BGP for individual VRFs. + +The lab I built is using a VRF (called **mgmt**) to provide out-of-band +SSH access to the PE (Provider Edge) routers. + +.. literalinclude:: _include/PE1.conf + :language: none + :lines: 1-6 + + +******** +Topology +******** + +We use the following network topology in this example: + +.. image:: _include/topology.* + :alt: L3VPN EVPN with VyOS topology image + + +************ +Core network +************ + +I chose to run OSPF as the IGP (Interior Gateway Protocol). +All required BGP sessions are established via a dummy interfaces +(similar to the loopback, but in Linux you can have only one loopback, +while there can be many dummy interfaces) on the PE routers. In case of a link +failure, traffic is diverted in the other direction in this triangle setup and +BGP sessions will not go down. One could even enable +BFD (Bidirectional Forwarding Detection) on the links for a faster +failover and resilience in the network. + +Regular VyOS users will notice that the BGP syntax has changed in VyOS 1.4 from +even the prior post about this subject. This is due to T1711, where it was +finally decided to get rid of the redundant BGP ASN (Autonomous System Number) +specification on the CLI and move it to a single leaf node +(set protocols bgp local-as). + +It's important to note that all your existing configurations will be migrated +automatically on image upgrade. Nothing to do on your side. + +PE1 + +.. literalinclude:: _include/PE1.conf + :language: none + :lines: 8-38 + +PE2 + +.. literalinclude:: _include/PE2.conf + :language: none + :lines: 8-38 + +PE3 + +.. literalinclude:: _include/PE3.conf + :language: none + :lines: 8-38 + + +********************** +Tenant networks (VRFs) +********************** + +Once all routers can be safely remotely managed and the core network is +operational, we can now setup the tenant networks. + +Every tenant is assigned an individual VRF that would support overlapping +address ranges for customers blue, red and green. In our example, +we do not use overlapping ranges to make it easier when showing debug commands. + +Thus you can easily match it to one of the devices/networks below. + +Every router that provides access to a customer network needs to have the +customer network (VRF + VNI) configured. To make our own lives easier, +we utilize the same VRF table id (local routing table number) and +VNI (Virtual Network Identifier) per tenant on all our routers. + +* blue uses local routing table id and VNI 2000 +* red uses local routing table id and VNI 3000 +* green uses local routing table id and VNI 4000 + +PE1 + +.. literalinclude:: _include/PE1.conf + :language: none + :lines: 40-96 + +PE2 + +.. literalinclude:: _include/PE2.conf + :language: none + :lines: 40-89 + +PE3 + +.. literalinclude:: _include/PE3.conf + :language: none + :lines: 40-89 + +********************* +Testing and debugging +********************* + +You managed to come this far, now we want to see the network and routing +tables in action. + +Show routes for all VRFs + + +.. code-block:: none + + vyos@PE1:~$ show ip route vrf all + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF blue: + C>* 10.1.1.0/24 is directly connected, br2000, 00:01:13 + B>* 10.1.2.0/24 [200/0] via 172.29.255.2, br2000 onlink, weight 1, 00:00:49 + B>* 10.1.3.0/24 [200/0] via 172.29.255.3, br2000 onlink, weight 1, 00:00:49 + + VRF default: + O 172.29.0.2/31 [110/1] is directly connected, eth1, weight 1, 00:01:09 + C>* 172.29.0.2/31 is directly connected, eth1, 00:01:12 + O>* 172.29.0.4/31 [110/2] via 172.29.0.3, eth1, weight 1, 00:00:46 + * via 172.29.0.7, eth3, weight 1, 00:00:46 + O 172.29.0.6/31 [110/1] is directly connected, eth3, weight 1, 00:01:09 + C>* 172.29.0.6/31 is directly connected, eth3, 00:01:12 + C>* 172.29.255.1/32 is directly connected, dum0, 00:01:14 + O>* 172.29.255.2/32 [110/20] via 172.29.0.3, eth1, weight 1, 00:00:50 + O>* 172.29.255.3/32 [110/20] via 172.29.0.7, eth3, weight 1, 00:00:45 + + VRF green: + C>* 10.3.1.0/24 is directly connected, br4000, 00:01:13 + B>* 10.3.3.0/24 [200/0] via 172.29.255.3, br4000 onlink, weight 1, 00:00:49 + + VRF mgmt: + S>* 0.0.0.0/0 [210/0] via 10.100.0.1, eth0, weight 1, 00:01:45 + C>* 10.100.0.0/24 is directly connected, eth0, 00:01:45 + + VRF red: + C>* 10.2.1.0/24 is directly connected, br3000, 00:01:13 + B>* 10.2.2.0/24 [200/0] via 172.29.255.2, br3000 onlink, weight 1, 00:00:49 + +Information about Ethernet Virtual Private Networks + + +.. code-block:: none + + vyos@PE1:~$ show bgp l2vpn evpn + BGP table version is 1, local router ID is 172.29.255.1 + Status codes: s suppressed, d damped, h history, * valid, > best, i - internal + Origin codes: i - IGP, e - EGP, ? - incomplete + EVPN type-1 prefix: [1]:[EthTag]:[ESI]:[IPlen]:[VTEP-IP]:[Frag-id] + EVPN type-2 prefix: [2]:[EthTag]:[MAClen]:[MAC]:[IPlen]:[IP] + EVPN type-3 prefix: [3]:[EthTag]:[IPlen]:[OrigIP] + EVPN type-4 prefix: [4]:[ESI]:[IPlen]:[OrigIP] + EVPN type-5 prefix: [5]:[EthTag]:[IPlen]:[IP] + + Network Next Hop Metric LocPrf Weight Path + Route Distinguisher: 10.1.1.1:5 + *> [5]:[0]:[24]:[10.1.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:2000 Rmac:4e:bb:3c:ba:bd:a6 + Route Distinguisher: 10.1.2.1:4 + *>i[5]:[0]:[24]:[10.1.2.0] + 172.29.255.2 0 100 0 ? + RT:100:2000 ET:8 Rmac:26:07:da:eb:fc:ea + Route Distinguisher: 10.1.3.1:4 + *>i[5]:[0]:[24]:[10.1.3.0] + 172.29.255.3 0 100 0 ? + RT:100:2000 ET:8 Rmac:26:98:28:24:6e:54 + Route Distinguisher: 10.2.1.1:6 + *> [5]:[0]:[24]:[10.2.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:3000 Rmac:50:00:00:01:00:05 + Route Distinguisher: 10.2.2.1:5 + *>i[5]:[0]:[24]:[10.2.2.0] + 172.29.255.2 0 100 0 ? + RT:100:3000 ET:8 Rmac:50:00:00:02:00:05 + Route Distinguisher: 10.3.1.1:7 + *> [5]:[0]:[24]:[10.3.1.0] + 172.29.255.1 0 32768 ? + ET:8 RT:100:4000 Rmac:50:00:00:01:00:06 + Route Distinguisher: 10.3.3.1:6 + *>i[5]:[0]:[24]:[10.3.3.0] + 172.29.255.3 0 100 0 ? + RT:100:4000 ET:8 Rmac:06:32:9d:22:55:8a + + Displayed 7 out of 7 total prefixes + +If we need to retrieve information about a specific host/network inside +the EVPN network we need to run + + +.. code-block:: none + + vyos@PE2:~$ show bgp l2vpn evpn 10.3.1.10 + BGP routing table entry for 10.3.1.1:7:[5]:[0]:[24]:[10.3.1.0] + Paths: (1 available, best #1) + Not advertised to any peer + Route [5]:[0]:[24]:[10.3.1.0] VNI 4000 + Local + 172.29.255.1 (metric 20) from 172.29.255.1 (172.29.255.1) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:100:4000 ET:8 Rmac:50:00:00:01:00:06 + Last update: Thu May 11 13:31:13 2023 diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md new file mode 100644 index 00000000..bd1ccfc4 --- /dev/null +++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.md @@ -0,0 +1,238 @@ +(examples-openvpn-with-ldap)= + +# OpenVPN with LDAP + +```{eval-rst} +| Testdate: 2023-05-11 +| Version: 1.4-rolling-202305100734 +``` + +This LAB shows how to use OpenVPN with a Active Directory authentication method. + +Topology consists of: +: - Windows Server 2019 with a running Active Directory + - VyOS as a OpenVPN Server + - VyOS as Client + +```{image} _include/topology.webp +:alt: OpenVPN with LDAP topology image +``` + + +## Active Directory on Windows server + +The lab assumes a full running Active Directory on the Windows Server. +Here are some PowerShell commands to quickly add a Test Active Directory. + +```powershell +# install the Active Directory Server role +Install-WindowsFeature AD-Domain-Services -IncludeManagementTools + +# install the Active Directory Server role +Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -NoRebootCompletion:$true + +# create test user01 and binduser +New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true +New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true +``` + + +## Configure VyOS as OpenVPN Server + +In this example OpenVPN will be setup with a client certificate and username / password authentication. + +First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed. +Please look {ref}`here ` for more information. + +```{eval-rst} +| Add the LDAP plugin configuration file `/config/auth/ldap-auth.config` +``` + +```{eval-rst} +| Check all possible settings `here `_. +``` + +```{literalinclude} _include/ldap-auth.config +:language: none +``` + +Now generate all required certificates on the ovpn-server: + +First the CA + +```none +vyos@ovpn-server# run generate pki ca install OVPN-CA +``` + +after this create a signed server and a client certificate + +```none +vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV +vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT +``` + +and last the DH Key + +```none +vyos@ovpn-server# run generate pki dh install DH +``` + +after all these steps the config look like this: + +```none +set pki ca OVPN-CA certificate 'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/DNfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCqPg==' +set pki ca OVPN-CA private key '' +set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzFaFw0zMzA1MDgxMjM4MzFaMFsxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxFDASBgNVBAMMC292cG4tc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApDWzTcB5LFM/tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DMn/Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/ItrfEadvgxrYR9gfhX79AkK0VHmZ/hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H//U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8nLnU0FnqpMMY14r7LZE/mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1ALqGrNUGFH4bEioTjDDx2GieOtp9rUwJMlkAyUEe0k/wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHpyzpwsA0WjA6sDTyWthgNYSxb1ikNGO8STCA==' +set pki certificate SRV private key '' +set pki certificate CLIENT certificate 'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yUqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NEtYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pYb4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64=' +set pki certificate CLIENT private key '' +set pki dh DH parameters 'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWAKh2iwNRwyeXIEOtUDBkfcLGSNNfK0kQsos/J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg==' +``` + +Once all the required certificates and keys are installed, the remaining +OpenVPN Server configuration can be carried out. + +```{literalinclude} _include/ovpn-server.conf +:language: none +``` + + +## Client configuration + +One advantage of having the client certificate stored is the ability to create the client configuration. + +```none +vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA certificate CLIENT +``` + +save the output to a file and import it in nearly all openvpn clients. + +```none +client +nobind +remote 198.51.100.254 1194 +remote-cert-tls server +proto udp +dev tun +dev-type tun +persist-key +persist-tun +verb 3 + +# Encryption options + +keysize 256 +comp-lzo no + + +-----BEGIN CERTIFICATE----- +MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL +BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM +CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y +MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD +VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 +T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK +AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8 +gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z +CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA +sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU +5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL +c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG +oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC +8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1 +cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00 +uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O +u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP +BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF +BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G +CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy +O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR +IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo +lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ +7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH +bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU +rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld +a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D +NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I +Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI +V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq +Pg== +-----END CERTIFICATE----- + + + + +-----BEGIN CERTIFICATE----- +MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL +BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM +CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y +MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD +VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 +T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC +ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7 +fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD +pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP +5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem +TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y +Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et ++/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY +ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE +euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE +tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD +Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG +A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC +MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n +P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj +6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp +v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY +b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560 +jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc +xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz +4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4 +MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO +xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4 +BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W +OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs +24+4XwZYb8mbM31j7Nx8YvhR+64= +-----END CERTIFICATE----- + + + + +-----BEGIN PRIVATE KEY----- +...REDACTED... +-----END PRIVATE KEY----- + + +``` + + +### Configure VyOS as client + +```none +set interfaces openvpn vtun10 authentication username 'user01' +set interfaces openvpn vtun10 authentication password '$ecret' +set interfaces openvpn vtun10 encryption cipher 'aes256' +set interfaces openvpn vtun10 hash 'sha512' +set interfaces openvpn vtun10 mode 'client' +set interfaces openvpn vtun10 persistent-tunnel +set interfaces openvpn vtun10 protocol 'udp' +set interfaces openvpn vtun10 remote-host '198.51.100.254' +set interfaces openvpn vtun10 remote-port '1194' +set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA' +set interfaces openvpn vtun10 tls certificate 'CLIENT' +``` + + +## Monitoring + +If the client is connected successfully you can check the status + +```none +vyos@ovpn-server:~$ show openvpn server +OpenVPN status on vtun10 + +Client CN Remote Host Tunnel IP Local Host TX bytes RX bytes Connected Since +----------- ------------------ ----------- ------------------- ---------- ---------- ------------------- +client 198.51.100.1:55150 10.23.1.6 198.51.100.254:1194 4.7 KB 4.7 KB 2023-05-11 12:47:11 +``` diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst deleted file mode 100644 index acb880d1..00000000 --- a/docs/configexamples/autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP.rst +++ /dev/null @@ -1,289 +0,0 @@ -.. _examples-OpenVPN-with-LDAP: - -################# -OpenVPN with LDAP -################# - -| Testdate: 2023-05-11 -| Version: 1.4-rolling-202305100734 - -This LAB shows how to use OpenVPN with a Active Directory authentication method. - -Topology consists of: - * Windows Server 2019 with a running Active Directory - * VyOS as a OpenVPN Server - * VyOS as Client - -.. image:: _include/topology.* - :alt: OpenVPN with LDAP topology image - -Active Directory on Windows server -================================== - -The lab assumes a full running Active Directory on the Windows Server. -Here are some PowerShell commands to quickly add a Test Active Directory. - -.. code-block:: powershell - - # install the Active Directory Server role - Install-WindowsFeature AD-Domain-Services -IncludeManagementTools - - # install the Active Directory Server role - Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -NoRebootCompletion:$true - - # create test user01 and binduser - New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true - New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true - - -Configure VyOS as OpenVPN Server -==================================== - -In this example OpenVPN will be setup with a client certificate and -username / password authentication. - -First a CA, a signed server and client ceftificate and a -Diffie-Hellman parameter musst be generated and installed. -Please look :ref:`here ` for more -information. - -| Add the LDAP plugin configuration file `/config/auth/ldap-auth.config` - -| Check all possible settings `here`_. - -.. _here: - https://github.com/threerings/openvpn-auth-ldap/blob/master/auth-ldap.conf - -.. literalinclude:: _include/ldap-auth.config - :language: none - - -Now generate all required certificates on the ovpn-server: - -First the CA - -.. code-block:: none - - vyos@ovpn-server# run generate pki ca install OVPN-CA - -after this create a signed server and a client certificate - -.. code-block:: none - - vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV - vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT - -and last the DH Key - -.. code-block:: none - - vyos@ovpn-server# run generate pki dh install DH - -after all these steps the config look like this: - -.. code-block:: none - - set pki ca OVPN-CA certificate 'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/DNfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCqPg==' - set pki ca OVPN-CA private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABAoICACVsewzYmD6RU2pKJYSPX4pl1aO6ADqNZHZi0GR4K+FyXUqDiHTwA+cLz8K7aWV/WWeUC6j5ZcH4XH+Gg0yumfCgNsnyNhDlyUNHIjPZBT4Cywvg/QTwEfK8//wEHYudT6aam0IIF1O12UW8VgmEiAwMN5Kz476lNQjbgg3efujmJaQhpnULKE2q3V51BC8qhe05JdafDOEE11vOmGj/ARYcbCQhoFJQpDzyTLB8RuEj0cTCe7oVXwwTUF1O4wcmoMCHNvsJxqKwFrER5m+giu83NcKTT13yRlg9LVg094XoGDFtRgmW1dD6ONHzi3Yd28UOIoII8sRYugLU6YcnjXfrgxvKJHJywEEJobfS2o/2/mHh6kjv7pvppWdDhjkf+dWZ0frx2YyF5/dUgGG6e94hzOwRunEu4JVKl0Qr+Vfsqt/STVDA3vbhaMdMuIR2Ir0OkoYiqGBdiEGVx82lf4uDy2TXveqKUADXU5SchjP0JZpBANO4RVoxFpY2r1tEh/sRBu9wY+Fjk4FqdjjOmsbmFwhyG/j2VvKkVsq5itsxG/Rg1nTThE2LN+R6LUquujtn94rIaz6lukEr7Yq9qy14Prj5A7tYnuHbcN36b0A3xN7bxxeX6w12naVp0KZPmey6W4HNeNOOfTLh8BpG+TMPZLJq6U+fryHD2nIhk1mxAoIBAQD88A7vo3LIzas83bYaCa1BgjtJ6WUsqsriuG55pt8olzF/X0THkcDiozCy1IJchL4+GxxA0dp+NBispflvbFWZFAHMnbJx4cc7qMR9k8DDSHNQVgfV6nBa4xBvjBp+sanOOOLV4p+fQZW+n6VMzCcKC74awjbIKgPY0LhUQxIVjtzFyor+MLLoqeavxWzBVVBslwR2oyjbTtTMkeNuTyC4kQAJcfWDN/s2bl6P8Mldpik2WhW0GdxHyK3sgZWXIrnkTlQg3EMPb2sPhFZm6pQKpxXwl8gGgFzEx4mEpHxHm/igZPVRTnYfGwkPmHu3caF59IWHq4jsUAxRQperRgStAoIBAQDjnJ4dZgcnI4PxiDKDKXeb5ZgjnIL0eyxMZoLtaVYnO2lLG0uMlACUEuRwGz4acQcjRoW4FOh3NSberobSHOVBO9Y3qgEcTtgJvzkso5IXD76/vmpiYFdPo9aGaVR/fr+yPZ0h4S9wFShRBtDZapjAlds68ROQsvF/fdU4kqtfyIAst1lwtqMPeTmiZJxVubE0h2YEXOpwIEFcu3+MUvqtCd8X/T+VyF4ZQqn64NvYvkoWpfIiKmOGsCBc4agYuPs4Cy1QvN6oLXp+0b8mSzp+ot35n1lBGTSY2l4/9k6sIzWY7x23GS2g3AUJ2kYUTpQIq2pow8Sc8ptxLwZSQZwrAoIBABqhW7E3UDp8DO9XmHidVDR1dbCOdiyBvuKn8Fm2jABGCtwSN7ebTOePruzlGuSKxUzcpdjdP1fSPFbRErX8ffaj+JyGbec3kjZhym4+RClLU3i91g1bpYCsL2rPIWr9YZdovdkvBwdJbG6peEnhpKqWGenPUN06LzWApCea+Ch05iGc9Y1Vq0B7wuH2s0CXruP/8mRbQU31usnfAkb25ccI3SwhZ2vtVPGiJSqae1j0yZoDWg2gO2UDZ+xiqFFFQrUa2hirmBPj8y2rDT3ArN2CQfkWweSNVzcQmxXwC3Wuojqg5oMs85rKyeVudHgX6pxgdj6WfNAEjYdwr29E6/ECggEBAIHl7i7k/YwOrsx3aCyGy+ZC39LjDbGtYhiwIGSRy0NUmsDscO9nv/TB23FHeufoPaSaKNJnzEvMH8TSYcskBop2NclK0ptvO8hEQ8MADu3uZHRVna1LQkkHPfUzw6+HjKuSkky1kTcsO/gSJbsPJOI0JAu9becU2NJj4/4HZpqheNUMRpUXBnRcQNI3DSm3cjSCWWyAAqO/JM5hi2dwK/P5QEMWmuVGlr1f2FZ/YbiO0QWf61IoUuiZN78KYb7KQ0U2y8PaJlBgtBoQZkDaiiWfmYNOt8d5NRVO+p8SWM/QwFPpk1Hdora9GnsHARuxxLY17eKgZ2MS6jdsGPV00EUCggEBAPuNZ3peHYhIo2EMb6wpnAFV2fAUajymwenr+Bmv5BlAnW7bE2bSNuK0P342H047On8pSEHD4tk9C/GedKiUyxP2UnaFS24mWpe44X3UlC+KJLqJG+zVGXryC7bvhS3N1KlI6H2pRY1fPAhlfUk2KAe+ZP5C7iWwtR6FlPpjB3JoS77qFVhnYdlfnQEuJ7woEKD1TXQH0Sb2OGfPQW1UjIYoEp+9p2F5scB8rV6WaOIpwLY1H0ODvo1JYdTruWGHMKqhuLs5L2MeOluUOyHW7HkJLdLuyDIR9nA4+vNB1RNF3rz83L4Xs/NA1CW3iFWIyG57oFMX1td3i3xJwhjd40M=' - set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzFaFw0zMzA1MDgxMjM4MzFaMFsxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxFDASBgNVBAMMC292cG4tc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApDWzTcB5LFM/tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DMn/Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/ItrfEadvgxrYR9gfhX79AkK0VHmZ/hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H//U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8nLnU0FnqpMMY14r7LZE/mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1ALqGrNUGFH4bEioTjDDx2GieOtp9rUwJMlkAyUEe0k/wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHpyzpwsA0WjA6sDTyWthgNYSxb1ikNGO8STCA==' - set pki certificate SRV private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCkNbNNwHksUz+1pxpEe+lyEEouKAnkWWo018na+c/zsp8KZMDm2RYXsy25j33S0dm2XW9Dc+Kbh3pcE6eCJCZrDu1l5YAiu/Uvb9UGM5FSsutCGSSD2dKlxgXGjJRDO6RNjvk9zCFguRLpk7+889IG6H3t/ddHrjkBq5/tkiTY2xSJ0/a4ZnP9KvlULui8faXfPPWQgc8KKd++k8RVvmhO3uoR9+Ti+cqPL1Fj4fWFmjC9wCnXN8to6391dorq98261ubAMdtgCUhqWzQRyO1Ov7rfKbGa6mftEGOBa0rsyChwZme3ocongnq14/daCJJ34j2l0UbjAdk5JUvdrF/esHHurT0Myf9Ke99uXL5KWFfD0RuTfrwnqPquE1STGj8z19t+DFLQmc2McidE0C9FBbkKBB9P0rJR3FHrcF5KeeCTZdhf5sOKdvSKD5UOllyvo+A4FHxo0WwI9tdHAPLRua4WcVgzOz/tmYVCHMTqtDKQe9W8CzK/sViuVbQTTYfj5d7psRWkTV8twfw4IZjZx+5N+rUDHpHiv610dhbWTMUuPB2He6pMsXXXNxuQDB3vwT8i2t8Rp2+DGthH2B+Ffv0CQrRUeZn+HOssV4bOedVyqhMqCrbV18x9AbY/XdC+pLu0ITmzAz03T0BJWuJ/JUO6gvqNpb3rCB6pHp4cwQIDAQABAoICAQCgNLAZhFX0E8hNbplnBUltek0VGQUFnuLKaVlLZXwn8zXNCx1UW6l9N9e9eSw1uXzhueiqc247dQLAwIAlrSU6P9cHGdBYku4T+NRpd3gpqdtyolsItEQabccGvfKMYazb6khqrTRHTGkSL47aRzq6eKsbvRMCoQyG/61JN9LxK1SvX3gO0g4Jipq0MgvokeF5mdyuvqaC8PWU1k+vo9PaVwsguqy5cSDZbz3F6BcE4Lj693cavRmb5F52+E9yDI/P4IhCLKIt4QCgmxiC3XgA43fq75+SV21LUTjzc/0mY+VoO9CmzJcQ0vDrclzJnyFfCwBAPZweL5iBc0zAGcNxTA5/k86ejHdLlASH0dRf55F8ALeO22um21F7cEqOSYBtl009LDvpHte9wKWp9MpHABeDCigYMc05/IgVPQemtd6NtQ0ZVWHWUiWWqh5cY4v8d0CHWAv4HJZI5JuGWdWUc1QufMfu9UbTuNJe0RGQ/N9OJZzzwX+Vpuflrg9K0CT47Yo3NGFbYOuxn12JQBEYDNl5VHWZGAe1x/ljD0OjWmw3xkLNyRqwZnSTTJ4salCSW6qLrsqHWEeNyx+J4t2gBY0TNoylQ8hECxozFu/CYNIlY7+dJjFFe29r+FNBK+WOuUcSoyrABbqCkQH3iXOC97SQSyxdXMNvkkl9X8gvQQKCAQEA2VKt5k7HqvUTC26DNswNQGfd89GcQSeWaipzOBe0Oq12QA0G4ZfPTR00F6CqYnEOSuu2Qa++KEkTBsgl9mE0tdWCAXTTWuqmnsvX2FYQ8rD8FMce+Hs8nn3qNtxAkqPjIY0uEe5AJDzeB0ct7A5w5K5f6MUE/2rWhCeBGVqJKQ+qRjgk0KeVTcnTGzyujaHN1akUA1CRKEqtrCCspZjollWhxDygevMbXs/0QlDkUxaflPOzit6B5vDJqLGJUgvPI3Hc+9eDZXeCyCCdXOVGY8FUxMQ84RnDO8sVOthgahHsdbxjdUb0KcgaV5xNuMyuYsA++QG7fnsHCHnKT0c4eQKCAQEAwW8ppE0K/EmTp2OXKq+cuZHRZWaBtm3zDwfOz3FLVBXi3JGX9M6Hv6q/2cgLDudYiE3LCNagNkI7rRRO8Gfqd2i9KVRQHWCTl4mpTOwwmKWONNgS34aTPjD5UptNUzTvIItGGSMfg/DNrYg6G9HA666aIqpvodSfUv1ryJViml/3NtvmlRmRKEYe03txKhAN1Reuq30BoOGs4Tu5Hy8ijws9hOSCdZbOyte4EhDRSNyZB45YXooJOHEWTLjrZZqgGH3B/uUAUmyHbutPF/Wkep7M1LVeU8KS4HeVmwMRgPL10nxoHPE/UGBuqL09p4a1muXQ+TMHvnI59Shkn9cEiQKCAQEA10v/l/BoAse0TFj5iSnx3uKHkmsQX8P2UcsoRmPFW3RJd/7v2EJrTrwlxVqYMdpLDJIkB0MyIfry7H8QjNuUOqgAmazBToq08xCDD4GEXMpVkcgKuKRuU53ukNb26c+Ozshs4bqktMHQPGmZ5wgPc54EyjeVUezoBBiW3yVASPuJ9vLcFhJP6baOe6dMTmgD4S4V84q3o7EICUR9hbjMg1LmZeCiI+wAK5fdJm25JU9+XTRppKP3EXFudr8bibrFRRoikSTauYUCfX1CKKvDZkQ71IuMvHynW+8/YwLF0Y9cMO+noKHgdhwVbMIehXvRL2fBezLqKs17FDyD3rJyEQKCAQAdwFtHShJGe4qaVFcL2bbhU+xBDGMnDAI2bZ0BiwtrA3LBOiOFI779W+XmOT56LFsRm+V+loRN1CIZnOYHU/RcKV/u22j3G8OXqzS/ABT5ZX1Z42IDv08mYaH3cquSALJG7yT4+M4AHSmFZ06IuNpTZaePbWd+HJXkzdWmJFPmKpx7c5cjl6sb5q0XGgVt0spN3Dahabi2Zf+RJP50LWvDVJdBuWPXcjqcOFG3dZ669jMTVnGBGPoSFFK5ujd6iS3WloEgE1jZVJgAF3Ey3jVOJt6aWMsJVwQAQmRgUzh9/OCSX1AkI3b5hdt/WJwDCFUmXfKmYZLvV+JSMsRHUWsBAoIBAC2ZuZ3hYmSFMq+rZme72lIl3PUiOWPO9VVbs+PsRk58/ceCWnGCO647+KGb4jFw0vKPwP5RKmPny9a6ZSpYB2jsgWItKewdah+VPEOSLZQT/aPB5f61eiazCnuUuWrrycQVyLlELD0pj29mMxAJ0Nr1CIVboYp+YYA7dWNVSUT6T+EV6ASEC6jflb//UUUmCjOfxILGMkqvNJ2T7WguaPLOw21wLx0eDvQA/N8ZTiyKmE+GVRkDwGzC/yLeelgzyBgmyr15hfo7Q41VtAso6rzzExc4GasmgQe8z4Y0Gm7t3RDL3GXxBmonZtxNZt0vwvVyS/kAJedmPgcfxJunPnM=' - set pki certificate CLIENT certificate 'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yUqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NEtYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pYb4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64=' - set pki certificate CLIENT private key 'MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7xlX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKlZcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUzHcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYlDRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEMCS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUWvcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6TkEetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5+oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfKw2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWNB0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGMCKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLEczAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7AgySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde39I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1gon8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2Ov5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsmorc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSKKY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaRcbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIVWjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7TsQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VPyRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJLj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpjnCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPKNb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCotUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVyab1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQziWKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsphNOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1RunLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addXk/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDefdkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74uckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nCSgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNPimfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl' - set pki dh DH parameters 'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWAKh2iwNRwyeXIEOtUDBkfcLGSNNfK0kQsos/J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg==' - -Once all the required certificates and keys are installed, the remaining -OpenVPN Server configuration can be carried out. - -.. literalinclude:: _include/ovpn-server.conf - :language: none - -Client configuration -==================== - -One advantage of having the client certificate stored is the ability to -create the client configuration. - -.. code-block:: none - - vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA certificate CLIENT - -save the output to a file and import it in nearly all openvpn clients. - -.. code-block:: none - - client - nobind - remote 198.51.100.254 1194 - remote-cert-tls server - proto udp - dev tun - dev-type tun - persist-key - persist-tun - verb 3 - - # Encryption options - - keysize 256 - comp-lzo no - - - -----BEGIN CERTIFICATE----- - MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL - BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM - CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y - MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD - VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 - T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK - AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8 - gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z - CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA - sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU - 5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL - c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG - oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC - 8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1 - cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00 - uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O - u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP - BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF - BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G - CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy - O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR - IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo - lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ - 7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH - bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU - rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld - a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D - NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I - Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI - V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq - Pg== - -----END CERTIFICATE----- - - - - - -----BEGIN CERTIFICATE----- - MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL - BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM - CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y - MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD - VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 - T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC - ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7 - fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD - pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP - 5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem - TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y - Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et - +/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY - ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE - euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE - tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD - Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG - A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC - MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n - P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj - 6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp - v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY - b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560 - jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc - xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz - 4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4 - MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO - xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4 - BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W - OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs - 24+4XwZYb8mbM31j7Nx8YvhR+64= - -----END CERTIFICATE----- - - - - - -----BEGIN PRIVATE KEY----- - MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4 - i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7x - lX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKl - Zcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUz - HcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1 - PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYl - DRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEM - CS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUW - vcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm - 2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6Tk - EetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5 - +oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfK - w2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWN - B0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGM - CKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ - 6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLE - czAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7A - gySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV - 7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+ - VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD - 5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde3 - 9I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1go - n8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2O - v5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/ - 5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y - 6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5 - ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsm - orc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSK - KY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaR - cbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIV - Wjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7T - sQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8 - ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VP - yRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJ - Lj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpj - nCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPK - Nb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCo - tUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT - 1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVya - b1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQzi - WKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2 - qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsph - NOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1R - unLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addX - k/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDef - dkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74u - ckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nC - SgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNP - imfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp - 2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl - -----END PRIVATE KEY----- - - - -Configure VyOS as client ------------------------- - -.. code-block:: none - - set interfaces openvpn vtun10 authentication username 'user01' - set interfaces openvpn vtun10 authentication password '$ecret' - set interfaces openvpn vtun10 encryption cipher 'aes256' - set interfaces openvpn vtun10 hash 'sha512' - set interfaces openvpn vtun10 mode 'client' - set interfaces openvpn vtun10 persistent-tunnel - set interfaces openvpn vtun10 protocol 'udp' - set interfaces openvpn vtun10 remote-host '198.51.100.254' - set interfaces openvpn vtun10 remote-port '1194' - set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA' - set interfaces openvpn vtun10 tls certificate 'CLIENT' - -Monitoring -========== - -If the client is connected successfully you can check the status - -.. code-block:: none - - vyos@ovpn-server:~$ show openvpn server - OpenVPN status on vtun10 - - Client CN Remote Host Tunnel IP Local Host TX bytes RX bytes Connected Since - ----------- ------------------ ----------- ------------------- ---------- ---------- ------------------- - client 198.51.100.1:55150 10.23.1.6 198.51.100.254:1194 4.7 KB 4.7 KB 2023-05-11 12:47:11 diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md b/docs/configexamples/autotest/OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md deleted file mode 100644 index bd1ccfc4..00000000 --- a/docs/configexamples/autotest/OpenVPN_with_LDAP/md-OpenVPN_with_LDAP.md +++ /dev/null @@ -1,238 +0,0 @@ -(examples-openvpn-with-ldap)= - -# OpenVPN with LDAP - -```{eval-rst} -| Testdate: 2023-05-11 -| Version: 1.4-rolling-202305100734 -``` - -This LAB shows how to use OpenVPN with a Active Directory authentication method. - -Topology consists of: -: - Windows Server 2019 with a running Active Directory - - VyOS as a OpenVPN Server - - VyOS as Client - -```{image} _include/topology.webp -:alt: OpenVPN with LDAP topology image -``` - - -## Active Directory on Windows server - -The lab assumes a full running Active Directory on the Windows Server. -Here are some PowerShell commands to quickly add a Test Active Directory. - -```powershell -# install the Active Directory Server role -Install-WindowsFeature AD-Domain-Services -IncludeManagementTools - -# install the Active Directory Server role -Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -NoRebootCompletion:$true - -# create test user01 and binduser -New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true -New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true -``` - - -## Configure VyOS as OpenVPN Server - -In this example OpenVPN will be setup with a client certificate and username / password authentication. - -First a CA, a signed server and client ceftificate and a Diffie-Hellman parameter musst be generated and installed. -Please look {ref}`here ` for more information. - -```{eval-rst} -| Add the LDAP plugin configuration file `/config/auth/ldap-auth.config` -``` - -```{eval-rst} -| Check all possible settings `here `_. -``` - -```{literalinclude} _include/ldap-auth.config -:language: none -``` - -Now generate all required certificates on the ovpn-server: - -First the CA - -```none -vyos@ovpn-server# run generate pki ca install OVPN-CA -``` - -after this create a signed server and a client certificate - -```none -vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV -vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT -``` - -and last the DH Key - -```none -vyos@ovpn-server# run generate pki dh install DH -``` - -after all these steps the config look like this: - -```none -set pki ca OVPN-CA certificate 'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/DNfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCqPg==' -set pki ca OVPN-CA private key '' -set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzFaFw0zMzA1MDgxMjM4MzFaMFsxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxFDASBgNVBAMMC292cG4tc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApDWzTcB5LFM/tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DMn/Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/ItrfEadvgxrYR9gfhX79AkK0VHmZ/hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H//U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8nLnU0FnqpMMY14r7LZE/mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1ALqGrNUGFH4bEioTjDDx2GieOtp9rUwJMlkAyUEe0k/wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHpyzpwsA0WjA6sDTyWthgNYSxb1ikNGO8STCA==' -set pki certificate SRV private key '' -set pki certificate CLIENT certificate 'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yUqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NEtYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pYb4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64=' -set pki certificate CLIENT private key '' -set pki dh DH parameters 'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWAKh2iwNRwyeXIEOtUDBkfcLGSNNfK0kQsos/J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg==' -``` - -Once all the required certificates and keys are installed, the remaining -OpenVPN Server configuration can be carried out. - -```{literalinclude} _include/ovpn-server.conf -:language: none -``` - - -## Client configuration - -One advantage of having the client certificate stored is the ability to create the client configuration. - -```none -vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA certificate CLIENT -``` - -save the output to a file and import it in nearly all openvpn clients. - -```none -client -nobind -remote 198.51.100.254 1194 -remote-cert-tls server -proto udp -dev tun -dev-type tun -persist-key -persist-tun -verb 3 - -# Encryption options - -keysize 256 -comp-lzo no - - ------BEGIN CERTIFICATE----- -MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL -BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM -CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y -MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD -VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 -T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK -AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8 -gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z -CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA -sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU -5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL -c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG -oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC -8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1 -cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00 -uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O -u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP -BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF -BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G -CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy -O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR -IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo -lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ -7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH -bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU -rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld -a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D -NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I -Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI -V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq -Pg== ------END CERTIFICATE----- - - - - ------BEGIN CERTIFICATE----- -MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL -BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM -CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y -MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD -VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 -T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC -ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7 -fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD -pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP -5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem -TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y -Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et -+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY -ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE -euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE -tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD -Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG -A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC -MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n -P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj -6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp -v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY -b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560 -jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc -xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz -4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4 -MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO -xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4 -BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W -OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs -24+4XwZYb8mbM31j7Nx8YvhR+64= ------END CERTIFICATE----- - - - - ------BEGIN PRIVATE KEY----- -...REDACTED... ------END PRIVATE KEY----- - - -``` - - -### Configure VyOS as client - -```none -set interfaces openvpn vtun10 authentication username 'user01' -set interfaces openvpn vtun10 authentication password '$ecret' -set interfaces openvpn vtun10 encryption cipher 'aes256' -set interfaces openvpn vtun10 hash 'sha512' -set interfaces openvpn vtun10 mode 'client' -set interfaces openvpn vtun10 persistent-tunnel -set interfaces openvpn vtun10 protocol 'udp' -set interfaces openvpn vtun10 remote-host '198.51.100.254' -set interfaces openvpn vtun10 remote-port '1194' -set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA' -set interfaces openvpn vtun10 tls certificate 'CLIENT' -``` - - -## Monitoring - -If the client is connected successfully you can check the status - -```none -vyos@ovpn-server:~$ show openvpn server -OpenVPN status on vtun10 - -Client CN Remote Host Tunnel IP Local Host TX bytes RX bytes Connected Since ------------ ------------------ ----------- ------------------- ---------- ---------- ------------------- -client 198.51.100.1:55150 10.23.1.6 198.51.100.254:1194 4.7 KB 4.7 KB 2023-05-11 12:47:11 -``` diff --git a/docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst b/docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst new file mode 100644 index 00000000..acb880d1 --- /dev/null +++ b/docs/configexamples/autotest/OpenVPN_with_LDAP/rst-OpenVPN_with_LDAP.rst @@ -0,0 +1,289 @@ +.. _examples-OpenVPN-with-LDAP: + +################# +OpenVPN with LDAP +################# + +| Testdate: 2023-05-11 +| Version: 1.4-rolling-202305100734 + +This LAB shows how to use OpenVPN with a Active Directory authentication method. + +Topology consists of: + * Windows Server 2019 with a running Active Directory + * VyOS as a OpenVPN Server + * VyOS as Client + +.. image:: _include/topology.* + :alt: OpenVPN with LDAP topology image + +Active Directory on Windows server +================================== + +The lab assumes a full running Active Directory on the Windows Server. +Here are some PowerShell commands to quickly add a Test Active Directory. + +.. code-block:: powershell + + # install the Active Directory Server role + Install-WindowsFeature AD-Domain-Services -IncludeManagementTools + + # install the Active Directory Server role + Install-ADDSForest -DomainName "vyos.local" -DomainNetBiosName "VYOS" -InstallDns:$true -NoRebootCompletion:$true + + # create test user01 and binduser + New-ADUser binduser -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true + New-ADUser user01 -AccountPassword(Read-Host -AsSecureString "Input Password") -Enabled $true + + +Configure VyOS as OpenVPN Server +==================================== + +In this example OpenVPN will be setup with a client certificate and +username / password authentication. + +First a CA, a signed server and client ceftificate and a +Diffie-Hellman parameter musst be generated and installed. +Please look :ref:`here ` for more +information. + +| Add the LDAP plugin configuration file `/config/auth/ldap-auth.config` + +| Check all possible settings `here`_. + +.. _here: + https://github.com/threerings/openvpn-auth-ldap/blob/master/auth-ldap.conf + +.. literalinclude:: _include/ldap-auth.config + :language: none + + +Now generate all required certificates on the ovpn-server: + +First the CA + +.. code-block:: none + + vyos@ovpn-server# run generate pki ca install OVPN-CA + +after this create a signed server and a client certificate + +.. code-block:: none + + vyos@ovpn-server# run generate pki certificate sign OVPN-CA install SRV + vyos@ovpn-server# run generate pki certificate sign OVPN-CA install CLIENT + +and last the DH Key + +.. code-block:: none + + vyos@ovpn-server# run generate pki dh install DH + +after all these steps the config look like this: + +.. code-block:: none + + set pki ca OVPN-CA certificate 'MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTyO7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpRIF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/QolalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KHbHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotUrlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/lda6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/DNfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6IPof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwIV0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCqPg==' + set pki ca OVPN-CA private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88zCIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SAsJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tLc6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BGoewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7Ou5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABAoICACVsewzYmD6RU2pKJYSPX4pl1aO6ADqNZHZi0GR4K+FyXUqDiHTwA+cLz8K7aWV/WWeUC6j5ZcH4XH+Gg0yumfCgNsnyNhDlyUNHIjPZBT4Cywvg/QTwEfK8//wEHYudT6aam0IIF1O12UW8VgmEiAwMN5Kz476lNQjbgg3efujmJaQhpnULKE2q3V51BC8qhe05JdafDOEE11vOmGj/ARYcbCQhoFJQpDzyTLB8RuEj0cTCe7oVXwwTUF1O4wcmoMCHNvsJxqKwFrER5m+giu83NcKTT13yRlg9LVg094XoGDFtRgmW1dD6ONHzi3Yd28UOIoII8sRYugLU6YcnjXfrgxvKJHJywEEJobfS2o/2/mHh6kjv7pvppWdDhjkf+dWZ0frx2YyF5/dUgGG6e94hzOwRunEu4JVKl0Qr+Vfsqt/STVDA3vbhaMdMuIR2Ir0OkoYiqGBdiEGVx82lf4uDy2TXveqKUADXU5SchjP0JZpBANO4RVoxFpY2r1tEh/sRBu9wY+Fjk4FqdjjOmsbmFwhyG/j2VvKkVsq5itsxG/Rg1nTThE2LN+R6LUquujtn94rIaz6lukEr7Yq9qy14Prj5A7tYnuHbcN36b0A3xN7bxxeX6w12naVp0KZPmey6W4HNeNOOfTLh8BpG+TMPZLJq6U+fryHD2nIhk1mxAoIBAQD88A7vo3LIzas83bYaCa1BgjtJ6WUsqsriuG55pt8olzF/X0THkcDiozCy1IJchL4+GxxA0dp+NBispflvbFWZFAHMnbJx4cc7qMR9k8DDSHNQVgfV6nBa4xBvjBp+sanOOOLV4p+fQZW+n6VMzCcKC74awjbIKgPY0LhUQxIVjtzFyor+MLLoqeavxWzBVVBslwR2oyjbTtTMkeNuTyC4kQAJcfWDN/s2bl6P8Mldpik2WhW0GdxHyK3sgZWXIrnkTlQg3EMPb2sPhFZm6pQKpxXwl8gGgFzEx4mEpHxHm/igZPVRTnYfGwkPmHu3caF59IWHq4jsUAxRQperRgStAoIBAQDjnJ4dZgcnI4PxiDKDKXeb5ZgjnIL0eyxMZoLtaVYnO2lLG0uMlACUEuRwGz4acQcjRoW4FOh3NSberobSHOVBO9Y3qgEcTtgJvzkso5IXD76/vmpiYFdPo9aGaVR/fr+yPZ0h4S9wFShRBtDZapjAlds68ROQsvF/fdU4kqtfyIAst1lwtqMPeTmiZJxVubE0h2YEXOpwIEFcu3+MUvqtCd8X/T+VyF4ZQqn64NvYvkoWpfIiKmOGsCBc4agYuPs4Cy1QvN6oLXp+0b8mSzp+ot35n1lBGTSY2l4/9k6sIzWY7x23GS2g3AUJ2kYUTpQIq2pow8Sc8ptxLwZSQZwrAoIBABqhW7E3UDp8DO9XmHidVDR1dbCOdiyBvuKn8Fm2jABGCtwSN7ebTOePruzlGuSKxUzcpdjdP1fSPFbRErX8ffaj+JyGbec3kjZhym4+RClLU3i91g1bpYCsL2rPIWr9YZdovdkvBwdJbG6peEnhpKqWGenPUN06LzWApCea+Ch05iGc9Y1Vq0B7wuH2s0CXruP/8mRbQU31usnfAkb25ccI3SwhZ2vtVPGiJSqae1j0yZoDWg2gO2UDZ+xiqFFFQrUa2hirmBPj8y2rDT3ArN2CQfkWweSNVzcQmxXwC3Wuojqg5oMs85rKyeVudHgX6pxgdj6WfNAEjYdwr29E6/ECggEBAIHl7i7k/YwOrsx3aCyGy+ZC39LjDbGtYhiwIGSRy0NUmsDscO9nv/TB23FHeufoPaSaKNJnzEvMH8TSYcskBop2NclK0ptvO8hEQ8MADu3uZHRVna1LQkkHPfUzw6+HjKuSkky1kTcsO/gSJbsPJOI0JAu9becU2NJj4/4HZpqheNUMRpUXBnRcQNI3DSm3cjSCWWyAAqO/JM5hi2dwK/P5QEMWmuVGlr1f2FZ/YbiO0QWf61IoUuiZN78KYb7KQ0U2y8PaJlBgtBoQZkDaiiWfmYNOt8d5NRVO+p8SWM/QwFPpk1Hdora9GnsHARuxxLY17eKgZ2MS6jdsGPV00EUCggEBAPuNZ3peHYhIo2EMb6wpnAFV2fAUajymwenr+Bmv5BlAnW7bE2bSNuK0P342H047On8pSEHD4tk9C/GedKiUyxP2UnaFS24mWpe44X3UlC+KJLqJG+zVGXryC7bvhS3N1KlI6H2pRY1fPAhlfUk2KAe+ZP5C7iWwtR6FlPpjB3JoS77qFVhnYdlfnQEuJ7woEKD1TXQH0Sb2OGfPQW1UjIYoEp+9p2F5scB8rV6WaOIpwLY1H0ODvo1JYdTruWGHMKqhuLs5L2MeOluUOyHW7HkJLdLuyDIR9nA4+vNB1RNF3rz83L4Xs/NA1CW3iFWIyG57oFMX1td3i3xJwhjd40M=' + set pki certificate SRV certificate 'MIIFtTCCA52gAwIBAgIUeZnSAMPohIvKL/1Fy/pW2cV73HkwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzFaFw0zMzA1MDgxMjM4MzFaMFsxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxFDASBgNVBAMMC292cG4tc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEApDWzTcB5LFM/tacaRHvpchBKLigJ5FlqNNfJ2vnP87KfCmTA5tkWF7MtuY990tHZtl1vQ3Pim4d6XBOngiQmaw7tZeWAIrv1L2/VBjORUrLrQhkkg9nSpcYFxoyUQzukTY75PcwhYLkS6ZO/vPPSBuh97f3XR645Aauf7ZIk2NsUidP2uGZz/Sr5VC7ovH2l3zz1kIHPCinfvpPEVb5oTt7qEffk4vnKjy9RY+H1hZowvcAp1zfLaOt/dXaK6vfNutbmwDHbYAlIals0EcjtTr+63ymxmupn7RBjgWtK7MgocGZnt6HKJ4J6teP3WgiSd+I9pdFG4wHZOSVL3axf3rBx7q09DMn/Snvfbly+SlhXw9Ebk368J6j6rhNUkxo/M9fbfgxS0JnNjHInRNAvRQW5CgQfT9KyUdxR63BeSnngk2XYX+bDinb0ig+VDpZcr6PgOBR8aNFsCPbXRwDy0bmuFnFYMzs/7ZmFQhzE6rQykHvVvAsyv7FYrlW0E02H4+Xe6bEVpE1fLcH8OCGY2cfuTfq1Ax6R4r+tdHYW1kzFLjwdh3uqTLF11zcbkAwd78E/ItrfEadvgxrYR9gfhX79AkK0VHmZ/hzrLFeGznnVcqoTKgq21dfMfQG2P13QvqS7tCE5swM9N09ASVrifyVDuoL6jaW96wgeqR6eHMECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwEwHQYDVR0OBBYEFE1U3Zamfuv6ocYiF9q7H//U8h+AMB8GA1UdIwQYMBaAFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0GCSqGSIb3DQEBCwUAA4ICAQBZwHvGj/jziNFwXS2W1Q11I12YANmVhISP39AA7DNhXR+E1hXFs+U52ehurZoLTi5YTjd8PD0KcE58mw8CLsFQB/+pni9EwJuAhpMb6XsmYEp0PeOH7C/q5eOc4TB/NBsvEa5IdTmUoewmjubKeJ8OHdRBMI77Me53lSC6iskc9DGyixSLqQogQW4aiTposFJOW/YugBy7kiuygmFNJv4luDbyRBb9131zH0qSSishLT4Bp5lXQNYWI4AU0JeyQcYaSHWCr0h6H9GN3QOf/emc3/2Tee40FcEMsszJBRnQ3IISzU5xVLlfU02SJMpjvFT2MGfHAs7obrNbwiFeoLZ6fQeGLe53aOQ5M9XeW5bdIeR2ZrLoO1hW33x5jYI8nLnU0FnqpMMY14r7LZE/mjwfdrTsGChFzsLasB0Tj++mGMOXw3DSusppub17AE2bO2uO6J9XMlbkOC8EmDCF1Hetija4D3aunhtu6jRBOcR8DHVBqNae2YgUk1ALqGrNUGFH4bEioTjDDx2GieOtp9rUwJMlkAyUEe0k/wzcBLjZaO8KBCtrmTdr1wMXizPT+XcjAlzRNXvHiZFq0NG5Rnim+LH9tp90EHzO7EeVXV+LegnIKQqboIrY3KOw5Qx8ska+t1WrWHpyzpwsA0WjA6sDTyWthgNYSxb1ikNGO8STCA==' + set pki certificate SRV private key 'MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCkNbNNwHksUz+1pxpEe+lyEEouKAnkWWo018na+c/zsp8KZMDm2RYXsy25j33S0dm2XW9Dc+Kbh3pcE6eCJCZrDu1l5YAiu/Uvb9UGM5FSsutCGSSD2dKlxgXGjJRDO6RNjvk9zCFguRLpk7+889IG6H3t/ddHrjkBq5/tkiTY2xSJ0/a4ZnP9KvlULui8faXfPPWQgc8KKd++k8RVvmhO3uoR9+Ti+cqPL1Fj4fWFmjC9wCnXN8to6391dorq98261ubAMdtgCUhqWzQRyO1Ov7rfKbGa6mftEGOBa0rsyChwZme3ocongnq14/daCJJ34j2l0UbjAdk5JUvdrF/esHHurT0Myf9Ke99uXL5KWFfD0RuTfrwnqPquE1STGj8z19t+DFLQmc2McidE0C9FBbkKBB9P0rJR3FHrcF5KeeCTZdhf5sOKdvSKD5UOllyvo+A4FHxo0WwI9tdHAPLRua4WcVgzOz/tmYVCHMTqtDKQe9W8CzK/sViuVbQTTYfj5d7psRWkTV8twfw4IZjZx+5N+rUDHpHiv610dhbWTMUuPB2He6pMsXXXNxuQDB3vwT8i2t8Rp2+DGthH2B+Ffv0CQrRUeZn+HOssV4bOedVyqhMqCrbV18x9AbY/XdC+pLu0ITmzAz03T0BJWuJ/JUO6gvqNpb3rCB6pHp4cwQIDAQABAoICAQCgNLAZhFX0E8hNbplnBUltek0VGQUFnuLKaVlLZXwn8zXNCx1UW6l9N9e9eSw1uXzhueiqc247dQLAwIAlrSU6P9cHGdBYku4T+NRpd3gpqdtyolsItEQabccGvfKMYazb6khqrTRHTGkSL47aRzq6eKsbvRMCoQyG/61JN9LxK1SvX3gO0g4Jipq0MgvokeF5mdyuvqaC8PWU1k+vo9PaVwsguqy5cSDZbz3F6BcE4Lj693cavRmb5F52+E9yDI/P4IhCLKIt4QCgmxiC3XgA43fq75+SV21LUTjzc/0mY+VoO9CmzJcQ0vDrclzJnyFfCwBAPZweL5iBc0zAGcNxTA5/k86ejHdLlASH0dRf55F8ALeO22um21F7cEqOSYBtl009LDvpHte9wKWp9MpHABeDCigYMc05/IgVPQemtd6NtQ0ZVWHWUiWWqh5cY4v8d0CHWAv4HJZI5JuGWdWUc1QufMfu9UbTuNJe0RGQ/N9OJZzzwX+Vpuflrg9K0CT47Yo3NGFbYOuxn12JQBEYDNl5VHWZGAe1x/ljD0OjWmw3xkLNyRqwZnSTTJ4salCSW6qLrsqHWEeNyx+J4t2gBY0TNoylQ8hECxozFu/CYNIlY7+dJjFFe29r+FNBK+WOuUcSoyrABbqCkQH3iXOC97SQSyxdXMNvkkl9X8gvQQKCAQEA2VKt5k7HqvUTC26DNswNQGfd89GcQSeWaipzOBe0Oq12QA0G4ZfPTR00F6CqYnEOSuu2Qa++KEkTBsgl9mE0tdWCAXTTWuqmnsvX2FYQ8rD8FMce+Hs8nn3qNtxAkqPjIY0uEe5AJDzeB0ct7A5w5K5f6MUE/2rWhCeBGVqJKQ+qRjgk0KeVTcnTGzyujaHN1akUA1CRKEqtrCCspZjollWhxDygevMbXs/0QlDkUxaflPOzit6B5vDJqLGJUgvPI3Hc+9eDZXeCyCCdXOVGY8FUxMQ84RnDO8sVOthgahHsdbxjdUb0KcgaV5xNuMyuYsA++QG7fnsHCHnKT0c4eQKCAQEAwW8ppE0K/EmTp2OXKq+cuZHRZWaBtm3zDwfOz3FLVBXi3JGX9M6Hv6q/2cgLDudYiE3LCNagNkI7rRRO8Gfqd2i9KVRQHWCTl4mpTOwwmKWONNgS34aTPjD5UptNUzTvIItGGSMfg/DNrYg6G9HA666aIqpvodSfUv1ryJViml/3NtvmlRmRKEYe03txKhAN1Reuq30BoOGs4Tu5Hy8ijws9hOSCdZbOyte4EhDRSNyZB45YXooJOHEWTLjrZZqgGH3B/uUAUmyHbutPF/Wkep7M1LVeU8KS4HeVmwMRgPL10nxoHPE/UGBuqL09p4a1muXQ+TMHvnI59Shkn9cEiQKCAQEA10v/l/BoAse0TFj5iSnx3uKHkmsQX8P2UcsoRmPFW3RJd/7v2EJrTrwlxVqYMdpLDJIkB0MyIfry7H8QjNuUOqgAmazBToq08xCDD4GEXMpVkcgKuKRuU53ukNb26c+Ozshs4bqktMHQPGmZ5wgPc54EyjeVUezoBBiW3yVASPuJ9vLcFhJP6baOe6dMTmgD4S4V84q3o7EICUR9hbjMg1LmZeCiI+wAK5fdJm25JU9+XTRppKP3EXFudr8bibrFRRoikSTauYUCfX1CKKvDZkQ71IuMvHynW+8/YwLF0Y9cMO+noKHgdhwVbMIehXvRL2fBezLqKs17FDyD3rJyEQKCAQAdwFtHShJGe4qaVFcL2bbhU+xBDGMnDAI2bZ0BiwtrA3LBOiOFI779W+XmOT56LFsRm+V+loRN1CIZnOYHU/RcKV/u22j3G8OXqzS/ABT5ZX1Z42IDv08mYaH3cquSALJG7yT4+M4AHSmFZ06IuNpTZaePbWd+HJXkzdWmJFPmKpx7c5cjl6sb5q0XGgVt0spN3Dahabi2Zf+RJP50LWvDVJdBuWPXcjqcOFG3dZ669jMTVnGBGPoSFFK5ujd6iS3WloEgE1jZVJgAF3Ey3jVOJt6aWMsJVwQAQmRgUzh9/OCSX1AkI3b5hdt/WJwDCFUmXfKmYZLvV+JSMsRHUWsBAoIBAC2ZuZ3hYmSFMq+rZme72lIl3PUiOWPO9VVbs+PsRk58/ceCWnGCO647+KGb4jFw0vKPwP5RKmPny9a6ZSpYB2jsgWItKewdah+VPEOSLZQT/aPB5f61eiazCnuUuWrrycQVyLlELD0pj29mMxAJ0Nr1CIVboYp+YYA7dWNVSUT6T+EV6ASEC6jflb//UUUmCjOfxILGMkqvNJ2T7WguaPLOw21wLx0eDvQA/N8ZTiyKmE+GVRkDwGzC/yLeelgzyBgmyr15hfo7Q41VtAso6rzzExc4GasmgQe8z4Y0Gm7t3RDL3GXxBmonZtxNZt0vwvVyS/kAJedmPgcfxJunPnM=' + set pki certificate CLIENT certificate 'MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcMCVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0yMzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHDpnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRemTYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5yUqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et+/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uYORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HEeuH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NEtYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGDFq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2nP8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEpv5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pYb4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjcxpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YOxBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5WOFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs24+4XwZYb8mbM31j7Nx8YvhR+64=' + set pki certificate CLIENT private key 'MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7xlX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKlZcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUzHcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYlDRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEMCS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUWvcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6TkEetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5+oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfKw2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWNB0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGMCKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLEczAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7AgySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde39I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1gon8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2Ov5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsmorc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSKKY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaRcbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIVWjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7TsQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VPyRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJLj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpjnCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPKNb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCotUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVyab1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQziWKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsphNOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1RunLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addXk/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDefdkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74uckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nCSgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNPimfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl' + set pki dh DH parameters 'MIIBCAKCAQEAzPOQWrWaIX2qt4sbV6bRbUnFx4jmeE+WXC8GIvulnC4pIr1nt2Gc/7uNfEPjDZ4X6csD3X6zAWxtSuWeNuml9Yuy+tS8gI7d0FlbQRAFO/9GIlRuVdMcbCtEhg8ja7Y0g3fQjOSQJ9mqFo7sRoXyYQALD+MDEJOxhnV7neCrgDi1pqnN4xZLoR9DLARp0ad30VIvnv0ay55wxFWAKh2iwNRwyeXIEOtUDBkfcLGSNNfK0kQsos/J8Q+7YXmk4cN9tiVX4xR92edVO4z/vhMkjsGKLSDm/E6EMusX+N0UhQ3dv7qDgeSS8vDsqBm8XJonumNZLvFbYt2ARGRZYL6DUwIBAg==' + +Once all the required certificates and keys are installed, the remaining +OpenVPN Server configuration can be carried out. + +.. literalinclude:: _include/ovpn-server.conf + :language: none + +Client configuration +==================== + +One advantage of having the client certificate stored is the ability to +create the client configuration. + +.. code-block:: none + + vyos@ovpn-server:~$ generate openvpn client-config interface vtun10 ca OVPN-CA certificate CLIENT + +save the output to a file and import it in nearly all openvpn clients. + +.. code-block:: none + + client + nobind + remote 198.51.100.254 1194 + remote-cert-tls server + proto udp + dev tun + dev-type tun + persist-key + persist-tun + verb 3 + + # Encryption options + + keysize 256 + comp-lzo no + + + -----BEGIN CERTIFICATE----- + MIIFnTCCA4WgAwIBAgIUIPFIXvCxYdavCnSPFNjr6lUtlsswDQYJKoZIhvcNAQEL + BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM + CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y + MzA1MTExMjM4MjJaFw0zMzA1MDgxMjM4MjJaMFcxCzAJBgNVBAYTAkdCMRMwEQYD + VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 + T1MxEDAOBgNVBAMMB3Z5b3MuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK + AoICAQDg45vAzS6xNqU+Pa7wk1Imt1/az1C22Sbp3wPJLfgOmy0K3TA5qVsx/c/8 + gatsatMkCsekGnK5BPzCDd5eCCLo//B25HFO6fBYRNvHvVyCUx7QEXw4FHFNG88z + CIizx114AGtVwZfGGG9xCc53xjLPUpH6iqTXme41cCFFQlqXwZ7fuySieSdoV8SA + sJTTOsGCEUEcDEnNPn6tX3KWTzNuyFPECy8WCmNgWNyG2nmH+U7WRTX0ehZ5dZyU + 5au7TxpRN4a+JtE0gNqcWJ+nh1A543q2pcRoQpPAzHFclgj8wG/EyauQMY/LC4tL + c6moPaNlTwA9HJv8s6xUqpzNptDoUHKOqKuw2JRFnno5SCQ788KkKNgVWBy2o3BG + oewfHFhAdR61CXeLpmuneuhi96GcM031gW8ptXbd4DkCF7H6KRtqeIvwiyG79ttC + 8kZf01Sn1fM5fTjGxaE38dAk/RchtHRC6rtFavHJjB2cUcCkhhQofUE6IR2dYJZ1 + cw0Wy5CI3bXHf43BpvDGmuxIlNGirTq8wf5RCWzDJJgmkQpYhUYe8x4faF4gTo00 + uH4ZvAYjQu3JNZGkb50p4kM9Mu5rQAiZJUeMAz/QD+EIV9xXgOk14+BbnHKWbZ7O + u5emewFuE/bjl79oNJklpXdc4soRkCPCTEGK3zDBdmUtCYk1DwIDAQABo2EwXzAP + BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEF + BQcDAgYIKwYBBQUHAwEwHQYDVR0OBBYEFP5NDac/yC+mQmaTpZDUv9GZMGMBMA0G + CSqGSIb3DQEBCwUAA4ICAQDEqpF2ibwYFxsF1XDIPS5/Gs0sZTZBuByNm5d2+jTy + O7d5alZUdbvobbwhxZOhWasmFNyPLr4TYmZm5zF+efFsiOxjyRuEoVU+Fe8rZmpR + IF/+6+nYX5r9vMI4QxGjeeyP20OHJ85Kvz182CTsITrM15Vw/kVVjAVzFI5Gm/Qo + lalAoFQza9rAL4kDqaUszjHjPbysvDpGF+NLPjiYDHXcty/BC48bnuzAeEM60SGZ + 7EXvf8l0X8YsO7z39w6780A/3rbZvFhCYMKp/+p5xBRDjnX91dM6DJw73RwYQ1KH + bHk9wWUwnL1giL71jzp/y4Oj6SSK2PQv+OnO80J6Zg06WIQx9xYcxr108Xh9FotU + rlG7GYPI3Udf95t6SjuydDhULAVD0lMBxlDe9DHW1k1q1pOXaHZg926tY66xx/ld + a6dcuwJjA2Dx5JI6L0u9ureQmQAtxvnoTCtf+hR1iX/IkskZCKs34SjNiCnBuw/D + NfdOpfaABm7y+tWiXBwnu5l/K8poXcQYQByyZj6YMmpgsbVPr5KNsLWOgRA81M6I + Pof8qxvnFrkazhiQWh1YHSjnaHtA3z5/BdgwHVICuFyrIOlbkKyJOjKcKBsDdMwI + V0tsnpnyli2xEPZKu1tAQFAavXrK/RGYYhOZ3e0aRSV8hlP8i/mf7p0I45cJiBCq + Pg== + -----END CERTIFICATE----- + + + + + -----BEGIN CERTIFICATE----- + MIIFsDCCA5igAwIBAgIUSzQgwzGsfJFecGxCwLXVsGCLMkAwDQYJKoZIhvcNAQEL + BQAwVzELMAkGA1UEBhMCR0IxEzARBgNVBAgMClNvbWUtU3RhdGUxEjAQBgNVBAcM + CVNvbWUtQ2l0eTENMAsGA1UECgwEVnlPUzEQMA4GA1UEAwwHdnlvcy5pbzAeFw0y + MzA1MTExMjM4MzlaFw0zMzA1MDgxMjM4MzlaMFYxCzAJBgNVBAYTAkdCMRMwEQYD + VQQIDApTb21lLVN0YXRlMRIwEAYDVQQHDAlTb21lLUNpdHkxDTALBgNVBAoMBFZ5 + T1MxDzANBgNVBAMMBmNsaWVudDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC + ggIBANHNJOSwcDbRqziL1gXYnHIq7P7vEUFvS8d/XLYJ1xIpcYTRXTut2CTGRar7 + fZZicu7x0yoK4TzrHvGVf1o4NC4NSGV5RX6kwRdrfWBmvpIkjSLGtCREFyhb+PHD + pnsIS7cfN9udC0vocqVlx/xM/sfcP6Vja/uFp+9TQcneJIxYw34zkF+TtOVbE3pP + 5VxU7ZAj8F5/q1ONhTMdzG4Ol4/0nBqZfdYA3LVDeSSNIJNF5jlaKXXFHz1EJRem + TYDx+f5bfCVcK2Qs8fU9jCFBlATjMu9O5rgk6nMLRwEnJZuZ1gj2tWQvz4e9yo5y + Uqf1PUhOrn3c81MRliUNHKr+CkxgQJal6P3Ar3q4iftJih3K+/j4o194mQ/Dt/Et + +/Qn/DUFk2FB0rTMcQwJLTEAzxtTdmBJeJpipIPDR0u7UMZLNh/raQ8s3FsbY4uY + ORt2f5YQlCVHbth4dRa9xa+oRbm7eomNACIbWfkLh5Bzud1+qIfdBMZKaZbnf0HE + euH0J5LBJeova8EPxWbYMJPrRHzu5gowkIKl+uIxcy8IiNTA9YEoJVonCjmlr8NE + tYShrIVbicdMNSI3pOQR60MFhkHwBjSU2l/z+4wwLxtzq/c2xKw9yrOZ46ZVLwGD + Fq8rPwp7/P9r6mDKsbn6jIvGOeH71dMZvoc4lCaClw+hKIzLAgMBAAGjdTBzMAwG + A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMC + MB0GA1UdDgQWBBS6j30FmL6kZW7rDH8QjRMoWoA/njAfBgNVHSMEGDAWgBT+TQ2n + P8gvpkJmk6WQ1L/RmTBjATANBgkqhkiG9w0BAQsFAAOCAgEANW2Y4bgaB9oexEjj + 6rkGvePtQmXRkF/adVQREY9iZDGTe72ePybVzrfMkZHjse3o7JvXWRIVVztWSzEp + v5noIOX7lAioGG3wsFTHotTFR0zrYJHXHBcV2Neq4Kx2Ta/TZwD8QnZHAAxEQ1pY + b4fxwN/A60VElAZoz9zYsbrJyVrfuHDL9queQxPFzqis+7W1BiVIcv4rn0DMQ560 + jTGh4t4rImOSu5gUsUrQaih85XDdOBPxViSNwfVdZJIgbvamudpfEaKsIun/uCjc + xpNnzIp0rhyYmDeqVat4GnTV7Sy48e/Uvcq71ZWbBYJF4+yW4pylIU2Sh/Uy2sAz + 4C2M71FlFB7qsmcnPRsFFHf+r1NyD1lkVI9k2371fTG/Kub9V0rOz4pvKz4Em5b4 + MUPdDbZOqJ8hQ+atGE3ovFJIovA3NFb0OtnyC4l+kG7dfjqFudOnmDa+Qsya+2YO + xBZBIRfuhlXhb6Y6Smsk9R6x0jBmcQTPS5ZmvKaTxQCFc53xMdQNAswjiI2L9rw4 + BcqQfVmf/vpoN+VusD/XEv2V0Ixm10YybA7BI/tixh9vwj3fdQXVLy3jSYjVBd5W + OFPizbQZeD10ElvlLqZZyWrP/Wre7Nmi/gEOnhBXXmo034fFF/vXf0JRpQsd2oDs + 24+4XwZYb8mbM31j7Nx8YvhR+64= + -----END CERTIFICATE----- + + + + + -----BEGIN PRIVATE KEY----- + MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDRzSTksHA20as4 + i9YF2JxyKuz+7xFBb0vHf1y2CdcSKXGE0V07rdgkxkWq+32WYnLu8dMqCuE86x7x + lX9aODQuDUhleUV+pMEXa31gZr6SJI0ixrQkRBcoW/jxw6Z7CEu3HzfbnQtL6HKl + Zcf8TP7H3D+lY2v7hafvU0HJ3iSMWMN+M5Bfk7TlWxN6T+VcVO2QI/Bef6tTjYUz + HcxuDpeP9JwamX3WANy1Q3kkjSCTReY5Wil1xR89RCUXpk2A8fn+W3wlXCtkLPH1 + PYwhQZQE4zLvTua4JOpzC0cBJyWbmdYI9rVkL8+HvcqOclKn9T1ITq593PNTEZYl + DRyq/gpMYECWpej9wK96uIn7SYodyvv4+KNfeJkPw7fxLfv0J/w1BZNhQdK0zHEM + CS0xAM8bU3ZgSXiaYqSDw0dLu1DGSzYf62kPLNxbG2OLmDkbdn+WEJQlR27YeHUW + vcWvqEW5u3qJjQAiG1n5C4eQc7ndfqiH3QTGSmmW539BxHrh9CeSwSXqL2vBD8Vm + 2DCT60R87uYKMJCCpfriMXMvCIjUwPWBKCVaJwo5pa/DRLWEoayFW4nHTDUiN6Tk + EetDBYZB8AY0lNpf8/uMMC8bc6v3NsSsPcqzmeOmVS8BgxavKz8Ke/z/a+pgyrG5 + +oyLxjnh+9XTGb6HOJQmgpcPoSiMywIDAQABAoICACNXi396uWyCpXVBGSyi8LfK + w2GupBmBxiI1Mkj4H2LP2G+nVS1Ye7C2NcY311AeBX56/jd23bqFYRERPgLUtPWN + B0UQyMQsvNpVISm8JR45Sg0xq+bwEXabB7SyYLkZDKgsehxkuCJxZd625pl53vGM + CKyzst0MBt4qCEsZQM7jpQr9ZLS1DSQV05InI1wKcnp1k2hX2WSZ0nZp7qYbjyyQ + 6DsS4D/MpWFjnGSr4XDttXqz1YghTMHlWNpDCYtPN+3BO4iPnj+h0qCdXZ28jlLE + czAc+oDKtzPqEmv/TDaKE6Qu6x+VbkBPmG+mkoX4qfokRwCs19CGheR38PxdDx7A + gySv7K8hM8gFC0XEqNdjt86KG+N1Ps5Sru4QMrf8j9XXNPUvt0M8wsPVeWa5ubkV + 7/h0HIEROOFpEFbzWnhBChPVvFObuuEjl5Jnj3KUEnckQFU07mPP/BpysHo3v/p+ + VTVoo2UkfVvjamnwQOUt3cVlPVC4FzVgkswJa4f75nGmDv8dafyPrCYciOh0qyhD + 5Pw/EBJkKtDBYHaoxtAw9Ann4A5rvZAveLNTPESOMo90pJwJbQcZyq9H+UGVnde3 + 9I4m5vHB5izZJI24Yd3fjRRkRf+/68VYKrkI5B7oH73Z/cl/xgEdI1hag4MLv1go + n8wna4yCX/321YPTrDABAoIBAQDpHtvnvpOaoSjkJHUx4EGJkrp5R/mPfEbzzU2O + v5pNIcufv++2lsoUVCTDwgp4+7GngqYO5vVyW/AS4pSrDx7kdWpFaUtJUUCcCHk/ + 5hYcvvourYtW1NR+XPiI28IqRp1P0L1+P0mUaRgpEcw6nEnc37XEujvTB1M/yF2y + 6xc+kZGjrZTmJeu0V5kkaGcXlAqUv2k0Lj3tEPQR/qj+kMX5hidROGuybNBESgA5 + ELY6QVnpcOyNDyniWq+RIUyBOuXp7DpUbmUANFEEP8lwjZX+HqwTpSjTSFdcPrsm + orc9FpTXA9ktt1Z0ZxBzUvdcWbUeVsFqL0yICiShE7UxlOPBAoIBAQDmZGQ5roSK + KY+VnmjIq2+gx8zsMYeliQm0hnKrFw9MM8U+/XOpXlpNHx2ehrGWp/BbmlmrnQaR + cbLPJaRtWSEywbWnG77g+zj0w+4BdsYyTtGGFj4tXVZhPPo/DID3FPLn9cSv8MIV + Wjzg1G/BZcxtCDBDRBhwhZHCPOfd0K/S7rvRBq7IsNNHMTGswWGRMaF+M/trZw7T + sQ0BX+5zZUyO8VNBi/NgTV3yoQ8ynBefRt1dmNa2CKXPT+5R19cBtecFEyhc3yo8 + ryTtM22JzndzA8agQmNPnWmYGivvcNHNikTQ2qUvvcd7Siny6j0+CmFdT9bl64VP + yRJrFCw3jaOLAoIBAQCQ/1OyShRO+myPsql+U0kQQ8Zeh0kPWTJclFboMf7MePfJ + Lj3waMvaZxfS9s9CvvKaCSY2YKtL7Sle5bWozCff27Q05jAgszwnkRGxj/AzAwpj + nCft40UkL7majm2vk+pm6aPjcYPXnqKbcOmBjxJWIoNRkLCDKqw6IOs+zQDRNwPK + Nb5GhFGeA1pKjfGJddg6+u95uEVmPcRBqQ79/5hUAoBUAW7jNNE5mHmZBO8DPwCo + tUc82bCojNVkxLxsKPE2VWtWdq+1t9SoevBVZItl2zgWpATHndhQlOgdONoWUgRT + 1J3x1HYewrg1suYOd/GypC17WV4Vw5FS6wopg71BAoIBAQC63vDgTGpauk0pOVya + b1tSmNzhM2dn4BhMIcU+eqzAzTkO13sKBGrQJQ3cODoxDbSKSE61QN9D92nmVQzi + WKnxxmb1zS5sw7g15/nTnCg0Q/P0g3QZTZyzsEb1/slYH9jKRnErl+eEdDXu0sB2 + qIBAa6Th2ojMM7q/RrF3HD6Qo20ZpQb951bnZsJ48j2WDCCGAdnLCsNe9zuqQsph + NOf9BUbXYpGcKgSquPJfxXXvjgYdVcvJyIfc+GNAZQaS750bY6eYdLaIlDMqZk1R + unLuikCAWni86dvtMEU0qFi0E5Ovp7jWWWNE4CnYSyAzgy3oBssyoG74AQp8addX + k/3zAoIBAQC8/7DglQGMcKnk4zX+7jCuc0p+qMcd5RdnfBKlRhcWYNRPup9jyDef + dkXCBTumCHXrIil/rJzP6b1IZZdC4xkheQpLXNUcceAidRWIrTypaXKkmhR0D74u + ckGiLXB4S84HYmIdw89ZiF0gB0yyZH5mZnqVMojwnGmWqcM2sr2N44bNQMfhD+nC + SgQmReYKKfMQCdvYMxRLQfseU0pFEOGnh9jAmpn8qWMWxNDmFR/rVl26BXtRPiNP + imfwWKrYNYhESN7A5/hWcrNUhE4PI+Pjd74npimqs5TDSst2Jc6DiahdaZ6JNNzp + 2PMUXNbfsMCVgZx+qtVNnVxVMiEngPRl + -----END PRIVATE KEY----- + + + +Configure VyOS as client +------------------------ + +.. code-block:: none + + set interfaces openvpn vtun10 authentication username 'user01' + set interfaces openvpn vtun10 authentication password '$ecret' + set interfaces openvpn vtun10 encryption cipher 'aes256' + set interfaces openvpn vtun10 hash 'sha512' + set interfaces openvpn vtun10 mode 'client' + set interfaces openvpn vtun10 persistent-tunnel + set interfaces openvpn vtun10 protocol 'udp' + set interfaces openvpn vtun10 remote-host '198.51.100.254' + set interfaces openvpn vtun10 remote-port '1194' + set interfaces openvpn vtun10 tls ca-certificate 'OVPN-CA' + set interfaces openvpn vtun10 tls certificate 'CLIENT' + +Monitoring +========== + +If the client is connected successfully you can check the status + +.. code-block:: none + + vyos@ovpn-server:~$ show openvpn server + OpenVPN status on vtun10 + + Client CN Remote Host Tunnel IP Local Host TX bytes RX bytes Connected Since + ----------- ------------------ ----------- ------------------- ---------- ---------- ------------------- + client 198.51.100.1:55150 10.23.1.6 198.51.100.254:1194 4.7 KB 4.7 KB 2023-05-11 12:47:11 diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.md b/docs/configexamples/autotest/Wireguard/Wireguard.md new file mode 100644 index 00000000..7bbf4c55 --- /dev/null +++ b/docs/configexamples/autotest/Wireguard/Wireguard.md @@ -0,0 +1,108 @@ +# Wireguard + +```{eval-rst} +| Testdate: 2024-01-13 +| Version: 1.5-rolling-202401121239 +``` + +This simple structure show how to connect two offices. One remote branch and the +central office. + +## Topology + +The topology have a central and a branch VyOS router and one client, to +test, in each site. + +```{image} _include/topology.webp +:alt: Ansible Example topology image +``` + + +## Configuration + +Set the local subnet on eth2 and the public ip address eth1 on each site. + +Central + +```{literalinclude} _include/central.conf +:language: none +:lines: 1-2 +``` + +Branch + +```{literalinclude} _include/branch.conf +:language: none +:lines: 1-2 +``` + +Next thing to do, is to create a wireguard keypair on each side. +After this, the public key can be displayed, to save for later. + +```none +vyos@central:~$ generate pki wireguard +Private key: wHQS+ib3eMIp2DxRiAeXfFVaSCMMP1YHBaKfSR1xfV8= +Public key: RCMy6BAER0uEcPvspUb3K38MHyHJpK5kiV5IOX943HI= +``` + +After you have each public key. The wireguard interfaces can be setup. + +Central + +```{literalinclude} _include/central.conf +:language: none +:lines: 4-12 +``` + +Branch + +```{literalinclude} _include/branch.conf +:language: none +:lines: 4-12 +``` + +To reach the network, a route must be set on each VyOS host. +In this structure, a static interface route will fit the requirements. + +Central + +```{literalinclude} _include/central.conf +:language: none +:lines: 14 +``` + +Branch + +```{literalinclude} _include/branch.conf +:language: none +:lines: 14 +``` + + +## Testing and debugging + +After all is done and commit, let's take a look if the Wireguard interface is +up and running. + +```none +vyos@central:~$ show interfaces wireguard +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +wg01 192.168.0.1/24 u/u VPN-to-Branch +``` + +And ping the Branch PC from your central router to check the response. + +```none +vyos@central:~$ ping 10.0.2.100 count 4 +PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data. +64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.894 ms +64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.869 ms +64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.966 ms +64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=0.998 ms + +--- 10.0.2.100 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3004ms +rtt min/avg/max/mdev = 0.869/0.931/0.998/0.052 ms +``` diff --git a/docs/configexamples/autotest/Wireguard/Wireguard.rst b/docs/configexamples/autotest/Wireguard/Wireguard.rst deleted file mode 100644 index 7d7b216a..00000000 --- a/docs/configexamples/autotest/Wireguard/Wireguard.rst +++ /dev/null @@ -1,112 +0,0 @@ -######### -Wireguard -######### - - -| Testdate: 2024-01-13 -| Version: 1.5-rolling-202401121239 - - -This simple structure show how to connect two offices. One remote branch and the -central office. - -******** -Topology -******** - -The topology have a central and a branch VyOS router and one client, to -test, in each site. - -.. image:: _include/topology.* - :alt: Ansible Example topology image - -************* -Configuration -************* - -Set the local subnet on eth2 and the public ip address eth1 on each site. - -Central - -.. literalinclude:: _include/central.conf - :language: none - :lines: 1-2 - -Branch - -.. literalinclude:: _include/branch.conf - :language: none - :lines: 1-2 - - -Next thing to do, is to create a wireguard keypair on each side. -After this, the public key can be displayed, to save for later. - -.. code-block:: none - - vyos@central:~$ generate pki wireguard - Private key: wHQS+ib3eMIp2DxRiAeXfFVaSCMMP1YHBaKfSR1xfV8= - Public key: RCMy6BAER0uEcPvspUb3K38MHyHJpK5kiV5IOX943HI= - - -After you have each public key. The wireguard interfaces can be setup. - - -Central - -.. literalinclude:: _include/central.conf - :language: none - :lines: 4-12 - -Branch - -.. literalinclude:: _include/branch.conf - :language: none - :lines: 4-12 - - -To reach the network, a route must be set on each VyOS host. -In this structure, a static interface route will fit the requirements. - -Central - -.. literalinclude:: _include/central.conf - :language: none - :lines: 14 - -Branch - -.. literalinclude:: _include/branch.conf - :language: none - :lines: 14 - -********************* -Testing and debugging -********************* - -After all is done and commit, let's take a look if the Wireguard interface is -up and running. - -.. code-block:: none - - vyos@central:~$ show interfaces wireguard - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - wg01 192.168.0.1/24 u/u VPN-to-Branch - - -And ping the Branch PC from your central router to check the response. - -.. code-block:: none - - vyos@central:~$ ping 10.0.2.100 count 4 - PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data. - 64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.894 ms - 64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.869 ms - 64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.966 ms - 64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=0.998 ms - - --- 10.0.2.100 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3004ms - rtt min/avg/max/mdev = 0.869/0.931/0.998/0.052 ms diff --git a/docs/configexamples/autotest/Wireguard/md-Wireguard.md b/docs/configexamples/autotest/Wireguard/md-Wireguard.md deleted file mode 100644 index 7bbf4c55..00000000 --- a/docs/configexamples/autotest/Wireguard/md-Wireguard.md +++ /dev/null @@ -1,108 +0,0 @@ -# Wireguard - -```{eval-rst} -| Testdate: 2024-01-13 -| Version: 1.5-rolling-202401121239 -``` - -This simple structure show how to connect two offices. One remote branch and the -central office. - -## Topology - -The topology have a central and a branch VyOS router and one client, to -test, in each site. - -```{image} _include/topology.webp -:alt: Ansible Example topology image -``` - - -## Configuration - -Set the local subnet on eth2 and the public ip address eth1 on each site. - -Central - -```{literalinclude} _include/central.conf -:language: none -:lines: 1-2 -``` - -Branch - -```{literalinclude} _include/branch.conf -:language: none -:lines: 1-2 -``` - -Next thing to do, is to create a wireguard keypair on each side. -After this, the public key can be displayed, to save for later. - -```none -vyos@central:~$ generate pki wireguard -Private key: wHQS+ib3eMIp2DxRiAeXfFVaSCMMP1YHBaKfSR1xfV8= -Public key: RCMy6BAER0uEcPvspUb3K38MHyHJpK5kiV5IOX943HI= -``` - -After you have each public key. The wireguard interfaces can be setup. - -Central - -```{literalinclude} _include/central.conf -:language: none -:lines: 4-12 -``` - -Branch - -```{literalinclude} _include/branch.conf -:language: none -:lines: 4-12 -``` - -To reach the network, a route must be set on each VyOS host. -In this structure, a static interface route will fit the requirements. - -Central - -```{literalinclude} _include/central.conf -:language: none -:lines: 14 -``` - -Branch - -```{literalinclude} _include/branch.conf -:language: none -:lines: 14 -``` - - -## Testing and debugging - -After all is done and commit, let's take a look if the Wireguard interface is -up and running. - -```none -vyos@central:~$ show interfaces wireguard -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -wg01 192.168.0.1/24 u/u VPN-to-Branch -``` - -And ping the Branch PC from your central router to check the response. - -```none -vyos@central:~$ ping 10.0.2.100 count 4 -PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data. -64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.894 ms -64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.869 ms -64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.966 ms -64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=0.998 ms - ---- 10.0.2.100 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3004ms -rtt min/avg/max/mdev = 0.869/0.931/0.998/0.052 ms -``` diff --git a/docs/configexamples/autotest/Wireguard/rst-Wireguard.rst b/docs/configexamples/autotest/Wireguard/rst-Wireguard.rst new file mode 100644 index 00000000..7d7b216a --- /dev/null +++ b/docs/configexamples/autotest/Wireguard/rst-Wireguard.rst @@ -0,0 +1,112 @@ +######### +Wireguard +######### + + +| Testdate: 2024-01-13 +| Version: 1.5-rolling-202401121239 + + +This simple structure show how to connect two offices. One remote branch and the +central office. + +******** +Topology +******** + +The topology have a central and a branch VyOS router and one client, to +test, in each site. + +.. image:: _include/topology.* + :alt: Ansible Example topology image + +************* +Configuration +************* + +Set the local subnet on eth2 and the public ip address eth1 on each site. + +Central + +.. literalinclude:: _include/central.conf + :language: none + :lines: 1-2 + +Branch + +.. literalinclude:: _include/branch.conf + :language: none + :lines: 1-2 + + +Next thing to do, is to create a wireguard keypair on each side. +After this, the public key can be displayed, to save for later. + +.. code-block:: none + + vyos@central:~$ generate pki wireguard + Private key: wHQS+ib3eMIp2DxRiAeXfFVaSCMMP1YHBaKfSR1xfV8= + Public key: RCMy6BAER0uEcPvspUb3K38MHyHJpK5kiV5IOX943HI= + + +After you have each public key. The wireguard interfaces can be setup. + + +Central + +.. literalinclude:: _include/central.conf + :language: none + :lines: 4-12 + +Branch + +.. literalinclude:: _include/branch.conf + :language: none + :lines: 4-12 + + +To reach the network, a route must be set on each VyOS host. +In this structure, a static interface route will fit the requirements. + +Central + +.. literalinclude:: _include/central.conf + :language: none + :lines: 14 + +Branch + +.. literalinclude:: _include/branch.conf + :language: none + :lines: 14 + +********************* +Testing and debugging +********************* + +After all is done and commit, let's take a look if the Wireguard interface is +up and running. + +.. code-block:: none + + vyos@central:~$ show interfaces wireguard + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + wg01 192.168.0.1/24 u/u VPN-to-Branch + + +And ping the Branch PC from your central router to check the response. + +.. code-block:: none + + vyos@central:~$ ping 10.0.2.100 count 4 + PING 10.0.2.100 (10.0.2.100) 56(84) bytes of data. + 64 bytes from 10.0.2.100: icmp_seq=1 ttl=63 time=0.894 ms + 64 bytes from 10.0.2.100: icmp_seq=2 ttl=63 time=0.869 ms + 64 bytes from 10.0.2.100: icmp_seq=3 ttl=63 time=0.966 ms + 64 bytes from 10.0.2.100: icmp_seq=4 ttl=63 time=0.998 ms + + --- 10.0.2.100 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3004ms + rtt min/avg/max/mdev = 0.869/0.931/0.998/0.052 ms diff --git a/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md b/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md deleted file mode 100644 index 6c59a491..00000000 --- a/docs/configexamples/autotest/tunnelbroker/md-tunnelbroker.md +++ /dev/null @@ -1,206 +0,0 @@ -(examples-tunnelbroker-ipv6)= - -# Tunnelbroker.net (IPv6) - -```{eval-rst} -| Testdate: 2024-01-13 -| Version: 1.5-rolling-202401121239 -``` - -This guide walks through the setup of for an -IPv6 Tunnel. - -## Prerequisites - -- A public, routable IPv4 address. This does not necessarily need to be static, - but you will need to update the tunnel endpoint when/if your IP address - changes, which can be done with a script and a scheduled task. -- Account at -- Requested a "Regular Tunnel". You want to choose a location that is closest - to your physical location for the best response time. - -### Topology - -The example topology has 2 VyOS routers. One as the WAN router and one as a -client, to test a single LAN setup - -```{image} _include/topology.webp -:alt: Tunnelbroker topology image -``` - - -### Configuration - -First, we configure the `vyos-wan` interface to get a DHCP address. - -```{literalinclude} _include/vyos-wan.conf -:language: none -``` - -Now we are able to setup the tunnel interface. - -```{literalinclude} _include/vyos-wan_tun0.conf -:language: none -:lines: 1-5 -``` - -:::{note} -The `source-address` is the Tunnelbroker client IPv4 -address or if there is NAT the current WAN interface address. - -If `source-address` is dynamic, the tunnel will cease working once -the address changes. To avoid having to manually update -`source-address` each time the dynamic IP changes, an address of -'0.0.0.0' can be specified. -::: - -Setup the IPv6 default route to the tunnel interface - -```{literalinclude} _include/vyos-wan_tun0.conf -:language: none -:lines: 7 -``` - -Now you should be able to ping a public IPv6 Address - -```none -vyos@vyos-wan:~$ ping 2001:470:20::2 count 4 -PING 2001:470:20::2(2001:470:20::2) 56 data bytes -64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=33.8 ms -64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=43.9 ms -64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=43.4 ms -64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=42.5 ms - ---- 2001:470:20::2 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 2999ms -rtt min/avg/max/mdev = 33.802/40.920/43.924/4.139 ms -``` - -Assuming the pings are successful, you need to add some DNS servers. -Some options: - -```{literalinclude} _include/vyos-wan_tun0.conf -:language: none -:lines: 13 -``` - -You should now be able to ping something by IPv6 DNS name: - -```none -vyos@vyos-wan:~$ ping tunnelbroker.net count 4 -PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes -64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=48 time=285 ms -64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=48 time=186 ms -64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=48 time=178 ms -64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=48 time=177 ms - ---- tunnelbroker.net ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3002ms -rtt min/avg/max/mdev = 176.707/206.638/285.128/45.457 ms -``` - - -### LAN Configuration - -At this point, your VyOS install should have full IPv6, but now your LAN devices -need access. - -With Tunnelbroker.net, you have two options: - -- Routed /64. This is the default assignment. In IPv6-land, it's good for a - single "LAN", and is somewhat equivalent to a /24. -- Routed /48. This is something you can request by clicking the "Assign /48" - link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k - -Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So -if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore -the assigned /64, and request the /48 and use that. - -## Single LAN Setup - -Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker -Routed /64 prefix: - -```{literalinclude} _include/vyos-wan_tun0.conf -:language: none -:lines: 9-11 -``` - -Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, -'valid-lifetime' and 'preferred-lifetime' are set to default values of -30 days and 4 hours respectively. - -And the `client` to receive an IPv6 address with stateless autoconfig. - -```{literalinclude} _include/client.conf -:language: none -``` - -This accomplishes a few things: -- Sets your LAN interface's IP address -- Enables router advertisements. This is an IPv6 alternative for DHCP (though - DHCPv6 can still be used). With RAs, Your devices will automatically find the - information they need for routing and DNS. - -Now the Client is able to ping a public IPv6 address - -```none -vyos@client:~$ ping 2001:470:20::2 count 4 -PING 2001:470:20::2(2001:470:20::2) 56 data bytes -64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=32.1 ms -64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=41.8 ms -64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=41.7 ms -64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=47.1 ms - ---- 2001:470:20::2 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3005ms -rtt min/avg/max/mdev = 32.128/40.688/47.107/5.403 ms -``` - - -## Multiple LAN/DMZ Setup - -That's how you can expand the example above. -Use the `Routed /48` information. This allows you to assign a -different /64 to every interface, LAN, or even device. Or you could break your -network into smaller chunks like /56 or /60. - -The format of these addresses: -- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker. -- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN -- `2001:470:xxxx:2::/64`: Another subnet -- `2001:470:xxxx:ffff::/64`: The last usable /64 subnet. - -In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff -(1-65535). - -So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: - -```none -set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' -set service router-advert interface eth1 name-server '2001:470:20::2' -set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64 - -set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64' -set service router-advert interface eth2 name-server '2001:470:20::2' -set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 - -set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64' -set service router-advert interface eth3 name-server '2001:470:20::2' -set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 -``` - -Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, -'valid-lifetime' and 'preferred-lifetime' are set to default values of -30 days and 4 hours respectively. - -## Firewall - -Finally, don't forget the -{ref}`Firewall `. The usage is -identical, except instead of `set firewall ipv4 name NAME`, you would -use `set firewall ipv6 name NAME`. - -Similarly, to attach the firewall, you would use -`set firewall ipv6 name NAME rule N inbound-interface name eth0` or -`set firewall zone LOCAL from WAN firewall ipv6-name`. diff --git a/docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst new file mode 100644 index 00000000..e34cb779 --- /dev/null +++ b/docs/configexamples/autotest/tunnelbroker/rst-tunnelbroker.rst @@ -0,0 +1,230 @@ +.. _examples-tunnelbroker-ipv6: + +####################### +Tunnelbroker.net (IPv6) +####################### + +| Testdate: 2024-01-13 +| Version: 1.5-rolling-202401121239 + +This guide walks through the setup of https://www.tunnelbroker.net/ for an +IPv6 Tunnel. + +Prerequisites +============= + +- A public, routable IPv4 address. This does not necessarily need to be static, + but you will need to update the tunnel endpoint when/if your IP address + changes, which can be done with a script and a scheduled task. +- Account at https://www.tunnelbroker.net/ +- Requested a "Regular Tunnel". You want to choose a location that is closest + to your physical location for the best response time. + + +******** +Topology +******** + +The example topology has 2 VyOS routers. One as The WAN Router and on as a +Client, to test a single LAN setup + +.. image:: _include/topology.* + :alt: Tunnelbroker topology image + + +************* +Configuration +************* + +First, we configure the ``vyos-wan`` interface to get a DHCP address. + +.. literalinclude:: _include/vyos-wan.conf + :language: none + + +Now we are able to setup the tunnel interface. + +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 1-5 + +.. note:: The `source-address` is the Tunnelbroker client IPv4 + address or if there is NAT the current WAN interface address. + + If `source-address` is dynamic, the tunnel will cease working once + the address changes. To avoid having to manually update + `source-address` each time the dynamic IP changes, an address of + '0.0.0.0' can be specified. + +Setup the IPv6 default route to the tunnel interface + +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 7 + +Now you should be able to ping a public IPv6 Address + +.. stop_vyoslinter + +.. code-block:: none + + vyos@vyos-wan:~$ ping 2001:470:20::2 count 4 + PING 2001:470:20::2(2001:470:20::2) 56 data bytes + 64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=33.8 ms + 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=43.9 ms + 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=43.4 ms + 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=42.5 ms + + --- 2001:470:20::2 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 2999ms + rtt min/avg/max/mdev = 33.802/40.920/43.924/4.139 ms + +.. start_vyoslinter + + +Assuming the pings are successful, you need to add some DNS servers. +Some options: + +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 13 + +You should now be able to ping something by IPv6 DNS name: + +.. stop_vyoslinter + +.. code-block:: none + + vyos@vyos-wan:~$ ping tunnelbroker.net count 4 + PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes + 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=48 time=285 ms + 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=48 time=186 ms + 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=48 time=178 ms + 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=48 time=177 ms + + --- tunnelbroker.net ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3002ms + rtt min/avg/max/mdev = 176.707/206.638/285.128/45.457 ms + +.. start_vyoslinter + + +***************** +LAN Configuration +***************** + +At this point, your VyOS install should have full IPv6, but now your LAN devices +need access. + +With Tunnelbroker.net, you have two options: + +- Routed /64. This is the default assignment. In IPv6-land, it's good for a + single "LAN", and is somewhat equivalent to a /24. + +- Routed /48. This is something you can request by clicking the "Assign /48" + link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k + +Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So +if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore +the assigned /64, and request the /48 and use that. + + +Single LAN Setup +================ + +Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker +Routed /64 prefix: + +.. literalinclude:: _include/vyos-wan_tun0.conf + :language: none + :lines: 9-11 + +Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, +'valid-lifetime' and 'preferred-lifetime' are set to default values of +30 days and 4 hours respectively. + +And the ``client`` to receive an IPv6 address with stateless autoconfig. + +.. literalinclude:: _include/client.conf + :language: none + +This accomplishes a few things: + +- Sets your LAN interface's IP address +- Enables router advertisements. This is an IPv6 alternative for DHCP (though + DHCPv6 can still be used). With RAs, Your devices will automatically find the + information they need for routing and DNS. + +Now the Client is able to ping a public IPv6 address + +.. stop_vyoslinter + +.. code-block:: none + + vyos@client:~$ ping 2001:470:20::2 count 4 + PING 2001:470:20::2(2001:470:20::2) 56 data bytes + 64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=32.1 ms + 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=41.8 ms + 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=41.7 ms + 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=47.1 ms + + --- 2001:470:20::2 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3005ms + rtt min/avg/max/mdev = 32.128/40.688/47.107/5.403 ms + +.. start_vyoslinter + + +Multiple LAN/DMZ Setup +====================== + +That's how you can expand the example above. +Use the `Routed /48` information. This allows you to assign a +different /64 to every interface, LAN, or even device. Or you could break your +network into smaller chunks like /56 or /60. + +The format of these addresses: + +- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker. +- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN +- `2001:470:xxxx:2::/64`: Another subnet +- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet. + +In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff +(1-65535). + +So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: + +.. stop_vyoslinter + +.. code-block:: none + + set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' + set service router-advert interface eth1 name-server '2001:470:20::2' + set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64 + + set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64' + set service router-advert interface eth2 name-server '2001:470:20::2' + set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 + + set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64' + set service router-advert interface eth3 name-server '2001:470:20::2' + set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 + +.. start_vyoslinter + +Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, +'valid-lifetime' and 'preferred-lifetime' are set to default values of +30 days and 4 hours respectively. + +Firewall +======== + +Finally, don't forget the +:ref:`Firewall`. The usage is +identical, except instead of `set firewall ipv4 name NAME`, you would +use `set firewall ipv6 name NAME`. + +Similarly, to attach the firewall, you would use +`set firewall ipv6 name NAME rule N inbound-interface name eth0` or +`set firewall zone LOCAL from WAN firewall ipv6-name`. diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.md b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.md new file mode 100644 index 00000000..6c59a491 --- /dev/null +++ b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.md @@ -0,0 +1,206 @@ +(examples-tunnelbroker-ipv6)= + +# Tunnelbroker.net (IPv6) + +```{eval-rst} +| Testdate: 2024-01-13 +| Version: 1.5-rolling-202401121239 +``` + +This guide walks through the setup of for an +IPv6 Tunnel. + +## Prerequisites + +- A public, routable IPv4 address. This does not necessarily need to be static, + but you will need to update the tunnel endpoint when/if your IP address + changes, which can be done with a script and a scheduled task. +- Account at +- Requested a "Regular Tunnel". You want to choose a location that is closest + to your physical location for the best response time. + +### Topology + +The example topology has 2 VyOS routers. One as the WAN router and one as a +client, to test a single LAN setup + +```{image} _include/topology.webp +:alt: Tunnelbroker topology image +``` + + +### Configuration + +First, we configure the `vyos-wan` interface to get a DHCP address. + +```{literalinclude} _include/vyos-wan.conf +:language: none +``` + +Now we are able to setup the tunnel interface. + +```{literalinclude} _include/vyos-wan_tun0.conf +:language: none +:lines: 1-5 +``` + +:::{note} +The `source-address` is the Tunnelbroker client IPv4 +address or if there is NAT the current WAN interface address. + +If `source-address` is dynamic, the tunnel will cease working once +the address changes. To avoid having to manually update +`source-address` each time the dynamic IP changes, an address of +'0.0.0.0' can be specified. +::: + +Setup the IPv6 default route to the tunnel interface + +```{literalinclude} _include/vyos-wan_tun0.conf +:language: none +:lines: 7 +``` + +Now you should be able to ping a public IPv6 Address + +```none +vyos@vyos-wan:~$ ping 2001:470:20::2 count 4 +PING 2001:470:20::2(2001:470:20::2) 56 data bytes +64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=33.8 ms +64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=43.9 ms +64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=43.4 ms +64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=42.5 ms + +--- 2001:470:20::2 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 2999ms +rtt min/avg/max/mdev = 33.802/40.920/43.924/4.139 ms +``` + +Assuming the pings are successful, you need to add some DNS servers. +Some options: + +```{literalinclude} _include/vyos-wan_tun0.conf +:language: none +:lines: 13 +``` + +You should now be able to ping something by IPv6 DNS name: + +```none +vyos@vyos-wan:~$ ping tunnelbroker.net count 4 +PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes +64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=48 time=285 ms +64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=48 time=186 ms +64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=48 time=178 ms +64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=48 time=177 ms + +--- tunnelbroker.net ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3002ms +rtt min/avg/max/mdev = 176.707/206.638/285.128/45.457 ms +``` + + +### LAN Configuration + +At this point, your VyOS install should have full IPv6, but now your LAN devices +need access. + +With Tunnelbroker.net, you have two options: + +- Routed /64. This is the default assignment. In IPv6-land, it's good for a + single "LAN", and is somewhat equivalent to a /24. +- Routed /48. This is something you can request by clicking the "Assign /48" + link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k + +Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So +if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore +the assigned /64, and request the /48 and use that. + +## Single LAN Setup + +Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker +Routed /64 prefix: + +```{literalinclude} _include/vyos-wan_tun0.conf +:language: none +:lines: 9-11 +``` + +Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, +'valid-lifetime' and 'preferred-lifetime' are set to default values of +30 days and 4 hours respectively. + +And the `client` to receive an IPv6 address with stateless autoconfig. + +```{literalinclude} _include/client.conf +:language: none +``` + +This accomplishes a few things: +- Sets your LAN interface's IP address +- Enables router advertisements. This is an IPv6 alternative for DHCP (though + DHCPv6 can still be used). With RAs, Your devices will automatically find the + information they need for routing and DNS. + +Now the Client is able to ping a public IPv6 address + +```none +vyos@client:~$ ping 2001:470:20::2 count 4 +PING 2001:470:20::2(2001:470:20::2) 56 data bytes +64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=32.1 ms +64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=41.8 ms +64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=41.7 ms +64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=47.1 ms + +--- 2001:470:20::2 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3005ms +rtt min/avg/max/mdev = 32.128/40.688/47.107/5.403 ms +``` + + +## Multiple LAN/DMZ Setup + +That's how you can expand the example above. +Use the `Routed /48` information. This allows you to assign a +different /64 to every interface, LAN, or even device. Or you could break your +network into smaller chunks like /56 or /60. + +The format of these addresses: +- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker. +- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN +- `2001:470:xxxx:2::/64`: Another subnet +- `2001:470:xxxx:ffff::/64`: The last usable /64 subnet. + +In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff +(1-65535). + +So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: + +```none +set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' +set service router-advert interface eth1 name-server '2001:470:20::2' +set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64 + +set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64' +set service router-advert interface eth2 name-server '2001:470:20::2' +set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 + +set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64' +set service router-advert interface eth3 name-server '2001:470:20::2' +set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 +``` + +Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, +'valid-lifetime' and 'preferred-lifetime' are set to default values of +30 days and 4 hours respectively. + +## Firewall + +Finally, don't forget the +{ref}`Firewall `. The usage is +identical, except instead of `set firewall ipv4 name NAME`, you would +use `set firewall ipv6 name NAME`. + +Similarly, to attach the firewall, you would use +`set firewall ipv6 name NAME rule N inbound-interface name eth0` or +`set firewall zone LOCAL from WAN firewall ipv6-name`. diff --git a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst b/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst deleted file mode 100644 index e34cb779..00000000 --- a/docs/configexamples/autotest/tunnelbroker/tunnelbroker.rst +++ /dev/null @@ -1,230 +0,0 @@ -.. _examples-tunnelbroker-ipv6: - -####################### -Tunnelbroker.net (IPv6) -####################### - -| Testdate: 2024-01-13 -| Version: 1.5-rolling-202401121239 - -This guide walks through the setup of https://www.tunnelbroker.net/ for an -IPv6 Tunnel. - -Prerequisites -============= - -- A public, routable IPv4 address. This does not necessarily need to be static, - but you will need to update the tunnel endpoint when/if your IP address - changes, which can be done with a script and a scheduled task. -- Account at https://www.tunnelbroker.net/ -- Requested a "Regular Tunnel". You want to choose a location that is closest - to your physical location for the best response time. - - -******** -Topology -******** - -The example topology has 2 VyOS routers. One as The WAN Router and on as a -Client, to test a single LAN setup - -.. image:: _include/topology.* - :alt: Tunnelbroker topology image - - -************* -Configuration -************* - -First, we configure the ``vyos-wan`` interface to get a DHCP address. - -.. literalinclude:: _include/vyos-wan.conf - :language: none - - -Now we are able to setup the tunnel interface. - -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 1-5 - -.. note:: The `source-address` is the Tunnelbroker client IPv4 - address or if there is NAT the current WAN interface address. - - If `source-address` is dynamic, the tunnel will cease working once - the address changes. To avoid having to manually update - `source-address` each time the dynamic IP changes, an address of - '0.0.0.0' can be specified. - -Setup the IPv6 default route to the tunnel interface - -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 7 - -Now you should be able to ping a public IPv6 Address - -.. stop_vyoslinter - -.. code-block:: none - - vyos@vyos-wan:~$ ping 2001:470:20::2 count 4 - PING 2001:470:20::2(2001:470:20::2) 56 data bytes - 64 bytes from 2001:470:20::2: icmp_seq=1 ttl=64 time=33.8 ms - 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=64 time=43.9 ms - 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=64 time=43.4 ms - 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=64 time=42.5 ms - - --- 2001:470:20::2 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 2999ms - rtt min/avg/max/mdev = 33.802/40.920/43.924/4.139 ms - -.. start_vyoslinter - - -Assuming the pings are successful, you need to add some DNS servers. -Some options: - -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 13 - -You should now be able to ping something by IPv6 DNS name: - -.. stop_vyoslinter - -.. code-block:: none - - vyos@vyos-wan:~$ ping tunnelbroker.net count 4 - PING tunnelbroker.net(tunnelbroker.net (2001:470:0:63::2)) 56 data bytes - 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=1 ttl=48 time=285 ms - 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=2 ttl=48 time=186 ms - 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=3 ttl=48 time=178 ms - 64 bytes from tunnelbroker.net (2001:470:0:63::2): icmp_seq=4 ttl=48 time=177 ms - - --- tunnelbroker.net ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3002ms - rtt min/avg/max/mdev = 176.707/206.638/285.128/45.457 ms - -.. start_vyoslinter - - -***************** -LAN Configuration -***************** - -At this point, your VyOS install should have full IPv6, but now your LAN devices -need access. - -With Tunnelbroker.net, you have two options: - -- Routed /64. This is the default assignment. In IPv6-land, it's good for a - single "LAN", and is somewhat equivalent to a /24. - -- Routed /48. This is something you can request by clicking the "Assign /48" - link in the Tunnelbroker.net tunnel config. It allows you to have up to 65k - -Unlike IPv4, IPv6 is really not designed to be broken up smaller than /64. So -if you ever want to have multiple LANs, VLANs, DMZ, etc, you'll want to ignore -the assigned /64, and request the /48 and use that. - - -Single LAN Setup -================ - -Single LAN setup where eth2 is your LAN interface. Use the Tunnelbroker -Routed /64 prefix: - -.. literalinclude:: _include/vyos-wan_tun0.conf - :language: none - :lines: 9-11 - -Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, -'valid-lifetime' and 'preferred-lifetime' are set to default values of -30 days and 4 hours respectively. - -And the ``client`` to receive an IPv6 address with stateless autoconfig. - -.. literalinclude:: _include/client.conf - :language: none - -This accomplishes a few things: - -- Sets your LAN interface's IP address -- Enables router advertisements. This is an IPv6 alternative for DHCP (though - DHCPv6 can still be used). With RAs, Your devices will automatically find the - information they need for routing and DNS. - -Now the Client is able to ping a public IPv6 address - -.. stop_vyoslinter - -.. code-block:: none - - vyos@client:~$ ping 2001:470:20::2 count 4 - PING 2001:470:20::2(2001:470:20::2) 56 data bytes - 64 bytes from 2001:470:20::2: icmp_seq=1 ttl=63 time=32.1 ms - 64 bytes from 2001:470:20::2: icmp_seq=2 ttl=63 time=41.8 ms - 64 bytes from 2001:470:20::2: icmp_seq=3 ttl=63 time=41.7 ms - 64 bytes from 2001:470:20::2: icmp_seq=4 ttl=63 time=47.1 ms - - --- 2001:470:20::2 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3005ms - rtt min/avg/max/mdev = 32.128/40.688/47.107/5.403 ms - -.. start_vyoslinter - - -Multiple LAN/DMZ Setup -====================== - -That's how you can expand the example above. -Use the `Routed /48` information. This allows you to assign a -different /64 to every interface, LAN, or even device. Or you could break your -network into smaller chunks like /56 or /60. - -The format of these addresses: - -- `2001:470:xxxx::/48`: The whole subnet. xxxx should come from Tunnelbroker. -- `2001:470:xxxx:1::/64`: A subnet suitable for a LAN -- `2001:470:xxxx:2::/64`: Another subnet -- `2001:470:xxxx:ffff:/64`: The last usable /64 subnet. - -In the above examples, 1,2,ffff are all chosen by you. You can use 1-ffff -(1-65535). - -So, when your LAN is eth1, your DMZ is eth2, your cameras are on eth3, etc: - -.. stop_vyoslinter - -.. code-block:: none - - set interfaces ethernet eth1 address '2001:470:xxxx:1::1/64' - set service router-advert interface eth1 name-server '2001:470:20::2' - set service router-advert interface eth1 prefix 2001:470:xxxx:1::/64 - - set interfaces ethernet eth2 address '2001:470:xxxx:2::1/64' - set service router-advert interface eth2 name-server '2001:470:20::2' - set service router-advert interface eth2 prefix 2001:470:xxxx:2::/64 - - set interfaces ethernet eth3 address '2001:470:xxxx:3::1/64' - set service router-advert interface eth3 name-server '2001:470:20::2' - set service router-advert interface eth3 prefix 2001:470:xxxx:3::/64 - -.. start_vyoslinter - -Please note, 'autonomous-flag' and 'on-link-flag' are enabled by default, -'valid-lifetime' and 'preferred-lifetime' are set to default values of -30 days and 4 hours respectively. - -Firewall -======== - -Finally, don't forget the -:ref:`Firewall`. The usage is -identical, except instead of `set firewall ipv4 name NAME`, you would -use `set firewall ipv6 name NAME`. - -Similarly, to attach the firewall, you would use -`set firewall ipv6 name NAME rule N inbound-interface name eth0` or -`set firewall zone LOCAL from WAN firewall ipv6-name`. diff --git a/docs/configexamples/azure-vpn-bgp.md b/docs/configexamples/azure-vpn-bgp.md new file mode 100644 index 00000000..83d77e53 --- /dev/null +++ b/docs/configexamples/azure-vpn-bgp.md @@ -0,0 +1,134 @@ +--- +lastproofread: '2021-06-28' +--- + +(examples-azure-vpn-bgp)= + +# Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) + +This guide shows an example of a route-based IKEv2 site-to-site VPN to +Azure using VTI and BGP for dynamic routing updates. + +For redundant / active-active configurations see +{ref}`examples-azure-vpn-dual-bgp` + +## Prerequisites + +- A pair of Azure VNet Gateways deployed in active-passive + configuration with BGP enabled. +- A local network gateway deployed in Azure representing + the Vyos device, matching the below Vyos settings except for + address space, which only requires the Vyos private IP, in + this example 10.10.0.5/32 +- A connection resource deployed in Azure linking the + Azure VNet gateway and the local network gateway representing + the Vyos device. + +## Example + +```{eval-rst} ++---------------------------------------+---------------------+ +| WAN Interface | eth0 | ++---------------------------------------+---------------------+ +| On-premises address space | 10.10.0.0/16 | ++---------------------------------------+---------------------+ +| Azure address space | 10.0.0.0/16 | ++---------------------------------------+---------------------+ +| Vyos public IP | 198.51.100.3 | ++---------------------------------------+---------------------+ +| Vyos private IP | 10.10.0.5 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway public IP | 203.0.113.2 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway BGP IP | 10.0.0.4 | ++---------------------------------------+---------------------+ +| Pre-shared key | ch00s3-4-s3cur3-psk | ++---------------------------------------+---------------------+ +| Vyos ASN | 64499 | ++---------------------------------------+---------------------+ +| Azure ASN | 65540 | ++---------------------------------------+---------------------+ +``` + +## Vyos configuration + +- Configure the IKE and ESP settings to match a subset + of those supported by Azure: + +```none +set vpn ipsec esp-group AZURE lifetime '3600' +set vpn ipsec esp-group AZURE mode 'tunnel' +set vpn ipsec esp-group AZURE pfs 'dh-group2' +set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' +set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' + +set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' +set vpn ipsec ike-group AZURE dead-peer-detection interval '15' +set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' +set vpn ipsec ike-group AZURE ikev2-reauth +set vpn ipsec ike-group AZURE key-exchange 'ikev2' +set vpn ipsec ike-group AZURE lifetime '28800' +set vpn ipsec ike-group AZURE proposal 1 dh-group '2' +set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' +set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' +``` + +- Enable IPsec on eth0 + +```none +set vpn ipsec interface 'eth0' +``` + +- Configure a VTI with a dummy IP address + +```none +set interfaces vti vti1 address '10.10.1.5/32' +set interfaces vti vti1 description 'Azure Tunnel' +``` + +- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. + +```none +set interfaces vti vti1 ip adjust-mss 1350 +``` + +- Configure the VPN tunnel + +```none +set vpn ipsec authentication psk azure id '198.51.100.3' +set vpn ipsec authentication psk azure id '203.0.113.2' +set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' +set vpn ipsec site-to-site peer 203.0.113.2 authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' +set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate' +set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' +set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' +set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' +set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' +set vpn ipsec site-to-site peer 203.0.113.2 remote-address '203.0.113.2' +set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' +set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' +``` + +- **Important**: Add an interface route to reach Azure's BGP listener + +```none +set protocols static route 10.0.0.4/32 interface vti1 +``` + +- Configure your BGP settings + +```none +set protocols bgp system-as 64499 +set protocols bgp neighbor 10.0.0.4 remote-as '65540' +set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' +set protocols bgp neighbor 10.0.0.4 timers holdtime '30' +set protocols bgp neighbor 10.0.0.4 timers keepalive '10' +``` + +- **Important**: Disable connected check + +```none +set protocols bgp neighbor 10.0.0.4 disable-connected-check +``` diff --git a/docs/configexamples/azure-vpn-bgp.rst b/docs/configexamples/azure-vpn-bgp.rst deleted file mode 100644 index 597a4d15..00000000 --- a/docs/configexamples/azure-vpn-bgp.rst +++ /dev/null @@ -1,138 +0,0 @@ -:lastproofread: 2021-06-28 - -.. _examples-azure-vpn-bgp: - -############################################################ -Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) -############################################################ - -This guide shows an example of a route-based IKEv2 site-to-site VPN to -Azure using VTI and BGP for dynamic routing updates. - -For redundant / active-active configurations see -:ref:`examples-azure-vpn-dual-bgp` - - -Prerequisites -^^^^^^^^^^^^^ - -- A pair of Azure VNet Gateways deployed in active-passive - configuration with BGP enabled. - -- A local network gateway deployed in Azure representing - the Vyos device, matching the below Vyos settings except for - address space, which only requires the Vyos private IP, in - this example 10.10.0.5/32 - -- A connection resource deployed in Azure linking the - Azure VNet gateway and the local network gateway representing - the Vyos device. - -Example -^^^^^^^ - -+---------------------------------------+---------------------+ -| WAN Interface | eth0 | -+---------------------------------------+---------------------+ -| On-premises address space | 10.10.0.0/16 | -+---------------------------------------+---------------------+ -| Azure address space | 10.0.0.0/16 | -+---------------------------------------+---------------------+ -| Vyos public IP | 198.51.100.3 | -+---------------------------------------+---------------------+ -| Vyos private IP | 10.10.0.5 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway public IP | 203.0.113.2 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway BGP IP | 10.0.0.4 | -+---------------------------------------+---------------------+ -| Pre-shared key | ch00s3-4-s3cur3-psk | -+---------------------------------------+---------------------+ -| Vyos ASN | 64499 | -+---------------------------------------+---------------------+ -| Azure ASN | 65540 | -+---------------------------------------+---------------------+ - -Vyos configuration -^^^^^^^^^^^^^^^^^^ - -- Configure the IKE and ESP settings to match a subset - of those supported by Azure: - -.. code-block:: none - - set vpn ipsec esp-group AZURE lifetime '3600' - set vpn ipsec esp-group AZURE mode 'tunnel' - set vpn ipsec esp-group AZURE pfs 'dh-group2' - set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' - set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' - - set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' - set vpn ipsec ike-group AZURE dead-peer-detection interval '15' - set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' - set vpn ipsec ike-group AZURE ikev2-reauth - set vpn ipsec ike-group AZURE key-exchange 'ikev2' - set vpn ipsec ike-group AZURE lifetime '28800' - set vpn ipsec ike-group AZURE proposal 1 dh-group '2' - set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' - set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' - -- Enable IPsec on eth0 - -.. code-block:: none - - set vpn ipsec interface 'eth0' - -- Configure a VTI with a dummy IP address - -.. code-block:: none - - set interfaces vti vti1 address '10.10.1.5/32' - set interfaces vti vti1 description 'Azure Tunnel' - -- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. - -.. code-block:: none - - set interfaces vti vti1 ip adjust-mss 1350 - -- Configure the VPN tunnel - -.. code-block:: none - - set vpn ipsec authentication psk azure id '198.51.100.3' - set vpn ipsec authentication psk azure id '203.0.113.2' - set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' - set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3' - set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' - set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate' - set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' - set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' - set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' - set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' - set vpn ipsec site-to-site peer azure remote-address '203.0.113.2' - set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' - set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' - -- **Important**: Add an interface route to reach Azure's BGP listener - -.. code-block:: none - - set protocols static route 10.0.0.4/32 interface vti1 - -- Configure your BGP settings - -.. code-block:: none - - set protocols bgp system-as 64499 - set protocols bgp neighbor 10.0.0.4 remote-as '65540' - set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' - set protocols bgp neighbor 10.0.0.4 timers holdtime '30' - set protocols bgp neighbor 10.0.0.4 timers keepalive '10' - -- **Important**: Disable connected check \ - -.. code-block:: none - - set protocols bgp neighbor 10.0.0.4 disable-connected-check diff --git a/docs/configexamples/azure-vpn-dual-bgp.md b/docs/configexamples/azure-vpn-dual-bgp.md new file mode 100644 index 00000000..967debd4 --- /dev/null +++ b/docs/configexamples/azure-vpn-dual-bgp.md @@ -0,0 +1,160 @@ +--- +lastproofread: '2021-06-28' +--- + +(examples-azure-vpn-dual-bgp)= + +# Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) + +This guide shows an example of a redundant (active-active) route-based IKEv2 +site-to-site VPN to Azure using VTI +and BGP for dynamic routing updates. + +## Prerequisites + +- A pair of Azure VNet Gateways deployed in active-active + configuration with BGP enabled. +- A local network gateway deployed in Azure representing + the Vyos device, matching the below Vyos settings except for + address space, which only requires the Vyos private IP, in + this example 10.10.0.5/32 +- A connection resource deployed in Azure linking the + Azure VNet gateway and the local network gateway representing + the Vyos device. + +## Example + +```{eval-rst} ++---------------------------------------+---------------------+ +| WAN Interface | eth0 | ++---------------------------------------+---------------------+ +| On-premises address space | 10.10.0.0/16 | ++---------------------------------------+---------------------+ +| Azure address space | 10.0.0.0/16 | ++---------------------------------------+---------------------+ +| Vyos public IP | 198.51.100.3 | ++---------------------------------------+---------------------+ +| Vyos private IP | 10.10.0.5 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway 1 public IP | 203.0.113.2 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway 2 public IP | 203.0.113.3 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway BGP IP | 10.0.0.4,10.0.0.5 | ++---------------------------------------+---------------------+ +| Pre-shared key | ch00s3-4-s3cur3-psk | ++---------------------------------------+---------------------+ +| Vyos ASN | 64499 | ++---------------------------------------+---------------------+ +| Azure ASN | 65540 | ++---------------------------------------+---------------------+ +``` + +## Vyos configuration + +- Configure the IKE and ESP settings to match a subset + of those supported by Azure: + +```none +set vpn ipsec esp-group AZURE lifetime '3600' +set vpn ipsec esp-group AZURE mode 'tunnel' +set vpn ipsec esp-group AZURE pfs 'dh-group2' +set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' +set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' + +set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' +set vpn ipsec ike-group AZURE dead-peer-detection interval '15' +set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' +set vpn ipsec ike-group AZURE ikev2-reauth +set vpn ipsec ike-group AZURE key-exchange 'ikev2' +set vpn ipsec ike-group AZURE lifetime '28800' +set vpn ipsec ike-group AZURE proposal 1 dh-group '2' +set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' +set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' +``` + +- Enable IPsec on eth0 + +```none +set vpn ipsec interface 'eth0' +``` + +- Configure two VTIs with a dummy IP address each + +```none +set interfaces vti vti1 address '10.10.1.5/32' +set interfaces vti vti1 description 'Azure Primary Tunnel' + +set interfaces vti vti2 address '10.10.1.6/32' +set interfaces vti vti2 description 'Azure Secondary Tunnel' +``` + +- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. + +```none +set interfaces vti vti1 ip adjust-mss 1350 +set interfaces vti vti2 ip adjust-mss 1350 +``` + +- Configure the VPN tunnels + +```none +set vpn ipsec authentication psk azure id '198.51.100.3' +set vpn ipsec authentication psk azure id '203.0.113.2' +set vpn ipsec authentication psk azure id '203.0.113.3' +set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' + +set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2' +set vpn ipsec site-to-site peer azure-primary connection-type 'initiate' +set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL' +set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE' +set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit' +set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5' +set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2' +set vpn ipsec site-to-site peer azure-primary vti bind 'vti1' +set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE' + +set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3' +set vpn ipsec site-to-site peer azure-secondary connection-type 'initiate' +set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL' +set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE' +set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit' +set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5' +set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3' +set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2' +set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE' +``` + +- **Important**: Add an interface route to reach both Azure's BGP listeners + +```none +set protocols static route 10.0.0.4/32 interface vti1 +set protocols static route 10.0.0.5/32 interface vti2 +``` + +- Configure your BGP settings + +```none +set protocols bgp system-as 64499 +set protocols bgp neighbor 10.0.0.4 remote-as '65540' +set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' +set protocols bgp neighbor 10.0.0.4 timers holdtime '30' +set protocols bgp neighbor 10.0.0.4 timers keepalive '10' + +set protocols bgp neighbor 10.0.0.5 remote-as '65540' +set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound' +set protocols bgp neighbor 10.0.0.5 timers holdtime '30' +set protocols bgp neighbor 10.0.0.5 timers keepalive '10' +``` + +- **Important**: Disable connected check, otherwise the routes learned + from Azure will not be imported into the routing table. + +```none +set protocols bgp neighbor 10.0.0.4 disable-connected-check +set protocols bgp neighbor 10.0.0.5 disable-connected-check +``` diff --git a/docs/configexamples/azure-vpn-dual-bgp.rst b/docs/configexamples/azure-vpn-dual-bgp.rst deleted file mode 100644 index 04a6a631..00000000 --- a/docs/configexamples/azure-vpn-dual-bgp.rst +++ /dev/null @@ -1,163 +0,0 @@ -:lastproofread: 2021-06-28 - -.. _examples-azure-vpn-dual-bgp: - -###################################################################### -Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) -###################################################################### - -This guide shows an example of a redundant (active-active) route-based IKEv2 -site-to-site VPN to Azure using VTI -and BGP for dynamic routing updates. - -Prerequisites -^^^^^^^^^^^^^ - -- A pair of Azure VNet Gateways deployed in active-active - configuration with BGP enabled. - -- A local network gateway deployed in Azure representing - the Vyos device, matching the below Vyos settings except for - address space, which only requires the Vyos private IP, in - this example 10.10.0.5/32 - -- A connection resource deployed in Azure linking the - Azure VNet gateway and the local network gateway representing - the Vyos device. - -Example -^^^^^^^ - -+---------------------------------------+---------------------+ -| WAN Interface | eth0 | -+---------------------------------------+---------------------+ -| On-premises address space | 10.10.0.0/16 | -+---------------------------------------+---------------------+ -| Azure address space | 10.0.0.0/16 | -+---------------------------------------+---------------------+ -| Vyos public IP | 198.51.100.3 | -+---------------------------------------+---------------------+ -| Vyos private IP | 10.10.0.5 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway 1 public IP | 203.0.113.2 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway 2 public IP | 203.0.113.3 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway BGP IP | 10.0.0.4,10.0.0.5 | -+---------------------------------------+---------------------+ -| Pre-shared key | ch00s3-4-s3cur3-psk | -+---------------------------------------+---------------------+ -| Vyos ASN | 64499 | -+---------------------------------------+---------------------+ -| Azure ASN | 65540 | -+---------------------------------------+---------------------+ - -Vyos configuration -^^^^^^^^^^^^^^^^^^ - -- Configure the IKE and ESP settings to match a subset - of those supported by Azure: - -.. code-block:: none - - set vpn ipsec esp-group AZURE lifetime '3600' - set vpn ipsec esp-group AZURE mode 'tunnel' - set vpn ipsec esp-group AZURE pfs 'dh-group2' - set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' - set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' - - set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' - set vpn ipsec ike-group AZURE dead-peer-detection interval '15' - set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' - set vpn ipsec ike-group AZURE ikev2-reauth - set vpn ipsec ike-group AZURE key-exchange 'ikev2' - set vpn ipsec ike-group AZURE lifetime '28800' - set vpn ipsec ike-group AZURE proposal 1 dh-group '2' - set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' - set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' - -- Enable IPsec on eth0 - -.. code-block:: none - - set vpn ipsec interface 'eth0' - -- Configure two VTIs with a dummy IP address each - -.. code-block:: none - - set interfaces vti vti1 address '10.10.1.5/32' - set interfaces vti vti1 description 'Azure Primary Tunnel' - - set interfaces vti vti2 address '10.10.1.6/32' - set interfaces vti vti2 description 'Azure Secondary Tunnel' - -- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. - -.. code-block:: none - - set interfaces vti vti1 ip adjust-mss 1350 - set interfaces vti vti2 ip adjust-mss 1350 - -- Configure the VPN tunnels - -.. code-block:: none - - set vpn ipsec authentication psk azure id '198.51.100.3' - set vpn ipsec authentication psk azure id '203.0.113.2' - set vpn ipsec authentication psk azure id '203.0.113.3' - set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' - - set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3' - set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2' - set vpn ipsec site-to-site peer azure-primary connection-type 'initiate' - set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL' - set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE' - set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit' - set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5' - set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2' - set vpn ipsec site-to-site peer azure-primary vti bind 'vti1' - set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE' - - set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3' - set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3' - set vpn ipsec site-to-site peer azure-secondary connection-type 'initiate' - set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL' - set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE' - set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit' - set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5' - set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3' - set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2' - set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE' - -- **Important**: Add an interface route to reach both Azure's BGP listeners - -.. code-block:: none - - set protocols static route 10.0.0.4/32 interface vti1 - set protocols static route 10.0.0.5/32 interface vti2 - -- Configure your BGP settings - -.. code-block:: none - - set protocols bgp system-as 64499 - set protocols bgp neighbor 10.0.0.4 remote-as '65540' - set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' - set protocols bgp neighbor 10.0.0.4 timers holdtime '30' - set protocols bgp neighbor 10.0.0.4 timers keepalive '10' - - set protocols bgp neighbor 10.0.0.5 remote-as '65540' - set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound' - set protocols bgp neighbor 10.0.0.5 timers holdtime '30' - set protocols bgp neighbor 10.0.0.5 timers keepalive '10' - -- **Important**: Disable connected check, otherwise the routes learned - from Azure will not be imported into the routing table. - -.. code-block:: none - - set protocols bgp neighbor 10.0.0.4 disable-connected-check - set protocols bgp neighbor 10.0.0.5 disable-connected-check diff --git a/docs/configexamples/bgp-ipv6-unnumbered.md b/docs/configexamples/bgp-ipv6-unnumbered.md new file mode 100644 index 00000000..4fa29834 --- /dev/null +++ b/docs/configexamples/bgp-ipv6-unnumbered.md @@ -0,0 +1,174 @@ +--- +lastproofread: '2021-06-28' +--- + +(examples-bgp-ipv6-unnumbered)= + +# BGP IPv6 unnumbered with extended nexthop + +General information can be found in the {ref}`routing-bgp` chapter. + +## Configuration + +- Router A: + +```none +set protocols bgp system-as 64496 +set protocols bgp address-family ipv4-unicast redistribute connected +set protocols bgp address-family ipv6-unicast redistribute connected +set protocols bgp neighbor eth1 interface v6only +set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' +set protocols bgp neighbor eth2 interface v6only +set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' +set protocols bgp parameters bestpath as-path multipath-relax +set protocols bgp parameters bestpath compare-routerid +set protocols bgp parameters default no-ipv4-unicast +set protocols bgp parameters router-id '192.168.0.1' +set protocols bgp peer-group fabric address-family ipv4-unicast +set protocols bgp peer-group fabric address-family ipv6-unicast +set protocols bgp peer-group fabric capability extended-nexthop +set protocols bgp peer-group fabric remote-as 'external' +``` + +- Router B: + +```none +set protocols bgp system-as 64499 +set protocols bgp address-family ipv4-unicast redistribute connected +set protocols bgp address-family ipv6-unicast redistribute connected +set protocols bgp neighbor eth1 interface v6only +set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' +set protocols bgp neighbor eth2 interface v6only +set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' +set protocols bgp parameters bestpath as-path multipath-relax +set protocols bgp parameters bestpath compare-routerid +set protocols bgp parameters default no-ipv4-unicast +set protocols bgp parameters router-id '192.168.0.2' +set protocols bgp peer-group fabric address-family ipv4-unicast +set protocols bgp peer-group fabric address-family ipv6-unicast +set protocols bgp peer-group fabric capability extended-nexthop +set protocols bgp peer-group fabric remote-as 'external' +``` + + +## Results + +- Router A: + +```none +vyos@vyos:~$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 198.51.100.34/24 u/u +eth1 - u/u +eth2 - u/u +lo 127.0.0.1/8 u/u + 192.168.0.1/32 + ::1/128 +``` + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route + +S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53 +C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53 +C>* 192.168.0.1/32 is directly connected, lo, 03:21:56 +B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07 + * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07 +``` + +```none +vyos@vyos:~$ ping 192.168.0.2 +PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data. +64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms +64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms +64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms +64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms +64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms + +--- 192.168.0.2 ping statistics --- +5 packets transmitted, 5 received, 0% packet loss, time 4086ms +rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms +``` + +```none +vyos@vyos:~$ show ip bgp summary + +IPv4 Unicast Summary: +BGP router identifier 192.168.0.1, local AS number 64496 vrf-id 0 +BGP table version 4 +RIB entries 5, using 800 bytes of memory +Peers 2, using 41 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd +eth1 4 64499 13 13 0 0 0 00:05:33 2 +eth2 4 64499 13 14 0 0 0 00:05:29 2 + +Total number of neighbors 2 +``` + +- Router B: + +```none +vyos@vyos:~$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 198.51.100.33/24 u/u +eth1 - u/u +eth2 - u/u +lo 127.0.0.1/8 u/u + 192.168.0.2/32 + ::1/128 +``` + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route + +S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08 +C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09 +B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18 + * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18 +C>* 192.168.0.2/32 is directly connected, lo, 00:44:11 +``` + +```none +vyos@vyos:~$ ping 192.168.0.1 +PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. +64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms +64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms +64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms +64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms + +--- 192.168.0.1 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3051ms +rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms +``` + +```none +vyos@vyos:~$ show ip bgp summary +IPv4 Unicast Summary: +BGP router identifier 192.168.0.2, local AS number 64499 vrf-id 0 +BGP table version 4 +RIB entries 5, using 800 bytes of memory +Peers 2, using 41 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd +eth1 4 64496 14 14 0 0 0 00:06:40 2 +eth2 4 64496 14 14 0 0 0 00:06:37 2 + +Total number of neighbors 2 +``` diff --git a/docs/configexamples/bgp-ipv6-unnumbered.rst b/docs/configexamples/bgp-ipv6-unnumbered.rst deleted file mode 100644 index f7a530d8..00000000 --- a/docs/configexamples/bgp-ipv6-unnumbered.rst +++ /dev/null @@ -1,176 +0,0 @@ -:lastproofread: 2021-06-28 - -.. _examples-bgp-ipv6-unnumbered: - -######################################### -BGP IPv6 unnumbered with extended nexthop -######################################### - -General information can be found in the :ref:`routing-bgp` chapter. - -Configuration -============= - -- Router A: - -.. code-block:: none - - set protocols bgp system-as 64496 - set protocols bgp address-family ipv4-unicast redistribute connected - set protocols bgp address-family ipv6-unicast redistribute connected - set protocols bgp neighbor eth1 interface v6only - set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' - set protocols bgp neighbor eth2 interface v6only - set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' - set protocols bgp parameters bestpath as-path multipath-relax - set protocols bgp parameters bestpath compare-routerid - set protocols bgp parameters default no-ipv4-unicast - set protocols bgp parameters router-id '192.168.0.1' - set protocols bgp peer-group fabric address-family ipv4-unicast - set protocols bgp peer-group fabric address-family ipv6-unicast - set protocols bgp peer-group fabric capability extended-nexthop - set protocols bgp peer-group fabric remote-as 'external' - -- Router B: - -.. code-block:: none - - set protocols bgp system-as 64499 - set protocols bgp address-family ipv4-unicast redistribute connected - set protocols bgp address-family ipv6-unicast redistribute connected - set protocols bgp neighbor eth1 interface v6only - set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' - set protocols bgp neighbor eth2 interface v6only - set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' - set protocols bgp parameters bestpath as-path multipath-relax - set protocols bgp parameters bestpath compare-routerid - set protocols bgp parameters default no-ipv4-unicast - set protocols bgp parameters router-id '192.168.0.2' - set protocols bgp peer-group fabric address-family ipv4-unicast - set protocols bgp peer-group fabric address-family ipv6-unicast - set protocols bgp peer-group fabric capability extended-nexthop - set protocols bgp peer-group fabric remote-as 'external' - -Results -======= - -- Router A: - -.. code-block:: none - - vyos@vyos:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 198.51.100.34/24 u/u - eth1 - u/u - eth2 - u/u - lo 127.0.0.1/8 u/u - 192.168.0.1/32 - ::1/128 - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route - - S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53 - C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53 - C>* 192.168.0.1/32 is directly connected, lo, 03:21:56 - B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07 - * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07 - -.. code-block:: none - - vyos@vyos:~$ ping 192.168.0.2 - PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data. - 64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms - 64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms - 64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms - 64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms - 64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms - - --- 192.168.0.2 ping statistics --- - 5 packets transmitted, 5 received, 0% packet loss, time 4086ms - rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms - -.. code-block:: none - - vyos@vyos:~$ show ip bgp summary - - IPv4 Unicast Summary: - BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0 - BGP table version 4 - RIB entries 5, using 800 bytes of memory - Peers 2, using 41 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd - eth1 4 64499 13 13 0 0 0 00:05:33 2 - eth2 4 64499 13 14 0 0 0 00:05:29 2 - - Total number of neighbors 2 - -- Router B: - -.. code-block:: none - - vyos@vyos:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 198.51.100.33/24 u/u - eth1 - u/u - eth2 - u/u - lo 127.0.0.1/8 u/u - 192.168.0.2/32 - ::1/128 - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route - - S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08 - C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09 - B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18 - * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18 - C>* 192.168.0.2/32 is directly connected, lo, 00:44:11 - -.. code-block:: none - - vyos@vyos:~$ ping 192.168.0.1 - PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. - 64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms - 64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms - 64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms - 64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms - - --- 192.168.0.1 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3051ms - rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms - -.. code-block:: none - - vyos@vyos:~$ show ip bgp summary - IPv4 Unicast Summary: - BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0 - BGP table version 4 - RIB entries 5, using 800 bytes of memory - Peers 2, using 41 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd - eth1 4 64496 14 14 0 0 0 00:06:40 2 - eth2 4 64496 14 14 0 0 0 00:06:37 2 - - Total number of neighbors 2 - diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.md b/docs/configexamples/dmvpn-dualhub-dualcloud.md new file mode 100644 index 00000000..20c1a064 --- /dev/null +++ b/docs/configexamples/dmvpn-dualhub-dualcloud.md @@ -0,0 +1,552 @@ +--- +lastproofread: '2024-02-21' +--- + +(examples-dmvpn-dualhub-dualcloud)= + +# DMVPN Dual HUB Dual Cloud + +This document is to describe a basic setup to build DMVPN network with two Hubs and two clouds using DMVPN Phase3. +OSPF is used as routing protocol inside DMVPN. + +In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) +as a Spoke. + +## Network Topology + +```{image} /_static/images/dual-hub-DMVPN.webp +:align: center +:alt: DMVPN Network Topology +:width: 80% +``` + + +## Configurations + +### Underlay configuration + +Networks 192.168.X.0/24 are used as LANs for every spoke. + +HUB-1 + +```none +set interfaces ethernet eth0 address '10.0.0.2/30' +set protocols static route 0.0.0.0/0 next-hop 10.0.0.1 +``` + +HUB-2 + +```none +set interfaces ethernet eth0 address '10.0.1.2/30' +set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 +``` + +Spoke-1 + +```none +interface GigabitEthernet0/0 + ip address 10.0.11.2 255.255.255.252 + duplex auto + speed auto + media-type rj45 +! +interface GigabitEthernet0/1 + ip address 192.168.11.1 255.255.255.0 + ip ospf 1 area 0 + duplex auto + speed auto + media-type rj45 +! +ip route 0.0.0.0 0.0.0.0 10.0.11.1 +``` + +Spoke-2 + +```none +set interfaces ethernet eth0 address '10.0.12.2/30' +set interfaces ethernet eth1 address '192.168.12.1/24' +set protocols static route 0.0.0.0/0 next-hop 10.0.12.1 +``` + +Spoke-3 + +```none +set interfaces ethernet eth0 address '10.0.13.2/30' +set interfaces ethernet eth1 address '192.168.13.1/24' +set protocols static route 0.0.0.0/0 next-hop 10.0.13.1 +``` + + +### NHRP configuration + +The next step is to configure the NHRP protocol. In a Dual cloud network, every HUB has to be configured with one GRE +multipoint tunnel interface and every spoke has to be configured with two tunnel interfaces, one tunnel to each hub. +In this example tunnel networks are 10.100.100.0/24 for the first cloud and 10.100.101.0/24 for the second cloud. +But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32. + +HUB-1 + +```none +set interfaces tunnel tun100 address '10.100.100.1/32' +set interfaces tunnel tun100 enable-multicast +set interfaces tunnel tun100 encapsulation 'gre' +set interfaces tunnel tun100 ip adjust-mss '1360' +set interfaces tunnel tun100 mtu '1436' +set interfaces tunnel tun100 parameters ip key '42' +set interfaces tunnel tun100 source-interface 'eth0' +set protocols nhrp tunnel tun100 authentication 'vyos' +set protocols nhrp tunnel tun100 holdtime '300' +set protocols nhrp tunnel tun100 multicast 'dynamic' +set protocols nhrp tunnel tun100 network-id '1' +set protocols nhrp tunnel tun100 redirect +set protocols nhrp tunnel tun100 registration-no-unique +``` + +HUB-2 + +```none +set interfaces tunnel tun101 address '10.100.101.1/32' +set interfaces tunnel tun101 enable-multicast +set interfaces tunnel tun101 encapsulation 'gre' +set interfaces tunnel tun101 ip adjust-mss '1360' +set interfaces tunnel tun101 mtu '1436' +set interfaces tunnel tun101 parameters ip key '43' +set interfaces tunnel tun101 source-interface 'eth0' +set protocols nhrp tunnel tun101 authentication 'vyos' +set protocols nhrp tunnel tun101 holdtime '300' +set protocols nhrp tunnel tun101 multicast 'dynamic' +set protocols nhrp tunnel tun101 network-id '2' +set protocols nhrp tunnel tun101 redirect +set protocols nhrp tunnel tun101 registration-no-unique +``` + +Spoke-1 + +```none +interface Tunnel100 + ip address 10.100.100.11 255.255.255.0 + no ip redirects + ip mtu 1436 + ip nhrp authentication vyos + ip nhrp map multicast 10.0.0.2 + ip nhrp network-id 1 + ip nhrp holdtime 300 + ip nhrp nhs 10.100.100.1 nbma 10.0.0.2 + ip nhrp shortcut + ip tcp adjust-mss 1360 + tunnel source GigabitEthernet0/0 + tunnel mode gre multipoint + tunnel key 42 +! +interface Tunnel101 + ip address 10.100.101.11 255.255.255.0 + no ip redirects + ip mtu 1436 + ip nhrp authentication vyos + ip nhrp map multicast 10.0.1.2 + ip nhrp network-id 2 + ip nhrp holdtime 300 + ip nhrp nhs 10.100.101.1 nbma 10.0.1.2 + ip nhrp shortcut + ip tcp adjust-mss 1360 + tunnel source GigabitEthernet0/0 + tunnel mode gre multipoint + tunnel key 43 +``` + +Spoke-2 + +```none +set interfaces tunnel tun100 address '10.100.100.12/32' +set interfaces tunnel tun100 enable-multicast +set interfaces tunnel tun100 encapsulation 'gre' +set interfaces tunnel tun100 ip adjust-mss '1360' +set interfaces tunnel tun100 mtu '1436' +set interfaces tunnel tun100 parameters ip key '42' +set interfaces tunnel tun100 source-interface 'eth0' +set interfaces tunnel tun101 address '10.100.101.12/32' +set interfaces tunnel tun101 enable-multicast +set interfaces tunnel tun101 encapsulation 'gre' +set interfaces tunnel tun101 ip adjust-mss '1360' +set interfaces tunnel tun101 mtu '1436' +set interfaces tunnel tun101 parameters ip key '43' +set interfaces tunnel tun101 source-interface 'eth0' +set protocols nhrp tunnel tun100 authentication 'vyos' +set protocols nhrp tunnel tun100 holdtime '300' +set protocols nhrp tunnel tun100 multicast '10.0.0.2' +set protocols nhrp tunnel tun100 network-id '1' +set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' +set protocols nhrp tunnel tun100 registration-no-unique +set protocols nhrp tunnel tun100 shortcut +set protocols nhrp tunnel tun101 authentication 'vyos' +set protocols nhrp tunnel tun101 holdtime '300' +set protocols nhrp tunnel tun101 multicast '10.0.1.2' +set protocols nhrp tunnel tun101 network-id '2' +set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' +set protocols nhrp tunnel tun101 registration-no-unique +set protocols nhrp tunnel tun101 shortcut +``` + +Spoke-3 + +```none +set protocols nhrp tunnel tun100 authentication 'vyos' +set protocols nhrp tunnel tun100 holdtime '300' +set protocols nhrp tunnel tun100 multicast '10.0.0.2' +set protocols nhrp tunnel tun100 network-id '1' +set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' +set protocols nhrp tunnel tun100 registration-no-unique +set protocols nhrp tunnel tun100 shortcut +set protocols nhrp tunnel tun101 authentication 'vyos' +set protocols nhrp tunnel tun101 holdtime '300' +set protocols nhrp tunnel tun101 multicast '10.0.1.2' +set protocols nhrp tunnel tun101 network-id '2' +set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' +set protocols nhrp tunnel tun101 registration-no-unique +set protocols nhrp tunnel tun101 shortcut +``` + + +### Overlay configuration + +The last step is to configure the routing protocol. In this scenario, OSPF was chosen as the dynamic routing protocol. +But you can use iBGP or eBGP. To form fast convergence it is possible to use BFD protocol. + +HUB-1 + +```none +set protocols ospf interface tun100 area '0' +set protocols ospf interface tun100 network 'point-to-multipoint' +set protocols ospf interface tun100 passive disable +set protocols ospf passive-interface 'default' +``` + +HUB-2 + +```none +set protocols ospf interface tun101 area '0' +set protocols ospf interface tun101 network 'point-to-multipoint' +set protocols ospf interface tun101 passive disable +set protocols ospf passive-interface 'default' +``` + +Spoke-1 + +```none +interface Tunnel100 + ip ospf network point-to-multipoint + ip ospf dead-interval 40 + ip ospf hello-interval 10 + ip ospf 1 area 0 +! +interface Tunnel101 + ip ospf network point-to-multipoint + ip ospf dead-interval 40 + ip ospf hello-interval 10 + ip ospf 1 area 0 +! +router ospf 1 + passive-interface default + no passive-interface Tunnel100 + no passive-interface Tunnel101 +``` + +Spoke-2 + +```none +set protocols ospf interface eth1 area '0' +set protocols ospf interface tun100 area '0' +set protocols ospf interface tun100 network 'point-to-multipoint' +set protocols ospf interface tun100 passive disable +set protocols ospf interface tun101 area '0' +set protocols ospf interface tun101 network 'point-to-multipoint' +set protocols ospf interface tun101 passive disable +set protocols ospf passive-interface 'default' +``` + +Spoke-3 + +```none +set protocols ospf interface eth1 area '0' +set protocols ospf interface tun100 area '0' +set protocols ospf interface tun100 network 'point-to-multipoint' +set protocols ospf interface tun100 passive disable +set protocols ospf interface tun101 area '0' +set protocols ospf interface tun101 network 'point-to-multipoint' +set protocols ospf interface tun101 passive disable +set protocols ospf passive-interface 'default' +``` + + +### Security configuration + +Tunnels can be encrypted by IPSEC for security. + +HUB-1 + +```{eval-rst} + .. code-block:: none + + set vpn ipsec esp-group ESP-HUB lifetime '1800' + set vpn ipsec esp-group ESP-HUB mode 'transport' + set vpn ipsec esp-group ESP-HUB pfs 'disable' + set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' + set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' + set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' + set vpn ipsec ike-group IKE-HUB lifetime '3600' + set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' + set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' + set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' + set vpn ipsec interface 'eth0' + set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' + set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' + set vpn ipsec profile NHRPVPN bind tunnel 'tun100' + set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' + set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' +``` + +HUB-2 + +```{eval-rst} + .. code-block:: none + + set vpn ipsec esp-group ESP-HUB lifetime '1800' + set vpn ipsec esp-group ESP-HUB mode 'transport' + set vpn ipsec esp-group ESP-HUB pfs 'disable' + set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' + set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' + set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' + set vpn ipsec ike-group IKE-HUB lifetime '3600' + set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' + set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' + set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' + set vpn ipsec interface 'eth0' + set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' + set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' + set vpn ipsec profile NHRPVPN bind tunnel 'tun101' + set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' + set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' +``` + +VyOS Spokes have the same configuration + +```{eval-rst} + .. code-block:: none + + set vpn ipsec esp-group ESP-HUB lifetime '1800' + set vpn ipsec esp-group ESP-HUB mode 'transport' + set vpn ipsec esp-group ESP-HUB pfs 'disable' + set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' + set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' + set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' + set vpn ipsec ike-group IKE-HUB lifetime '3600' + set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' + set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' + set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' + set vpn ipsec interface 'eth0' + set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' + set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' + set vpn ipsec profile NHRPVPN bind tunnel 'tun100' + set vpn ipsec profile NHRPVPN bind tunnel 'tun101' + set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' + set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' +``` + +SPOKE-1 + +```{eval-rst} + .. code-block:: none + + crypto isakmp policy 1 + encr aes 256 + authentication pre-share + group 2 + lifetime 3600 + crypto isakmp key secret address 0.0.0.0 + ! + ! + crypto ipsec transform-set ESP_TRANSFORMSET esp-aes 256 esp-sha-hmac + mode transport + ! + ! + crypto ipsec profile gre_protection + set security-association lifetime seconds 1800 + set transform-set ESP_TRANSFORMSET + ! + interface Tunnel100 + tunnel protection ipsec profile gre_protection shared + ! + interface Tunnel101 + tunnel protection ipsec profile gre_protection shared +``` + + +## Monitoring + +All spokes created IPSec tunnels to Hubs, are registered on Hubs using NHRP protocol and formed adjacency in OSPF. + +```none +vyos@HUB-1:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +-------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------ +dmvpn-NHRPVPN-tun100-child up 6m1s 4K/5K 51/56 10.0.13.2 10.0.13.2 AES_CBC_256/HMAC_SHA1_96 +dmvpn-NHRPVPN-tun100-child up 6m36s 4K/6K 56/65 10.0.12.2 10.0.12.2 AES_CBC_256/HMAC_SHA1_96 +dmvpn-NHRPVPN-tun100-child up 8m49s 6K/6K 73/77 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96 + +vyos@HUB-1:~$ show ip nhrp cache +Iface Type Protocol NBMA Claimed NBMA Flags Identity +tun100 dynamic 10.100.100.12 10.0.12.2 10.0.12.2 T 10.0.12.2 +tun100 dynamic 10.100.100.13 10.0.13.2 10.0.13.2 T 10.0.13.2 +tun100 dynamic 10.100.100.11 10.0.11.2 10.0.11.2 T 10.0.11.2 +tun100 local 10.100.100.1 10.0.0.2 10.0.0.2 - + +vyos@HUB-1:~$ show ip ospf neighbor + +Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL +192.168.11.1 1 Full/DROther 17m01s 36.201s 10.100.100.11 tun100:10.100.100.1 0 0 0 +192.168.12.1 1 Full/DROther 9m42s 37.443s 10.100.100.12 tun100:10.100.100.1 0 0 0 +192.168.13.1 1 Full/DROther 9m15s 35.053s 10.100.100.13 tun100:10.100.100.1 0 0 0 +``` + +First, we see that LANs are accessible through hubs using OSPF routes. + +```none +SPOKE-1#show ip route +Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP + D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area + N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 + E1 - OSPF external type 1, E2 - OSPF external type 2 + i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 + ia - IS-IS inter area, * - candidate default, U - per-user static route + o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + a - application route + + - replicated route, % - next hop override, p - overrides from PfR + +Gateway of last resort is 10.0.11.1 to network 0.0.0.0 +..... + 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks +C 192.168.11.0/24 is directly connected, GigabitEthernet0/1 +L 192.168.11.1/32 is directly connected, GigabitEthernet0/1 +O 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101 + [110/1002] via 10.100.100.1, 00:16:13, Tunnel100 +O 192.168.13.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101 + [110/1002] via 10.100.100.1, 00:15:45, Tunnel100 + + +vyos@SPOKE-2:~$ show ip route +Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +...... +O>* 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36 + * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36 +O 192.168.12.0/24 [110/1] is directly connected, eth1, weight 1, 01:24:40 +C>* 192.168.12.0/24 is directly connected, eth1, weight 1, 01:24:43 +L>* 192.168.12.1/32 is directly connected, eth1, weight 1, 01:24:43 +O>* 192.168.13.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36 + * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36 +``` + +After initiating traffic between SPOKES sites, Phase 3 of DMVPN will work. +For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1 + +```none +PC-SPOKE-2 : 192.168.12.2 255.255.255.0 gateway 192.168.12.1 + +PC-SPOKE-2> trace 192.168.11.2 +trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop + 1 192.168.12.1 0.558 ms 0.378 ms 0.561 ms + 2 10.100.101.1 1.768 ms 1.158 ms 1.744 ms + 3 10.100.101.11 7.196 ms 4.971 ms 4.793 ms + 4 *192.168.11.2 7.747 ms (ICMP type:3, code:3, Destination port unreachable) + +PC-SPOKE-2> trace 192.168.11.2 +trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop + 1 192.168.12.1 0.562 ms 0.396 ms 0.364 ms + 2 10.100.100.11 4.401 ms 4.399 ms 4.174 ms + 3 *192.168.11.2 3.241 ms (ICMP type:3, code:3, Destination port unreachable) +``` + +First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2. +Now routing tables are changed. LAN networks 192.168.12.0/24 and 192.168.11.0/24 available directly via SPOKES. + +```none +vyos@SPOKE-2:~$ show ip route +Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +N>* 192.168.11.0/24 [10/0] via 10.100.100.11, tun100 onlink, weight 1, 00:00:14 +O 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:00:54 + via 10.100.101.1, tun101 onlink, weight 1, 00:00:54 + + +SPOKE-1# show ip route next-hop-override +Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP + D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area + N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 + E1 - OSPF external type 1, E2 - OSPF external type 2 + i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 + ia - IS-IS inter area, * - candidate default, U - per-user static route + o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + a - application route + + - replicated route, % - next hop override, p - overrides from PfR + +Gateway of last resort is 10.0.11.1 to network 0.0.0.0 + +O % 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:24:09, Tunnel101 + [110/1002] via 10.100.100.1, 00:25:46, Tunnel100 + [NHO][110/1] via 10.100.100.12, 00:00:03, Tunnel100 +``` + +NHRP shows shortcuts on Spokes + +```none +vyos@SPOKE-2:~$ show ip nhrp shortcut +Type Prefix Via Identity +dynamic 192.168.11.0/24 10.100.100.11 10.0.11.2 + +SPOKE-1# show ip nhrp shortcut +10.100.100.12/32 via 10.100.100.12 + Tunnel100 created 00:09:59, expire 00:02:21 + Type: dynamic, Flags: router nhop rib nho + NBMA address: 10.0.12.2 +192.168.12.0/24 via 10.100.100.12 + Tunnel100 created 00:02:38, expire 00:02:21 + Type: dynamic, Flags: router rib nho + NBMA address: 10.0.12.2 +``` + +A new Spoke to Spoke IPSec tunnel is created + +```none +SPOKE-1#show crypto isakmp sa +IPv4 Crypto ISAKMP SA +dst src state conn-id status +10.0.0.2 10.0.11.2 QM_IDLE 1002 ACTIVE +10.0.12.2 10.0.11.2 QM_IDLE 1004 ACTIVE +10.0.1.2 10.0.11.2 QM_IDLE 1003 ACTIVE + +vyos@SPOKE-2:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +-------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------ +dmvpn-NHRPVPN-tun100-child up 7m26s 4K/4K 57/53 10.0.0.2 10.0.0.2 AES_CBC_256/HMAC_SHA1_96 +dmvpn-NHRPVPN-tun100-child up 11m48s 316B/1K 3/15 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96 +dmvpn-NHRPVPN-tun101-child up 5m58s 5K/4K 62/51 10.0.1.2 10.0.1.2 AES_CBC_256/HMAC_SHA1_96 +``` + + +## Summary + +If one of the Hubs loses connectivity to the Internet, the other Hub will be available and take the main role. +This is a simple example where only one internet connection is used. But in the real world, there can be two +connections to the Internet. In this case, there is a recommendation to build each tunnel via each Internet connection, +choose the main cloud, and manipulate traffic via a routing protocol. It allows the creation failover on link-level +connections too. diff --git a/docs/configexamples/dmvpn-dualhub-dualcloud.rst b/docs/configexamples/dmvpn-dualhub-dualcloud.rst deleted file mode 100644 index a3a4e619..00000000 --- a/docs/configexamples/dmvpn-dualhub-dualcloud.rst +++ /dev/null @@ -1,559 +0,0 @@ -:lastproofread: 2024-02-21 - -.. _examples-dmvpn-dualhub-dualcloud: - -######################### -DMVPN Dual HUB Dual Cloud -######################### - -This document is to describe a basic setup to build DVMPN network with -two Hubs and two clouds using DMVPN Phase3. -OSPF is used as routing protocol inside DMVPN. - -In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, -SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) as a Spoke. - -Network Topology -================ - -.. image:: /_static/images/dual-hub-DMVPN.* - :width: 80% - :align: center - :alt: DMVPN Network Topology - -Configurations -============== - -Underlay configuration -______________________ - -Networks 192.168.X.0/24 are used as LANs for every spoke. - -HUB-1 - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.0.2/30' - set protocols static route 0.0.0.0/0 next-hop 10.0.0.1 - -HUB-2 - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.1.2/30' - set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 - -Spoke-1 - -.. code-block:: none - - interface GigabitEthernet0/0 - ip address 10.0.11.2 255.255.255.252 - duplex auto - speed auto - media-type rj45 - ! - interface GigabitEthernet0/1 - ip address 192.168.11.1 255.255.255.0 - ip ospf 1 area 0 - duplex auto - speed auto - media-type rj45 - ! - ip route 0.0.0.0 0.0.0.0 10.0.11.1 - -Spoke-2 - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.12.2/30' - set interfaces ethernet eth1 address '192.168.12.1/24' - set protocols static route 0.0.0.0/0 next-hop 10.0.12.1 - -Spoke-3 - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.13.2/30' - set interfaces ethernet eth1 address '192.168.13.1/24' - set protocols static route 0.0.0.0/0 next-hop 10.0.13.1 - -NHRP configuration -__________________ - -The next step is to configure the NHRP protocol. In a Dual cloud -network, every HUB has to be configured with one GRE multipoint tunnel -interface and every spoke has to be configured with two tunnel -interfaces, one tunnel to each hub. -In this example tunnel networks are 10.100.100.0/24 for the first cloud -and 10.100.101.0/24 for the second cloud. -But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32. - -HUB-1 - -.. code-block:: none - - set interfaces tunnel tun100 address '10.100.100.1/32' - set interfaces tunnel tun100 enable-multicast - set interfaces tunnel tun100 encapsulation 'gre' - set interfaces tunnel tun100 ip adjust-mss '1360' - set interfaces tunnel tun100 mtu '1436' - set interfaces tunnel tun100 parameters ip key '42' - set interfaces tunnel tun100 source-interface 'eth0' - set protocols nhrp tunnel tun100 authentication 'vyos' - set protocols nhrp tunnel tun100 holdtime '300' - set protocols nhrp tunnel tun100 multicast 'dynamic' - set protocols nhrp tunnel tun100 network-id '1' - set protocols nhrp tunnel tun100 redirect - set protocols nhrp tunnel tun100 registration-no-unique - -HUB-2 - -.. code-block:: none - - set interfaces tunnel tun101 address '10.100.101.1/32' - set interfaces tunnel tun101 enable-multicast - set interfaces tunnel tun101 encapsulation 'gre' - set interfaces tunnel tun101 ip adjust-mss '1360' - set interfaces tunnel tun101 mtu '1436' - set interfaces tunnel tun101 parameters ip key '43' - set interfaces tunnel tun101 source-interface 'eth0' - set protocols nhrp tunnel tun101 authentication 'vyos' - set protocols nhrp tunnel tun101 holdtime '300' - set protocols nhrp tunnel tun101 multicast 'dynamic' - set protocols nhrp tunnel tun101 network-id '2' - set protocols nhrp tunnel tun101 redirect - set protocols nhrp tunnel tun101 registration-no-unique - -Spoke-1 - -.. code-block:: none - - interface Tunnel100 - ip address 10.100.100.11 255.255.255.0 - no ip redirects - ip mtu 1436 - ip nhrp authentication vyos - ip nhrp map multicast 10.0.0.2 - ip nhrp network-id 1 - ip nhrp holdtime 300 - ip nhrp nhs 10.100.100.1 nbma 10.0.0.2 - ip nhrp shortcut - ip tcp adjust-mss 1360 - tunnel source GigabitEthernet0/0 - tunnel mode gre multipoint - tunnel key 42 - ! - interface Tunnel101 - ip address 10.100.101.11 255.255.255.0 - no ip redirects - ip mtu 1436 - ip nhrp authentication vyos - ip nhrp map multicast 10.0.1.2 - ip nhrp network-id 2 - ip nhrp holdtime 300 - ip nhrp nhs 10.100.101.1 nbma 10.0.1.2 - ip nhrp shortcut - ip tcp adjust-mss 1360 - tunnel source GigabitEthernet0/0 - tunnel mode gre multipoint - tunnel key 43 - - -Spoke-2 - -.. code-block:: none - - set interfaces tunnel tun100 address '10.100.100.12/32' - set interfaces tunnel tun100 enable-multicast - set interfaces tunnel tun100 encapsulation 'gre' - set interfaces tunnel tun100 ip adjust-mss '1360' - set interfaces tunnel tun100 mtu '1436' - set interfaces tunnel tun100 parameters ip key '42' - set interfaces tunnel tun100 source-interface 'eth0' - set interfaces tunnel tun101 address '10.100.101.12/32' - set interfaces tunnel tun101 enable-multicast - set interfaces tunnel tun101 encapsulation 'gre' - set interfaces tunnel tun101 ip adjust-mss '1360' - set interfaces tunnel tun101 mtu '1436' - set interfaces tunnel tun101 parameters ip key '43' - set interfaces tunnel tun101 source-interface 'eth0' - set protocols nhrp tunnel tun100 authentication 'vyos' - set protocols nhrp tunnel tun100 holdtime '300' - set protocols nhrp tunnel tun100 multicast '10.0.0.2' - set protocols nhrp tunnel tun100 network-id '1' - set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' - set protocols nhrp tunnel tun100 registration-no-unique - set protocols nhrp tunnel tun100 shortcut - set protocols nhrp tunnel tun101 authentication 'vyos' - set protocols nhrp tunnel tun101 holdtime '300' - set protocols nhrp tunnel tun101 multicast '10.0.1.2' - set protocols nhrp tunnel tun101 network-id '2' - set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' - set protocols nhrp tunnel tun101 registration-no-unique - set protocols nhrp tunnel tun101 shortcut - -Spoke-3 - -.. code-block:: none - - set protocols nhrp tunnel tun100 authentication 'vyos' - set protocols nhrp tunnel tun100 holdtime '300' - set protocols nhrp tunnel tun100 multicast '10.0.0.2' - set protocols nhrp tunnel tun100 network-id '1' - set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' - set protocols nhrp tunnel tun100 registration-no-unique - set protocols nhrp tunnel tun100 shortcut - set protocols nhrp tunnel tun101 authentication 'vyos' - set protocols nhrp tunnel tun101 holdtime '300' - set protocols nhrp tunnel tun101 multicast '10.0.1.2' - set protocols nhrp tunnel tun101 network-id '2' - set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' - set protocols nhrp tunnel tun101 registration-no-unique - set protocols nhrp tunnel tun101 shortcut - -Overlay configuration -_____________________ - -The last step is to configure the routing protocol. In this scenario, -OSPF was chosen as the dynamic routing protocol. -But you can use iBGP or eBGP. To form fast convergence it is possible -to use BFD protocol. - - -HUB-1 - -.. code-block:: none - - set protocols ospf interface tun100 area '0' - set protocols ospf interface tun100 network 'point-to-multipoint' - set protocols ospf interface tun100 passive disable - set protocols ospf passive-interface 'default' - -HUB-2 - -.. code-block:: none - - set protocols ospf interface tun101 area '0' - set protocols ospf interface tun101 network 'point-to-multipoint' - set protocols ospf interface tun101 passive disable - set protocols ospf passive-interface 'default' - -Spoke-1 - -.. code-block:: none - - interface Tunnel100 - ip ospf network point-to-multipoint - ip ospf dead-interval 40 - ip ospf hello-interval 10 - ip ospf 1 area 0 - ! - interface Tunnel101 - ip ospf network point-to-multipoint - ip ospf dead-interval 40 - ip ospf hello-interval 10 - ip ospf 1 area 0 - ! - router ospf 1 - passive-interface default - no passive-interface Tunnel100 - no passive-interface Tunnel101 - -Spoke-2 - -.. code-block:: none - - set protocols ospf interface eth1 area '0' - set protocols ospf interface tun100 area '0' - set protocols ospf interface tun100 network 'point-to-multipoint' - set protocols ospf interface tun100 passive disable - set protocols ospf interface tun101 area '0' - set protocols ospf interface tun101 network 'point-to-multipoint' - set protocols ospf interface tun101 passive disable - set protocols ospf passive-interface 'default' - -Spoke-3 - -.. code-block:: none - - set protocols ospf interface eth1 area '0' - set protocols ospf interface tun100 area '0' - set protocols ospf interface tun100 network 'point-to-multipoint' - set protocols ospf interface tun100 passive disable - set protocols ospf interface tun101 area '0' - set protocols ospf interface tun101 network 'point-to-multipoint' - set protocols ospf interface tun101 passive disable - set protocols ospf passive-interface 'default' - -Security configuration -______________________ - -Tunnels can be encrypted by IPSEC for security. - -HUB-1 - - .. code-block:: none - - set vpn ipsec esp-group ESP-HUB lifetime '1800' - set vpn ipsec esp-group ESP-HUB mode 'transport' - set vpn ipsec esp-group ESP-HUB pfs 'disable' - set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' - set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' - set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' - set vpn ipsec ike-group IKE-HUB lifetime '3600' - set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' - set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' - set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' - set vpn ipsec interface 'eth0' - set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' - set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' - set vpn ipsec profile NHRPVPN bind tunnel 'tun100' - set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' - set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' - -HUB-2 - - .. code-block:: none - - set vpn ipsec esp-group ESP-HUB lifetime '1800' - set vpn ipsec esp-group ESP-HUB mode 'transport' - set vpn ipsec esp-group ESP-HUB pfs 'disable' - set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' - set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' - set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' - set vpn ipsec ike-group IKE-HUB lifetime '3600' - set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' - set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' - set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' - set vpn ipsec interface 'eth0' - set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' - set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' - set vpn ipsec profile NHRPVPN bind tunnel 'tun101' - set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' - set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' - -VyOS Spokes have the same configuration - - .. code-block:: none - - set vpn ipsec esp-group ESP-HUB lifetime '1800' - set vpn ipsec esp-group ESP-HUB mode 'transport' - set vpn ipsec esp-group ESP-HUB pfs 'disable' - set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' - set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' - set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' - set vpn ipsec ike-group IKE-HUB lifetime '3600' - set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' - set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' - set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' - set vpn ipsec interface 'eth0' - set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' - set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' - set vpn ipsec profile NHRPVPN bind tunnel 'tun100' - set vpn ipsec profile NHRPVPN bind tunnel 'tun101' - set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' - set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' - -SPOKE-1 - - .. code-block:: none - - crypto isakmp policy 1 - encr aes 256 - authentication pre-share - group 2 - lifetime 3600 - crypto isakmp key secret address 0.0.0.0 - ! - ! - crypto ipsec transform-set ESP_TRANSFORMSET esp-aes 256 esp-sha-hmac - mode transport - ! - ! - crypto ipsec profile gre_protection - set security-association lifetime seconds 1800 - set transform-set ESP_TRANSFORMSET - ! - interface Tunnel100 - tunnel protection ipsec profile gre_protection shared - ! - interface Tunnel101 - tunnel protection ipsec profile gre_protection shared - -Monitoring -========== - -All spokes created IPSec tunnels to Hubs, are registered on Hubs using -NHRP protocol and formed adjacency in OSPF. - -.. code-block:: none - - vyos@HUB-1:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - -------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------ - dmvpn-NHRPVPN-tun100-child up 6m1s 4K/5K 51/56 10.0.13.2 10.0.13.2 AES_CBC_256/HMAC_SHA1_96 - dmvpn-NHRPVPN-tun100-child up 6m36s 4K/6K 56/65 10.0.12.2 10.0.12.2 AES_CBC_256/HMAC_SHA1_96 - dmvpn-NHRPVPN-tun100-child up 8m49s 6K/6K 73/77 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96 - - vyos@HUB-1:~$ show ip nhrp cache - Iface Type Protocol NBMA Claimed NBMA Flags Identity - tun100 dynamic 10.100.100.12 10.0.12.2 10.0.12.2 T 10.0.12.2 - tun100 dynamic 10.100.100.13 10.0.13.2 10.0.13.2 T 10.0.13.2 - tun100 dynamic 10.100.100.11 10.0.11.2 10.0.11.2 T 10.0.11.2 - tun100 local 10.100.100.1 10.0.0.2 10.0.0.2 - - - vyos@HUB-1:~$ show ip ospf neighbor - - Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL - 192.168.11.1 1 Full/DROther 17m01s 36.201s 10.100.100.11 tun100:10.100.100.1 0 0 0 - 192.168.12.1 1 Full/DROther 9m42s 37.443s 10.100.100.12 tun100:10.100.100.1 0 0 0 - 192.168.13.1 1 Full/DROther 9m15s 35.053s 10.100.100.13 tun100:10.100.100.1 0 0 0 - - -First, we see that LANs are accessible through hubs using OSPF routes. - -.. code-block:: none - - SPOKE-1#show ip route - Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP - D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area - N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 - E1 - OSPF external type 1, E2 - OSPF external type 2 - i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 - ia - IS-IS inter area, * - candidate default, U - per-user static route - o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP - a - application route - + - replicated route, % - next hop override, p - overrides from PfR - - Gateway of last resort is 10.0.11.1 to network 0.0.0.0 - ..... - 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks - C 192.168.11.0/24 is directly connected, GigabitEthernet0/1 - L 192.168.11.1/32 is directly connected, GigabitEthernet0/1 - O 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101 - [110/1002] via 10.100.100.1, 00:16:13, Tunnel100 - O 192.168.13.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101 - [110/1002] via 10.100.100.1, 00:15:45, Tunnel100 - - - vyos@SPOKE-2:~$ show ip route - Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - ...... - O>* 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36 - * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36 - O 192.168.12.0/24 [110/1] is directly connected, eth1, weight 1, 01:24:40 - C>* 192.168.12.0/24 is directly connected, eth1, weight 1, 01:24:43 - L>* 192.168.12.1/32 is directly connected, eth1, weight 1, 01:24:43 - O>* 192.168.13.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36 - * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36 - -After initiating traffic between SPOKES sites, Phase 3 of DMVPN will work. -For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1 - -.. code-block:: none - - PC-SPOKE-2 : 192.168.12.2 255.255.255.0 gateway 192.168.12.1 - - PC-SPOKE-2> trace 192.168.11.2 - trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop - 1 192.168.12.1 0.558 ms 0.378 ms 0.561 ms - 2 10.100.101.1 1.768 ms 1.158 ms 1.744 ms - 3 10.100.101.11 7.196 ms 4.971 ms 4.793 ms - 4 *192.168.11.2 7.747 ms (ICMP type:3, code:3, Destination port unreachable) - - PC-SPOKE-2> trace 192.168.11.2 - trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop - 1 192.168.12.1 0.562 ms 0.396 ms 0.364 ms - 2 10.100.100.11 4.401 ms 4.399 ms 4.174 ms - 3 *192.168.11.2 3.241 ms (ICMP type:3, code:3, Destination port unreachable) - -First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2. -Now routing tables are changed. LAN networks 192.168.12.0/24 and -192.168.11.0/24 available directly via SPOKES. - -.. code-block:: none - - vyos@SPOKE-2:~$ show ip route - Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - N>* 192.168.11.0/24 [10/0] via 10.100.100.11, tun100 onlink, weight 1, 00:00:14 - O 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:00:54 - via 10.100.101.1, tun101 onlink, weight 1, 00:00:54 - - - SPOKE-1# show ip route next-hop-override - Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP - D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area - N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 - E1 - OSPF external type 1, E2 - OSPF external type 2 - i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 - ia - IS-IS inter area, * - candidate default, U - per-user static route - o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP - a - application route - + - replicated route, % - next hop override, p - overrides from PfR - - Gateway of last resort is 10.0.11.1 to network 0.0.0.0 - - O % 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:24:09, Tunnel101 - [110/1002] via 10.100.100.1, 00:25:46, Tunnel100 - [NHO][110/1] via 10.100.100.12, 00:00:03, Tunnel100 - -NHRP shows shortcuts on Spokes - -.. code-block:: none - - vyos@SPOKE-2:~$ show ip nhrp shortcut - Type Prefix Via Identity - dynamic 192.168.11.0/24 10.100.100.11 10.0.11.2 - - SPOKE-1# show ip nhrp shortcut - 10.100.100.12/32 via 10.100.100.12 - Tunnel100 created 00:09:59, expire 00:02:21 - Type: dynamic, Flags: router nhop rib nho - NBMA address: 10.0.12.2 - 192.168.12.0/24 via 10.100.100.12 - Tunnel100 created 00:02:38, expire 00:02:21 - Type: dynamic, Flags: router rib nho - NBMA address: 10.0.12.2 - -A new Spoke to Spoke IPSec tunnel is created - -.. code-block:: none - - SPOKE-1#show crypto isakmp sa - IPv4 Crypto ISAKMP SA - dst src state conn-id status - 10.0.0.2 10.0.11.2 QM_IDLE 1002 ACTIVE - 10.0.12.2 10.0.11.2 QM_IDLE 1004 ACTIVE - 10.0.1.2 10.0.11.2 QM_IDLE 1003 ACTIVE - - vyos@SPOKE-2:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - -------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------ - dmvpn-NHRPVPN-tun100-child up 7m26s 4K/4K 57/53 10.0.0.2 10.0.0.2 AES_CBC_256/HMAC_SHA1_96 - dmvpn-NHRPVPN-tun100-child up 11m48s 316B/1K 3/15 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96 - dmvpn-NHRPVPN-tun101-child up 5m58s 5K/4K 62/51 10.0.1.2 10.0.1.2 AES_CBC_256/HMAC_SHA1_96 - -Summary -======= - -If one of the Hubs loses connectivity to the Internet, the other Hub -will be available and take the main role. -This is a simple example where only one internet connection is used. -But in the real world, there can be two connections to the Internet. -In this case, there is a recommendation to build each tunnel via each -Internet connection, choose the main cloud, and manipulate traffic via -a routing protocol. It allows the creation failover on link-level -connections too. \ No newline at end of file diff --git a/docs/configexamples/firewall.md b/docs/configexamples/firewall.md new file mode 100644 index 00000000..5d170511 --- /dev/null +++ b/docs/configexamples/firewall.md @@ -0,0 +1,16 @@ +--- +lastproofread: '2024-09-11' +--- + +# Firewall Examples + +This section contains examples of firewall configurations for various +deployments. + +```{toctree} +:maxdepth: 2 + +fwall-and-vrf +fwall-and-bridge +zone-policy +``` diff --git a/docs/configexamples/firewall.rst b/docs/configexamples/firewall.rst deleted file mode 100644 index 6968eb04..00000000 --- a/docs/configexamples/firewall.rst +++ /dev/null @@ -1,15 +0,0 @@ -:lastproofread: 2024-09-11 - -################# -Firewall Examples -################# - -This section contains examples of firewall configurations for various -deployments. - -.. toctree:: - :maxdepth: 2 - - fwall-and-vrf - fwall-and-bridge - zone-policy diff --git a/docs/configexamples/fwall-and-bridge.md b/docs/configexamples/fwall-and-bridge.md new file mode 100644 index 00000000..5eb7a7fd --- /dev/null +++ b/docs/configexamples/fwall-and-bridge.md @@ -0,0 +1,490 @@ +--- +lastproofread: '2024-09-11' +--- + +# Bridge and firewall example + +## Scenario and requirements + +This example shows how to configure a VyOS router with bridge interfaces and +firewall rules. + +Three non VLAN-aware bridges are going to be configured, and each one has its +own requirements. + +- Bridge br0: + : - Isolated layer 2 bridge. + - Accept only IPv6 communication within the bridge. +- Bridge br1: + : - Drop all DHCP discover packets. + - Accept all ARP packets. + - Within the bridge, accept only new IPv4 connections from host 10.1.1.102 + - Drop all other IPv4 connections. + - Drop all IPv6 connections. + - Accept access to router itself. + - Allow connections to internet + - Drop connections to other LANs. +- Bridge br2: + : - Accept all DHCP discover packets. + - Accept only DHCP offers from valid server and|or trusted bridge port. + - Accept all ARP packets. + - Accept all IPv4 connections. + - Drop all IPv6 connections. + - Deny access to the router. + - Allow connections to internet. + - Allow connections to bridge br1. + +## Configuration + +### Bridges and interfaces configuration + +First, we need to configure the interfaces and bridges: + +```none +# Bridge br0 +set interfaces bridge br0 description 'Isolated L2 bridge' +set interfaces bridge br0 member interface eth1 +set interfaces bridge br0 member interface eth2 +set interfaces ethernet eth1 description 'br0' +set interfaces ethernet eth2 description 'br0' + +# Bridge br1: +set interfaces bridge br1 address '10.1.1.1/24' +set interfaces bridge br1 description 'L3 bridge br1' +set interfaces bridge br1 member interface eth3 +set interfaces bridge br1 member interface eth4 +set interfaces ethernet eth3 description 'br1' +set interfaces ethernet eth4 description 'br1' + +# Bridge br2: +set interfaces bridge br2 address '10.2.2.1/24' +set interfaces bridge br2 description 'L3 bridge br2' +set interfaces bridge br2 member interface eth5 +set interfaces bridge br2 member interface eth6 +set interfaces bridge br2 member interface eth7 +set interfaces ethernet eth5 description 'br2 - Host' +set interfaces ethernet eth6 description 'br2 - Trusted DHCP Server' +set interfaces ethernet eth7 description 'br2' +``` + + +### Bridge firewall configuration + +In this section, we are going to configure the firewall rules that will be used +in bridge firewall, and will control the traffic within each bridge. + +We are going to use custom firewall rulesets, one for each bridge that will +be used in `prerouting`, and one for each bridge that will be used in the +`forward` chain. + +Also, we are going to use firewall interface groups in order to simplify the +firewall configuration. + +So first, let's create the required firewall interface groups: + +```none +# Bridge br0 interface-group: +set firewall group interface-group br0-ifaces interface 'br0' +set firewall group interface-group br0-ifaces interface 'eth1' +set firewall group interface-group br0-ifaces interface 'eth2' + +# Bridge br1 interface-group: +set firewall group interface-group br1-ifaces interface 'br1' +set firewall group interface-group br1-ifaces interface 'eth3' +set firewall group interface-group br1-ifaces interface 'eth4' + +# Bridge br2 interface-group: +set firewall group interface-group br2-ifaces interface 'br2' +set firewall group interface-group br2-ifaces interface 'eth5' +set firewall group interface-group br2-ifaces interface 'eth6' +set firewall group interface-group br2-ifaces interface 'eth7' +``` + +As said before, we are going to create custom firewall rulesets for each +bridge, that will be used in the `prerouting` chain, in order to drop as much +unwanted traffic as early as possible. So, custom rulesets used in +`prerouting` chain are going to be `br0-pre`, `br1-pre`, and `br2-pre`: + +```none +# Prerouting - Catch all traffic for br0 +set firewall bridge prerouting filter rule 10 action 'jump' +set firewall bridge prerouting filter rule 10 description 'br0 traffic' +set firewall bridge prerouting filter rule 10 inbound-interface group 'br0-ifaces' +set firewall bridge prerouting filter rule 10 jump-target 'br0-pre' + +# Prerouting - Catch all traffic for br1 +set firewall bridge prerouting filter rule 20 action 'jump' +set firewall bridge prerouting filter rule 20 description 'br1 traffic' +set firewall bridge prerouting filter rule 20 inbound-interface group 'br1-ifaces' +set firewall bridge prerouting filter rule 20 jump-target 'br1-pre' + +# Prerouting - Catch all traffic for br2 +set firewall bridge prerouting filter rule 30 action 'jump' +set firewall bridge prerouting filter rule 30 description 'br2 traffic' +set firewall bridge prerouting filter rule 30 inbound-interface group 'br2-ifaces' +set firewall bridge prerouting filter rule 30 jump-target 'br2-pre' +``` + +And then create the custom rulesets: + +```none +### br0 - br0-pre + # Requirements: accept only IPv6 communication within the bridge +set firewall bridge name br0-pre rule 10 description 'Accept IPv6 traffic' +set firewall bridge name br0-pre rule 10 action 'accept' +set firewall bridge name br0-pre rule 10 ethernet-type 'ipv6' + # And drop everything else +set firewall bridge name br0-pre default-action 'drop' + +### br1 - br1-pre + # Requirements: drop all DHCP discover packets +set firewall bridge name br1-pre rule 10 description 'Drop DHCP discover' +set firewall bridge name br1-pre rule 10 action 'drop' +set firewall bridge name br1-pre rule 10 protocol 'udp' +set firewall bridge name br1-pre rule 10 source port '68' +set firewall bridge name br1-pre rule 10 destination port '67' +set firewall bridge name br1-pre rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff' +set firewall bridge name br1-pre rule 10 log + # Requirement: drop all IPv6 connections +set firewall bridge name br1-pre rule 20 description 'Drop IPv6 traffic' +set firewall bridge name br1-pre rule 20 action 'drop' +set firewall bridge name br1-pre rule 20 ethernet-type 'ipv6' + # Accept everything else so it can be parsed later +set firewall bridge name br1-pre default-action 'accept' + +### br2 - br2-pre + # Requirements: drop all IPv6 connections +set firewall bridge name br2-pre rule 10 description 'Drop IPv6 traffic' +set firewall bridge name br2-pre rule 10 action 'drop' +set firewall bridge name br2-pre rule 10 ethernet-type 'ipv6' + # Accept everything else so it can be parsed later +set firewall bridge name br2-pre default-action 'accept' +``` + +Now, in the `forward` chain, we are going to define state policies, and +custom rulesets for each bridge that would be used in the `forward` chain. +These rulesets are `br0-fwd`, `br1-fwd`, and `br2-fwd`: + +```none +# Forward - State policies if not defined globally +set firewall bridge forward filter rule 5 action 'accept' +set firewall bridge forward filter rule 5 state 'established' +set firewall bridge forward filter rule 5 state 'related' +set firewall bridge forward filter rule 10 action 'drop' +set firewall bridge forward filter rule 10 state 'invalid' + +# Forward - Catch all traffic for br0 +set firewall bridge forward filter rule 110 description 'br0 traffic' +set firewall bridge forward filter rule 110 action 'jump' +set firewall bridge forward filter rule 110 inbound-interface group 'br0-ifaces' +set firewall bridge forward filter rule 110 jump-target 'br0-fwd' + +# Forward - Catch all traffic for br1 +set firewall bridge forward filter rule 120 description 'br1 traffic' +set firewall bridge forward filter rule 120 action 'jump' +set firewall bridge forward filter rule 120 inbound-interface group 'br1-ifaces' +set firewall bridge forward filter rule 120 jump-target 'br1-fwd' + +# Forward - Catch all traffic for br2 +set firewall bridge forward filter rule 130 description 'br2 traffic' +set firewall bridge forward filter rule 130 action 'jump' +set firewall bridge forward filter rule 130 inbound-interface group 'br2-ifaces' +set firewall bridge forward filter rule 130 jump-target 'br2-fwd' + +# Forward - Default action drop: +set firewall bridge forward filter default-action 'drop' +``` + +And the content of the custom rulesets: + +```none +### br0 - br0-fwd + # Accept everything that wasn't dropped in prerouting +set firewall bridge name br0-fwd default-action 'accept' + +### br1 - br1-fwd + # Requirement: Accept all ARP packets +set firewall bridge name br1-fwd rule 10 description 'Accept ARP' +set firewall bridge name br1-fwd rule 10 action 'accept' +set firewall bridge name br1-fwd rule 10 ethernet-type 'arp' + # Requirement: Accept only new IPv4 connections from host 10.1.1.102 +set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host' +set firewall bridge name br1-fwd rule 20 action 'accept' +set firewall bridge name br1-fwd rule 20 source address '10.1.1.102' +set firewall bridge name br1-fwd rule 20 state 'new' + # Drop everything else within the bridge: +set firewall bridge name br1-fwd default-action 'drop' + +### br2 - br2-fwd + # Requirement: Accept all DHCP discover packets +set firewall bridge name br2-fwd rule 10 description 'Accept DHCP discover' +set firewall bridge name br2-fwd rule 10 action 'accept' +set firewall bridge name br2-fwd rule 10 protocol 'udp' +set firewall bridge name br2-fwd rule 10 source port '68' +set firewall bridge name br2-fwd rule 10 destination port '67' +set firewall bridge name br2-fwd rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff' + # Requirement: Accept only DHCP offers from valid server on port eth6 +set firewall bridge name br2-fwd rule 20 description 'Accept DHCP offers from trusted interface' +set firewall bridge name br2-fwd rule 20 action 'accept' +set firewall bridge name br2-fwd rule 20 protocol 'udp' +set firewall bridge name br2-fwd rule 20 source port '67' +set firewall bridge name br2-fwd rule 20 destination port '68' +set firewall bridge name br2-fwd rule 20 inbound-interface name 'eth6' +set firewall bridge name br2-fwd rule 22 description 'Drop all other DHCP offers' +set firewall bridge name br2-fwd rule 22 action 'drop' +set firewall bridge name br2-fwd rule 22 protocol 'udp' +set firewall bridge name br2-fwd rule 22 source port '67' +set firewall bridge name br2-fwd rule 22 destination port '68' +set firewall bridge name br2-fwd rule 22 log + + # Accept all ARP packets +set firewall bridge name br2-fwd rule 30 description 'Accept ARP' +set firewall bridge name br2-fwd rule 30 action 'accept' +set firewall bridge name br2-fwd rule 30 ethernet-type 'arp' + # Accept all IPv4 connections +set firewall bridge name br2-fwd rule 40 description 'Accept ipv4' +set firewall bridge name br2-fwd rule 40 action 'accept' +set firewall bridge name br2-fwd rule 40 ethernet-type 'ipv4' + # Drop everything else +set firewall bridge name br2-fwd default-action 'drop' +``` + + +### IP firewall configuration + +Since some of the requirements listed above exceed the capabilities of the +bridge firewall, we need to use the IP firewall to implement them. +For bridge br1 and br2, we need to control the traffic that is going to the +router itself, to other local networks, and to the Internet. + +As a reminder, here's a link to the {doc}`firewall documentation +`, where you can find more information about +the packet flow for traffic that comes from bridge layer and should be analyzed +by the IP firewall. + +Access to the router itself is controlled by the base chain `input`, and +rules to accomplish all the requirements are: + +```none +# First of all, if not using global state policies, we need to define them: +set firewall ipv4 input filter rule 10 state 'established' +set firewall ipv4 input filter rule 10 state 'related' +set firewall ipv4 input filter rule 10 action 'accept' +set firewall ipv4 input filter rule 20 state 'invalid' +set firewall ipv4 input filter rule 20 action 'drop' + +# Input - br1 - Accept access to router itself +set firewall ipv4 input filter rule 110 description "Accept access from br1" +set firewall ipv4 input filter rule 110 action 'accept' +set firewall ipv4 input filter rule 110 inbound-interface group 'br1-ifaces' + +# Input - br2 - Deny access to the router +set firewall ipv4 input filter rule 120 description "Deny access from br2" +set firewall ipv4 input filter rule 120 action 'drop' +set firewall ipv4 input filter rule 120 inbound-interface group 'br2-ifaces' +``` + +And for traffic that is going to other local networks, and to he Internet, we +need to use the base chain `forward`. As in the bridge firewall, we are +going to use custom rulesets for each bridge, that would be used in the +`forward` chain. Those rulesets are `ip-br1-fwd` and `ip-br2-fwd`: + +```none +# First of all, if not using global state policies, we need to define them: +set firewall ipv4 forward filter rule 5 action 'accept' +set firewall ipv4 forward filter rule 5 state 'established' +set firewall ipv4 forward filter rule 5 state 'related' +set firewall ipv4 forward filter rule 10 action 'drop' +set firewall ipv4 forward filter rule 10 state 'invalid' + +# Forward - Catch all traffic for br1 +set firewall ipv4 forward filter rule 110 description 'br1 traffic' +set firewall ipv4 forward filter rule 110 action 'jump' +set firewall ipv4 forward filter rule 110 inbound-interface group 'br1-ifaces' +set firewall ipv4 forward filter rule 110 jump-target 'ip-br1-fwd' + +# Forward - Catch all traffic for br2 +set firewall ipv4 forward filter rule 120 description 'br2 traffic' +set firewall ipv4 forward filter rule 120 action 'jump' +set firewall ipv4 forward filter rule 120 inbound-interface group 'br2-ifaces' +set firewall ipv4 forward filter rule 120 jump-target 'ip-br2-fwd' + +# Forward - Default action drop: +set firewall ipv4 forward filter default-action 'drop' +``` + +And the content of the custom rulesets: + +```none +### br1 - ip-br1-fwd + # Requirement: Allow connections to internet +set firewall ipv4 name ip-br1-fwd rule 10 description 'br1 - allow internet access' +set firewall ipv4 name ip-br1-fwd rule 10 action 'accept' +set firewall ipv4 name ip-br1-fwd rule 10 outbound-interface name 'eth0' + # Requirement: Drop all other connections +set firewall ipv4 name ip-br1-fwd default-action 'drop' + +### br2 - ip-br2-fwd + # Requirement: Allow connections to internet +set firewall ipv4 name ip-br2-fwd rule 10 description 'br2 - allow internet access' +set firewall ipv4 name ip-br2-fwd rule 10 action 'accept' +set firewall ipv4 name ip-br2-fwd rule 10 outbound-interface name 'eth0' + # Requirement: Allow connections to br1 +set firewall ipv4 name ip-br2-fwd rule 20 description 'br2 - allow access to br1' +set firewall ipv4 name ip-br2-fwd rule 20 action 'accept' +set firewall ipv4 name ip-br2-fwd rule 20 outbound-interface group 'br1-ifaces' + # Requirement: Drop all other connections +set firewall ipv4 name ip-br2-fwd default-action 'drop' +``` + + +## Validation + +While testing the configuration, we can check logs in order to ensure that +we are accepting and/or blocking the correct traffic. + +For example, while a host tries to get an IP address from a DHCP server in +br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from +untrusted servers are dropped: + +```none +vyos@bridge:~$ show log firewall bridge +Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302 +Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 +Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 +``` + +And with operational mode commands, we can check rules matchers, actions, and +counters. + +Bridge firewall ruleset: + +```none +vyos@bri:~$ show firewall bridge +Rulesets bridge Information + +--------------------------------- +bridge Firewall "forward filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ----------------------------------------- +5 accept all 19 1916 ct state { established, related } accept +10 drop all 0 0 ct state invalid +110 jump all 2 208 iifname @I_br0-ifaces jump NAME_br0-fwd +120 jump all 10 670 iifname @I_br1-ifaces jump NAME_br1-fwd +130 jump all 12 3086 iifname @I_br2-ifaces jump NAME_br2-fwd +default drop all 0 0 + +--------------------------------- +bridge Firewall "name br0-fwd" + +Rule Action Protocol Packets Bytes +------- -------- ---------- --------- ------- +default accept all 2 208 + +--------------------------------- +bridge Firewall "name br0-pre" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ---------------------- +10 accept all 18 1872 ether type ip6 accept +default drop all 9 1476 + +--------------------------------- +bridge Firewall "name br1-fwd" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ---------------------------------------- +10 accept all 5 250 ether type arp accept +20 accept all 3 252 ct state new ip saddr 10.1.1.102 accept +default drop all 2 168 + +--------------------------------- +bridge Firewall "name br1-pre" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ---------------------------------------------------------------------------------------- +10 drop udp 3 1176 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 prefix "[bri-NAM-br1-pre-10-D]" +20 drop all 0 0 ether type ip6 +default accept all 58 4430 + +--------------------------------- +bridge Firewall "name br2-fwd" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- --------------------------------------------------------------- +10 accept udp 4 1312 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 accept +20 accept udp 2 656 udp sport 67 udp dport 68 iifname "eth6" accept +22 drop udp 1 322 udp sport 67 udp dport 68 prefix "[bri-NAM-br2-fwd-22-D]" +30 accept all 2 92 ether type arp accept +40 accept all 3 704 ether type ip accept +default drop all 0 0 + +--------------------------------- +bridge Firewall "name br2-pre" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- -------------- +10 drop all 7 728 ether type ip6 +default accept all 77 7548 + +--------------------------------- +bridge Firewall "prerouting filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ---------------------------------------- +10 jump all 27 3348 iifname @I_br0-ifaces jump NAME_br0-pre +20 jump all 61 5606 iifname @I_br1-ifaces jump NAME_br1-pre +30 jump all 84 8276 iifname @I_br2-ifaces jump NAME_br2-pre +default drop all 0 0 + +vyos@bridge:~$ +``` + +IPv4 firewall ruleset: + +```none +vyos@bridge:~$ show firewall ipv4 +Rulesets ipv4 Information + +--------------------------------- +ipv4 Firewall "forward filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ------------------------------------------- +5 accept all 76 6384 ct state { established, related } accept +10 drop all 0 0 ct state invalid +110 jump all 13 1092 iifname @I_br1-ifaces jump NAME_ip-br1-fwd +120 jump all 3 252 iifname @I_br2-ifaces jump NAME_ip-br2-fwd +default drop all 0 0 + +--------------------------------- +ipv4 Firewall "input filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ----------------------------------------- +10 accept all 0 0 ct state { established, related } accept +20 drop all 0 0 ct state invalid +110 accept all 10 720 iifname @I_br1-ifaces accept +120 drop all 26 2672 iifname @I_br2-ifaces +default accept all 3037 991621 + +--------------------------------- +ipv4 Firewall "name ip-br1-fwd" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ---------------------- +10 accept all 5 420 oifname "eth0" accept +default drop all 8 672 + +--------------------------------- +ipv4 Firewall "name ip-br2-fwd" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ----------------------------- +10 accept all 1 84 oifname "eth0" accept +20 accept all 2 168 oifname @I_br1-ifaces accept +default drop all 0 0 + +vyos@bridge:~$ +``` diff --git a/docs/configexamples/fwall-and-bridge.rst b/docs/configexamples/fwall-and-bridge.rst deleted file mode 100644 index 134dd6c0..00000000 --- a/docs/configexamples/fwall-and-bridge.rst +++ /dev/null @@ -1,502 +0,0 @@ -:lastproofread: 2024-09-11 - -########################### -Bridge and firewall example -########################### - -Scenario and requirements -^^^^^^^^^^^^^^^^^^^^^^^^^ - -This example shows how to configure a VyOS router with bridge interfaces and -firewall rules. - -Three non VLAN-aware bridges are going to be configured, and each one has its -own requirements. - -* Bridge br0: - * Isolated layer 2 bridge. - * Accept only IPv6 communication whithin the bridge. - -* Bridge br1: - * Drop all DHCP discover packets. - * Accept all ARP packets. - * Within the bridge, accept only new IPv4 connections from host 10.1.1.102 - * Drop all other IPv4 connections. - * Drop all IPv6 connections. - * Accept access to router itself. - * Allow connections to internet - * Drop connections to other LANs. - -* Bridge br2: - * Accept all DHCP discover packets. - * Accept only DHCP offers from valid server and|or trusted bridge port. - * Accept all ARP packets. - * Accept all IPv4 connections. - * Drop all IPv6 connections. - * Deny access to the router. - * Allow connections to internet. - * Allow connections to bridge br1. - -Configuration -^^^^^^^^^^^^^ - -Bridges and interfaces configuration -"""""""""""""""""""""""""""""""""""" - -First, we need to configure the interfaces and bridges: - -.. code-block:: none - - # Brige br0 - set interfaces bridge br0 description 'Isolated L2 bridge' - set interfaces bridge br0 member interface eth1 - set interfaces bridge br0 member interface eth2 - set interfaces ethernet eth1 description 'br0' - set interfaces ethernet eth2 description 'br0' - - # Bridge br1: - set interfaces bridge br1 address '10.1.1.1/24' - set interfaces bridge br1 description 'L3 bridge br1' - set interfaces bridge br1 member interface eth3 - set interfaces bridge br1 member interface eth4 - set interfaces ethernet eth3 description 'br1' - set interfaces ethernet eth4 description 'br1' - - # Bridge br2: - set interfaces bridge br2 address '10.2.2.1/24' - set interfaces bridge br2 description 'L3 bridge br2' - set interfaces bridge br2 member interface eth5 - set interfaces bridge br2 member interface eth6 - set interfaces bridge br2 member interface eth7 - set interfaces ethernet eth5 description 'br2 - Host' - set interfaces ethernet eth6 description 'br2 - Trusted DHCP Server' - set interfaces ethernet eth7 description 'br2' - -Bridge firewall configuration -""""""""""""""""""""""""""""" - -In this section, we are going to configure the firewall rules that will be used -in bridge firewall, and will control the traffic within each bridge. - -We are going to use custom firewall rulesets, one for each bridge that will -be used in ``prerouting``, and one for each bridge that will be used in the -``forward`` chain. - -Also, we are going to use firewall interface groups in order to simplify the -firewall configuration. - -So first, let's create the required firewall interface groups: - -.. code-block:: none - - # Bridge br0 interface-group: - set firewall group interface-group br0-ifaces interface 'br0' - set firewall group interface-group br0-ifaces interface 'eth1' - set firewall group interface-group br0-ifaces interface 'eth2' - - # Bridge br1 interface-group: - set firewall group interface-group br1-ifaces interface 'br1' - set firewall group interface-group br1-ifaces interface 'eth3' - set firewall group interface-group br1-ifaces interface 'eth4' - - # Bridge br2 interface-group: - set firewall group interface-group br2-ifaces interface 'br2' - set firewall group interface-group br2-ifaces interface 'eth5' - set firewall group interface-group br2-ifaces interface 'eth6' - set firewall group interface-group br2-ifaces interface 'eth7' - -As said before, we are going to create custom firewall rulesets for each -bridge, that will be used in the ``prerouting`` chain, in order to drop as much -unwanted traffic as early as possible. So, custom rulesets used in -``prerouting`` chain are going to be ``br0-pre``, ``br1-pre``, and ``br2-pre``: - -.. code-block:: none - - # Prerouting - Catch all traffic for br0 - set firewall bridge prerouting filter rule 10 action 'jump' - set firewall bridge prerouting filter rule 10 description 'br0 traffic' - set firewall bridge prerouting filter rule 10 inbound-interface group 'br0-ifaces' - set firewall bridge prerouting filter rule 10 jump-target 'br0-pre' - - # Prerouting - Catch all traffic for br1 - set firewall bridge prerouting filter rule 20 action 'jump' - set firewall bridge prerouting filter rule 20 description 'br1 traffic' - set firewall bridge prerouting filter rule 20 inbound-interface group 'br1-ifaces' - set firewall bridge prerouting filter rule 20 jump-target 'br1-pre' - - # Prerouting - Catch all traffic for br2 - set firewall bridge prerouting filter rule 30 action 'jump' - set firewall bridge prerouting filter rule 30 description 'br2 traffic' - set firewall bridge prerouting filter rule 30 inbound-interface group 'br2-ifaces' - set firewall bridge prerouting filter rule 30 jump-target 'br2-pre' - -And then create the custom rulesets: - -.. code-block:: none - - ### br0 - br0-pre - # Requirements: accept only IPv6 communication within the bridge - set firewall bridge name br0-pre rule 10 description 'Accept IPv6 traffic' - set firewall bridge name br0-pre rule 10 action 'accept' - set firewall bridge name br0-pre rule 10 ethernet-type 'ipv6' - # And drop everything else - set firewall bridge name br0-pre default-action 'drop' - - ### br1 - br1-pre - # Requirements: drop all DHCP discover packets - set firewall bridge name br1-pre rule 10 description 'Drop DHCP discover' - set firewall bridge name br1-pre rule 10 action 'drop' - set firewall bridge name br1-pre rule 10 protocol 'udp' - set firewall bridge name br1-pre rule 10 source port '68' - set firewall bridge name br1-pre rule 10 destination port '67' - set firewall bridge name br1-pre rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff' - set firewall bridge name br1-pre rule 10 log - # Requirement: drop all IPv6 connections - set firewall bridge name br1-pre rule 20 description 'Drop IPv6 traffic' - set firewall bridge name br1-pre rule 20 action 'drop' - set firewall bridge name br1-pre rule 20 ethernet-type 'ipv6' - # Accept everything else so it can be parsed later - set firewall bridge name br1-pre default-action 'accept' - - ### br2 - br2-pre - # Requirements: drop all IPv6 connections - set firewall bridge name br2-pre rule 10 description 'Drop IPv6 traffic' - set firewall bridge name br2-pre rule 10 action 'drop' - set firewall bridge name br2-pre rule 10 ethernet-type 'ipv6' - # Accept everything else so it can be parsed later - set firewall bridge name br2-pre default-action 'accept' - -Now, in the ``forward`` chain, we are going to define state policies, and -custom rulesets for each bridge that would be used in the ``forward`` chain. -These rulesets are ``br0-fwd``, ``br1-fwd``, and ``br2-fwd``: - -.. code-block:: none - - # Forward - State policies if not defined globally - set firewall bridge forward filter rule 5 action 'accept' - set firewall bridge forward filter rule 5 state 'established' - set firewall bridge forward filter rule 5 state 'related' - set firewall bridge forward filter rule 10 action 'drop' - set firewall bridge forward filter rule 10 state 'invalid' - - # Forward - Catch all traffic for br0 - set firewall bridge forward filter rule 110 description 'br0 traffic' - set firewall bridge forward filter rule 110 action 'jump' - set firewall bridge forward filter rule 110 inbound-interface group 'br0-ifaces' - set firewall bridge forward filter rule 110 jump-target 'br0-fwd' - - # Forward - Catch all traffic for br1 - set firewall bridge forward filter rule 120 description 'br1 traffic' - set firewall bridge forward filter rule 120 action 'jump' - set firewall bridge forward filter rule 120 inbound-interface group 'br1-ifaces' - set firewall bridge forward filter rule 120 jump-target 'br1-fwd' - - # Forward - Catch all traffic for br2 - set firewall bridge forward filter rule 130 description 'br2 traffic' - set firewall bridge forward filter rule 130 action 'jump' - set firewall bridge forward filter rule 130 inbound-interface group 'br2-ifaces' - set firewall bridge forward filter rule 130 jump-target 'br2-fwd' - - # Forward - Default action drop: - set firewall bridge forward filter default-action 'drop' - -And the content of the custom rulesets: - -.. code-block:: none - - ### br0 - br0-fwd - # Accept everything that wasn't dropped in prerouting - set firewall bridge name br0-fwd default-action 'accept' - - ### br1 - br1-fwd - # Requirement: Accept all ARP packets - set firewall bridge name br1-fwd rule 10 description 'Accept ARP' - set firewall bridge name br1-fwd rule 10 action 'accept' - set firewall bridge name br1-fwd rule 10 ethernet-type 'arp' - # Requirement: Accept only new IPv4 connections from host 10.1.1.102 - set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host' - set firewall bridge name br1-fwd rule 20 action 'accept' - set firewall bridge name br1-fwd rule 20 source address '10.1.1.102' - set firewall bridge name br1-fwd rule 20 state 'new' - # Drop everythin else within the bridge: - set firewall bridge name br1-fwd default-action 'drop' - - ### br2 - br2-fwd - # Requirement: Accept all DHCP discover packets - set firewall bridge name br2-fwd rule 10 description 'Accept DHCP discover' - set firewall bridge name br2-fwd rule 10 action 'accept' - set firewall bridge name br2-fwd rule 10 protocol 'udp' - set firewall bridge name br2-fwd rule 10 source port '68' - set firewall bridge name br2-fwd rule 10 destination port '67' - set firewall bridge name br2-fwd rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff' - # Requirement: Accept only DHCP offers from valid server on port eth6 - set firewall bridge name br2-fwd rule 20 description 'Accept DHCP offers from trusted interface' - set firewall bridge name br2-fwd rule 20 action 'accept' - set firewall bridge name br2-fwd rule 20 protocol 'udp' - set firewall bridge name br2-fwd rule 20 source port '67' - set firewall bridge name br2-fwd rule 20 destination port '68' - set firewall bridge name br2-fwd rule 20 inbound-interface name 'eth6' - set firewall bridge name br2-fwd rule 22 description 'Drop all other DHCP offers' - set firewall bridge name br2-fwd rule 22 action 'drop' - set firewall bridge name br2-fwd rule 22 protocol 'udp' - set firewall bridge name br2-fwd rule 22 source port '67' - set firewall bridge name br2-fwd rule 22 destination port '68' - set firewall bridge name br2-fwd rule 22 log - - # Accept all ARP packets - set firewall bridge name br2-fwd rule 30 description 'Accept ARP' - set firewall bridge name br2-fwd rule 30 action 'accept' - set firewall bridge name br2-fwd rule 30 ethernet-type 'arp' - # Accept all IPv4 connections - set firewall bridge name br2-fwd rule 40 description 'Accept ipv4' - set firewall bridge name br2-fwd rule 40 action 'accept' - set firewall bridge name br2-fwd rule 40 ethernet-type 'ipv4' - # Drop everything else - set firewall bridge name br2-fwd default-action 'drop' - - -IP firewall configuration -""""""""""""""""""""""""" - -Since some of the requirements listed above exceed the capabilities of the -bridge firewall, we need to use the IP firewall to implement them. -For bridge br1 and br2, we need to control the traffic that is going to the -router itself, to other local networks, and to the Internet. - -As a reminder, here's a link to the :doc:`firewall documentation -`, where you can find more information about -the packet flow for traffic that comes from bridge layer and should be analized -by the IP firewall. - -Access to the router itself is controlled by the base chain ``input``, and -rules to accomplish all the requirements are: - -.. code-block:: none - - # First of all, if not using global state policies, we need to define them: - set firewall ipv4 input filter rule 10 state 'established' - set firewall ipv4 input filter rule 10 state 'related' - set firewall ipv4 input filter rule 10 action 'accept' - set firewall ipv4 input filter rule 20 state 'invalid' - set firewall ipv4 input filter rule 20 action 'drop' - - # Input - br1 - Accept access to router itself - set firewall ipv4 input filter rule 110 description "Accept access from br1" - set firewall ipv4 input filter rule 110 action 'accept' - set firewall ipv4 input filter rule 110 inbound-interface group 'br1-ifaces' - - # Input - br2 - Deny access to the router - set firewall ipv4 input filter rule 120 description "Deny access from br2" - set firewall ipv4 input filter rule 120 action 'drop' - set firewall ipv4 input filter rule 120 inbound-interface group 'br2-ifaces' - -And for traffic that is going to other local networks, and to he Internet, we -need to use the base chain ``forward``. As in the bridge firewall, we are -going to use custom rulesets for each bridge, that would be used in the -``forward`` chain. Those rulesets are ``ip-br1-fwd`` and ``ip-br2-fwd``: - -.. code-block:: none - - # First of all, if not using global state policies, we need to define them: - set firewall ipv4 forward filter rule 5 action 'accept' - set firewall ipv4 forward filter rule 5 state 'established' - set firewall ipv4 forward filter rule 5 state 'related' - set firewall ipv4 forward filter rule 10 action 'drop' - set firewall ipv4 forward filter rule 10 state 'invalid' - - # Forward - Catch all traffic for br1 - set firewall ipv4 forward filter rule 110 description 'br1 traffic' - set firewall ipv4 forward filter rule 110 action 'jump' - set firewall ipv4 forward filter rule 110 inbound-interface group 'br1-ifaces' - set firewall ipv4 forward filter rule 110 jump-target 'ip-br1-fwd' - - # Forward - Catch all traffic for br2 - set firewall ipv4 forward filter rule 120 description 'br2 traffic' - set firewall ipv4 forward filter rule 120 action 'jump' - set firewall ipv4 forward filter rule 120 inbound-interface group 'br2-ifaces' - set firewall ipv4 forward filter rule 120 jump-target 'ip-br2-fwd' - - # Forward - Default action drop: - set firewall ipv4 forward filter default-action 'drop' - -And the content of the custom rulesets: - -.. code-block:: none - - ### br1 - ip-br1-fwd - # Requirement: Allow connections to internet - set firewall ipv4 name ip-br1-fwd rule 10 description 'br1 - allow internet access' - set firewall ipv4 name ip-br1-fwd rule 10 action 'accept' - set firewall ipv4 name ip-br1-fwd rule 10 outbound-interface name 'eth0' - # Requirement: Drop all other connections - set firewall ipv4 name ip-br1-fwd default-action 'drop' - - ### br2 - ip-br2-fwd - # Requirement: Allow connections to internet - set firewall ipv4 name ip-br2-fwd rule 10 description 'br2 - allow internet access' - set firewall ipv4 name ip-br2-fwd rule 10 action 'accept' - set firewall ipv4 name ip-br2-fwd rule 10 outbound-interface name 'eth0' - # Requirement: Allow connections to br1 - set firewall ipv4 name ip-br2-fwd rule 20 description 'br2 - allow access to br1' - set firewall ipv4 name ip-br2-fwd rule 20 action 'accept' - set firewall ipv4 name ip-br2-fwd rule 20 outbound-interface group 'br1-ifaces' - # Requirement: Drop all other connections - set firewall ipv4 name ip-br2-fwd default-action 'drop' - - -Validation -^^^^^^^^^^ - -While testing the configuration, we can check logs in order to ensure that -we are accepting and/or blocking the correct traffic. - -For example, while a host tries to get an IP address from a DHCP server in -br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from -untrusted servers are dropped: - -.. stop_vyoslinter - -.. code-block:: none - - vyos@bridge:~$ show log firewall bridge - Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302 - Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 - Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 - -.. start_vyoslinter - - -And with operational mode commands, we can check rules matchers, actions, and -counters. - -Bridge firewall rulset: - -.. code-block:: none - - vyos@bri:~$ show firewall bridge - Rulesets bridge Information - - --------------------------------- - bridge Firewall "forward filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ----------------------------------------- - 5 accept all 19 1916 ct state { established, related } accept - 10 drop all 0 0 ct state invalid - 110 jump all 2 208 iifname @I_br0-ifaces jump NAME_br0-fwd - 120 jump all 10 670 iifname @I_br1-ifaces jump NAME_br1-fwd - 130 jump all 12 3086 iifname @I_br2-ifaces jump NAME_br2-fwd - default drop all 0 0 - - --------------------------------- - bridge Firewall "name br0-fwd" - - Rule Action Protocol Packets Bytes - ------- -------- ---------- --------- ------- - default accept all 2 208 - - --------------------------------- - bridge Firewall "name br0-pre" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------- - 10 accept all 18 1872 ether type ip6 accept - default drop all 9 1476 - - --------------------------------- - bridge Firewall "name br1-fwd" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------------------------- - 10 accept all 5 250 ether type arp accept - 20 accept all 3 252 ct state new ip saddr 10.1.1.102 accept - default drop all 2 168 - - --------------------------------- - bridge Firewall "name br1-pre" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------------------------------------------------------------------------- - 10 drop udp 3 1176 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 prefix "[bri-NAM-br1-pre-10-D]" - 20 drop all 0 0 ether type ip6 - default accept all 58 4430 - - --------------------------------- - bridge Firewall "name br2-fwd" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- --------------------------------------------------------------- - 10 accept udp 4 1312 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 accept - 20 accept udp 2 656 udp sport 67 udp dport 68 iifname "eth6" accept - 22 drop udp 1 322 udp sport 67 udp dport 68 prefix "[bri-NAM-br2-fwd-22-D]" - 30 accept all 2 92 ether type arp accept - 40 accept all 3 704 ether type ip accept - default drop all 0 0 - - --------------------------------- - bridge Firewall "name br2-pre" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- -------------- - 10 drop all 7 728 ether type ip6 - default accept all 77 7548 - - --------------------------------- - bridge Firewall "prerouting filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------------------------- - 10 jump all 27 3348 iifname @I_br0-ifaces jump NAME_br0-pre - 20 jump all 61 5606 iifname @I_br1-ifaces jump NAME_br1-pre - 30 jump all 84 8276 iifname @I_br2-ifaces jump NAME_br2-pre - default drop all 0 0 - - vyos@bridge:~$ - -IPv4 firewall rulset: - -.. code-block:: none - - vyos@bridge:~$ show firewall ipv4 - Rulesets ipv4 Information - - --------------------------------- - ipv4 Firewall "forward filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ------------------------------------------- - 5 accept all 76 6384 ct state { established, related } accept - 10 drop all 0 0 ct state invalid - 110 jump all 13 1092 iifname @I_br1-ifaces jump NAME_ip-br1-fwd - 120 jump all 3 252 iifname @I_br2-ifaces jump NAME_ip-br2-fwd - default drop all 0 0 - - --------------------------------- - ipv4 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ----------------------------------------- - 10 accept all 0 0 ct state { established, related } accept - 20 drop all 0 0 ct state invalid - 110 accept all 10 720 iifname @I_br1-ifaces accept - 120 drop all 26 2672 iifname @I_br2-ifaces - default accept all 3037 991621 - - --------------------------------- - ipv4 Firewall "name ip-br1-fwd" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------- - 10 accept all 5 420 oifname "eth0" accept - default drop all 8 672 - - --------------------------------- - ipv4 Firewall "name ip-br2-fwd" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ----------------------------- - 10 accept all 1 84 oifname "eth0" accept - 20 accept all 2 168 oifname @I_br1-ifaces accept - default drop all 0 0 - - vyos@bridge:~$ diff --git a/docs/configexamples/fwall-and-vrf.md b/docs/configexamples/fwall-and-vrf.md new file mode 100644 index 00000000..da9949db --- /dev/null +++ b/docs/configexamples/fwall-and-vrf.md @@ -0,0 +1,121 @@ +# VRF and firewall example + +## Scenario and requirements + +This example shows how to configure a VyOS router with VRFs and firewall rules. + +Diagram used in this example: + +```{image} /_static/images/firewall-and-vrf-blueprints.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +As exposed in the diagram, there are four VRFs. These VRFs are `MGMT`, +`WAN`, `LAN` and `PROD`, and their requirements are: + +```{eval-rst} +* VRF MGMT: + * Allow connections to LAN and PROD. + * Deny connections to internet(WAN). + * Allow connections to the router. +* VRF LAN: + * Allow connections to PROD. + * Allow connections to internet(WAN). +* VRF PROD: + * Only accepts connections. +* VRF WAN: + * Allow connection to PROD. +``` + +## Configuration + +First, we need to configure the interfaces and VRFs: + +```none +set interfaces ethernet eth1 address '10.100.100.1/24' +set interfaces ethernet eth1 vrf 'MGMT' +set interfaces ethernet eth2 vif 150 address '10.150.150.1/24' +set interfaces ethernet eth2 vif 150 vrf 'LAN' +set interfaces ethernet eth2 vif 160 address '10.160.160.1/24' +set interfaces ethernet eth2 vif 160 vrf 'LAN' +set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24' +set interfaces ethernet eth2 vif 3500 vrf 'PROD' +set interfaces loopback lo +set interfaces pppoe pppoe0 authentication password 'p4ssw0rd' +set interfaces pppoe pppoe0 authentication username 'vyos' +set interfaces pppoe pppoe0 source-interface 'eth0' +set interfaces pppoe pppoe0 vrf 'WAN' +set vrf bind-to-all +set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' +set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' +set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' +set vrf name LAN table '103' +set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' +set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' +set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' +set vrf name MGMT table '102' +set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' +set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' +set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' +set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' +set vrf name PROD table '104' +set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' +set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' +set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' +set vrf name WAN table '101' +``` + +And before firewall rules are shown, we need to pay attention how to configure +and match interfaces and VRFs. In case where an interface is assigned to a +non-default VRF, if we want to use inbound-interface or outbound-interface in +firewall rules, we need to: + +- For **inbound-interface**: use the interface name with the VRF name, like + `MGMT` or `LAN`. +- For **outbound-interface**: use the interface name, like `eth0`, `vtun0`, + `eth2*` or similar. + +Next, we need to configure the firewall rules. First we will define all rules +for transit traffic between VRFs. + +```none +set firewall ipv4 forward filter default-action 'drop' +set firewall ipv4 forward filter default-log +set firewall ipv4 forward filter rule 10 action 'accept' +set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD' +set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT' +set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*' +set firewall ipv4 forward filter rule 99 action 'drop' +set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt' +set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1' +set firewall ipv4 forward filter rule 120 action 'accept' +set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD' +set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN' +set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500' +set firewall ipv4 forward filter rule 130 action 'accept' +set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet' +set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN' +set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0' +``` + +Also, we are adding global state policies, in order to allow established and +related traffic, in order not to drop valid responses: + +```none +set firewall global-options state-policy established action 'accept' +set firewall global-options state-policy invalid action 'drop' +set firewall global-options state-policy related action 'accept' +``` + +And finally, we need to allow input connections to the router itself only from +vrf MGMT: + +```none +set firewall ipv4 input filter default-action 'drop' +set firewall ipv4 input filter default-log +set firewall ipv4 input filter rule 10 action 'accept' +set firewall ipv4 input filter rule 10 description 'MGMT - Allow input' +set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT' +``` diff --git a/docs/configexamples/fwall-and-vrf.rst b/docs/configexamples/fwall-and-vrf.rst deleted file mode 100644 index bd97e1ad..00000000 --- a/docs/configexamples/fwall-and-vrf.rst +++ /dev/null @@ -1,122 +0,0 @@ -######################## -VRF and firewall example -######################## - -Scenario and requirements -^^^^^^^^^^^^^^^^^^^^^^^^^ - -This example shows how to configure a VyOS router with VRFs and firewall rules. - -Diagram used in this example: - -.. image:: /_static/images/firewall-and-vrf-blueprints.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -As exposed in the diagram, there are four VRFs. These VRFs are ``MGMT``, -``WAN``, ``LAN`` and ``PROD``, and their requirements are: - -* VRF MGMT: - * Allow connections to LAN and PROD. - * Deny connections to internet(WAN). - * Allow connections to the router. -* VRF LAN: - * Allow connections to PROD. - * Allow connections to internet(WAN). -* VRF PROD: - * Only accepts connections. -* VRF WAN: - * Allow connection to PROD. - -Configuration -^^^^^^^^^^^^^ - -First, we need to configure the interfaces and VRFs: - -.. code-block:: none - - set interfaces ethernet eth1 address '10.100.100.1/24' - set interfaces ethernet eth1 vrf 'MGMT' - set interfaces ethernet eth2 vif 150 address '10.150.150.1/24' - set interfaces ethernet eth2 vif 150 vrf 'LAN' - set interfaces ethernet eth2 vif 160 address '10.160.160.1/24' - set interfaces ethernet eth2 vif 160 vrf 'LAN' - set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24' - set interfaces ethernet eth2 vif 3500 vrf 'PROD' - set interfaces loopback lo - set interfaces pppoe pppoe0 authentication password 'p4ssw0rd' - set interfaces pppoe pppoe0 authentication username 'vyos' - set interfaces pppoe pppoe0 source-interface 'eth0' - set interfaces pppoe pppoe0 vrf 'WAN' - set vrf bind-to-all - set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' - set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' - set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' - set vrf name LAN table '103' - set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' - set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' - set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' - set vrf name MGMT table '102' - set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' - set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' - set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' - set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' - set vrf name PROD table '104' - set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' - set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' - set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' - set vrf name WAN table '101' - -And before firewall rules are shown, we need to pay attention how to configure -and match interfaces and VRFs. In case where an interface is assigned to a -non-default VRF, if we want to use inbound-interface or outbound-interface in -firewall rules, we need to: - -* For **inbound-interface**: use the interface name with the VRF name, like - ``MGMT`` or ``LAN``. -* For **outbound-interface**: use the interface name, like ``eth0``, ``vtun0``, - ``eth2*`` or similar. - -Next, we need to configure the firewall rules. First we will define all rules -for transit traffic between VRFs. - -.. code-block:: none - - set firewall ipv4 forward filter default-action 'drop' - set firewall ipv4 forward filter default-log - set firewall ipv4 forward filter rule 10 action 'accept' - set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD' - set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT' - set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*' - set firewall ipv4 forward filter rule 99 action 'drop' - set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt' - set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1' - set firewall ipv4 forward filter rule 120 action 'accept' - set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD' - set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN' - set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500' - set firewall ipv4 forward filter rule 130 action 'accept' - set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet' - set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN' - set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0' - -Also, we are adding global state policies, in order to allow established and -related traffic, in order not to drop valid responses: - -.. code-block:: none - - set firewall global-options state-policy established action 'accept' - set firewall global-options state-policy invalid action 'drop' - set firewall global-options state-policy related action 'accept' - -And finally, we need to allow input connections to the router itself only from -vrf MGMT: - -.. code-block:: none - - set firewall ipv4 input filter default-action 'drop' - set firewall ipv4 input filter default-log - set firewall ipv4 input filter rule 10 action 'accept' - set firewall ipv4 input filter rule 10 description 'MGMT - Allow input' - set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT' \ No newline at end of file diff --git a/docs/configexamples/ha.md b/docs/configexamples/ha.md new file mode 100644 index 00000000..c3fd4f84 --- /dev/null +++ b/docs/configexamples/ha.md @@ -0,0 +1,556 @@ +--- +lastproofread: '2021-06-28' +--- + +(example-high-availability)= + +# High Availability Walkthrough + +This document walks you through a complete HA setup of two VyOS machines. This +design is based on a VM as the primary router and a physical machine as a +backup, using VRRP, BGP, OSPF, and conntrack sharing. + +This document aims to walk you through setting everything up, so +at a point where you can reboot any machine and not lose more than a few +seconds worth of connectivity. + +## Design + +This is based on a real-life production design. One of the complex issues +is ensuring you have redundant data INTO your network. We do this with a pair +of Cisco Nexus switches and using Virtual PortChannels that are spanned across +them. As a bonus, this also allows for complete switch failure without +an outage. How you achieve this yourself is left as an exercise to the reader. +But our setup is documented here. + +### Walkthrough suggestion + +The `commit` command is implied after every section. If you make an error, +`commit` will warn you and you can fix it before getting too far into things. +Please ensure you commit early and commit often. + +If you are following through this document, it is strongly suggested you +complete the entire document, ONLY doing the virtual router1 steps, and then +come back and walk through it AGAIN on the backup hardware router. + +This ensures you don't go too fast or miss a step. However, it will make your +life easier to configure the fixed IP address and default route now on the +hardware router. + +### Example Network + +In this document, we have been allocated 203.0.113.0/24 by our upstream +provider, which we are publishing on VLAN100. + +They want us to establish a BGP session to their routers on 192.0.2.11 and +192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and +we are AS 65551. + +Our routers are going to have a floating IP address of 203.0.113.1, and use +.2 and .3 as their fixed IPs. + +We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201. + +When traffic is originated from the 10.200.201.0/24 network, it will be +masqueraded to 203.0.113.1 + +For connection between sites, we are running a WireGuard link to two REMOTE +routers and using OSPF over those links to distribute routes. That remote +site is expected to send traffic from anything in 10.201.0.0/16 + +### VLANs + +These are the vlans we will be using: + +- 50: Upstream, using the 192.0.2.0/24 network allocated by them. +- 100: 'Public' network, using our 203.0.113.0/24 network. +- 201: 'Internal' network, using 10.200.201.0/24 + +### Hardware + +- switch1 (Nexus 10gb Switch) +- switch2 (Nexus 10gb Switch) +- compute1 (VMware ESXi 6.5) +- compute2 (VMware ESXi 6.5) +- compute3 (VMware ESXi 6.5) +- router2 (Random 1RU machine with 4 NICs) + +Note that router1 is a VM that runs on one of the compute nodes. + +### Network Cabling + +- From Datacenter - This connects into port 1 on both switches, and is tagged + as VLAN 50 +- Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch +- Hardware Router - Port 8 of each switch +- compute1 - Port 9 of each switch +- compute2 - Port 10 of each switch +- compute3 - Port 11 of each switch + +This is ignoring the extra Out-of-band management networking, which should be +on totally different switches, and a different feed into the rack, and is out +of scope of this. + +:::{note} +Our implementation uses VMware's Distributed Port Groups, which allows +VMware to use LACP. This is a part of the ENTERPRISE licence, and is not +available on a free licence. If you are implementing this and do not have +access to DPGs, you should not use VMware, and use some other virtualization +platform instead. +::: + +## Basic Setup (via console) + +Create your router1 VM. So it can withstand a VM Host failing or a +network link failing. Using VMware, this is achieved by enabling vSphere DRS, +vSphere Availability, and creating a Distributed Port Group that uses LACP. + +Many other Hypervisors do this, and I'm hoping that this document will be +expanded to document how to do this for others. + +Create an 'All VLANs' network group, that passes all trunked traffic through +to the VM. Attach this network group to router1 as eth0. + +:::{note} +VMware: You must DISABLE SECURITY on this Port group. Make sure that +`Promiscuous Mode`, `MAC address changes` and `Forged transmits` are +enabled. All of these will be done as part of failover. +::: + +### Bonding on Hardware Router + +Create a LACP bond on the hardware router. We are assuming that eth0 and eth1 +are connected to port 8 on both switches, and that those ports are configured +as a Port-Channel. + +```none +set interfaces bonding bond0 description 'Switch Port-Channel' +set interfaces bonding bond0 hash-policy 'layer2' +set interfaces bonding bond0 member interface 'eth0' +set interfaces bonding bond0 member interface 'eth1' +set interfaces bonding bond0 mode '802.3ad' +``` + + +### Assign external IP addresses + +VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this +is talking directly to upstream. Create our IP address on vlan50. + +For the hardware router, replace `eth0` with `bond0`. As (almost) every +command is identical, this will not be specified unless different things need +to be performed on different hosts. + +```none +set interfaces ethernet eth0 vif 50 address '192.0.2.21/24' +``` + +In this case, the hardware router has a different IP, so it would be + +```none +set interfaces ethernet bond0 vif 50 address '192.0.2.22/24' +``` + + +### Add (temporary) default route + +It is assumed that the routers provided by upstream are capable of acting as a +default router, add that as a static route. + +```none +set protocols static route 0.0.0.0/0 next-hop 192.0.2.11 +commit +save +``` + + +### Enable SSH + +Enable SSH so you can now SSH into the routers, rather than using the console. + +```none +set service ssh +commit +save +``` + +At this point, you should be able to SSH into both of them, and will no longer +need access to the console (unless you break something!) + +## VRRP Configuration + +We are setting up VRRP so that it does NOT fail back when a machine returns into +service, and it prioritizes router1 over router2. + +### Internal Network + +This has a floating IP address of 10.200.201.1/24, using virtual router ID 201. +The difference between them is the interface name, hello-source-address, and +peer-address. + +**router1** + +```none +set interfaces ethernet eth0 vif 201 address 10.200.201.2/24 +set high-availability vrrp group int hello-source-address '10.200.201.2' +set high-availability vrrp group int interface 'eth0.201' +set high-availability vrrp group int peer-address '10.200.201.3' +set high-availability vrrp group int no-preempt +set high-availability vrrp group int priority '200' +set high-availability vrrp group int address '10.200.201.1/24' +set high-availability vrrp group int vrid '201' +``` + +**router2** + +```none +set interfaces ethernet bond0 vif 201 address 10.200.201.3/24 +set high-availability vrrp group int hello-source-address '10.200.201.3' +set high-availability vrrp group int interface 'bond0.201' +set high-availability vrrp group int peer-address '10.200.201.2' +set high-availability vrrp group int no-preempt +set high-availability vrrp group int priority '100' +set high-availability vrrp group int address '10.200.201.1/24' +set high-availability vrrp group int vrid '201' +``` + + +### Public Network + +This has a floating IP address of 203.0.113.1/24, using virtual router ID 113. +The virtual router ID is just a random number between 1 and 254, and can be set +to whatever you want. Best practices suggest you try to keep them unique +enterprise-wide. + +**router1** + +```none +set interfaces ethernet eth0 vif 100 address 203.0.113.2/24 +set high-availability vrrp group public hello-source-address '203.0.113.2' +set high-availability vrrp group public interface 'eth0.100' +set high-availability vrrp group public peer-address '203.0.113.3' +set high-availability vrrp group public no-preempt +set high-availability vrrp group public priority '200' +set high-availability vrrp group public address '203.0.113.1/24' +set high-availability vrrp group public vrid '113' +``` + +**router2** + +```none +set interfaces ethernet bond0 vif 100 address 203.0.113.3/24 +set high-availability vrrp group public hello-source-address '203.0.113.3' +set high-availability vrrp group public interface 'bond0.100' +set high-availability vrrp group public peer-address '203.0.113.2' +set high-availability vrrp group public no-preempt +set high-availability vrrp group public priority '100' +set high-availability vrrp group public address '203.0.113.1/24' +set high-availability vrrp group public vrid '113' +``` + + +### Create VRRP sync-group + +The sync group is used to replicate connection tracking. It needs to be assigned +to a random VRRP group, and we are creating a sync group called `sync` using +the vrrp group `int`. + +```none +set high-availability vrrp sync-group sync member 'int' +``` + + +### Testing + +At this point, you should be able to see both IP addresses when you run +`show interfaces`, and `show vrrp` should show both interfaces in MASTER +state (and SLAVE state on router2). + +```none +vyos@router1:~$ show vrrp +Name Interface VRID State Last Transition +-------- ----------- ------ ------- ----------------- +int eth0.201 201 MASTER 100s +public eth0.100 113 MASTER 200s +vyos@router1:~$ +``` + +You should be able to ping to and from all the IPs you have allocated. + +## NAT and conntrack-sync + +Masquerade Traffic originating from 10.200.201.0/24 that is heading out the +public interface. + +:::{note} +We explicitly exclude the primary upstream network so that BGP or +OSPF traffic doesn't accidentally get NAT'ed. +::: + +```none +set nat source rule 10 destination address '!192.0.2.0/24' +set nat source rule 10 outbound-interface name 'eth0.50' +set nat source rule 10 source address '10.200.201.0/24' +set nat source rule 10 translation address '203.0.113.1' +``` + + +### Configure conntrack-sync and enable helpers + +Conntrack helper modules are enabled by default, but they tend to cause more +problems than they're worth in complex networks. You can disable all of them +at one go. + +```none +delete system conntrack modules +``` + +Now enable replication between nodes. Replace eth0.201 with bond0.201 on the +hardware router. + +```none +set service conntrack-sync accept-protocol 'tcp,udp,icmp' +set service conntrack-sync event-listen-queue-size '8' +set service conntrack-sync failover-mechanism vrrp sync-group 'sync' +set service conntrack-sync interface eth0.201 +set service conntrack-sync mcast-group '224.0.0.50' +set service conntrack-sync sync-queue-size '8' +``` + +(ha-contracktesting)= + +### Testing + +The simplest way to test is to look at the connection tracking stats on the +standby hardware router with the command `show conntrack-sync statistics`. +The numbers should be very close to the numbers on the primary router. + +When you have both routers up, you should be able to establish a connection +from a NAT'ed machine out to the internet, reboot the active machine, and that +connection should be preserved, and will not drop out. + +## OSPF Over WireGuard + +Wireguard doesn't have the concept of an up or down link, due to its design. +This complicates AND simplifies using it for network transport, as for reliable +state detection you need to use SOMETHING to detect when the link is down. + +If you use a routing protocol itself, you solve two problems at once. This is +only a basic example, and is provided as a starting point. + +### Configure Wireguard + +There is plenty of instructions and documentation on setting up Wireguard. The +only important thing you need to remember is to only use one WireGuard +interface per OSPF connection. + +We use small /30's from 10.254.60/24 for the point-to-point links. + +**router1** + +Replace the 203.0.113.3 with whatever the other router's IP address is. + +```none +set interfaces wireguard wg01 address '10.254.60.1/30' +set interfaces wireguard wg01 description 'router1-to-offsite1' +set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001' +set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' +set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' +set interfaces wireguard wg01 port '50001' +set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' +set protocols ospf interface wg01 cost '11' +set protocols ospf interface wg01 dead-interval '5' +set protocols ospf interface wg01 hello-interval '1' +set protocols ospf interface wg01 network 'point-to-point' +set protocols ospf interface wg01 priority '1' +set protocols ospf interface wg01 retransmit-interval '5' +set protocols ospf interface wg01 transmit-delay '1' +``` + +**offsite1** + +This is connecting back to the STATIC IP of router1, not the floating. + +```none +set interfaces wireguard wg01 address '10.254.60.2/30' +set interfaces wireguard wg01 description 'offsite1-to-router1' +set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001' +set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15' +set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=' +set interfaces wireguard wg01 port '50001' +set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' +set protocols ospf interface wg01 cost '11' +set protocols ospf interface wg01 dead-interval '5' +set protocols ospf interface wg01 hello-interval '1' +set protocols ospf interface wg01 network 'point-to-point' +set protocols ospf interface wg01 priority '1' +set protocols ospf interface wg01 retransmit-interval '5' +set protocols ospf interface wg01 transmit-delay '1' +``` + + +### Test WireGuard + +Make sure you can ping 10.254.60.1 and .2 from both routers. + +### Create Export Filter + +We only want to export the networks we know. Always do a whitelist on your route +filters, both importing and exporting. A good rule of thumb is +**'If you are not the default router for a network, don't advertise +it'**. This means we explicitly do not want to advertise the 192.0.2.0/24 +network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE +the default route for). This filter is applied to `redistribute connected`. +If we WERE to advertise it, the remote machines would see 192.0.2.21 available +via their default route, establish the connection, and then OSPF would say +'192.0.2.0/24 is available via this tunnel', at which point the tunnel would +break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via +default again. This is called 'flapping'. + +```none +set policy access-list 150 description 'Outbound OSPF Redistribution' +set policy access-list 150 rule 10 action 'permit' +set policy access-list 150 rule 10 destination any +set policy access-list 150 rule 10 source inverse-mask '0.0.0.255' +set policy access-list 150 rule 10 source network '10.200.201.0' +set policy access-list 150 rule 20 action 'permit' +set policy access-list 150 rule 20 destination any +set policy access-list 150 rule 20 source inverse-mask '0.0.0.255' +set policy access-list 150 rule 20 source network '203.0.113.0' +set policy access-list 150 rule 100 action 'deny' +set policy access-list 150 rule 100 destination any +set policy access-list 150 rule 100 source any +``` + + +### Create Import Filter + +We only want to import networks we know. Our OSPF peer should only be +advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE +MATCH. You deny in access-list 100 to accept the route. + +```none +set policy access-list 100 description 'Inbound OSPF Routes from Peers' +set policy access-list 100 rule 10 action 'deny' +set policy access-list 100 rule 10 destination any +set policy access-list 100 rule 10 source inverse-mask '0.0.255.255' +set policy access-list 100 rule 10 source network '10.201.0.0' +set policy access-list 100 rule 100 action 'permit' +set policy access-list 100 rule 100 destination any +set policy access-list 100 rule 100 source any +set policy route-map PUBOSPF rule 100 action 'deny' +set policy route-map PUBOSPF rule 100 match ip address access-list '100' +set policy route-map PUBOSPF rule 500 action 'permit' +``` + + +### Enable OSPF + +Every router **must** have a unique router-id. +The 'reference-bandwidth' is used because when OSPF was originally designed, +the idea of a link faster than 1gbit was unheard of, and it does not scale +correctly. + +```none +set protocols ospf area 0.0.0.0 authentication 'md5' +set protocols ospf area 0.0.0.0 network '10.254.60.0/24' +set protocols ospf auto-cost reference-bandwidth '10000' +set protocols ospf log-adjacency-changes +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.254.60.2' +set system ip protocol ospf route-map PUBOSPF +``` + + +### Test OSPF + +When you have enabled OSPF on both routers, you should be able to see each +other with the command `show ip ospf neighbour`. The state must be 'Full' +or '2-Way'. If it is not, then there is a network connectivity issue between the +hosts. This is often caused by NAT or MTU issues. You should not see any new +routes (unless this is the second pass) in the output of `show ip route` + +## Advertise connected routes + +As a reminder, only advertise routes that you are the default router for. This +is why we are NOT announcing the 192.0.2.0/24 network, because if that was +announced into OSPF, the other routers would try to connect to that network +over a tunnel that connects to that network! + +```none +set protocols ospf access-list 150 export 'connected' +set protocols ospf redistribute connected +``` + +You should now be able to see the advertised network on the other host. + +### Duplicate configuration + +At this point, you now need to create the X link between all four routers. +Use a different /30 for each link. + +### Priorities + +Set the cost on the secondary links to be 200. This means that they will not +be used unless the primary links are down. + +```none +set protocols ospf interface wg01 cost '10' +set protocols ospf interface wg01 cost '200' +``` + +This will be visible in 'show ip route'. + +## BGP + +BGP is an extremely complex network protocol. An example is provided here. + +:::{note} +Router id's must be unique. +::: + +**router1** + +The `redistribute ospf` command is there purely as an example of how this can +be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as +it is not 203.0.113.0/24. + +```none +set policy prefix-list BGPOUT description 'BGP Export List' +set policy prefix-list BGPOUT rule 10 action 'deny' +set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' +set policy prefix-list BGPOUT rule 10 ge '25' +set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' +set policy prefix-list BGPOUT rule 100 action 'permit' +set policy prefix-list BGPOUT rule 100 description 'Our network' +set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' +set policy prefix-list BGPOUT rule 10000 action 'deny' +set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' + +set policy route-map BGPOUT description 'BGP Export Filter' +set policy route-map BGPOUT rule 10 action 'permit' +set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT' +set policy route-map BGPOUT rule 10000 action 'deny' +set policy route-map BGPPREPENDOUT description 'BGP Export Filter' +set policy route-map BGPPREPENDOUT rule 10 action 'permit' +set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' +set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT' +set policy route-map BGPPREPENDOUT rule 10000 action 'deny' + +set protocols bgp system-as 65551 +set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 +set protocols bgp address-family ipv4-unicast redistribute connected metric '50' +set protocols bgp address-family ipv4-unicast redistribute ospf metric '50' +set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT' +set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound +set protocols bgp neighbor 192.0.2.11 remote-as '65550' +set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21' +set protocols bgp parameters router-id '192.0.2.21' +``` + +**router2** + +This is identical, but you use the BGPPREPENDOUT route-map to advertise the +route with a longer path. diff --git a/docs/configexamples/ha.rst b/docs/configexamples/ha.rst deleted file mode 100644 index 2f7bd4a4..00000000 --- a/docs/configexamples/ha.rst +++ /dev/null @@ -1,584 +0,0 @@ -:lastproofread: 2021-06-28 - -.. _example-high-availability: - -############################# -High Availability Walkthrough -############################# - -This document walks you through a complete HA setup of two VyOS machines. This -design is based on a VM as the primary router and a physical machine as a -backup, using VRRP, BGP, OSPF, and conntrack sharing. - -This document aims to walk you through setting everything up, so -at a point where you can reboot any machine and not lose more than a few -seconds worth of connectivity. - -Design -====== - -This is based on a real-life production design. One of the complex issues -is ensuring you have redundant data INTO your network. We do this with a pair -of Cisco Nexus switches and using Virtual PortChannels that are spanned across -them. As a bonus, this also allows for complete switch failure without -an outage. How you achieve this yourself is left as an exercise to the reader. -But our setup is documented here. - -Walkthrough suggestion ----------------------- - -The ``commit`` command is implied after every section. If you make an error, -``commit`` will warn you and you can fix it before getting too far into things. -Please ensure you commit early and commit often. - -If you are following through this document, it is strongly suggested you -complete the entire document, ONLY doing the virtual router1 steps, and then -come back and walk through it AGAIN on the backup hardware router. - -This ensures you don't go too fast or miss a step. However, it will make your -life easier to configure the fixed IP address and default route now on the -hardware router. - -Example Network ---------------- - -In this document, we have been allocated 203.0.113.0/24 by our upstream -provider, which we are publishing on VLAN100. - -They want us to establish a BGP session to their routers on 192.0.2.11 and -192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and -we are AS 65551. - -Our routers are going to have a floating IP address of 203.0.113.1, and use -.2 and .3 as their fixed IPs. - -We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201. - -When traffic is originated from the 10.200.201.0/24 network, it will be -masqueraded to 203.0.113.1 - -For connection between sites, we are running a WireGuard link to two REMOTE -routers and using OSPF over those links to distribute routes. That remote -site is expected to send traffic from anything in 10.201.0.0/16 - -VLANs ------ - -These are the vlans we will be using: - -* 50: Upstream, using the 192.0.2.0/24 network allocated by them. -* 100: 'Public' network, using our 203.0.113.0/24 network. -* 201: 'Internal' network, using 10.200.201.0/24 - -Hardware --------- - -* switch1 (Nexus 10gb Switch) -* switch2 (Nexus 10gb Switch) -* compute1 (VMware ESXi 6.5) -* compute2 (VMware ESXi 6.5) -* compute3 (VMware ESXi 6.5) -* router2 (Random 1RU machine with 4 NICs) - -Note that router1 is a VM that runs on one of the compute nodes. - -Network Cabling ---------------- - -* From Datacenter - This connects into port 1 on both switches, and is tagged - as VLAN 50 -* Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch -* Hardware Router - Port 8 of each switch -* compute1 - Port 9 of each switch -* compute2 - Port 10 of each switch -* compute3 - Port 11 of each switch - -This is ignoring the extra Out-of-band management networking, which should be -on totally different switches, and a different feed into the rack, and is out -of scope of this. - -.. note:: Our implementation uses VMware's Distributed Port Groups, which allows - VMware to use LACP. This is a part of the ENTERPRISE licence, and is not - available on a free licence. If you are implementing this and do not have - access to DPGs, you should not use VMware, and use some other virtualization - platform instead. - - -Basic Setup (via console) -========================= - -Create your router1 VM. So it can withstand a VM Host failing or a -network link failing. Using VMware, this is achieved by enabling vSphere DRS, -vSphere Availability, and creating a Distributed Port Group that uses LACP. - -Many other Hypervisors do this, and I'm hoping that this document will be -expanded to document how to do this for others. - -Create an 'All VLANs' network group, that passes all trunked traffic through -to the VM. Attach this network group to router1 as eth0. - -.. note:: VMware: You must DISABLE SECURITY on this Port group. Make sure that - ``Promiscuous Mode``\ , ``MAC address changes`` and ``Forged transmits`` are - enabled. All of these will be done as part of failover. - -Bonding on Hardware Router --------------------------- - -Create a LACP bond on the hardware router. We are assuming that eth0 and eth1 -are connected to port 8 on both switches, and that those ports are configured -as a Port-Channel. - -.. code-block:: none - - set interfaces bonding bond0 description 'Switch Port-Channel' - set interfaces bonding bond0 hash-policy 'layer2' - set interfaces bonding bond0 member interface 'eth0' - set interfaces bonding bond0 member interface 'eth1' - set interfaces bonding bond0 mode '802.3ad' - - -Assign external IP addresses ----------------------------- - -VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this -is talking directly to upstream. Create our IP address on vlan50. - -For the hardware router, replace ``eth0`` with ``bond0``. As (almost) every -command is identical, this will not be specified unless different things need -to be performed on different hosts. - -.. code-block:: none - - set interfaces ethernet eth0 vif 50 address '192.0.2.21/24' - -In this case, the hardware router has a different IP, so it would be - -.. code-block:: none - - set interfaces ethernet bond0 vif 50 address '192.0.2.22/24' - -Add (temporary) default route ------------------------------ - -It is assumed that the routers provided by upstream are capable of acting as a -default router, add that as a static route. - -.. code-block:: none - - set protocols static route 0.0.0.0/0 next-hop 192.0.2.11 - commit - save - - -Enable SSH ----------- - -Enable SSH so you can now SSH into the routers, rather than using the console. - -.. code-block:: none - - set service ssh - commit - save - -At this point, you should be able to SSH into both of them, and will no longer -need access to the console (unless you break something!) - - -VRRP Configuration -================== - -We are setting up VRRP so that it does NOT fail back when a machine returns into -service, and it prioritizes router1 over router2. - -Internal Network ----------------- - -This has a floating IP address of 10.200.201.1/24, using virtual router ID 201. -The difference between them is the interface name, hello-source-address, and -peer-address. - -**router1** - -.. code-block:: none - - set interfaces ethernet eth0 vif 201 address 10.200.201.2/24 - set high-availability vrrp group int hello-source-address '10.200.201.2' - set high-availability vrrp group int interface 'eth0.201' - set high-availability vrrp group int peer-address '10.200.201.3' - set high-availability vrrp group int no-preempt - set high-availability vrrp group int priority '200' - set high-availability vrrp group int address '10.200.201.1/24' - set high-availability vrrp group int vrid '201' - - -**router2** - -.. code-block:: none - - set interfaces ethernet bond0 vif 201 address 10.200.201.3/24 - set high-availability vrrp group int hello-source-address '10.200.201.3' - set high-availability vrrp group int interface 'bond0.201' - set high-availability vrrp group int peer-address '10.200.201.2' - set high-availability vrrp group int no-preempt - set high-availability vrrp group int priority '100' - set high-availability vrrp group int address '10.200.201.1/24' - set high-availability vrrp group int vrid '201' - - -Public Network --------------- - -This has a floating IP address of 203.0.113.1/24, using virtual router ID 113. -The virtual router ID is just a random number between 1 and 254, and can be set -to whatever you want. Best practices suggest you try to keep them unique -enterprise-wide. - -**router1** - -.. code-block:: none - - set interfaces ethernet eth0 vif 100 address 203.0.113.2/24 - set high-availability vrrp group public hello-source-address '203.0.113.2' - set high-availability vrrp group public interface 'eth0.100' - set high-availability vrrp group public peer-address '203.0.113.3' - set high-availability vrrp group public no-preempt - set high-availability vrrp group public priority '200' - set high-availability vrrp group public address '203.0.113.1/24' - set high-availability vrrp group public vrid '113' - -**router2** - -.. code-block:: none - - set interfaces ethernet bond0 vif 100 address 203.0.113.3/24 - set high-availability vrrp group public hello-source-address '203.0.113.3' - set high-availability vrrp group public interface 'bond0.100' - set high-availability vrrp group public peer-address '203.0.113.2' - set high-availability vrrp group public no-preempt - set high-availability vrrp group public priority '100' - set high-availability vrrp group public address '203.0.113.1/24' - set high-availability vrrp group public vrid '113' - - -Create VRRP sync-group ----------------------- - -The sync group is used to replicate connection tracking. It needs to be assigned -to a random VRRP group, and we are creating a sync group called ``sync`` using -the vrrp group ``int``. - -.. code-block:: none - - set high-availability vrrp sync-group sync member 'int' - -Testing -------- - -At this point, you should be able to see both IP addresses when you run -``show interfaces``\ , and ``show vrrp`` should show both interfaces in MASTER -state (and SLAVE state on router2). - -.. code-block:: none - - vyos@router1:~$ show vrrp - Name Interface VRID State Last Transition - -------- ----------- ------ ------- ----------------- - int eth0.201 201 MASTER 100s - public eth0.100 113 MASTER 200s - vyos@router1:~$ - - -You should be able to ping to and from all the IPs you have allocated. - -NAT and conntrack-sync -====================== - -Masquerade Traffic originating from 10.200.201.0/24 that is heading out the -public interface. - -.. note:: We explicitly exclude the primary upstream network so that BGP or - OSPF traffic doesn't accidentally get NAT'ed. - -.. code-block:: none - - set nat source rule 10 destination address '!192.0.2.0/24' - set nat source rule 10 outbound-interface name 'eth0.50' - set nat source rule 10 source address '10.200.201.0/24' - set nat source rule 10 translation address '203.0.113.1' - - -Configure conntrack-sync and enable helpers --------------------------------------------- - -Conntrack helper modules are enabled by default, but they tend to cause more -problems than they're worth in complex networks. You can disable all of them -at one go. - -.. code-block:: none - - delete system conntrack modules - -Now enable replication between nodes. Replace eth0.201 with bond0.201 on the -hardware router. - -.. code-block:: none - - set service conntrack-sync accept-protocol 'tcp,udp,icmp' - set service conntrack-sync event-listen-queue-size '8' - set service conntrack-sync failover-mechanism vrrp sync-group 'sync' - set service conntrack-sync interface eth0.201 - set service conntrack-sync mcast-group '224.0.0.50' - set service conntrack-sync sync-queue-size '8' - -.. _ha:contracktesting: - -Testing -------- - -The simplest way to test is to look at the connection tracking stats on the -standby hardware router with the command ``show conntrack-sync statistics``. -The numbers should be very close to the numbers on the primary router. - -When you have both routers up, you should be able to establish a connection -from a NAT'ed machine out to the internet, reboot the active machine, and that -connection should be preserved, and will not drop out. - -OSPF Over WireGuard -=================== - -Wireguard doesn't have the concept of an up or down link, due to its design. -This complicates AND simplifies using it for network transport, as for reliable -state detection you need to use SOMETHING to detect when the link is down. - -If you use a routing protocol itself, you solve two problems at once. This is -only a basic example, and is provided as a starting point. - -Configure Wireguard -------------------- - -There is plenty of instructions and documentation on setting up Wireguard. The -only important thing you need to remember is to only use one WireGuard -interface per OSPF connection. - -We use small /30's from 10.254.60/24 for the point-to-point links. - -**router1** - -Replace the 203.0.113.3 with whatever the other router's IP address is. - -.. code-block:: none - - set interfaces wireguard wg01 address '10.254.60.1/30' - set interfaces wireguard wg01 description 'router1-to-offsite1' - set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' - set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001' - set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' - set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' - set interfaces wireguard wg01 port '50001' - set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' - set protocols ospf interface wg01 cost '11' - set protocols ospf interface wg01 dead-interval '5' - set protocols ospf interface wg01 hello-interval '1' - set protocols ospf interface wg01 network 'point-to-point' - set protocols ospf interface wg01 priority '1' - set protocols ospf interface wg01 retransmit-interval '5' - set protocols ospf interface wg01 transmit-delay '1' - - -**offsite1** - -This is connecting back to the STATIC IP of router1, not the floating. - -.. code-block:: none - - set interfaces wireguard wg01 address '10.254.60.2/30' - set interfaces wireguard wg01 description 'offsite1-to-router1' - set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0' - set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001' - set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15' - set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=' - set interfaces wireguard wg01 port '50001' - set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' - set protocols ospf interface wg01 cost '11' - set protocols ospf interface wg01 dead-interval '5' - set protocols ospf interface wg01 hello-interval '1' - set protocols ospf interface wg01 network 'point-to-point' - set protocols ospf interface wg01 priority '1' - set protocols ospf interface wg01 retransmit-interval '5' - set protocols ospf interface wg01 transmit-delay '1' - -Test WireGuard --------------- - -Make sure you can ping 10.254.60.1 and .2 from both routers. - -Create Export Filter --------------------- - -We only want to export the networks we know. Always do a whitelist on your route -filters, both importing and exporting. A good rule of thumb is -**'If you are not the default router for a network, don't advertise -it'**. This means we explicitly do not want to advertise the 192.0.2.0/24 -network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE -the default route for). This filter is applied to ``redistribute connected``. -If we WERE to advertise it, the remote machines would see 192.0.2.21 available -via their default route, establish the connection, and then OSPF would say -'192.0.2.0/24 is available via this tunnel', at which point the tunnel would -break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via -default again. This is called 'flapping'. - -.. code-block:: none - - set policy access-list 150 description 'Outbound OSPF Redistribution' - set policy access-list 150 rule 10 action 'permit' - set policy access-list 150 rule 10 destination any - set policy access-list 150 rule 10 source inverse-mask '0.0.0.255' - set policy access-list 150 rule 10 source network '10.200.201.0' - set policy access-list 150 rule 20 action 'permit' - set policy access-list 150 rule 20 destination any - set policy access-list 150 rule 20 source inverse-mask '0.0.0.255' - set policy access-list 150 rule 20 source network '203.0.113.0' - set policy access-list 150 rule 100 action 'deny' - set policy access-list 150 rule 100 destination any - set policy access-list 150 rule 100 source any - - -Create Import Filter --------------------- - -We only want to import networks we know. Our OSPF peer should only be -advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE -MATCH. You deny in access-list 100 to accept the route. - -.. code-block:: none - - set policy access-list 100 description 'Inbound OSPF Routes from Peers' - set policy access-list 100 rule 10 action 'deny' - set policy access-list 100 rule 10 destination any - set policy access-list 100 rule 10 source inverse-mask '0.0.255.255' - set policy access-list 100 rule 10 source network '10.201.0.0' - set policy access-list 100 rule 100 action 'permit' - set policy access-list 100 rule 100 destination any - set policy access-list 100 rule 100 source any - set policy route-map PUBOSPF rule 100 action 'deny' - set policy route-map PUBOSPF rule 100 match ip address access-list '100' - set policy route-map PUBOSPF rule 500 action 'permit' - - -Enable OSPF ------------ - -Every router **must** have a unique router-id. -The 'reference-bandwidth' is used because when OSPF was originally designed, -the idea of a link faster than 1gbit was unheard of, and it does not scale -correctly. - -.. code-block:: none - - set protocols ospf area 0.0.0.0 authentication 'md5' - set protocols ospf area 0.0.0.0 network '10.254.60.0/24' - set protocols ospf auto-cost reference-bandwidth '10000' - set protocols ospf log-adjacency-changes - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.254.60.2' - set system ip protocol ospf route-map PUBOSPF - - -Test OSPF ---------- - -When you have enabled OSPF on both routers, you should be able to see each -other with the command ``show ip ospf neighbour``. The state must be 'Full' -or '2-Way'. If it is not, then there is a network connectivity issue between the -hosts. This is often caused by NAT or MTU issues. You should not see any new -routes (unless this is the second pass) in the output of ``show ip route`` - -Advertise connected routes -========================== - -As a reminder, only advertise routes that you are the default router for. This -is why we are NOT announcing the 192.0.2.0/24 network, because if that was -announced into OSPF, the other routers would try to connect to that network -over a tunnel that connects to that network! - -.. code-block:: none - - set protocols ospf access-list 150 export 'connected' - set protocols ospf redistribute connected - - -You should now be able to see the advertised network on the other host. - -Duplicate configuration ------------------------ - -At this point, you now need to create the X link between all four routers. -Use amdifferent /30 for each link. - -Priorities ----------- - -Set the cost on the secondary links to be 200. This means that they will not -be used unless the primary links are down. - -.. code-block:: none - - set protocols ospf interface wg01 cost '10' - set protocols ospf interface wg01 cost '200' - - -This will be visible in 'show ip route'. - -BGP -=== - -BGP is an extremely complex network protocol. An example is provided here. - -.. note:: Router id's must be unique. - -**router1** - - -The ``redistribute ospf`` command is there purely as an example of how this can -be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as -it is not 203.0.113.0/24. - -.. code-block:: none - - set policy prefix-list BGPOUT description 'BGP Export List' - set policy prefix-list BGPOUT rule 10 action 'deny' - set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' - set policy prefix-list BGPOUT rule 10 ge '25' - set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' - set policy prefix-list BGPOUT rule 100 action 'permit' - set policy prefix-list BGPOUT rule 100 description 'Our network' - set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' - set policy prefix-list BGPOUT rule 10000 action 'deny' - set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' - - set policy route-map BGPOUT description 'BGP Export Filter' - set policy route-map BGPOUT rule 10 action 'permit' - set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT' - set policy route-map BGPOUT rule 10000 action 'deny' - set policy route-map BGPPREPENDOUT description 'BGP Export Filter' - set policy route-map BGPPREPENDOUT rule 10 action 'permit' - set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' - set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT' - set policy route-map BGPPREPENDOUT rule 10000 action 'deny' - - set protocols bgp system-as 65551 - set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 - set protocols bgp address-family ipv4-unicast redistribute connected metric '50' - set protocols bgp address-family ipv4-unicast redistribute ospf metric '50' - set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT' - set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound - set protocols bgp neighbor 192.0.2.11 remote-as '65550' - set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21' - set protocols bgp parameters router-id '192.0.2.21' - - -**router2** - -This is identical, but you use the BGPPREPENDOUT route-map to advertise the -route with a longer path. diff --git a/docs/configexamples/index.md b/docs/configexamples/index.md new file mode 100644 index 00000000..e5a81305 --- /dev/null +++ b/docs/configexamples/index.md @@ -0,0 +1,60 @@ +(examples)= + +# Configuration Blueprints + +This chapter contains various configuration examples: + +```{toctree} +:maxdepth: 2 + +firewall +bgp-ipv6-unnumbered +ospf-unnumbered +azure-vpn-bgp +azure-vpn-dual-bgp +ha +wan-load-balancing +pppoe-ipv6-basic +l3vpn-hub-and-spoke +lac-lns +inter-vrf-routing-vrf-lite +dmvpn-dualhub-dualcloud +qos +segment-routing-isis +nmp +ansible +ipsec-cisco-policy-based +ipsec-cisco-route-based +ipsec-pa-route-based +policy-based-ipsec-and-firewall +site-2-site-cisco +``` + + +## Configuration Blueprints (autotest) + +The next pages contain fully automated configuration examples. + +Each lab will build and test from an external script. +The page content is generated, so changes will not take effect. + +A host `vyos-oobm` will be used as an SSH proxy. This host is just +necessary for the lab tests. + +The process will do the following steps: +1. create the lab on a eve-ng server +2. configure each host in the lab +3. do some defined tests +4. optional do an upgrade to a higher version and do step 3 again. +5. generate the documentation and include files +6. shutdown and destroy the lab, if there is no error + +```{toctree} +:maxdepth: 1 + +autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE +autotest/tunnelbroker/tunnelbroker +autotest/L3VPN_EVPN/L3VPN_EVPN +autotest/Wireguard/Wireguard +autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP +``` diff --git a/docs/configexamples/index.rst b/docs/configexamples/index.rst deleted file mode 100644 index b5985d7f..00000000 --- a/docs/configexamples/index.rst +++ /dev/null @@ -1,63 +0,0 @@ -.. _examples: - -######################## -Configuration Blueprints -######################## - -This chapter contains various configuration examples: - -.. toctree:: - :maxdepth: 2 - - firewall - bgp-ipv6-unnumbered - ospf-unnumbered - azure-vpn-bgp - azure-vpn-dual-bgp - ha - wan-load-balancing - pppoe-ipv6-basic - l3vpn-hub-and-spoke - lac-lns - inter-vrf-routing-vrf-lite - dmvpn-dualhub-dualcloud - qos - segment-routing-isis - nmp - ansible - ipsec-cisco-policy-based - ipsec-cisco-route-based - ipsec-pa-route-based - policy-based-ipsec-and-firewall - site-2-site-cisco - - -Configuration Blueprints (autotest) -=================================== - -The next pages contains automatic full tested configuration examples. - -Each lab will build an test from an external script. -The page content will generate, so changes will not take an effect. - -A host ``vyos-oobm`` will use as a ssh proxy. This host is just -necessary for the Lab test. - -The process will do the following steps: - -1. create the lab on a eve-ng server -2. configure each host in the lab -3. do some defined tests -4. optional do an upgrade to a higher version and do step 3 again. -5. generate the documentation and include files -6. shutdown and destroy the lab, if there is no error - - -.. toctree:: - :maxdepth: 1 - - autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE - autotest/tunnelbroker/tunnelbroker - autotest/L3VPN_EVPN/L3VPN_EVPN - autotest/Wireguard/Wireguard - autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.md b/docs/configexamples/inter-vrf-routing-vrf-lite.md new file mode 100644 index 00000000..2ac36904 --- /dev/null +++ b/docs/configexamples/inter-vrf-routing-vrf-lite.md @@ -0,0 +1,797 @@ +# Inter-VRF Routing over VRF Lite + +**Virtual Routing and Forwarding** is a technology that allow multiple instance +of a routing table to exist within a single device. One of the key aspect of +**VRFs** is that do not share the same routes or interfaces, therefore packets +are forwarded between interfaces that belong to the same VRF only. + +Any information related to a VRF is not exchanged between devices -or in the +same device- by default, this is a technique called **VRF-Lite**. + +Keep networks isolated is -in general- a good principle, but there are cases +where you might need that some network can access other in a different VRF. + +The scope of this document is to cover such cases in a dynamic way without the +use of MPLS-LDP. + +General information about L3VPNs can be found in the {ref}`configuration/vrf/index:L3VPN VRFs` chapter. + +## Overview + +Let’s say we have a requirement to have multiple networks. + +- LAN 1 +- LAN 2 +- Management +- Internet + +Both LANs have to be able to route between each other, both will have managed +devices through a dedicated management network and both will need Internet +access yet the LAN2 will need access to some set of outside networks, not all. +The management network will need access to both LANs but cannot have access +to/from the outside. + +This scenario could be a nightmare applying regular routing and might need +filtering in multiple interfaces. + +A simple solution could be using different routing tables, or VRFs +for all the networks so we can keep the routing restrictions. +But for us to route between the different VRFs we would need a cable or a +logical connection between each other: + +- One cable/logical connection between LAN1 and LAN2 +- One cable/logical connection between LAN1 and Internet +- One cable/logical connection between LAN2 and Internet +- One cable/logical connection between LAN1 and Management +- One cable/logical connection between LAN2 and Management + +As we can see this is unpractical. + +To address this scenario we will use to our advantage an extension of the BGP +routing protocol that will help us in the “Export” between VRFs without the +need for MPLS. + +MP-BGP or MultiProtocol BGP introduces two main concepts to solve this +limitation: +\- Route Distinguisher (RD): Is used to distinguish between different VRFs +–called VPNs- inside the BGP Process. The RD is appended to each IPv4 Network +that is advertised into BGP for that VPN making it a unique VPNv4 route. +\- Route Target (RT): This is an extended BGP community append to the VPNv4 route +in the Import/Export process. When a route passes from the VRF routing table +into the BGP process it will add the configured export extended community(ies) +for that VPN. When that route needs to go from BGP into the VRF routing table +will only pass if that given VPN import policy matches any of the appended +community(ies) into that prefix. + +## Topology + +```{image} /_static/images/inter-vrf-routing-vrf-lite.webp +:align: center +:alt: Network Topology Diagram +:width: 70% +``` + + +### IP Schema + +```{eval-rst} ++----------+------------+----------------+------------------+ +| Device-A | Device-B | IPv4 Network | IPv6 Network | ++----------+------------+----------------+------------------+ +| Core | LAN1 | 10.1.1.0/30 | 2001:db8::/127 | ++----------+------------+----------------+------------------+ +| Core | LAN2 | 172.16.2.0/30 | 2001:db8::2/127 | ++----------+------------+----------------+------------------+ +| Core | Management | 192.168.3.0/30 | 2001:db8::4/127 | ++----------+------------+----------------+------------------+ +| Core | ISP | 10.2.2.0/30 | 2001:db8::6/127 | ++----------+------------+----------------+------------------+ +``` + +### RD & RT Schema + +```{eval-rst} ++------------+-----------+-----------+ +| VRF | RD | RT | ++------------+-----------+-----------+ +| LAN1 | 64496:1 | 64496:1 | ++------------+-----------+-----------+ +| LAN2 | 64496:2 | 64496:2 | ++------------+-----------+-----------+ +| Management | 64496:50 | 64496:50 | ++------------+-----------+-----------+ +| Internet | 64496:100 | 64496:100 | ++------------+-----------+-----------+ +``` + +## Configurations + +:::{note} +We use a static route configuration in between the Core and each +LAN and Management router, and BGP between the Core router and the ISP router +but any dynamic routing protocol can be used. +::: + +### Remote Networks + +The following template configuration can be used in each remote router based +in our topology. + +```none +# Interface Configuration +set interface eth eth address + +# Static default route back to Core +set protocols static route 0.0.0.0/0 next-hop +``` + + +### Core Router + +#### Step 1: VRF and Configurations to remote networks + +- Configuration + +Set the VRF name and Table ID, set interface address and bind it to the VRF. +Last add the static route to the remote network. + +```none +# VRF name and table ID (MANDATORY) +set vrf name table + +# Interface Configuration +set interface eth eth address + +# Assign interface to VRF +set interface eth eth vrf + +# Static route to remote Network +set vrf name protocols static route next-hop +``` + +- Verification + +Checking the routing table of the VRF should reveal both static and connected +entries active. A PING test between the Core and remote router is a way to +validate connectivity within the VRF. + +```none +# show ip route vrf +# show ipv6 route vrf + +vyos@Core:~$ show ip route vrf LAN1 +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF LAN1: +S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41 +C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44 + +vyos@Core:~$ show ipv6 route vrf LAN1 +Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF LAN1: +C>* 2001:db8::/127 is directly connected, eth0, 00:18:43 +S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03 +C>* fe80::/64 is directly connected, eth0, 00:18:43 + +# ping vrf + +vyos@Core:~$ ping 10.1.1.2 vrf LAN1 +PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data. +64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms +64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms +^C +--- 10.1.1.2 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1002ms +rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms +vyos@Core:~$ ping 10.0.0.1 vrf LAN1 +PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. +64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms +64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms +^C +--- 10.0.0.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1002ms +rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms + +vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1 +PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes +64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms +64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms +64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms +^C +--- 2001:db8:0:1::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2004ms +rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms +``` + + +#### Step 2: BGP Configuration for VRF-Lite + +- Configuration + +Setting BGP global local-as as well inside the VRF. Redistribute static +routes to inject configured networks into the BGP process but still inside +the VRF. + +```none +# set BGP global local-as +set protocols bgp system-as + +# set BGP VRF local-as and redistribution +set vrf name protocols bgp address-family redistribute static +``` + +- Verification + +Check the BGP VRF table and verify if the static routes are injected showing +the correct next-hop information. + +```none +# show ip bgp vrf +# show bgp vrf ipv6 + +vyos@Core:~$ show ip bgp vrf LAN1 +BGP table version is 3, local router ID is 10.1.1.1, vrf id 8 +Default local pref 100, local AS 64496 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete +RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path +*> 10.0.0.0/24 10.1.1.2 0 32768 ? + +vyos@Core# run show bgp vrf LAN1 ipv6 +BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 +Default local pref 100, local AS 64496 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete +RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path +*> 2001:db8:0:1::/64 + 2001:db8::1 0 32768 ? +``` + + +#### Step 3: VPN Configuration + +- Configuration + +Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT), +then we enable the export/import VPN. + +```none +# set Route-distinguisher +set vrf name protocols bgp address-family rd vpn export '' + +# set route-target for import/export +# Note: RT are a list that can be more than one community between apostrophe +# and separated by blank space. Ex: ' ' +set vrf name protocols bgp address-family route-target vpn export '' +set vrf name protocols bgp address-family route-target vpn import '' + +# Enable VPN export/import under this VRF +set vrf name protocols bgp address-family export vpn +set vrf name protocols bgp address-family import vpn +``` + +A key point to understand is that if we need two VRFs to communicate between +each other EXPORT rt from VRF1 has to be in the IMPORT rt list from VRF2. But +this is only in ONE direction, to complete the communication the EXPORT rt from +VRF2 has to be in the IMPORT rt list from VRF1. + +There are some cases where this is not needed -for example, in some +DDoS appliance- but most inter-vrf routing designs use the above configurations. + +- Verification + +After configured all the VRFs involved in this topology we take a deeper look +at both BGP and Routing table for the VRF LAN1 + +```none +# show ip bgp vrf +# show bgp vrf ipv6 + +vyos@Core# run show ip bgp vrf LAN1 +BGP table version is 53, local router ID is 10.1.1.1, vrf id 8 +Default local pref 100, local AS 64496 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete +RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path +*> 0.0.0.0/0 10.2.2.2@7< 0 64497 i +*> 10.0.0.0/24 10.1.1.2 0 32768 ? +*> 10.2.2.0/30 10.2.2.2@7< 0 0 64497 ? +*> 192.0.2.0/24 10.2.2.2@7< 0 0 64497 ? +*> 192.168.0.0/24 192.168.3.2@11< 0 32768 ? +*> 198.51.100.0/24 10.2.2.2@7< 0 0 64497 ? +*> 203.0.113.0/24 10.2.2.2@7< 0 0 64497 ? + +vyos@Core# run show bgp vrf LAN1 ipv6 +BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 +Default local pref 100, local AS 64496 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete +RPKI validation codes: V valid, I invalid, N Not found + +Network Next Hop Metric LocPrf Weight Path +*> ::/0 fe80::5200:ff:fe02:3@7< + 0 64497 i +*> 2001:db8::6/127 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? +*> 2001:db8:0:1::/64 + 2001:db8::1 0 32768 ? +*> 2001:db8:0:3::/64 + 2001:db8::5@11< 0 32768 ? +*> 2001:db8:1::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? +*> 2001:db8:2::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? +*> 2001:db8:3::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + +# show ip route vrf +# show ipv6 route vrf + +vyos@Core:~$ show ip route vrf LAN1 +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF LAN1: +B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 +S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57 +C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59 +B 10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38 +B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38 +B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 +B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 +B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + +vyos@Core# run show ipv6 route vrf LAN1 +Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +VRF LAN1: +B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +C>* 2001:db8::/127 is directly connected, eth0, 05:33:43 +B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03 +B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50 +B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 +C>* fe80::/64 is directly connected, eth0, 05:33:43 +``` + +As we can see in the BGP table any imported route has been injected with a "@" +followed by the VPN id; In the routing table of the VRF, if the route was +installed, we can see -between round brackets- the exported VRF table. + +#### Step 4: End to End verification + +Now we perform some end-to-end testing +- From Management to LAN1/LAN2 + +```none +vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1 +PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data. +64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms +64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms +64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms +^C +--- 10.0.0.1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2005ms +rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms +vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1 +PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data. +64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms +64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms +^C +--- 172.16.0.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1001ms +rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms +vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1 +PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes +64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms +64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms +64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms +^C +--- 2001:db8:0:1::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2003ms +rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms +vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1 +PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes +64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms +^C +--- 2001:db8:0:2::1 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3005ms +rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms +``` + +- From Management to Outside (fails as intended) + +```none +vyos@Management:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58 +C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05 +C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03 +vyos@Management:~$ ping 192.0.2.1 +PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data. +From 192.168.3.1 icmp_seq=1 Destination Net Unreachable +From 192.168.3.1 icmp_seq=2 Destination Net Unreachable +^C +--- 192.0.2.1 ping statistics --- +2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + +vyos@Management:~$ ping 195.51.100.1 +PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data. +From 192.168.3.1 icmp_seq=1 Destination Net Unreachable +From 192.168.3.1 icmp_seq=2 Destination Net Unreachable +From 192.168.3.1 icmp_seq=3 Destination Net Unreachable +^C +--- 195.51.100.1 ping statistics --- +3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms + +vyos@Management:~$ ping 2001:db8:1::1 +PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes +From 2001:db8::4 icmp_seq=1 Destination unreachable: No route +From 2001:db8::4 icmp_seq=2 Destination unreachable: No route +^C +--- 2001:db8:1::1 ping statistics --- +2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + +vyos@Management:~$ ping 2001:db8:2::1 +PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes +From 2001:db8::4 icmp_seq=1 Destination unreachable: No route +From 2001:db8::4 icmp_seq=2 Destination unreachable: No route +^C +--- 2001:db8:2::1 ping statistics --- +2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms +``` + +- LAN1 to Outside + +```none +vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1 +PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data. +64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms +64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms +64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms +^C +--- 192.0.2.1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2004ms +rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms +vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1 +PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data. +64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms +64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms +^C +--- 198.51.100.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1002ms +rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms +vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1 +PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data. +64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms +64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms +^C +--- 203.0.113.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1003ms +rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms +vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1 +PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes +64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms +64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms +64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms +^C +--- 2001:db8:1::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2004ms +rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms +vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1 +PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes +64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms +64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms +64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms +^C +--- 2001:db8:2::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2003ms +rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms +``` + +:::{note} +we are using "source-address" option cause we are not redistributing +connected interfaces into BGP on the Core router hence there is no comeback +route and ping will fail. +::: + +- LAN1 to LAN2 + +```none +vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1 +PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data. +64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms +64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms +^C +--- 172.16.0.1 ping statistics --- +2 packets transmitted, 2 received, 0% packet loss, time 1002ms +rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms +vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1 +PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes +64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms +64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms +^C +--- 2001:db8:0:2::1 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 2003ms +rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms +``` + + +## Conclusions + +Inter-VRF routing is a well-known solution to address complex routing scenarios +that enable -in a dynamic way- to leak routes between VRFs. Is recommended to +take special consideration while designing route-targets and its application as +it can minimize future interventions while creating a new VRF will automatically +take the desired effect in its propagation. + +## Appendix-A + +### Full configuration from all devices + +- Core + +```none +set interfaces ethernet eth0 address '10.1.1.1/30' +set interfaces ethernet eth0 address '2001:db8::/127' +set interfaces ethernet eth0 vrf 'LAN1' +set interfaces ethernet eth1 address '172.16.2.1/30' +set interfaces ethernet eth1 address '2001:db8::2/127' +set interfaces ethernet eth1 vrf 'LAN2' +set interfaces ethernet eth2 address '192.168.3.1/30' +set interfaces ethernet eth2 address '2001:db8::4/127' +set interfaces ethernet eth2 vrf 'Management' +set interfaces ethernet eth3 address '10.2.2.1/30' +set interfaces ethernet eth3 address '2001:db8::6/127' +set interfaces ethernet eth3 vrf 'Internet' +set protocols bgp address-family ipv4-unicast +set protocols bgp system-as '64496' +set vrf name Internet protocols bgp address-family ipv4-unicast export vpn +set vrf name Internet protocols bgp address-family ipv4-unicast import vpn +set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' +set vrf name Internet protocols bgp address-family ipv6-unicast export vpn +set vrf name Internet protocols bgp address-family ipv6-unicast import vpn +set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' +set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' +set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast +set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497' +set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast +set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497' +set vrf name Internet table '104' +set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn +set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn +set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static +set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' +set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn +set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn +set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static +set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' +set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' +set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2 +set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1 +set vrf name LAN1 table '101' +set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn +set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn +set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' +set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn +set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn +set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' +set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2 +set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3 +set vrf name LAN2 table '102' +set vrf name Management protocols bgp address-family ipv4-unicast export vpn +set vrf name Management protocols bgp address-family ipv4-unicast import vpn +set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv4-unicast redistribute static +set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' +set vrf name Management protocols bgp address-family ipv6-unicast export vpn +set vrf name Management protocols bgp address-family ipv6-unicast import vpn +set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv6-unicast redistribute static +set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' +set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' +set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2 +set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5 +set vrf name Management table '103' +``` + +- LAN1 + +```none +set interfaces dummy dum0 address '10.0.0.1/24' +set interfaces dummy dum0 address '2001:db8:0:1::1/64' +set interfaces ethernet eth0 address '10.1.1.2/30' +set interfaces ethernet eth0 address '2001:db8::1/127' +set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 +set protocols static route6 ::/0 next-hop 2001:db8::1 +``` + +- LAN2 + +```none +set interfaces dummy dum0 address '172.16.0.1/24' +set interfaces dummy dum0 address '2001:db8:0:2::1/64' +set interfaces ethernet eth0 hw-id '50:00:00:03:00:00' +set interfaces ethernet eth1 address '172.16.2.2/30' +set interfaces ethernet eth1 address '2001:db8::3/127' +set protocols static route 0.0.0.0/0 next-hop 172.16.2.1 +set protocols static route6 ::/0 next-hop 2001:db8::2 +``` + +- Management + +```none +set interfaces dummy dum0 address '192.168.0.1/24' +set interfaces dummy dum0 address '2001:db8:0:3::1/64' +set interfaces ethernet eth2 address '192.168.3.2/30' +set interfaces ethernet eth2 address '2001:db8::5/127' +set protocols static route 0.0.0.0/0 next-hop 192.168.3.1 +set protocols static route6 ::/0 next-hop 2001:db8::4 +``` + +- ISP + +```none +set interfaces dummy dum0 address '192.0.2.1/24' +set interfaces dummy dum0 address '2001:db8:1::1/48' +set interfaces dummy dum1 address '198.51.100.1/24' +set interfaces dummy dum1 address '2001:db8:2::1/48' +set interfaces dummy dum2 address '203.0.113.1/24' +set interfaces dummy dum2 address '2001:db8:3::1/48' +set interfaces ethernet eth3 address '10.2.2.2/30' +set interfaces ethernet eth3 address '2001:db8::7/127' +set protocols bgp address-family ipv4-unicast redistribute connected +set protocols bgp address-family ipv6-unicast redistribute connected +set protocols bgp system-as '64497' +set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate +set protocols bgp neighbor 10.2.2.1 remote-as '64496' +set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate +set protocols bgp neighbor 2001:db8::6 remote-as '64496' +set protocols static route 0.0.0.0/0 next-hop 10.2.2.1 +set protocols static route6 ::/0 next-hop 2001:db8::6 +``` + + +## Appendix-B + +### Route-Filtering + +When importing routes using MP-BGP it is possible to filter a subset of them +before are injected in the BGP table. One of the most common case is to use a +route-map with an prefix-list. +- Configuration + +We create a prefix-list first and add all the routes we need to. + +```none +# set both ipv4 and ipv6 policies + +set policy prefix-list LAN2-Internet rule 1 action 'permit' +set policy prefix-list LAN2-Internet rule 1 le '24' +set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16' +set policy prefix-list LAN2-Internet rule 2 action 'permit' +set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24' +set policy prefix-list LAN2-Internet rule 3 action 'permit' +set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24' +set policy prefix-list LAN2-Internet rule 4 action 'permit' +set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24' + +set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48' +set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48' +set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64' +set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' +set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' +``` + +Then add a route-map and reference to above prefix. Consider that the actions +taken inside the prefix will MATCH the routes that will be affected by the +actions inside the rules of the route-map. + +```none +set policy route-map LAN2-Internet rule 1 action 'permit' +set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet' + +set policy route-map LAN2-Internet-v6 rule 1 action 'permit' +set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-Internet-v6' +``` + +We are using a "white list" approach by allowing only what is necessary. In case +that need to implement a "black list" approach then you will need to change the +action in the route-map for a deny BUT you need to add a rule that permits the +rest due to the implicit deny in the route-map. + +Then we need to attach the policy to the BGP process. This needs to be under +the import statement in the vrf we need to filter. + +```none +set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet' +set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6' +``` + +- Verification + +```none +# show ip route vrf LAN2 + +B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28 +S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32 +C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39 +B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 +B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Management), weight 1, 00:45:27 +B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 + +# show ipv6 route vrf LAN2 + +C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26 +B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17 +S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21 +B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:46:16 +B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 +B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 +C>* fe80::/64 is directly connected, eth1, 00:46:27 +``` + +As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able +to select which routes are effectively imported and installed. diff --git a/docs/configexamples/inter-vrf-routing-vrf-lite.rst b/docs/configexamples/inter-vrf-routing-vrf-lite.rst deleted file mode 100644 index 1f02da8e..00000000 --- a/docs/configexamples/inter-vrf-routing-vrf-lite.rst +++ /dev/null @@ -1,856 +0,0 @@ -################################ -Inter-VRF Routing over VRF Lite -################################ - -**Virtual Routing and Forwarding** is a technology that allow multiple instance -of a routing table to exist within a single device. One of the key aspect of -**VRFs** is that do not share the same routes or interfaces, therefore packets -are forwarded between interfaces that belong to the same VRF only. - -Any information related to a VRF is not exchanged between devices -or in the -same device- by default, this is a technique called **VRF-Lite**. - -Keep networks isolated is -in general- a good principle, but there are cases -where you might need that some network can access other in a different VRF. - -The scope of this document is to cover such cases in a dynamic way without the -use of MPLS-LDP. - -General information about L3VPNs can be found in the -:ref:`configuration/vrf/index:L3VPN VRFs` chapter. - -******** -Overview -******** - -Let’s say we have a requirement to have multiple networks. - -* LAN 1 -* LAN 2 -* Management -* Internet - -Both LANs have to be able to route between each other, both will have managed -devices through a dedicated management network and both will need Internet -access yet the LAN2 will need access to some set of outside networks, not all. -The management network will need access to both LANs but cannot have access -to/from the outside. - -This scenario could be a nightmare applying regular routing and might need -filtering in multiple interfaces. - -A simple solution could be using different routing tables, or VRFs -for all the networks so we can keep the routing restrictions. -But for us to route between the different VRFs we would need a cable or a -logical connection between each other: - -* One cable/logical connection between LAN1 and LAN2 -* One cable/logical connection between LAN1 and Internet -* One cable/logical connection between LAN2 and Internet -* One cable/logical connection between LAN1 and Management -* One cable/logical connection between LAN2 and Management - -As we can see this is unpractical. - -To address this scenario we will use to our advantage an extension of the BGP -routing protocol that will help us in the “Export” between VRFs without the -need for MPLS. - -MP-BGP or MultiProtocol BGP introduces two main concepts to solve this -limitation: -- Route Distinguisher (RD): Is used to distinguish between different VRFs -–called VPNs- inside the BGP Process. The RD is appended to each IPv4 Network -that is advertised into BGP for that VPN making it a unique VPNv4 route. -- Route Target (RT): This is an extended BGP community append to the VPNv4 route -in the Import/Export process. When a route passes from the VRF routing table -into the BGP process it will add the configured export extended community(ies) -for that VPN. When that route needs to go from BGP into the VRF routing table -will only pass if that given VPN import policy matches any of the appended -community(ies) into that prefix. - -******** -Topology -******** -.. image:: /_static/images/inter-vrf-routing-vrf-lite.* - :width: 70% - :align: center - :alt: Network Topology Diagram - - - - -IP Schema -========= - -+----------+------------+----------------+------------------+ -| Device-A | Device-B | IPv4 Network | IPv6 Network | -+----------+------------+----------------+------------------+ -| Core | LAN1 | 10.1.1.0/30 | 2001:db8::/127 | -+----------+------------+----------------+------------------+ -| Core | LAN2 | 172.16.2.0/30 | 2001:db8::2/127 | -+----------+------------+----------------+------------------+ -| Core | Management | 192.168.3.0/30 | 2001:db8::4/127 | -+----------+------------+----------------+------------------+ -| Core | ISP | 10.2.2.0/30 | 2001:db8::6/127 | -+----------+------------+----------------+------------------+ - -RD & RT Schema -============== - -+------------+-----------+-----------+ -| VRF | RD | RT | -+------------+-----------+-----------+ -| LAN1 | 64496:1 | 64496:1 | -+------------+-----------+-----------+ -| LAN2 | 64496:2 | 64496:2 | -+------------+-----------+-----------+ -| Management | 64496:50 | 64496:50 | -+------------+-----------+-----------+ -| Internet | 64496:100 | 64496:100 | -+------------+-----------+-----------+ - -************** -Configurations -************** - -.. note:: We use a static route configuration in between the Core and each - LAN and Management router, and BGP between the Core router and the ISP router - but any dynamic routing protocol can be used. - -Remote Networks -=============== - -The following template configuration can be used in each remote router based -in our topology. - -.. code-block:: none - - # Interface Configuration - set interface eth eth address - - # Static default route back to Core - set procotols static route 0.0.0.0/0 next-hop - -Core Router -=========== - -Step 1: VRF and Configurations to remote networks -------------------------------------------------- - -- Configuration - - - -Set the VRF name and Table ID, set interface address and bind it to the VRF. -Last add the static route to the remote network. - -.. code-block:: none - - # VRF name and table ID (MANDATORY) - set vrf name table - - # Interface Configuration - set interface eth eth address - - # Assign interface to VRF - set interface eth eth vrf - - # Static route to remote Network - set vrf name protocols static route next-hop - -- Verification - - - -Checking the routing table of the VRF should reveal both static and connected -entries active. A PING test between the Core and remote router is a way to -validate connectivity within the VRF. - -.. code-block:: none - - # show ip route vrf - # show ipv6 route vrf - - vyos@Core:~$ show ip route vrf LAN1 - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF LAN1: - S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41 - C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44 - - vyos@Core:~$ show ipv6 route vrf LAN1 - Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF LAN1: - C>* 2001:db8::/127 is directly connected, eth0, 00:18:43 - S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03 - C>* fe80::/64 is directly connected, eth0, 00:18:43 - - # ping vrf - - vyos@Core:~$ ping 10.1.1.2 vrf LAN1 - PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data. - 64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms - 64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms - ^C - --- 10.1.1.2 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1002ms - rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms - vyos@Core:~$ ping 10.0.0.1 vrf LAN1 - PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. - 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms - 64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms - ^C - --- 10.0.0.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1002ms - rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms - - vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1 - PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes - 64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms - 64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms - 64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms - ^C - --- 2001:db8:0:1::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2004ms - rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms - -Step 2: BGP Configuration for VRF-Lite --------------------------------------- - - -- Configuration - - - -Setting BGP global local-as as well inside the VRF. Redistribute static routes -to inject configured networks into the BGP process but still inside the VRF. - - -.. code-block:: none - - # set BGP global local-as - set protocols bgp system-as - - # set BGP VRF local-as and redistribution - set vrf name protocols bgp address-family redistribute static - -- Verification - - - -Check the BGP VRF table and verify if the static routes are injected showing -the correct next-hop information. - -.. code-block:: none - - # show ip bgp vrf - # show bgp vrf ipv6 - - vyos@Core:~$ show ip bgp vrf LAN1 - BGP table version is 3, local router ID is 10.1.1.1, vrf id 8 - Default local pref 100, local AS 64496 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path - *> 10.0.0.0/24 10.1.1.2 0 32768 ? - - vyos@Core# run show bgp vrf LAN1 ipv6 - BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 - Default local pref 100, local AS 64496 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path - *> 2001:db8:0:1::/64 - 2001:db8::1 0 32768 ? - - -Step 3: VPN Configuration -------------------------- - - -- Configuration - - -Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT), then -we enable the export/import VPN. - - -.. code-block:: none - - # set Route-distinguisher - set vrf name protocols bgp address-family rd vpn export '' - - # set route-target for import/export - # Note: RT are a list that can be more than one community between apostrophe - # and separated by blank space. Ex: ' ' - set vrf name protocols bgp address-family route-target vpn export '' - set vrf name protocols bgp address-family route-target vpn import '' - - # Enable VPN export/import under this VRF - set vrf name protocols bgp address-family export vpn - set vrf name protocols bgp address-family import vpn - -A key point to understand is that if we need two VRFs to communicate between -each other EXPORT rt from VRF1 has to be in the IMPORT rt list from VRF2. But -this is only in ONE direction, to complete the communication the EXPORT rt from -VRF2 has to be in the IMPORT rt list from VRF1. - -There are some cases where this is not needed -for example, in some -DDoS appliance- but most inter-vrf routing designs use the above configurations. - -- Verification - - - -After configured all the VRFs involved in this topology we take a deeper look -at both BGP and Routing table for the VRF LAN1 - -.. code-block:: none - - # show ip bgp vrf - # show bgp vrf ipv6 - - vyos@Core# run show ip bgp vrf LAN1 - BGP table version is 53, local router ID is 10.1.1.1, vrf id 8 - Default local pref 100, local AS 64496 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path - *> 0.0.0.0/0 10.2.2.2@7< 0 64497 i - *> 10.0.0.0/24 10.1.1.2 0 32768 ? - *> 10.2.2.0/30 10.2.2.2@7< 0 0 64497 ? - *> 192.0.2.0/24 10.2.2.2@7< 0 0 64497 ? - *> 192.168.0.0/24 192.168.3.2@11< 0 32768 ? - *> 198.51.100.0/24 10.2.2.2@7< 0 0 64497 ? - *> 203.0.113.0/24 10.2.2.2@7< 0 0 64497 ? - - vyos@Core# run show bgp vrf LAN1 ipv6 - BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 - Default local pref 100, local AS 64496 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path - *> ::/0 fe80::5200:ff:fe02:3@7< - 0 64497 i - *> 2001:db8::6/127 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - *> 2001:db8:0:1::/64 - 2001:db8::1 0 32768 ? - *> 2001:db8:0:3::/64 - 2001:db8::5@11< 0 32768 ? - *> 2001:db8:1::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - *> 2001:db8:2::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - *> 2001:db8:3::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - - - # show ip route vrf - # show ipv6 route vrf - - vyos@Core:~$ show ip route vrf LAN1 - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF LAN1: - B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57 - C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59 - B 10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38 - B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38 - B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - - vyos@Core# run show ipv6 route vrf LAN1 - Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - VRF LAN1: - B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - C>* 2001:db8::/127 is directly connected, eth0, 05:33:43 - B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03 - B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50 - B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 - C>* fe80::/64 is directly connected, eth0, 05:33:43 - - -As we can see in the BGP table any imported route has been injected with a "@" -followed by the VPN id; In the routing table of the VRF, if the route was -installed, we can see -between round brackets- the exported VRF table. - -Step 4: End to End verification -------------------------------- - - -Now we perform some end-to-end testing - -- From Management to LAN1/LAN2 - - -.. code-block:: none - - vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1 - PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data. - 64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms - 64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms - 64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms - ^C - --- 10.0.0.1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2005ms - rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms - vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1 - PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data. - 64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms - 64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms - ^C - --- 172.16.0.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1001ms - rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms - vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1 - PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes - 64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms - 64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms - 64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms - ^C - --- 2001:db8:0:1::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2003ms - rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms - vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1 - PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes - 64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms - ^C - --- 2001:db8:0:2::1 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3005ms - rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms - -- From Management to Outside (fails as intended) - -.. stop_vyoslinter - -.. code-block:: none - - vyos@Management:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58 - C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05 - C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03 - vyos@Management:~$ ping 192.0.2.1 - PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data. - From 192.168.3.1 icmp_seq=1 Destination Net Unreachable - From 192.168.3.1 icmp_seq=2 Destination Net Unreachable - ^C - --- 192.0.2.1 ping statistics --- - 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - - vyos@Management:~$ ping 195.51.100.1 - PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data. - From 192.168.3.1 icmp_seq=1 Destination Net Unreachable - From 192.168.3.1 icmp_seq=2 Destination Net Unreachable - From 192.168.3.1 icmp_seq=3 Destination Net Unreachable - ^C - --- 195.51.100.1 ping statistics --- - 3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms - - vyos@Management:~$ ping 2001:db8:1::1 - PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes - From 2001:db8::4 icmp_seq=1 Destination unreachable: No route - From 2001:db8::4 icmp_seq=2 Destination unreachable: No route - ^C - --- 2001:db8:1::1 ping statistics --- - 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - - vyos@Management:~$ ping 2001:db8:2::1 - PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes - From 2001:db8::4 icmp_seq=1 Destination unreachable: No route - From 2001:db8::4 icmp_seq=2 Destination unreachable: No route - ^C - --- 2001:db8:2::1 ping statistics --- - 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - -.. start_vyoslinter - -- LAN1 to Outside - - - -.. code-block:: none - - vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1 - PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data. - 64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms - 64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms - 64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms - ^C - --- 192.0.2.1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2004ms - rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms - vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1 - PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data. - 64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms - 64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms - ^C - --- 198.51.100.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1002ms - rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms - vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1 - PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data. - 64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms - 64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms - ^C - --- 203.0.113.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1003ms - rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms - vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1 - PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes - 64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms - 64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms - 64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms - ^C - --- 2001:db8:1::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2004ms - rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms - vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1 - PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes - 64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms - 64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms - 64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms - ^C - --- 2001:db8:2::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2003ms - rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms - - -.. note:: we are using "source-address" option cause we are not redistributing - connected interfaces into BGP on the Core router hence there is no comeback - route and ping will fail. - -- LAN1 to LAN2 - - - -.. code-block:: none - - vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1 - PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data. - 64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms - 64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms - ^C - --- 172.16.0.1 ping statistics --- - 2 packets transmitted, 2 received, 0% packet loss, time 1002ms - rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms - vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1 - PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes - 64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms - 64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms - ^C - --- 2001:db8:0:2::1 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 2003ms - rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms - -*********** -Conclusions -*********** - -Inter-VRF routing is a well-known solution to address complex routing scenarios -that enable -in a dynamic way- to leak routes between VRFs. Is recommended to -take special consideration while designing route-targets and its application as -it can minimize future interventions while creating a new VRF will automatically -take the desired effect in its propagation. - -********** -Appendix-A -********** - -Full configuration from all devices -=================================== - -- Core - - -.. code-block:: none - - set interfaces ethernet eth0 address '10.1.1.1/30' - set interfaces ethernet eth0 address '2001:db8::/127' - set interfaces ethernet eth0 vrf 'LAN1' - set interfaces ethernet eth1 address '172.16.2.1/30' - set interfaces ethernet eth1 address '2001:db8::2/127' - set interfaces ethernet eth1 vrf 'LAN2' - set interfaces ethernet eth2 address '192.168.3.1/30' - set interfaces ethernet eth2 address '2001:db8::4/127' - set interfaces ethernet eth2 vrf 'Management' - set interfaces ethernet eth3 address '10.2.2.1/30' - set interfaces ethernet eth3 address '2001:db8::6/127' - set interfaces ethernet eth3 vrf 'Internet' - set protocols bgp address-family ipv4-unicast - set protocols bgp system-as '64496' - set vrf name Internet protocols bgp address-family ipv4-unicast export vpn - set vrf name Internet protocols bgp address-family ipv4-unicast import vpn - set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' - set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' - set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' - set vrf name Internet protocols bgp address-family ipv6-unicast export vpn - set vrf name Internet protocols bgp address-family ipv6-unicast import vpn - set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' - set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' - set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' - set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast - set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497' - set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast - set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497' - set vrf name Internet table '104' - set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn - set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn - set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' - set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static - set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' - set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' - set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn - set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn - set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' - set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static - set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' - set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' - set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2 - set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1 - set vrf name LAN1 table '101' - set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn - set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn - set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' - set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static - set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' - set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' - set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn - set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn - set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' - set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static - set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' - set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' - set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2 - set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3 - set vrf name LAN2 table '102' - set vrf name Management protocols bgp address-family ipv4-unicast export vpn - set vrf name Management protocols bgp address-family ipv4-unicast import vpn - set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' - set vrf name Management protocols bgp address-family ipv4-unicast redistribute static - set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' - set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' - set vrf name Management protocols bgp address-family ipv6-unicast export vpn - set vrf name Management protocols bgp address-family ipv6-unicast import vpn - set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' - set vrf name Management protocols bgp address-family ipv6-unicast redistribute static - set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' - set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' - set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2 - set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5 - set vrf name Management table '103' - - -- LAN1 - - -.. code-block:: none - - set interfaces dummy dum0 address '10.0.0.1/24' - set interfaces dummy dum0 address '2001:db8:0:1::1/64' - set interfaces ethernet eth0 address '10.1.1.2/30' - set interfaces ethernet eth0 address '2001:db8::1/127' - set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 - set protocols static route6 ::/0 next-hop 2001:db8::* - -- LAN2 - - - -.. code-block:: none - - set interfaces dummy dum0 address '172.16.0.1/24' - set interfaces dummy dum0 address '2001:db8:0:2::1/64' - set interfaces ethernet eth0 hw-id '50:00:00:03:00:00' - set interfaces ethernet eth1 address '172.16.2.2/30' - set interfaces ethernet eth1 address '2001:db8::3/127' - set protocols static route 0.0.0.0/0 next-hop 172.16.2.1 - set protocols static route6 ::/0 next-hop 2001:db8::2 - -- Management - - -.. code-block:: none - - set interfaces dummy dum0 address '192.168.0.1/24' - set interfaces dummy dum0 address '2001:db8:0:3::1/64' - set interfaces ethernet eth2 address '192.168.3.2/30' - set interfaces ethernet eth2 address '2001:db8::5/127' - set protocols static route 0.0.0.0/0 next-hop 192.168.3.1 - set protocols static route6 ::/0 next-hop 2001:db8::4 - -- ISP - - -.. code-block:: none - - set interfaces dummy dum0 address '192.0.2.1/24' - set interfaces dummy dum0 address '2001:db8:1::1/48' - set interfaces dummy dum1 address '198.51.100.1/24' - set interfaces dummy dum1 address '2001:db8:2::1/48' - set interfaces dummy dum2 address '203.0.113.1/24' - set interfaces dummy dum2 address '2001:db8:3::1/48' - set interfaces ethernet eth3 address '10.2.2.2/30' - set interfaces ethernet eth3 address '2001:db8::7/127' - set protocols bgp address-family ipv4-unicast redistribute connected - set protocols bgp address-family ipv6-unicast redistribute connected - set protocols bgp system-as '64497' - set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate - set protocols bgp neighbor 10.2.2.1 remote-as '64496' - set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate - set protocols bgp neighbor 2001:db8::6 remote-as '64496' - set protocols static route 0.0.0.0/0 next-hop 10.2.2.1 - set protocols static route6 ::/0 next-hop 2001:db8::6 - -********** -Appendix-B -********** - -Route-Filtering -=============== - - -When importing routes using MP-BGP it is possible to filter a subset of them -before are injected in the BGP table. One of the most common case is to use a -route-map with an prefix-list. - -- Configuration - - - -We create a prefix-list first and add all the routes we need to. - -.. stop_vyoslinter - -.. code-block:: none - - # set both ipv4 and ipv6 policies - - set policy prefix-list LAN2-Internet rule 1 action 'permit' - set policy prefix-list LAN2-Internet rule 1 le '24' - set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16' - set policy prefix-list LAN2-Internet rule 2 action 'permit' - set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24' - set policy prefix-list LAN2-Internet rule 3 action 'permit' - set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24' - set policy prefix-list LAN2-Internet rule 4 action 'permit' - set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24' - - set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit' - set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48' - set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit' - set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48' - set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit' - set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64' - set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' - set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' - -.. start_vyoslinter - -Then add a route-map and reference to above prefix. Consider that the actions -taken inside the prefix will MATCH the routes that will be affected by the -actions inside the rules of the route-map. - -.. code-block:: none - - set policy route-map LAN2-Internet rule 1 action 'permit' - set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet' - - set policy route-map LAN2-Internet-v6 rule 1 action 'permit' - set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-Internet-v6' - -We are using a "white list" approach by allowing only what is necessary. In case -that need to implement a "black list" approach then you will need to change the -action in the route-map for a deny BUT you need to add a rule that permits the -rest due to the implicit deny in the route-map. - -Then we need to attach the policy to the BGP process. This needs to be under -the import statement in the vrf we need to filter. - -.. code-block:: none - - set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet' - set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6' - - -- Verification - - -.. code-block:: none - - # show ip route vrf LAN2 - - B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28 - S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32 - C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39 - B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 - B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Managment), weight 1, 00:45:27 - B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 - - # show ipv6 route vrf LAN2 - - C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26 - B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17 - S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21 - B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Managment), weight 1, 00:46:16 - B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 - B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 - C>* fe80::/64 is directly connected, eth1, 00:46:27 - -As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able -to select which routes are effectively imported and installed. - diff --git a/docs/configexamples/ipsec-cisco-policy-based.md b/docs/configexamples/ipsec-cisco-policy-based.md new file mode 100644 index 00000000..7a31601d --- /dev/null +++ b/docs/configexamples/ipsec-cisco-policy-based.md @@ -0,0 +1,363 @@ +--- +lastproofread: '2025-06-26' +--- + +(examples-ipsec-cisco-policy-based)= + +# Policy-based Site-to-Site VPN IPsec between VyOS and Cisco + +This document is to describe a basic setup using policy-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +Cisco IOS. Cisco initiates IPsec connection only if interesting +traffic present. For stable work we recommend configuring an +initiator role on VyOS side. + +## Network Topology + +```{image} /_static/images/cisco-vpn-ipsec.webp +:align: center +:alt: Network Topology Diagram +``` + + +## Prerequirements + +**VyOS:** + +```{eval-rst} ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ +``` + +**Cisco:** + +```{eval-rst} ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ +``` + +**IKE parameters:** + +```{eval-rst} ++-------------------+---------+ +| Encryption | AES-256 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 2 | ++-------------------+---------+ +``` + +**IPsec parameters:** + +```{eval-rst} ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ +``` + +```{eval-rst} +**Traffic Selectors** + 192.168.0.0/24 <==> 192.168.10.0/24 + + 192.168.1.0/24 <==> 192.168.11.0/24 +``` + +**Hosts configuration** + +```{eval-rst} ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ +``` + +## Configuration + +:::{note} +Pfs is disabled in Cisco by default. +::: + +### VyOS + +```none +set interfaces ethernet eth0 address '10.0.1.2/30' +set interfaces ethernet eth1 address '192.168.0.1/24' +set interfaces ethernet eth2 address '192.168.1.1/24' +set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 +set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' +set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' +set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' +set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' +set vpn ipsec esp-group ESP-GROUP lifetime '3600' +set vpn ipsec esp-group ESP-GROUP pfs 'disable' +set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' +set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' +set vpn ipsec ike-group IKE-GROUP close-action 'start' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' +set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' +set vpn ipsec ike-group IKE-GROUP lifetime '28800' +set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' +set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes256' +set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' +set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' +set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' +set vpn ipsec site-to-site peer CISCO connection-type 'initiate' +set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' +set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' +set vpn ipsec site-to-site peer CISCO tunnel 1 local prefix '192.168.0.0/24' +set vpn ipsec site-to-site peer CISCO tunnel 1 remote prefix '192.168.10.0/24' +set vpn ipsec site-to-site peer CISCO tunnel 2 local prefix '192.168.1.0/24' +set vpn ipsec site-to-site peer CISCO tunnel 2 remote prefix '192.168.11.0/24' +``` + + +### Cisco + +```none +crypto ikev2 proposal aes-cbc-256-proposal + encryption aes-cbc-256 + integrity sha1 + group 14 +! +crypto ikev2 policy policy1 + match address local 10.0.2.2 + proposal aes-cbc-256-proposal +! +crypto ikev2 keyring keys + peer VyOS + address 10.0.1.2 + pre-shared-key local test + pre-shared-key remote test +! +crypto ikev2 profile IKEv2-profile + match identity remote address 10.0.1.2 255.255.255.255 + authentication remote pre-share + authentication local pre-share + keyring local keys + lifetime 28800 +! +crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac + mode tunnel +! +crypto map IPSEC-map 10 ipsec-isakmp + set peer 10.0.1.2 + set security-association lifetime seconds 3600 + set transform-set TS + set ikev2-profile IKEv2-profile + match address cryptoacl +! +interface GigabitEthernet0/0 + ip address 10.0.2.2 255.255.255.252 + crypto map IPSEC-map +! +interface GigabitEthernet0/1 + ip address 192.168.10.1 255.255.255.0 +! +interface GigabitEthernet0/2 + ip address 192.168.11.1 255.255.255.0 +! +ip route 0.0.0.0 0.0.0.0 10.0.2.1 +! +ip access-list extended cryptoacl + permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255 + permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255 +``` + + +## Monitoring + +### Monitoring on VyOS side + +IKE SAs: + +```none +vyos@vyos:~$ show vpn ike sa +Peer ID / IP Local ID / IP +------------ ------------- +10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv2 AES_CBC_256 HMAC_SHA1_96 MODP_2048 no 304 26528 +``` + +IPsec SAs: + +```none +vyos@vyos:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +-------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- +CISCO-tunnel-1 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 +CISCO-tunnel-2 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 +``` + + +### Monitoring on Cisco side + +IKE SAs: + +```none +Cisco#show crypto ikev2 sa + IPv4 Crypto IKEv2 SA + +Tunnel-id Local Remote fvrf/ivrf Status +1 10.0.2.2/4500 10.0.1.2/4500 none/none READY + Encr: AES-CBC, keysize: 256, PRF: SHA1, Hash: SHA96, DH Grp:14, Auth sign: PSK, Auth verify: PSK + Life/Active Time: 28800/471 sec + + IPv6 Crypto IKEv2 SA +``` + +IPsec SAs: + +```none + Cisco#show crypto ipsec sa + +interface: GigabitEthernet0/0 + Crypto map tag: IPSEC-map, local addr 10.0.2.2 + + protected vrf: (none) + local ident (addr/mask/prot/port): (192.168.11.0/255.255.255.0/0/0) + remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) + current_peer 10.0.1.2 port 4500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 + #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC81F83DA(3357508570) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x8C63C51E(2355348766) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 23, flow_id: SW:23, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4231729/3585) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC81F83DA(3357508570) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 24, flow_id: SW:24, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4231729/3585) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: + + protected vrf: (none) + local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0) + remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0) + current_peer 10.0.1.2 port 4500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 + #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC40C7A20(3289152032) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x2948B6CB(692631243) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 21, flow_id: SW:21, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4194891/3581) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC40C7A20(3289152032) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 22, flow_id: SW:22, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4194891/3581) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: +``` + + +### Checking Connectivity + +ICMP packets from PC1 to PC3. + +```none +PC1> ping 192.168.10.2 + +84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms +84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms +84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms +84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms +84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms +``` + +ICMP packets from PC2 to PC4. + +```none +PC2> ping 192.168.11.2 + +84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms +84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms +84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms +``` diff --git a/docs/configexamples/ipsec-cisco-policy-based.rst b/docs/configexamples/ipsec-cisco-policy-based.rst deleted file mode 100644 index 257d98a1..00000000 --- a/docs/configexamples/ipsec-cisco-policy-based.rst +++ /dev/null @@ -1,355 +0,0 @@ -:lastproofread: 2025-06-26 - -.. _examples-ipsec-cisco-policy-based: - -########################################################## -Policy-based Site-to-Site VPN IPsec between VyOS and Cisco -########################################################## - -This document is to describe a basic setup using policy-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -Cisco IOS. Cisco initiates IPsec connection only if interesting -traffic present. For stable work we recommend configuring an -initiator role on VyOS side. - -Network Topology -================ - -.. image:: /_static/images/cisco-vpn-ipsec.* - :align: center - :alt: Network Topology Diagram - -Prerequirements -=============== - -**VyOS:** - -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ - -**Cisco:** - -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ - -**IKE parameters:** - -+-------------------+---------+ -| Encryption | AES-256 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 2 | -+-------------------+---------+ - -**IPsec parameters:** - -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ - -**Traffic Selectors** - 192.168.0.0/24 <==> 192.168.10.0/24 - - 192.168.1.0/24 <==> 192.168.11.0/24 - -**Hosts configuration** - -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ - -Configuration -============= - -.. note:: Pfs is disabled in Cisco by default. - -VyOS ----- - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.1.2/30' - set interfaces ethernet eth1 address '192.168.0.1/24' - set interfaces ethernet eth2 address '192.168.1.1/24' - set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 - set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' - set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' - set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' - set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' - set vpn ipsec esp-group ESP-GROUP lifetime '3600' - set vpn ipsec esp-group ESP-GROUP pfs 'disable' - set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' - set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' - set vpn ipsec ike-group IKE-GROUP close-action 'start' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' - set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' - set vpn ipsec ike-group IKE-GROUP lifetime '28800' - set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' - set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes256' - set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' - set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' - set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' - set vpn ipsec site-to-site peer CISCO connection-type 'initiate' - set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' - set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' - set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' - set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' - set vpn ipsec site-to-site peer CISCO tunnel 1 local prefix '192.168.0.0/24' - set vpn ipsec site-to-site peer CISCO tunnel 1 remote prefix '192.168.10.0/24' - set vpn ipsec site-to-site peer CISCO tunnel 2 local prefix '192.168.1.0/24' - set vpn ipsec site-to-site peer CISCO tunnel 2 remote prefix '192.168.11.0/24' - -Cisco ------ - -.. code-block:: none - - crypto ikev2 proposal aes-cbc-256-proposal - encryption aes-cbc-256 - integrity sha1 - group 14 - ! - crypto ikev2 policy policy1 - match address local 10.0.2.2 - proposal aes-cbc-256-proposal - ! - crypto ikev2 keyring keys - peer VyOS - address 10.0.1.2 - pre-shared-key local test - pre-shared-key remote test - ! - crypto ikev2 profile IKEv2-profile - match identity remote address 10.0.1.2 255.255.255.255 - authentication remote pre-share - authentication local pre-share - keyring local keys - lifetime 28800 - ! - crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac - mode tunnel - ! - crypto map IPSEC-map 10 ipsec-isakmp - set peer 10.0.1.2 - set security-association lifetime seconds 3600 - set transform-set TS - set ikev2-profile IKEv2-profile - match address cryptoacl - ! - interface GigabitEthernet0/0 - ip address 10.0.2.2 255.255.255.252 - crypto map IPSEC-map - ! - interface GigabitEthernet0/1 - ip address 192.168.10.1 255.255.255.0 - ! - interface GigabitEthernet0/2 - ip address 192.168.11.1 255.255.255.0 - ! - ip route 0.0.0.0 0.0.0.0 10.0.2.1 - ! - ip access-list extended cryptoacl - permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255 - permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255 - - - -Monitoring -========== - -Monitoring on VyOS side ------------------------ - -IKE SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ike sa - Peer ID / IP Local ID / IP - ------------ ------------- - 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv2 AES_CBC_256 HMAC_SHA1_96 MODP_2048 no 304 26528 - -IPsec SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - -------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- - CISCO-tunnel-1 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 - CISCO-tunnel-2 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 - -Monitoring on Cisco side ------------------------- - -IKE SAs: - -.. code-block:: none - - Cisco#show crypto ikev2 sa - IPv4 Crypto IKEv2 SA - - Tunnel-id Local Remote fvrf/ivrf Status - 1 10.0.2.2/4500 10.0.1.2/4500 none/none READY - Encr: AES-CBC, keysize: 256, PRF: SHA1, Hash: SHA96, DH Grp:14, Auth sign: PSK, Auth verify: PSK - Life/Active Time: 28800/471 sec - - IPv6 Crypto IKEv2 SA - - -IPsec SAs: - -.. code-block:: none - - Cisco#show crypto ipsec sa - - interface: GigabitEthernet0/0 - Crypto map tag: IPSEC-map, local addr 10.0.2.2 - - protected vrf: (none) - local ident (addr/mask/prot/port): (192.168.11.0/255.255.255.0/0/0) - remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) - current_peer 10.0.1.2 port 4500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 - #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC81F83DA(3357508570) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x8C63C51E(2355348766) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 23, flow_id: SW:23, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4231729/3585) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC81F83DA(3357508570) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 24, flow_id: SW:24, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4231729/3585) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: - - protected vrf: (none) - local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0) - remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0) - current_peer 10.0.1.2 port 4500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 - #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC40C7A20(3289152032) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x2948B6CB(692631243) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 21, flow_id: SW:21, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4194891/3581) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC40C7A20(3289152032) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 22, flow_id: SW:22, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4194891/3581) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: - -Checking Connectivity ---------------------- - -ICMP packets from PC1 to PC3. - -.. code-block:: none - - PC1> ping 192.168.10.2 - - 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms - 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms - 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms - 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms - 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms - -ICMP packets from PC2 to PC4. - -.. code-block:: none - - PC2> ping 192.168.11.2 - - 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms - 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms - 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/ipsec-cisco-route-based.md b/docs/configexamples/ipsec-cisco-route-based.md new file mode 100644 index 00000000..40a3985b --- /dev/null +++ b/docs/configexamples/ipsec-cisco-route-based.md @@ -0,0 +1,406 @@ +--- +lastproofread: '2025-06-26' +--- + +(examples-ipsec-cisco-route-based)= + +# Route-based Site-to-Site VPN IPsec between VyOS and Cisco + +This document is to describe a basic setup using route-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +Cisco IOS. Cisco initiates IPsec connection only if interesting +traffic present. For stable work we recommend configuring an +initiator role on VyOS side. OSPF is selected as routing protocol +inside the tunnel. + +## Network Topology + +```{eval-rst} +.. image:: /_static/images/cisco-vpn-ipsec.webp + :align: center + :alt: Network Topology Diagram +``` + + +## Prerequirements + +**VyOS:** + +```{eval-rst} ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ +``` + +**Cisco:** + +```{eval-rst} ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ +``` + +**IKE parameters:** + +```{eval-rst} ++-------------------+---------+ +| Encryption | AES-128 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 1 | ++-------------------+---------+ +``` + +**IPsec parameters:** + +```{eval-rst} ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ +``` + +**Hosts configuration** + +```{eval-rst} ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ +``` + +## Configuration + +:::{note} +Pfs is disabled in Cisco by default. +::: + +### VyOS + +```none +set interfaces ethernet eth0 address '10.0.1.2/30' +set interfaces ethernet eth1 address '192.168.0.1/24' +set interfaces ethernet eth2 address '192.168.1.1/24' +set interfaces vti vti1 address '10.100.100.1/30' +set interfaces vti vti1 mtu '1438' +set protocols ospf area 0 network '10.100.100.0/30' +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '192.168.1.0/24' +set protocols ospf interface eth1 passive +set protocols ospf interface eth2 passive +set protocols ospf interface vti1 network 'point-to-point' +set protocols ospf parameters router-id '2.2.2.2' +set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 +set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' +set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' +set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' +set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' +set vpn ipsec esp-group ESP-GROUP lifetime '3600' +set vpn ipsec esp-group ESP-GROUP pfs 'disable' +set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' +set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' +set vpn ipsec ike-group IKE-GROUP close-action 'start' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' +set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' +set vpn ipsec ike-group IKE-GROUP lifetime '28800' +set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' +set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' +set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' +set vpn ipsec options disable-route-autoinstall +set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' +set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' +set vpn ipsec site-to-site peer CISCO connection-type 'initiate' +set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' +set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' +set vpn ipsec site-to-site peer CISCO vti bind 'vti1' +``` + + +### Cisco + +```none +crypto isakmp policy 10 + encr aes + authentication pre-share + group 14 + lifetime 28800 +crypto isakmp key test address 10.0.1.2 +! +! +crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac + mode transport +! +crypto ipsec profile IPsec-profile + set transform-set TS +! +! +! +! +! +! +! +interface Loopback0 + ip address 1.1.1.1 255.255.255.255 +! +interface Tunnel10 + ip address 10.100.100.2 255.255.255.252 + ip ospf network point-to-point + tunnel source GigabitEthernet0/0 + tunnel mode ipsec ipv4 + tunnel destination 10.0.1.2 + tunnel protection ipsec profile IPsec-profile +! +interface GigabitEthernet0/0 + ip address 10.0.2.2 255.255.255.252 + duplex auto + speed auto + media-type rj45 +! +interface GigabitEthernet0/1 + ip address 192.168.10.1 255.255.255.0 + duplex auto + speed auto + media-type rj45 +! +interface GigabitEthernet0/2 + ip address 192.168.11.1 255.255.255.0 + duplex auto + speed auto + media-type rj45 +! +router ospf 1 + router-id 1.1.1.1 + passive-interface GigabitEthernet0/1 + passive-interface GigabitEthernet0/2 + network 10.100.100.0 0.0.0.3 area 0 + network 192.168.10.0 0.0.0.255 area 0 + network 192.168.11.0 0.0.0.255 area 0 +! +ip route 0.0.0.0 0.0.0.0 10.0.2.1 +``` + + +## Monitoring + +### Monitoring on VyOS side + +IKE SAs: + +```none +vyos@vyos:~$ show vpn ike sa +Peer ID / IP Local ID / IP +------------ ------------- +10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 8175 18439 +``` + +IPsec SAs: + +```none +vyos@vyos:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- +CISCO-vti up 34m59s 17K/14K 224/213 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 +``` + +OSPF Neighbor Status: + +```none +vyos@vyos:~$ show ip ospf neighbor + +Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL +1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 +``` + +Routing Table: + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure +S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54 +C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59 +L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59 +O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50 +C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50 +L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50 +O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54 +C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59 +L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59 +O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54 +C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59 +L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59 +O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 +O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 +``` + + +### Monitoring on Cisco side + +IKE SAs: + +```none +Cisco#show crypto isakmp sa +IPv4 Crypto ISAKMP SA +dst src state conn-id status +10.0.1.2 10.0.2.2 QM_IDLE 1002 ACTIVE + +IPv6 Crypto ISAKMP SA +``` + +IPsec SAs: + +```none +Cisco#show crypto ipsec sa + +interface: Tunnel10 + Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2 + + protected vrf: (none) + local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) + remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) + current_peer 10.0.1.2 port 500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295 + #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC3E9B307(3286872839) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x2740C328(658555688) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0 + sa timing: remaining key lifetime (k/sec): (4173824/1401) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC3E9B307(3286872839) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0 + sa timing: remaining key lifetime (k/sec): (4173819/1401) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: +``` + +OSPF Neighbor Status: + +```none +Cisco# show ip ospf neighbor + +Neighbor ID Pri State Dead Time Address Interface +2.2.2.2 0 FULL/ - 00:00:35 10.100.100.1 Tunnel10 +``` + +Routing Table: + +```none +Cisco#show ip route +Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP + D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area + N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 + E1 - OSPF external type 1, E2 - OSPF external type 2 + i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 + ia - IS-IS inter area, * - candidate default, U - per-user static route + o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + a - application route + + - replicated route, % - next hop override, p - overrides from PfR + +Gateway of last resort is 10.0.2.1 to network 0.0.0.0 + +S* 0.0.0.0/0 [1/0] via 10.0.2.1 + 1.0.0.0/32 is subnetted, 1 subnets +C 1.1.1.1 is directly connected, Loopback0 + 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks +C 10.0.2.0/30 is directly connected, GigabitEthernet0/0 +L 10.0.2.2/32 is directly connected, GigabitEthernet0/0 +C 10.100.100.0/30 is directly connected, Tunnel10 +L 10.100.100.2/32 is directly connected, Tunnel10 +O 192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 +O 192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 + 192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks +C 192.168.10.0/24 is directly connected, GigabitEthernet0/1 +L 192.168.10.1/32 is directly connected, GigabitEthernet0/1 + 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks +C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 +L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 +``` + + +### Checking Connectivity + +ICMP packets from PC1 to PC3. + +```none +PC1> ping 192.168.10.2 + +84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms +84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms +84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms +84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms +84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms +``` + +ICMP packets from PC2 to PC4. + +```none +PC2> ping 192.168.11.2 + +84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms +84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms +84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms +``` diff --git a/docs/configexamples/ipsec-cisco-route-based.rst b/docs/configexamples/ipsec-cisco-route-based.rst deleted file mode 100644 index 553c5e2a..00000000 --- a/docs/configexamples/ipsec-cisco-route-based.rst +++ /dev/null @@ -1,420 +0,0 @@ -:lastproofread: 2025-06-26 - -.. _examples-ipsec-cisco-route-based: - -######################################################### -Route-based Site-to-Site VPN IPsec between VyOS and Cisco -######################################################### - -This document is to describe a basic setup using route-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -Cisco IOS. Cisco initiates IPsec connection only if interesting -traffic present. For stable work we recommend configuring an -initiator role on VyOS side. OSPF is selected as routing protocol -inside the tunnel. - -Network Topology -================ - -.. image:: /_static/images/cisco-vpn-ipsec.* - :align: center - :alt: Network Topology Diagram - -Prerequirements -=============== - -**VyOS:** - -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ - -**Cisco:** - -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ - -**IKE parameters:** - -+-------------------+---------+ -| Encryption | AES-128 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 1 | -+-------------------+---------+ - -**IPsec parameters:** - -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ - -**Hosts configuration** - -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ - -Configuration -============= - -.. note:: Pfs is disabled in Cisco by default. - -VyOS ----- - -.. stop_vyoslinter - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.1.2/30' - set interfaces ethernet eth1 address '192.168.0.1/24' - set interfaces ethernet eth2 address '192.168.1.1/24' - set interfaces vti vti1 address '10.100.100.1/30' - set interfaces vti vti1 mtu '1438' - set protocols ospf area 0 network '10.100.100.0/30' - set protocols ospf area 0 network '192.168.0.0/24' - set protocols ospf area 0 network '192.168.1.0/24' - set protocols ospf interface eth1 passive - set protocols ospf interface eth2 passive - set protocols ospf interface vti1 network 'point-to-point' - set protocols ospf parameters router-id '2.2.2.2' - set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 - set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' - set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' - set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' - set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' - set vpn ipsec esp-group ESP-GROUP lifetime '3600' - set vpn ipsec esp-group ESP-GROUP pfs 'disable' - set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' - set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' - set vpn ipsec ike-group IKE-GROUP close-action 'start' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' - set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' - set vpn ipsec ike-group IKE-GROUP lifetime '28800' - set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' - set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' - set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' - set vpn ipsec options disable-route-autoinstall - set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' - set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' - set vpn ipsec site-to-site peer CISCO connection-type 'initiate' - set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' - set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' - set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' - set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' - set vpn ipsec site-to-site peer CISCO vti bind 'vti1' - -.. start_vyoslinter - -Cisco ------ - -.. stop_vyoslinter - -.. code-block:: none - - crypto isakmp policy 10 - encr aes - authentication pre-share - group 14 - lifetime 28800 - crypto isakmp key test address 10.0.1.2 - ! - ! - crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac - mode transport - ! - crypto ipsec profile IPsec-profile - set transform-set TS - ! - ! - ! - ! - ! - ! - ! - interface Loopback0 - ip address 1.1.1.1 255.255.255.255 - ! - interface Tunnel10 - ip address 10.100.100.2 255.255.255.252 - ip ospf network point-to-point - tunnel source GigabitEthernet0/0 - tunnel mode ipsec ipv4 - tunnel destination 10.0.1.2 - tunnel protection ipsec profile IPsec-profile - ! - interface GigabitEthernet0/0 - ip address 10.0.2.2 255.255.255.252 - duplex auto - speed auto - media-type rj45 - ! - interface GigabitEthernet0/1 - ip address 192.168.10.1 255.255.255.0 - duplex auto - speed auto - media-type rj45 - ! - interface GigabitEthernet0/2 - ip address 192.168.11.1 255.255.255.0 - duplex auto - speed auto - media-type rj45 - ! - router ospf 1 - router-id 1.1.1.1 - passive-interface GigabitEthernet0/1 - passive-interface GigabitEthernet0/2 - network 10.100.100.0 0.0.0.3 area 0 - network 192.168.10.0 0.0.0.255 area 0 - network 192.168.11.0 0.0.0.255 area 0 - ! - ip route 0.0.0.0 0.0.0.0 10.0.2.1 - -.. start_vyoslinter - - -Monitoring -========== - -Monitoring on VyOS side ------------------------ - -IKE SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ike sa - Peer ID / IP Local ID / IP - ------------ ------------- - 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 8175 18439 - - - -IPsec SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - ------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- - CISCO-vti up 34m59s 17K/14K 224/213 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 - -OSPF Neighbor Status: - -.. stop_vyoslinter - -.. code-block:: none - - vyos@vyos:~$ show ip ospf neighbor - - Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL - 1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 - -.. start_vyoslinter - -Routing Table: - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - - S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54 - C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59 - L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59 - O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50 - C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50 - L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50 - O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54 - C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59 - L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59 - O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54 - C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59 - L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59 - O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 - O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 - -Monitoring on Cisco side ------------------------- - -.. stop_vyoslinter - -IKE SAs: - -.. code-block:: none - - Cisco#show crypto isakmp sa - IPv4 Crypto ISAKMP SA - dst src state conn-id status - 10.0.1.2 10.0.2.2 QM_IDLE 1002 ACTIVE - - IPv6 Crypto ISAKMP SA - - - -IPsec SAs: - -.. code-block:: none - - Cisco#show crypto ipsec sa - - interface: Tunnel10 - Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2 - - protected vrf: (none) - local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) - remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) - current_peer 10.0.1.2 port 500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295 - #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC3E9B307(3286872839) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x2740C328(658555688) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0 - sa timing: remaining key lifetime (k/sec): (4173824/1401) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC3E9B307(3286872839) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0 - sa timing: remaining key lifetime (k/sec): (4173819/1401) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: - -OSPF Neighbor Status: - -.. code-block:: none - - Cisco# show ip ospf neighbor - - Neighbor ID Pri State Dead Time Address Interface - 2.2.2.2 0 FULL/ - 00:00:35 10.100.100.1 Tunnel10 - -Routing Table: - -.. code-block:: none - - Cisco#show ip route - Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP - D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area - N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 - E1 - OSPF external type 1, E2 - OSPF external type 2 - i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 - ia - IS-IS inter area, * - candidate default, U - per-user static route - o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP - a - application route - + - replicated route, % - next hop override, p - overrides from PfR - - Gateway of last resort is 10.0.2.1 to network 0.0.0.0 - - S* 0.0.0.0/0 [1/0] via 10.0.2.1 - 1.0.0.0/32 is subnetted, 1 subnets - C 1.1.1.1 is directly connected, Loopback0 - 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks - C 10.0.2.0/30 is directly connected, GigabitEthernet0/0 - L 10.0.2.2/32 is directly connected, GigabitEthernet0/0 - C 10.100.100.0/30 is directly connected, Tunnel10 - L 10.100.100.2/32 is directly connected, Tunnel10 - O 192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 - O 192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 - 192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks - C 192.168.10.0/24 is directly connected, GigabitEthernet0/1 - L 192.168.10.1/32 is directly connected, GigabitEthernet0/1 - 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks - C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 - L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 - -.. start_vyoslinter - - -Checking Connectivity ---------------------- - -ICMP packets from PC1 to PC3. - -.. code-block:: none - - PC1> ping 192.168.10.2 - - 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms - 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms - 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms - 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms - 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms - -ICMP packets from PC2 to PC4. - -.. code-block:: none - - PC2> ping 192.168.11.2 - - 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms - 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms - 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/ipsec-pa-route-based.md b/docs/configexamples/ipsec-pa-route-based.md new file mode 100644 index 00000000..c4a9e06c --- /dev/null +++ b/docs/configexamples/ipsec-pa-route-based.md @@ -0,0 +1,412 @@ +--- +lastproofread: '2025-06-26' +--- + +(examples-ipsec-pa-route-based)= + +# Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto + +This document is to describe a basic setup using route-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +PA 11.0.0. OSPF is selected as routing protocol inside the +tunnel. + +Since this example focuses on IPsec configuration it does not +include firewall configuration. + +## Network Topology + +```{image} /_static/images/ipsec-vyos-pa.webp +:align: center +:alt: Network Topology Diagram +``` + + +## Prerequirements + +**VyOS:** + +```{eval-rst} ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ +``` + +**Palo Alto:** + +```{eval-rst} ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ +``` + +**IKE parameters:** + +```{eval-rst} ++-------------------+---------+ +| Encryption | AES-128 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 1 | ++-------------------+---------+ +``` + +**IPsec parameters:** + +```{eval-rst} ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ +``` + +**Hosts configuration** + +```{eval-rst} ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ +``` + +## Configuration + +### VyOS + +```none +set interfaces ethernet eth0 address '10.0.1.2/30' +set interfaces ethernet eth1 address '192.168.0.1/24' +set interfaces ethernet eth2 address '192.168.1.1/24' +set interfaces vti vti1 address '10.100.100.1/30' +set interfaces vti vti1 mtu '1438' +set protocols ospf area 0 network '10.100.100.0/30' +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '192.168.1.0/24' +set protocols ospf interface eth1 passive +set protocols ospf interface eth2 passive +set protocols ospf interface vti1 network 'point-to-point' +set protocols ospf parameters router-id '2.2.2.2' +set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 +set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' +set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' +set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' +set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' +set vpn ipsec esp-group ESP-GROUP lifetime '3600' +set vpn ipsec esp-group ESP-GROUP pfs 'disable' +set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' +set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' +set vpn ipsec ike-group IKE-GROUP close-action 'start' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' +set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' +set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' +set vpn ipsec ike-group IKE-GROUP lifetime '28800' +set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' +set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' +set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' +set vpn ipsec options disable-route-autoinstall +set vpn ipsec site-to-site peer PA authentication local-id '10.0.1.2' +set vpn ipsec site-to-site peer PA authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer PA authentication remote-id '10.0.2.2' +set vpn ipsec site-to-site peer PA connection-type 'initiate' +set vpn ipsec site-to-site peer PA default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer PA ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer PA local-address '10.0.1.2' +set vpn ipsec site-to-site peer PA remote-address '10.0.2.2' +set vpn ipsec site-to-site peer PA vti bind 'vti1' +``` + + +### Palo Alto + +```{eval-rst} +GUI Configuration: + Network -> Network Profiles -> IKE Crypto + + .. image:: /_static/images/PA-IKE-group.webp + :align: center + + Network -> Network Profiles -> IKE Gateways + + .. image:: /_static/images/PA-IKE-GW-1.webp + :align: center + + .. image:: /_static/images/PA-IKE-GW-2.webp + :align: center + + Network -> Network Profiles -> IPSec Crypto + + .. image:: /_static/images/PA-ESP-group.webp + :align: center + + Network -> Interfaces + + .. image:: /_static/images/PA-tunnel-1.webp + :align: center + + .. image:: /_static/images/PA-tunnel-2.webp + :align: center + + .. image:: /_static/images/PA-tunnel-3.webp + :align: center + + Network -> IPSec Tunnels + + .. image:: /_static/images/PA-IPsec-tunnel.webp + :align: center +``` +CLI configuration with OSPF: +```none +set network interface ethernet ethernet1/1 layer3 ip 10.0.2.2/30 +set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow +set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24 +set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow +set network interface ethernet ethernet1/3 layer3 ip 192.168.11.1/24 +set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow +set network interface tunnel units tunnel.1 ip 10.100.100.2/30 +set network interface tunnel units tunnel.1 interface-management-profile Allow +set network interface tunnel units tunnel.1 mtu 1438 +set network profiles interface-management-profile Allow ping yes +set network ike crypto-profiles ike-crypto-profiles IKE-GROUP hash sha1 +set network ike crypto-profiles ike-crypto-profiles IKE-GROUP dh-group group14 +set network ike crypto-profiles ike-crypto-profiles IKE-GROUP encryption aes-128-cbc +set network ike crypto-profiles ike-crypto-profiles IKE-GROUP lifetime seconds 28800 +set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp authentication sha256 +set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp encryption aes-256-cbc +set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP lifetime seconds 3600 +set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP dh-group no-pfs +set network ike gateway VyOS authentication pre-shared-key key test +set network ike gateway VyOS protocol ikev1 dpd enable yes +set network ike gateway VyOS protocol ikev1 exchange-mode main +set network ike gateway VyOS protocol ikev1 ike-crypto-profile IKE-GROUP +set network ike gateway VyOS protocol ikev2 dpd enable yes +set network ike gateway VyOS protocol version ikev1 +set network ike gateway VyOS protocol-common nat-traversal enable yes +set network ike gateway VyOS protocol-common fragmentation enable no +set network ike gateway VyOS protocol-common passive-mode yes +set network ike gateway VyOS local-address interface ethernet1/1 +set network ike gateway VyOS peer-address ip 10.0.1.2 +set network ike gateway VyOS local-id id 10.0.2.2 +set network ike gateway VyOS local-id type ipaddr +set network ike gateway VyOS peer-id id 10.0.1.2 +set network ike gateway VyOS peer-id type ipaddr +set network tunnel ipsec VyOS-tunnel auto-key ike-gateway VyOS +set network tunnel ipsec VyOS-tunnel auto-key ipsec-crypto-profile ESP-GROUP +set network tunnel ipsec VyOS-tunnel tunnel-monitor enable no +set network tunnel ipsec VyOS-tunnel tunnel-interface tunnel.1 +set network tunnel ipsec VyOS-tunnel anti-replay no +set network virtual-router default protocol ospf enable yes +set network virtual-router default protocol ospf area 0.0.0.0 type normal +set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 enable yes +set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 passive no +set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 link-type p2p +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 enable yes +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 passive yes +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 link-type broadcast +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 enable yes +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 passive yes +set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 link-type broadcast +set network virtual-router default protocol ospf router-id 1.1.1.1 +set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] +``` + +## Monitoring +### Monitoring on VyOS side + +IKE SAs: + +```none +vyos@vyos:~$ show vpn ike sa +Peer ID / IP Local ID / IP +------------ ------------- +10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 1372 25802 +``` + +IPsec SAs: + +```none +vyos@vyos:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- +PA-vti up 23m27s 9K/10K 149/151 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 +``` + +OSPF Neighbor Status: + +```none +vyos@vyos:~$ show ip ospf neighbor + +Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL +1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 +``` + +Routing Table: + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:27:30 +C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:27:34 +L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:27:34 +O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:24:34 +C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:24:34 +L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:24:34 +O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:27:29 +C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:27:34 +L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:27:34 +O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:27:29 +C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:27:34 +L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:27:34 +O>* 192.168.10.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 +O>* 192.168.11.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 +``` + +### Monitoring on Palo Alto side + +IKE SAs: + +```none +admin@PA-VM> show vpn ike-sa + +IKEv1 phase-1 SAs +GwID/client IP Peer-Address Gateway Name Role Mode Algorithm Established Expiration V ST Xt Phase2 +-------------- ------------ ------------ ---- ---- --------- ----------- ---------- - -- -- ------ +1 10.0.1.2 VyOS Resp Main PSK/DH14/A128/SHA1 Jul.31 01:35:00 Jul.31 09:35:00 v1 13 1 1 + +Show IKEv1 IKE SA: Total 1 gateways found. 1 ike sa found. + + +IKEv1 phase-2 SAs +Gateway Name TnID Tunnel GwID/IP Role Algorithm SPI(in) SPI(out) MsgID ST Xt +------------ ---- ------ ------- ---- --------- ------- -------- ----- -- -- +VyOS 1 VyOS-tunnel 1 Resp ESP/ /tunl/SHA2 8827A3D9 C204F4FA BD202829 9 1 + +Show IKEv1 phase2 SA: Total 1 gateways found. 1 ike sa found. + + +There is no IKEv2 SA found. +``` + +IPsec SAs: + +```none +admin@PA-VM> show vpn ipsec-sa + +GwID/client IP TnID Peer-Address Tunnel(Gateway) Algorithm SPI(in) SPI(out) life(Sec/KB) remain-time(Sec) +-------------- ---- ------------ --------------- --------- ------- -------- ------------ ---------------- +1 1 10.0.1.2 VyOS-tunnel(VyOS) ESP/A256/SHA256 8827A3D9 C204F4FA 3600/Unlimited 2733 + +Show IPSec SA: Total 1 tunnels found. 1 ipsec sa found. +``` + +OSPF Neighbor Status: + +```none +admin@PA-VM> show routing protocol ospf neighbor + + Options: 0x80:reserved, O:Opaq-LSA capability, DC:demand circuits, EA:Ext-Attr LSA capability, + N/P:NSSA option, MC:multicase, E:AS external LSA capability, T:TOS capability + ========== + virtual router: default + neighbor address: 10.100.100.1 + local address binding: 0.0.0.0 + type: dynamic + status: full + neighbor router ID: 2.2.2.2 + area id: 0.0.0.0 + neighbor priority: 1 + lifetime remain: 32 + messages pending: 0 + LSA request pending: 0 + options: 0x02: E + hello suppressed: no + restart helper status: not helping + restart helper time remaining: 0 + restart helper exit reason: none +``` + +Routing Table: + +```none +admin@PA-VM> show routing route + +flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, + Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast + + +VIRTUAL ROUTER: default (id 1) + ========== +destination nexthop metric flags age interface next-AS +0.0.0.0/0 10.0.2.1 10 A S ethernet1/1 +10.0.2.0/30 10.0.2.2 0 A C ethernet1/1 +10.0.2.2/32 0.0.0.0 0 A H +10.100.100.0/30 0.0.0.0 10 Oi 1273 tunnel.1 +10.100.100.0/30 10.100.100.2 0 A C tunnel.1 +10.100.100.2/32 0.0.0.0 0 A H +192.168.0.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 +192.168.1.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 +192.168.10.0/24 0.0.0.0 10 Oi 1273 ethernet1/2 +192.168.10.0/24 192.168.10.1 0 A C ethernet1/2 +192.168.10.1/32 0.0.0.0 0 A H +192.168.11.0/24 0.0.0.0 10 Oi 1273 ethernet1/3 +192.168.11.0/24 192.168.11.1 0 A C ethernet1/3 +192.168.11.1/32 0.0.0.0 0 A H +total routes shown: 14 +``` + +### Checking Connectivity + +ICMP packets from PC1 to PC3. + +```none +PC1> ping 192.168.10.2 + +84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms +84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms +84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms +84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms +84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms +``` + +ICMP packets from PC2 to PC4. + +```none +PC2> ping 192.168.11.2 + +84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms +84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms +84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms +``` diff --git a/docs/configexamples/ipsec-pa-route-based.rst b/docs/configexamples/ipsec-pa-route-based.rst deleted file mode 100644 index 96349d98..00000000 --- a/docs/configexamples/ipsec-pa-route-based.rst +++ /dev/null @@ -1,436 +0,0 @@ -:lastproofread: 2025-06-26 - -.. _examples-ipsec-pa-route-based: - -############################################################# -Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto -############################################################# - -This document is to describe a basic setup using route-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -PA 11.0.0. OSPF is selected as routing protocol inside the -tunnel. - -Since this example focuses on IPsec configuration it does not -include firewall configuration. - -Network Topology -================ - -.. image:: /_static/images/ipsec-vyos-pa.* - :align: center - :alt: Network Topology Diagram - -Prerequirements -=============== - -**VyOS:** - -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ - -**Cisco:** - -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ - -**IKE parameters:** - -+-------------------+---------+ -| Encryption | AES-128 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 1 | -+-------------------+---------+ - -**IPsec parameters:** - -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ - -**Hosts configuration** - -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ - -Configuration -============= - -VyOS ----- - -.. stop_vyoslinter - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.1.2/30' - set interfaces ethernet eth1 address '192.168.0.1/24' - set interfaces ethernet eth2 address '192.168.1.1/24' - set interfaces vti vti1 address '10.100.100.1/30' - set interfaces vti vti1 mtu '1438' - set protocols ospf area 0 network '10.100.100.0/30' - set protocols ospf area 0 network '192.168.0.0/24' - set protocols ospf area 0 network '192.168.1.0/24' - set protocols ospf interface eth1 passive - set protocols ospf interface eth2 passive - set protocols ospf interface vti1 network 'point-to-point' - set protocols ospf parameters router-id '2.2.2.2' - set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 - set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' - set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' - set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' - set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' - set vpn ipsec esp-group ESP-GROUP lifetime '3600' - set vpn ipsec esp-group ESP-GROUP pfs 'disable' - set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' - set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' - set vpn ipsec ike-group IKE-GROUP close-action 'start' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' - set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' - set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' - set vpn ipsec ike-group IKE-GROUP lifetime '28800' - set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' - set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' - set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' - set vpn ipsec options disable-route-autoinstall - set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' - set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' - set vpn ipsec site-to-site peer CISCO connection-type 'initiate' - set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' - set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' - set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' - set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' - set vpn ipsec site-to-site peer CISCO vti bind 'vti1' - -.. start_vyoslinter - -Palo Alto ---------- - -.. stop_vyoslinter - -GUI Configuration: - Network -> Network Profiles -> IKE Crypto - - .. image:: /_static/images/PA-IKE-group.* - :align: center - - Network -> Network Profiles -> IKE Gateways - - .. image:: /_static/images/PA-IKE-GW-1.* - :align: center - - .. image:: /_static/images/PA-IKE-GW-2.* - :align: center - - Network -> Network Profiles -> IPSec Crypto - - .. image:: /_static/images/PA-ESP-group.* - :align: center - - Network -> Interfaces - - .. image:: /_static/images/PA-tunnel-1.* - :align: center - - .. image:: /_static/images/PA-tunnel-2.* - :align: center - - .. image:: /_static/images/PA-tunnel-3.* - :align: center - - Network -> IPSec Tunnels - - .. image:: /_static/images/PA-IPsec-tunnel.* - :align: center - -CLI configuration with OSPF: - -.. code-block:: none - - set network interface ethernet ethernet1/1 layer3 ip 10.0.2.2/30 - set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow - set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24 - set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow - set network interface ethernet ethernet1/3 layer3 ip 192.168.11.1/24 - set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow - set network interface tunnel units tunnel.1 ip 10.100.100.2/30 - set network interface tunnel units tunnel.1 interface-management-profile Allow - set network interface tunnel units tunnel.1 mtu 1438 - set network profiles interface-management-profile Allow ping yes - set network ike crypto-profiles ike-crypto-profiles IKE-GROUP hash sha1 - set network ike crypto-profiles ike-crypto-profiles IKE-GROUP dh-group group14 - set network ike crypto-profiles ike-crypto-profiles IKE-GROUP encryption aes-128-cbc - set network ike crypto-profiles ike-crypto-profiles IKE-GROUP lifetime seconds 28800 - set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp authentication sha256 - set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp encryption aes-256-cbc - set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP lifetime seconds 3600 - set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP dh-group no-pfs - set network ike gateway VyOS authentication pre-shared-key key test - set network ike gateway VyOS protocol ikev1 dpd enable yes - set network ike gateway VyOS protocol ikev1 exchange-mode main - set network ike gateway VyOS protocol ikev1 ike-crypto-profile IKE-GROUP - set network ike gateway VyOS protocol ikev2 dpd enable yes - set network ike gateway VyOS protocol version ikev1 - set network ike gateway VyOS protocol-common nat-traversal enable yes - set network ike gateway VyOS protocol-common fragmentation enable no - set network ike gateway VyOS protocol-common passive-mode yes - set network ike gateway VyOS local-address interface ethernet1/1 - set network ike gateway VyOS peer-address ip 10.0.1.2 - set network ike gateway VyOS local-id id 10.0.2.2 - set network ike gateway VyOS local-id type ipaddr - set network ike gateway VyOS peer-id id 10.0.1.2 - set network ike gateway VyOS peer-id type ipaddr - set network tunnel ipsec VyOS-tunnel auto-key ike-gateway VyOS - set network tunnel ipsec VyOS-tunnel auto-key ipsec-crypto-profile ESP-GROUP - set network tunnel ipsec VyOS-tunnel tunnel-monitor enable no - set network tunnel ipsec VyOS-tunnel tunnel-interface tunnel.1 - set network tunnel ipsec VyOS-tunnel anti-replay no - set network virtual-router default protocol ospf enable yes - set network virtual-router default protocol ospf area 0.0.0.0 type normal - set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 enable yes - set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 passive no - set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 link-type p2p - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 enable yes - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 passive yes - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 link-type broadcast - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 enable yes - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 passive yes - set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 link-type broadcast - set network virtual-router default protocol ospf router-id 1.1.1.1 - set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] - -.. start_vyoslinter - - -Monitoring -========== - -Monitoring on VyOS side ------------------------ - -IKE SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ike sa - Peer ID / IP Local ID / IP - ------------ ------------- - 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 1372 25802 - - - - -IPsec SAs: - -.. code-block:: none - - vyos@vyos:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - ------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- - PA-vti up 23m27s 9K/10K 149/151 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 - - -OSPF Neighbor Status: - -.. stop_vyoslinter - -.. code-block:: none - - vyos@vyos:~$ show ip ospf neighbor - - Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL - 1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 - -.. start_vyoslinter - - -Routing Table: - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:27:30 - C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:27:34 - L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:27:34 - O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:24:34 - C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:24:34 - L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:24:34 - O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:27:29 - C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:27:34 - L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:27:34 - O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:27:29 - C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:27:34 - L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:27:34 - O>* 192.168.10.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 - O>* 192.168.11.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 - - -Monitoring on Cisco side ------------------------- - -IKE SAs: - -.. code-block:: none - - admin@PA-VM> show vpn ike-sa - - IKEv1 phase-1 SAs - GwID/client IP Peer-Address Gateway Name Role Mode Algorithm Established Expiration V ST Xt Phase2 - -------------- ------------ ------------ ---- ---- --------- ----------- ---------- - -- -- ------ - 1 10.0.1.2 VyOS Resp Main PSK/DH14/A128/SHA1 Jul.31 01:35:00 Jul.31 09:35:00 v1 13 1 1 - - Show IKEv1 IKE SA: Total 1 gateways found. 1 ike sa found. - - - IKEv1 phase-2 SAs - Gateway Name TnID Tunnel GwID/IP Role Algorithm SPI(in) SPI(out) MsgID ST Xt - ------------ ---- ------ ------- ---- --------- ------- -------- ----- -- -- - VyOS 1 VyOS-tunnel 1 Resp ESP/ /tunl/SHA2 8827A3D9 C204F4FA BD202829 9 1 - - Show IKEv1 phase2 SA: Total 1 gateways found. 1 ike sa found. - - - There is no IKEv2 SA found. - -IPsec SAs: - -.. code-block:: none - - admin@PA-VM> show vpn ipsec-sa - - GwID/client IP TnID Peer-Address Tunnel(Gateway) Algorithm SPI(in) SPI(out) life(Sec/KB) remain-time(Sec) - -------------- ---- ------------ --------------- --------- ------- -------- ------------ ---------------- - 1 1 10.0.1.2 VyOS-tunnel(VyOS) ESP/A256/SHA256 8827A3D9 C204F4FA 3600/Unlimited 2733 - - Show IPSec SA: Total 1 tunnels found. 1 ipsec sa found. - -OSPF Neighbor Status: - -.. stop_vyoslinter - -.. code-block:: none - - admin@PA-VM> show routing protocol ospf neighbor - - Options: 0x80:reserved, O:Opaq-LSA capability, DC:demand circuits, EA:Ext-Attr LSA capability, - N/P:NSSA option, MC:multicase, E:AS external LSA capability, T:TOS capability - ========== - virtual router: default - neighbor address: 10.100.100.1 - local address binding: 0.0.0.0 - type: dynamic - status: full - neighbor router ID: 2.2.2.2 - area id: 0.0.0.0 - neighbor priority: 1 - lifetime remain: 32 - messages pending: 0 - LSA request pending: 0 - options: 0x02: E - hello suppressed: no - restart helper status: not helping - restart helper time remaining: 0 - restart helper exit reason: none - -.. start_vyoslinter - - - -Routing Table: - -.. code-block:: none - - admin@PA-VM> show routing route - - flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, - Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast - - - VIRTUAL ROUTER: default (id 1) - ========== - destination nexthop metric flags age interface next-AS - 0.0.0.0/0 10.0.2.1 10 A S ethernet1/1 - 10.0.2.0/30 10.0.2.2 0 A C ethernet1/1 - 10.0.2.2/32 0.0.0.0 0 A H - 10.100.100.0/30 0.0.0.0 10 Oi 1273 tunnel.1 - 10.100.100.0/30 10.100.100.2 0 A C tunnel.1 - 10.100.100.2/32 0.0.0.0 0 A H - 192.168.0.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 - 192.168.1.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 - 192.168.10.0/24 0.0.0.0 10 Oi 1273 ethernet1/2 - 192.168.10.0/24 192.168.10.1 0 A C ethernet1/2 - 192.168.10.1/32 0.0.0.0 0 A H - 192.168.11.0/24 0.0.0.0 10 Oi 1273 ethernet1/3 - 192.168.11.0/24 192.168.11.1 0 A C ethernet1/3 - 192.168.11.1/32 0.0.0.0 0 A H - total routes shown: 14 - - - -Checking Connectivity ---------------------- - -ICMP packets from PC1 to PC3. - -.. code-block:: none - - PC1> ping 192.168.10.2 - - 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms - 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms - 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms - 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms - 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms - -ICMP packets from PC2 to PC4. - -.. code-block:: none - - PC2> ping 192.168.11.2 - - 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms - 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms - 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/l3vpn-hub-and-spoke.md b/docs/configexamples/l3vpn-hub-and-spoke.md new file mode 100644 index 00000000..3c719926 --- /dev/null +++ b/docs/configexamples/l3vpn-hub-and-spoke.md @@ -0,0 +1,1091 @@ +# L3VPN for Hub-and-Spoke connectivity with VyOS + +IP/MPLS technology is widely used by various service providers and large +enterprises in order to achieve better network scalability, manageability +and flexibility. It also provides the possibility to deliver different +services for the customers in a seamless manner. +Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered +through OSI layer 3 networking technologies. Often the border gateway +protocol (BGP) is used to send and receive VPN-related data that is +responsible for the control plane. L3VPN utilizes virtual routing and +forwarding (VRF) techniques to receive and deliver user data as well as +separate data planes of the end-users. It is built using a combination of +IP- and MPLS-based information. Generally, L3VPNs are used to send data +on back-end VPN infrastructures, such as for VPN connections between data +centres, HQs and branches. + +An L3VPN consists of multiple access links, multiple VPN routing and +forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs. +An L3VPN can be configured to connect two or more customer sites. +In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have +unique Route Distinguishers (RDs). In order to use the hub site as a +transit point for connectivity in such an environment, the spoke sites +export their routes to the hub. Spokes can talk to hubs, but never have +direct paths to other spokes. All traffic between spokes is controlled +and delivered over the hub site. + +To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple +requirements in order to properly implement the solution. +We'll use the following nodes in our LAB environment: + +- 2 x Route reflectors (VyOS-RRx) +- 4 x Provider routers (VyOS-Px) +- 3 x Provider Edge (VyOs-PEx) +- 3 x Customer Edge (VyOS-CEx) + +The following software was used in the creation of this document: + +- Operating system: VyOS +- Version: 1.4-rolling-202110310317 +- Image name: vyos-1.4-rolling-202110310317-amd64.iso + +**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) +– The configurations below are specifically for VyOS 1.4.x. + +General information can be found in the +{ref}`configuration/vrf/index:L3VPN VRFs` chapter. + +## Topology + +```{image} /_static/images/L3VPN_hub_and_spoke.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + + +## How does it work? + +As we know the main assumption of L3VPN “Hub and Spoke” is, that the +traffic between spokes have to pass via hub, in our scenario VyOS-PE2 +is the Hub PE +and the VyOS-CE1-HUB is the central customer office device that is responsible +for controlling access between all spokes and announcing its network prefixes +(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its +own Route-Distinguisher(RD) and route-target import/export lists. +Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to +the nodes across network where PEs Spokes import the route-target 60535:1030 +(this is export route-target of vrf BLUE_HUB) and export its own route-target +60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the +Customer edge nodes can only learn the network prefixes of the HUB site +[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes +[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. +Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network +routes exchange and minimize iBGP peerings between devices. + +L3VPN configuration parameters table: + +```{eval-rst} ++----------+-------+------------+-----------------+-------------+-------------+ +| Node | Role | VRF | RD | RT import | RT export | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE2 | Hub | BLUE_HUB | 10.80.80.1:1011 | 65035:1011 | 65035:1030 | +| | | | | 65035:1030 | | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ +``` + +## Configuration + +### Step-1: Configuring IGP and enabling MPLS LDP + +At the first step we need to configure the IP/MPLS backbone network using OSPF +as IGP protocol and LDP as label-switching protocol for the base connectivity +between **P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R** +(eflector) nodes: +- VyOS-P1: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.3/32' +set interfaces ethernet eth0 address '172.16.30.1/24' +set interfaces ethernet eth1 address '172.16.40.1/24' +set interfaces ethernet eth2 address '172.16.90.1/24' +set interfaces ethernet eth3 address '172.16.10.1/24' +set interfaces ethernet eth5 address '172.16.100.1/24' + +# protocols ospf+ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth5' +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp interface 'eth5' +set protocols mpls ldp router-id '10.0.0.3' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.3' +``` + +- VyOS-P2: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.4/32' +set interfaces ethernet eth0 address '172.16.30.2/24' +set interfaces ethernet eth1 address '172.16.20.1/24' +set interfaces ethernet eth2 address '172.16.120.1/24' +set interfaces ethernet eth3 address '172.16.60.1/24' + +# protocols ospf+ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp router-id '10.0.0.4' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.4' +``` + +- VyOS-P3: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.5/32' +set interfaces ethernet eth0 address '172.16.110.1/24' +set interfaces ethernet eth1 address '172.16.40.2/24' +set interfaces ethernet eth2 address '172.16.50.1/24' +set interfaces ethernet eth3 address '172.16.70.1/24' + +# protocols ospf + ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp router-id '10.0.0.5' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.5' +``` + +- VyOS-P4: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.6/32' +set interfaces ethernet eth0 address '172.16.80.2/24' +set interfaces ethernet eth1 address '172.16.130.1/24' +set interfaces ethernet eth2 address '172.16.50.2/24' +set interfaces ethernet eth3 address '172.16.60.2/24' +set interfaces ethernet eth5 address '172.16.140.1/24' + + +# protocols ospf + ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth5' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp interface 'eth3' +set protocols mpls ldp interface 'eth5' +set protocols mpls ldp router-id '10.0.0.6' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.6' +``` + +- VyOS-PE1: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.7/32' +set interfaces ethernet eth0 address '172.16.90.2/24' + +# protocols ospf + ldp +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp router-id '10.0.0.7' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.7' +``` + +- VyOS-PE2: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.8/32' +set interfaces ethernet eth0 address '172.16.110.2/24' +set interfaces ethernet eth1 address '172.16.100.2/24' +set interfaces ethernet eth2 address '172.16.80.1/24' + +# protocols ospf + ldp +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp router-id '10.0.0.8' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.8' +``` + +- VyOS-PE3: + +```none +# interfaces +set interfaces dummy dum10 address '10.0.0.10/32' +set interfaces ethernet eth0 address '172.16.140.2/24' + +# protocols ospf + ldp +set protocols mpls interface 'eth0' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp router-id '10.0.0.10' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.10' +``` + +- VyOS-RR1: + +```none +# interfaces +set interfaces ethernet eth1 address '172.16.20.2/24' +set interfaces ethernet eth2 address '172.16.10.2/24' +set interfaces dummy dum10 address '10.0.0.1/32' + +# protocols ospf + ldp +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth2' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth2' +set protocols mpls ldp router-id '10.0.0.1' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.1' +``` + +- VyOS-RR2: + +```none +# interfaces +set interfaces ethernet eth0 address '172.16.80.1/24' +set interfaces ethernet eth1 address '172.16.70.2/24' +set interfaces dummy dum10 address '10.0.0.2/32' + +# protocols ospf + ldp +set protocols mpls interface 'eth0' +set protocols mpls interface 'eth1' +set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' +set protocols mpls ldp interface 'eth1' +set protocols mpls ldp interface 'eth0' +set protocols mpls ldp router-id '10.0.0.2' +set protocols ospf area 0 network '0.0.0.0/0' +set protocols ospf parameters abr-type 'cisco' +set protocols ospf parameters router-id '10.0.0.2' +``` + + +### Step-2: Configuring iBGP for L3VPN control-plane + +At this step we are going to enable iBGP protocol on MPLS nodes and +Route Reflectors (two routers for redundancy) that will deliver IPv4 +VPN (L3VPN) routes between them: +- VyOS-RR1: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' +set protocols bgp parameters cluster-id '10.0.0.1' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.1' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + +- VyOS-RR2: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client +set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' +set protocols bgp parameters cluster-id '10.0.0.1' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.2' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + +- VyOS-PE1: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.7' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + +- VyOS-PE2: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.8' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + +- VyOS-PE3: + +```none +set protocols bgp system-as '65001' +set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' +set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self +set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.0.0.10' +set protocols bgp peer-group RR_VPNv4 remote-as '65001' +set protocols bgp peer-group RR_VPNv4 update-source 'dum10' +``` + + +### Step-3: Configuring L3VPN VRFs on PE nodes + +This section provides configuration steps for setting up VRFs on our +PE nodes including CE facing interfaces, BGP, rd and route-target +import/export based on the pre-defined parameters. +- VyOS-PE1: + +```none +# VRF settings +set vrf name BLUE_SPOKE table '200' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' +set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override +set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035' + +# interfaces +set interfaces ethernet eth3 address '10.50.50.1/24' +set interfaces ethernet eth3 vrf 'BLUE_SPOKE' +``` + +- VyOS-PE2: + +```none +# VRF settings +set vrf name BLUE_HUB table '400' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' +set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' +set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override +set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035' + +# interfaces +set interfaces ethernet eth3 address '10.80.80.1/24' +set interfaces ethernet eth3 vrf 'BLUE_HUB' +``` + +- VyOS-PE3: + +```none +# VRF settings +set vrf name BLUE_SPOKE table '200' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' +set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' +set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override +set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035' + +# interfaces +set interfaces ethernet eth3 address '10.60.60.1/24' +set interfaces ethernet eth3 vrf 'BLUE_SPOKE' +``` + + +### Step-4: Configuring CE nodes + +Dynamic routing used between CE and PE nodes and eBGP peering +established for the route exchanging between them. All routes +received by PEs are then exported to L3VPN and delivered from +Spoke sites to Hub and vise-versa based on previously +configured L3VPN parameters. +- VyOS-CE1-SPOKE: + +```none +# interfaces +set interfaces dummy dum20 address '10.0.0.80/32' +set interfaces ethernet eth0 address '10.50.50.2/24' + +# BGP for peering with PE +set protocols bgp system-as 65035 +set protocols bgp address-family ipv4-unicast network 10.0.0.80/32 +set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2' +set protocols bgp neighbor 10.50.50.1 remote-as '65001' +set protocols bgp neighbor 10.50.50.1 update-source 'eth0' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.50.50.2' +``` + +- VyOS-CE1-HUB: + +```none +# interfaces +set interfaces dummy dum20 address '10.0.0.100/32' +set interfaces ethernet eth0 address '10.80.80.2/24' + +# BGP for peering with PE +set protocols bgp system-as 65035 +set protocols bgp address-family ipv4-unicast network 10.0.0.100/32 +set protocols bgp address-family ipv4-unicast redistribute connected +set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2' +set protocols bgp neighbor 10.80.80.1 remote-as '65001' +set protocols bgp neighbor 10.80.80.1 update-source 'eth0' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.80.80.2' +``` + +- VyOS-CE2-SPOKE: + +```none +# interfaces +set interfaces dummy dum20 address '10.0.0.90/32' +set interfaces ethernet eth0 address '10.60.60.2/24' + +# BGP for peering with PE +set protocols bgp system-as 65035 +set protocols bgp address-family ipv4-unicast network 10.0.0.90/32 +set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2' +set protocols bgp neighbor 10.60.60.1 remote-as '65001' +set protocols bgp neighbor 10.60.60.1 update-source 'eth0' +set protocols bgp parameters log-neighbor-changes +set protocols bgp parameters router-id '10.60.60.2' +``` + + +### Step-5: Verification + +This section describes verification commands for MPLS/BGP/LDP +protocols and L3VPN related routes as well as diagnosis and +reachability checks between CE nodes. + +Let’s check IPv4 routing and MPLS information on provider nodes +(same procedure for all P nodes): +- “show ip ospf neighbor” for checking ospf relationship + +```none +vyos@VyOS-P1:~$ show ip ospf neighbor + +Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL +10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 +10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 +10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 +10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 +10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 +``` + +- “show mpls ldp neighbor “ for checking ldp neighbors + +```none +vyos@VyOS-P1:~$ show mpls ldp neighbor +AF ID State Remote Address Uptime +ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h +ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h +ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h +ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h +ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h +``` + +- “show mpls ldp binding” for checking mpls label assignment + +```none +vyos@VyOS-P1:~$ show mpls ldp discovery +AF Destination Nexthop Local Label Remote Label In Use +ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes +ipv4 10.0.0.1/32 10.0.0.4 23 20 no +ipv4 10.0.0.1/32 10.0.0.5 23 17 no +ipv4 10.0.0.1/32 10.0.0.7 23 16 no +ipv4 10.0.0.1/32 10.0.0.8 23 16 no +ipv4 10.0.0.2/32 10.0.0.1 20 16 no +ipv4 10.0.0.2/32 10.0.0.4 20 22 no +ipv4 10.0.0.2/32 10.0.0.5 20 24 yes +ipv4 10.0.0.2/32 10.0.0.7 20 17 no +ipv4 10.0.0.2/32 10.0.0.8 20 17 no +ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no +ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no +ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no +ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no +ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no +ipv4 10.0.0.4/32 10.0.0.1 16 18 no +ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes +ipv4 10.0.0.4/32 10.0.0.5 16 19 no +ipv4 10.0.0.4/32 10.0.0.7 16 19 no +ipv4 10.0.0.4/32 10.0.0.8 16 19 no +ipv4 10.0.0.5/32 10.0.0.1 21 19 no +ipv4 10.0.0.5/32 10.0.0.4 21 17 no +ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes +ipv4 10.0.0.5/32 10.0.0.7 21 20 no +ipv4 10.0.0.5/32 10.0.0.8 21 20 no +ipv4 10.0.0.6/32 10.0.0.1 17 20 no +ipv4 10.0.0.6/32 10.0.0.4 17 23 yes +ipv4 10.0.0.6/32 10.0.0.5 17 21 yes +ipv4 10.0.0.6/32 10.0.0.7 17 21 no +ipv4 10.0.0.6/32 10.0.0.8 17 21 no +ipv4 10.0.0.7/32 10.0.0.1 22 21 no +ipv4 10.0.0.7/32 10.0.0.4 22 18 no +ipv4 10.0.0.7/32 10.0.0.5 22 20 no +ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes +ipv4 10.0.0.7/32 10.0.0.8 22 22 no +ipv4 10.0.0.8/32 10.0.0.1 24 22 no +ipv4 10.0.0.8/32 10.0.0.4 24 19 no +ipv4 10.0.0.8/32 10.0.0.5 24 16 no +ipv4 10.0.0.8/32 10.0.0.7 24 22 no +ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes +ipv4 10.0.0.9/32 10.0.0.1 18 23 no +ipv4 10.0.0.9/32 10.0.0.4 18 21 yes +ipv4 10.0.0.9/32 10.0.0.5 18 22 no +ipv4 10.0.0.9/32 10.0.0.7 18 23 no +ipv4 10.0.0.9/32 10.0.0.8 18 23 no +ipv4 10.0.0.10/32 10.0.0.1 19 24 no +ipv4 10.0.0.10/32 10.0.0.4 19 24 yes +ipv4 10.0.0.10/32 10.0.0.5 19 23 yes +ipv4 10.0.0.10/32 10.0.0.7 19 24 no +ipv4 10.0.0.10/32 10.0.0.8 19 24 no +``` + +Now we’re checking iBGP status and routes from route-reflector +nodes to other devices: +- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors: + +```none +vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary +BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0 +BGP table version 0 +RIB entries 9, using 1728 bytes of memory +Peers 4, using 85 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 +10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 +10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 +10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + +Total number of neighbors 4 +``` + +- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information: + +```none +vyos@VyOS-RR1:~$ show bgp ipv4 vpn +BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 +Default local pref 100, local AS 65001 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path +Route Distinguisher: 10.50.50.1:1011 +*>i10.50.50.0/24 10.0.0.7 0 100 0 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 +*>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 +Route Distinguisher: 10.60.60.1:1011 +*>i10.60.60.0/24 10.0.0.10 0 100 0 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 +*>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 +Route Distinguisher: 10.80.80.1:1011 +*>i10.80.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 +*>i100.100.100.100/32 + 10.0.0.8 0 100 0 65035 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 +Route Distinguisher: 172.16.80.1:2011 +*>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 +*>i172.16.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 +Route Distinguisher: 172.16.100.1:2011 +*>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 +*>i172.16.100.0/24 10.0.0.9 0 100 0 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 +``` + +- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected + for specific VPNv4 destination + +```none +vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32 +BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 +not allocated +Paths: (1 available, best #1) + Advertised to non peer-group peers: + 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 + 65035, (Received from a RR-client) + 10.0.0.8 from 10.0.0.8 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:65035:1030 + Remote label: 80 + Last update: Tue Oct 19 13:45:32 202 +``` + +Also we can verify how PE devices receives VPNv4 networks from the RRs +and installing them to the specific customer VRFs: +- “show bgp ipv4 vpn summary” for checking iBGP neighbors against + route-reflector devices: + +```none +vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary +BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0 +BGP table version 0 +RIB entries 9, using 1728 bytes of memory +Peers 2, using 43 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 +10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 +``` + +- “show bgp vrf all” for checking all the prefix learning on BGP + : within VRFs: + +```none +vyos@VyOS-PE1:~$ show bgp vrf all + +Instance default: +No BGP prefixes displayed, 0 exist + +Instance BLUE_SPOKE: +BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 +Default local pref 100, local AS 65001 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path +* 10.50.50.0/24 0.0.0.0 0 32768 ? +*> 0.0.0.0 0 32768 i +*> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i +* 10.0.0.8@0< 0 100 0 i +*> 10.0.0.80/32 10.50.50.2 0 0 65035 i +*> 10.0.0.100/32 + 10.0.0.8@0< 0 100 0 65035 ? +* 10.0.0.8@0< 0 100 0 65035 ? +``` + +- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor + : information between PE and CE: + +```none +vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary + +IPv4 Unicast Summary: +BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6 +BGP table version 8 +RIB entries 7, using 1344 bytes of memory +Peers 1, using 21 KiB of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 + +Total number of neighbors 1 +``` + +- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. + : Using this command we are also able to check the transport and + customer label (inner/outer) for Hub network prefix (10.0.0.100/32): + +```none +vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE + +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + +VRF BLUE_SPOKE: +K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h +C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h +B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 +B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m +B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 +``` + +- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the + : specific VPNv4 destination including extended community and + remotelabel information. This procedure is the same on all Spoke nodes: + +```none +vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32 +BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 +not allocated +Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.8 from 10.0.0.1 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Tue Oct 19 13:45:26 2021 + 65035 + 10.0.0.8 from 10.0.0.2 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Wed Oct 13 12:39:34 202 +``` + +Now, let’s check routing information on out Hub PE: +- “show bgp ipv4 vpn summary” for checking iBGP neighbors again + : VyOS-RR1/RR2 + +```none +vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary +BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0 +BGP table version 0 +RIB entries 9, using 1728 bytes of memory +Peers 2, using 43 KiB of memory +Peer groups 1, using 64 bytes of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 +10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 + +Total number of neighbors +``` + +- “show bgp vrf all” for checking all the prefixes learning on BGP + +```none +vyos@VyOS-PE2:~$ show bgp vrf all + +Instance default: +No BGP prefixes displayed, 0 exist + +Instance BLUE_HUB: +BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 +Default local pref 100, local AS 65001 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path +*> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i +* 10.0.0.7@0< 0 100 0 i +*> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i +* 10.0.0.10@0< 0 100 0 i +* 10.80.80.0/24 10.80.80.2 0 0 65035 ? +* 0.0.0.0 0 32768 i +*> 0.0.0.0 0 32768 ? +*> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i +*> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i +* 10.0.0.9@0< 0 100 0 65050 i +*> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i +* 10.0.0.7@0< 0 100 0 65035 i +*> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i +* 10.0.0.10@0< 0 100 0 65035 i +*> 10.0.0.100/32 + 10.80.80.2 0 0 65035 ? +*> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? + 0.0.0.0@9< 0 32768 i +*> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i +* 10.0.0.9@0< 0 100 0 i +``` + +- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor + : CE Hub device + +```none +vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary + +IPv4 Unicast Summary: +BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8 +BGP table version 50 +RIB entries 19, using 3648 bytes of memory +Peers 1, using 21 KiB of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt +10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 +``` + +- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. + : With this command we are able to check the transport and + customer label (inner/outer) for network spokes prefixes + 10.0.0.80/32 - 10.0.0.90/32 + +```none +vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB + +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + +VRF BLUE_HUB: +K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h +B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 +B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 +C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h +B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h +B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 +B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 +B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 +B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h +B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h +B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 +``` + +- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, + : extended community and remote label of specific destination + +```none +vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32 +BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32 +not allocated +Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.7 from 10.0.0.1 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 10.0.0.7 from 10.0.0.2 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:39:37 2021 + +vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 +BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 +not allocated +Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.10 from 10.0.0.1 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 10.0.0.10 from 10.0.0.2 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:45:44 2021 +``` + +Finally, let’s check the reachability between CEs: +- VyOS-CE1-SPOKE -----> VyOS-CE-HUB + +```none +# check rib +vyos@VyOS-CE1-SPOKE:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + +B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m +C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h +B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m +C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h +B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m + +# check icmp +vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80 +PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data. +64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms +64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms +64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms +64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms +^C +--- 10.0.0.100 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 8ms +rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms + +# check network path +vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100 +traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets + 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms + 2 * * * + 3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m +``` + +- VyOS-CE-HUB -------> VyOS-CE1-SPOKE +- VyOS-CE-HUB -------> VyOS-CE2-SPOKE + +```none +# check rib +vyos@VyOS-CE-HUB:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + +B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m +B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m +C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h +B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h +B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m +B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m +B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m +C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h +B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h +B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + +# check icmp +vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4 +PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data. +64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms +64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms +64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms +64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms + +--- 10.0.0.80 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 9ms +rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms + +vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4 +PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data. +64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms +64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms +64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms +^C +--- 10.0.0.90 ping statistics --- +3 packets transmitted, 3 received, 0% packet loss, time 6ms +rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms + +# check network path +vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80 +traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms + 2 * * * + 3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms + +vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90 +traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms + 2 * * * + 3 * * * + 4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms +``` + +- VyOS-CE2-SPOKE -------> VyOS-CE-HUB + +```none +# check rib +vyos@rt-ce2-SPOKE:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + +B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h +C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h +B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m +C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h +B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m + +# check icmp +vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4 +PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data. +64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms +64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms +64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms +64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms + +--- 10.0.0.100 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 9ms +rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms + +# check network path +vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100 +traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets + 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms + 2 * * * + 3 * * * + 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms +``` + +**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll +see `* * *` for the transit routers of the mpls backbone. diff --git a/docs/configexamples/l3vpn-hub-and-spoke.rst b/docs/configexamples/l3vpn-hub-and-spoke.rst deleted file mode 100644 index 90a036d8..00000000 --- a/docs/configexamples/l3vpn-hub-and-spoke.rst +++ /dev/null @@ -1,1127 +0,0 @@ - -############################################## -L3VPN for Hub-and-Spoke connectivity with VyOS -############################################## - -IP/MPLS technology is widely used by various service providers and large -enterprises in order to achieve better network scalability, manageability -and flexibility. It also provides the possibility to deliver different -services for the customers in a seamless manner. -Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered -through OSI layer 3 networking technologies. Often the border gateway -protocol (BGP) is used to send and receive VPN-related data that is -responsible for the control plane. L3VPN utilizes virtual routing and -forwarding (VRF) techniques to receive and deliver user data as well as -separate data planes of the end-users. It is built using a combination of -IP- and MPLS-based information. Generally, L3VPNs are used to send data -on back-end VPN infrastructures, such as for VPN connections between data -centres, HQs and branches. - -An L3VPN consists of multiple access links, multiple VPN routing and -forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs. -An L3VPN can be configured to connect two or more customer sites. -In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have -unique Route Distinguishers (RDs). In order to use the hub site as a -transit point for connectivity in such an environment, the spoke sites -export their routes to the hub. Spokes can talk to hubs, but never have -direct paths to other spokes. All traffic between spokes is controlled -and delivered over the hub site. - - -To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple -requirements in order to properly implement the solution. -We'll use the following nodes in our LAB environment: - -* 2 x Route reflectors (VyOS-RRx) -* 4 x Provider routers (VyOS-Px) -* 3 x Provider Edge (VyOs-PEx) -* 3 x Customer Edge (VyOS-CEx) - -The following software was used in the creation of this document: - -* Operating system: VyOS -* Version: 1.4-rolling-202110310317 -* Image name: vyos-1.4-rolling-202110310317-amd64.iso - -**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) -– The configurations below are specifically for VyOS 1.4.x. - -General information can be found in the -:ref:`configuration/vrf/index:L3VPN VRFs` chapter. - - - -******** -Topology -******** -.. image:: /_static/images/L3VPN_hub_and_spoke.* - :width: 80% - :align: center - :alt: Network Topology Diagram - - - -***************** -How does it work? -***************** - -As we know the main assumption of L3VPN “Hub and Spoke” is, that the -traffic between spokes have to pass via hub, in our scenario VyOS-PE2 -is the Hub PE -and the VyOS-CE1-HUB is the central customer office device that is responsible -for controlling access between all spokes and announcing its network prefixes -(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its -own Route-Distinguisher(RD) and route-target import/export lists. -Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to -the nodes across network where PEs Spokes import the route-target 60535:1030 -(this is export route-target of vrf BLUE_HUB) and export its own route-target -60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the -Customer edge nodes can only learn the network prefixes of the HUB site -[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes -[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. -Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network -routes exchange and minimize iBGP peerings between devices. - -L3VPN configuration parameters table: - -+----------+-------+------------+-----------------+-------------+-------------+ -| Node | Role | VRF | RD | RT import | RT export | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE2 | Hub | BLUE_HUB | 10.80.80.1:1011 | 65035:1011 | 65035:1030 | -| | | | | 65035:1030 | | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030 | 65035:1011 | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030 | 65035:1011 | -+----------+-------+------------+-----------------+-------------+-------------+ - - - -************* -Configuration -************* - - - -Step-1: Configuring IGP and enabling MPLS LDP -============================================= - -At the first step we need to configure the IP/MPLS backbone network using OSPF -as IGP protocol and LDP as label-switching protocol for the base connectivity -between **P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R** -(eflector) nodes: - -- VyOS-P1: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.3/32' - set interfaces ethernet eth0 address '172.16.30.1/24' - set interfaces ethernet eth1 address '172.16.40.1/24' - set interfaces ethernet eth2 address '172.16.90.1/24' - set interfaces ethernet eth3 address '172.16.10.1/24' - set interfaces ethernet eth5 address '172.16.100.1/24' - - # protocols ospf+ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set protocols mpls interface 'eth5' - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp interface 'eth3' - set protocols mpls ldp interface 'eth5' - set protocols mpls ldp router-id '10.0.0.3' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.3 - - -- VyOS-P2: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.4/32' - set interfaces ethernet eth0 address '172.16.30.2/24' - set interfaces ethernet eth1 address '172.16.20.1/24' - set interfaces ethernet eth2 address '172.16.120.1/24' - set interfaces ethernet eth3 address '172.16.60.1/24' - - # protocols ospf+ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp interface 'eth3' - set protocols mpls ldp router-id '10.0.0.4' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.4' - -- VyOS-P3: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.5/32' - set interfaces ethernet eth0 address '172.16.110.1/24' - set interfaces ethernet eth1 address '172.16.40.2/24' - set interfaces ethernet eth2 address '172.16.50.1/24' - set interfaces ethernet eth3 address '172.16.70.1/24' - - # protocols ospf + ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp interface 'eth3' - set protocols mpls ldp router-id '10.0.0.5' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.5' - -- VyOS-P4: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.6/32' - set interfaces ethernet eth0 address '172.16.80.2/24' - set interfaces ethernet eth1 address '172.16.130.1/24' - set interfaces ethernet eth2 address '172.16.50.2/24' - set interfaces ethernet eth3 address '172.16.60.2/24' - set interfaces ethernet eth5 address '172.16.140.1/24' - - - # protocols ospf + ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set protocols mpls interface 'eth0' - set protocols mpls interface 'eth5' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp interface 'eth3' - set protocols mpls ldp interface 'eth5' - set protocols mpls ldp router-id '10.0.0.6' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.6' - -- VyOS-PE1: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.7/32' - set interfaces ethernet eth0 address '172.16.90.2/24' - - # protocols ospf + ldp - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp router-id '10.0.0.7' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.7' - -- VyOS-PE2: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.8/32' - set interfaces ethernet eth0 address '172.16.110.2/24' - set interfaces ethernet eth1 address '172.16.100.2/24' - set interfaces ethernet eth2 address '172.16.80.1/24' - - # protocols ospf + ldp - set protocols mpls interface 'eth0' - set protocols mpls interface 'eth1' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp router-id '10.0.0.8' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.8' - -- VyOS-PE3: - -.. code-block:: none - - # interfaces - set interfaces dummy dum10 address '10.0.0.10/32' - set interfaces ethernet eth0 address '172.16.140.2/24' - - # protocols ospf + ldp - set protocols mpls interface 'eth0' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp router-id '10.0.0.10' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.10' - -- VyOS-RR1: - -.. code-block:: none - - # interfaces - set interfaces ethernet eth1 address '172.16.20.2/24' - set interfaces ethernet eth2 address '172.16.10.2/24' - set interfaces dummy dum10 address '10.0.0.1/32' - - # protocols ospf + ldp - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth2' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth2' - set protocols mpls ldp router-id '10.0.0.1' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.1' - -- VyOS-RR2: - -.. code-block:: none - - # interfaces - set interfaces ethernet eth0 address '172.16.80.1/24' - set interfaces ethernet eth1 address '172.16.70.2/24' - set interfaces dummy dum10 address '10.0.0.2/32' - - # protocols ospf + ldp - set protocols mpls interface 'eth0' - set protocols mpls interface 'eth1' - set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' - set protocols mpls ldp interface 'eth1' - set protocols mpls ldp interface 'eth0' - set protocols mpls ldp router-id '10.0.0.2' - set protocols ospf area 0 network '0.0.0.0/0' - set protocols ospf parameters abr-type 'cisco' - set protocols ospf parameters router-id '10.0.0.2' - - - -Step-2: Configuring iBGP for L3VPN control-plane -================================================ - -At this step we are going to enable iBGP protocol on MPLS nodes and -Route Reflectors (two routers for redundancy) that will deliver IPv4 -VPN (L3VPN) routes between them: - -.. stop_vyoslinter - -- VyOS-RR1: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' - set protocols bgp parameters cluster-id '10.0.0.1' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.1' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - -- VyOS-RR2: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client - set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' - set protocols bgp parameters cluster-id '10.0.0.1' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.2' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - -- VyOS-PE1: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.7' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - -- VyOS-PE2: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.8' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - -- VyOS-PE3: - -.. code-block:: none - - set protocols bgp system-as '65001' - set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' - set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self - set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.0.0.10' - set protocols bgp peer-group RR_VPNv4 remote-as '65001' - set protocols bgp peer-group RR_VPNv4 update-source 'dum10' - - - -Step-3: Configuring L3VPN VRFs on PE nodes -========================================== - -This section provides configuration steps for setting up VRFs on our -PE nodes including CE facing interfaces, BGP, rd and route-target -import/export based on the pre-defined parameters. - -- VyOS-PE1: - -.. code-block:: none - - # VRF settings - set vrf name BLUE_SPOKE table '200' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' - set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override - set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035' - - # interfaces - set interfaces ethernet eth3 address '10.50.50.1/24' - set interfaces ethernet eth3 vrf 'BLUE_SPOKE' - -- VyOS-PE2: - -.. code-block:: none - - # VRF settings - set vrf name BLUE_HUB table '400' - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' - set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' - set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override - set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035' - - # interfaces - set interfaces ethernet eth3 address '10.80.80.1/24' - set interfaces ethernet eth3 vrf 'BLUE_HUB' - -- VyOS-PE3: - -.. code-block:: none - - # VRF settings - set vrf name BLUE_SPOKE table '200' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' - set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' - set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override - set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035' - - # interfaces - set interfaces ethernet eth3 address '10.60.60.1/24' - set interfaces ethernet eth3 vrf 'BLUE_SPOKE' - - - -Step-4: Configuring CE nodes -============================ - -Dynamic routing used between CE and PE nodes and eBGP peering -established for the route exchanging between them. All routes -received by PEs are then exported to L3VPN and delivered from -Spoke sites to Hub and vise-versa based on previously -configured L3VPN parameters. - -- VyOS-CE1-SPOKE: - -.. code-block:: none - - # interfaces - set interfaces dummy dum20 address '10.0.0.80/32' - set interfaces ethernet eth0 address '10.50.50.2/24' - - # BGP for peering with PE - set protocols bgp system-as 65035 - set protocols bgp address-family ipv4-unicast network 10.0.0.80/32 - set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2' - set protocols bgp neighbor 10.50.50.1 remote-as '65001' - set protocols bgp neighbor 10.50.50.1 update-source 'eth0' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.50.50.2' - -- VyOS-CE1-HUB: - -.. code-block:: none - - # interfaces - set interfaces dummy dum20 address '10.0.0.100/32' - set interfaces ethernet eth0 address '10.80.80.2/24' - - # BGP for peering with PE - set protocols bgp system-as 65035 - set protocols bgp address-family ipv4-unicast network 10.0.0.100/32 - set protocols bgp address-family ipv4-unicast redistribute connected - set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2' - set protocols bgp neighbor 10.80.80.1 remote-as '65001' - set protocols bgp neighbor 10.80.80.1 update-source 'eth0' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.80.80.2' - -- VyOS-CE2-SPOKE: - -.. code-block:: none - - # interfaces - set interfaces dummy dum20 address '10.0.0.90/32' - set interfaces ethernet eth0 address '10.60.60.2/24' - - # BGP for peering with PE - set protocols bgp system-as 65035 - set protocols bgp address-family ipv4-unicast network 10.0.0.90/32 - set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2' - set protocols bgp neighbor 10.60.60.1 remote-as '65001' - set protocols bgp neighbor 10.60.60.1 update-source 'eth0' - set protocols bgp parameters log-neighbor-changes - set protocols bgp parameters router-id '10.60.60.2' - - - -Step-5: Verification -==================== - -This section describes verification commands for MPLS/BGP/LDP -protocols and L3VPN related routes as well as diagnosis and -reachability checks between CE nodes. - -Let’s check IPv4 routing and MPLS information on provider nodes -(same procedure for all P nodes): - -- “show ip ospf neighbor” for checking ospf relationship - -.. code-block:: none - - vyos@VyOS-P1:~$ show ip ospf neighbor - - Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL - 10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 - 10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 - 10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 - 10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 - 10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 - -- “show mpls ldp neighbor “ for checking ldp neighbors - -.. code-block:: none - - vyos@VyOS-P1:~$ show mpls ldp neighbor - AF ID State Remote Address Uptime - ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h - ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h - ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h - ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h - ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h - -- “show mpls ldp binding” for checking mpls label assignment - -.. code-block:: none - - vyos@VyOS-P1:~$ show mpls ldp discovery - AF Destination Nexthop Local Label Remote Label In Use - ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes - ipv4 10.0.0.1/32 10.0.0.4 23 20 no - ipv4 10.0.0.1/32 10.0.0.5 23 17 no - ipv4 10.0.0.1/32 10.0.0.7 23 16 no - ipv4 10.0.0.1/32 10.0.0.8 23 16 no - ipv4 10.0.0.2/32 10.0.0.1 20 16 no - ipv4 10.0.0.2/32 10.0.0.4 20 22 no - ipv4 10.0.0.2/32 10.0.0.5 20 24 yes - ipv4 10.0.0.2/32 10.0.0.7 20 17 no - ipv4 10.0.0.2/32 10.0.0.8 20 17 no - ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no - ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no - ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no - ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no - ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no - ipv4 10.0.0.4/32 10.0.0.1 16 18 no - ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes - ipv4 10.0.0.4/32 10.0.0.5 16 19 no - ipv4 10.0.0.4/32 10.0.0.7 16 19 no - ipv4 10.0.0.4/32 10.0.0.8 16 19 no - ipv4 10.0.0.5/32 10.0.0.1 21 19 no - ipv4 10.0.0.5/32 10.0.0.4 21 17 no - ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes - ipv4 10.0.0.5/32 10.0.0.7 21 20 no - ipv4 10.0.0.5/32 10.0.0.8 21 20 no - ipv4 10.0.0.6/32 10.0.0.1 17 20 no - ipv4 10.0.0.6/32 10.0.0.4 17 23 yes - ipv4 10.0.0.6/32 10.0.0.5 17 21 yes - ipv4 10.0.0.6/32 10.0.0.7 17 21 no - ipv4 10.0.0.6/32 10.0.0.8 17 21 no - ipv4 10.0.0.7/32 10.0.0.1 22 21 no - ipv4 10.0.0.7/32 10.0.0.4 22 18 no - ipv4 10.0.0.7/32 10.0.0.5 22 20 no - ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes - ipv4 10.0.0.7/32 10.0.0.8 22 22 no - ipv4 10.0.0.8/32 10.0.0.1 24 22 no - ipv4 10.0.0.8/32 10.0.0.4 24 19 no - ipv4 10.0.0.8/32 10.0.0.5 24 16 no - ipv4 10.0.0.8/32 10.0.0.7 24 22 no - ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes - ipv4 10.0.0.9/32 10.0.0.1 18 23 no - ipv4 10.0.0.9/32 10.0.0.4 18 21 yes - ipv4 10.0.0.9/32 10.0.0.5 18 22 no - ipv4 10.0.0.9/32 10.0.0.7 18 23 no - ipv4 10.0.0.9/32 10.0.0.8 18 23 no - ipv4 10.0.0.10/32 10.0.0.1 19 24 no - ipv4 10.0.0.10/32 10.0.0.4 19 24 yes - ipv4 10.0.0.10/32 10.0.0.5 19 23 yes - ipv4 10.0.0.10/32 10.0.0.7 19 24 no - ipv4 10.0.0.10/32 10.0.0.8 19 24 no - -Now we’re checking iBGP status and routes from route-reflector -nodes to other devices: - -- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors: - -.. code-block:: none - - vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary - BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0 - BGP table version 0 - RIB entries 9, using 1728 bytes of memory - Peers 4, using 85 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 - 10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 - 10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 - 10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 - - Total number of neighbors 4 - -- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information: - -.. code-block:: none - - vyos@VyOS-RR1:~$ show bgp ipv4 vpn - BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 - Default local pref 100, local AS 65001 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path - Route Distinguisher: 10.50.50.1:1011 - *>i10.50.50.0/24 10.0.0.7 0 100 0 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 - Route Distinguisher: 10.60.60.1:1011 - *>i10.60.60.0/24 10.0.0.10 0 100 0 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 - *>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 - Route Distinguisher: 10.80.80.1:1011 - *>i10.80.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 - *>i100.100.100.100/32 - 10.0.0.8 0 100 0 65035 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 - Route Distinguisher: 172.16.80.1:2011 - *>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 - *>i172.16.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 - Route Distinguisher: 172.16.100.1:2011 - *>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 - *>i172.16.100.0/24 10.0.0.9 0 100 0 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 - -- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected - for specific VPNv4 destination - -.. code-block:: none - - vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32 - BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 - not allocated - Paths: (1 available, best #1) - Advertised to non peer-group peers: - 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 - 65035, (Received from a RR-client) - 10.0.0.8 from 10.0.0.8 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:65035:1030 - Remote label: 80 - Last update: Tue Oct 19 13:45:32 202 - -Also we can verify how PE devices receives VPNv4 networks from the RRs -and installing them to the specific customer VRFs: - -- “show bgp ipv4 vpn summary” for checking iBGP neighbors against - route-reflector devices: - -.. code-block:: none - - vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary - BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0 - BGP table version 0 - RIB entries 9, using 1728 bytes of memory - Peers 2, using 43 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 - 10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 - -- “show bgp vrf all” for checking all the prefix learning on BGP - within VRFs: - -.. code-block:: none - - vyos@VyOS-PE1:~$ show bgp vrf all - - Instance default: - No BGP prefixes displayed, 0 exist - - Instance BLUE_SPOKE: - BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 - Default local pref 100, local AS 65001 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path - * 10.50.50.0/24 0.0.0.0 0 32768 ? - *> 0.0.0.0 0 32768 i - *> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i - * 10.0.0.8@0< 0 100 0 i - *> 10.0.0.80/32 10.50.50.2 0 0 65035 i - *> 10.0.0.100/32 - 10.0.0.8@0< 0 100 0 65035 ? - * 10.0.0.8@0< 0 100 0 65035 ? - -- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor - information between PE and CE: - -.. code-block:: none - - vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary - - - IPv4 Unicast Summary: - BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6 - BGP table version 8 - RIB entries 7, using 1344 bytes of memory - Peers 1, using 21 KiB of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 - - Total number of neighbors 1 - -- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. - Using this command we are also able to check the transport and - customer label (inner/outer) for Hub network prefix (10.0.0.100/32): - -.. code-block:: none - - vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE - - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - - VRF BLUE_SPOKE: - K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h - C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h - B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 - B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m - B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 - -- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the - specific VPNv4 destination including extended community and - remotelabel information. This procedure is the same on all Spoke nodes: - -.. code-block:: none - - vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32 - BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 - not allocated - Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.8 from 10.0.0.1 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Tue Oct 19 13:45:26 2021 - 65035 - 10.0.0.8 from 10.0.0.2 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Wed Oct 13 12:39:34 202 - -Now, let’s check routing information on out Hub PE: - -- “show bgp ipv4 vpn summary” for checking iBGP neighbors again - VyOS-RR1/RR2 - -.. code-block:: none - - vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary - BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0 - BGP table version 0 - RIB entries 9, using 1728 bytes of memory - Peers 2, using 43 KiB of memory - Peer groups 1, using 64 bytes of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 - 10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 - - Total number of neighbors - -- “show bgp vrf all” for checking all the prefixes learning on BGP - -.. code-block:: none - - vyos@VyOS-PE2:~$ show bgp vrf all - - Instance default: - No BGP prefixes displayed, 0 exist - - Instance BLUE_HUB: - BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 - Default local pref 100, local AS 65001 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path - *> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i - * 10.0.0.7@0< 0 100 0 i - *> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i - * 10.0.0.10@0< 0 100 0 i - * 10.80.80.0/24 10.80.80.2 0 0 65035 ? - * 0.0.0.0 0 32768 i - *> 0.0.0.0 0 32768 ? - *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i - *> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i - * 10.0.0.9@0< 0 100 0 65050 i - *> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i - * 10.0.0.7@0< 0 100 0 65035 i - *> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i - * 10.0.0.10@0< 0 100 0 65035 i - *> 10.0.0.100/32 - 10.80.80.2 0 0 65035 ? - *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? - 0.0.0.0@9< 0 32768 i - *> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i - * 10.0.0.9@0< 0 100 0 i - -- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor - CE Hub device - -.. code-block:: none - - vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary - - IPv4 Unicast Summary: - BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8 - BGP table version 50 - RIB entries 19, using 3648 bytes of memory - Peers 1, using 21 KiB of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt - 10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 - -- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. - With this command we are able to check the transport and - customer label (inner/outer) for network spokes prefixes - 10.0.0.80/32 - 10.0.0.90/32 - -.. code-block:: none - - vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - VRF BLUE_HUB: - K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h - B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 - B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 - C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h - B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h - B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 - B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 - B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 - B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h - B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h - B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 - -- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, - extended community and remote label of specific destination - -.. code-block:: none - - vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32 - BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32 - not allocated - Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.7 from 10.0.0.1 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 - 65035 - 10.0.0.7 from 10.0.0.2 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:39:37 2021 - - vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 - BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 - not allocated - Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.10 from 10.0.0.1 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 - 65035 - 10.0.0.10 from 10.0.0.2 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:45:44 2021 - -Finally, let’s check the reachability between CEs: - -- VyOS-CE1-SPOKE -----> VyOS-CE-HUB - - -.. code-block:: none - - # check rib - vyos@VyOS-CE1-SPOKE:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - - B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m - C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h - B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m - C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h - B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m - - # check icmp - vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80 - PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data. - 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms - 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms - 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms - 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms - ^C - --- 10.0.0.100 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 8ms - rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms - - # check network path - vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100 - traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets - 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms - 2 * * * - 3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m - -- VyOS-CE-HUB -------> VyOS-CE1-SPOKE -- VyOS-CE-HUB -------> VyOS-CE2-SPOKE - -.. code-block:: none - - # check rib - vyos@VyOS-CE-HUB:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - - B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m - B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h - B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h - B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m - B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h - B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h - B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - - # check icmp - vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4 - PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data. - 64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms - 64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms - 64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms - 64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms - - --- 10.0.0.80 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 9ms - rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms - - vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4 - PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data. - 64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms - 64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms - 64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms - ^C - --- 10.0.0.90 ping statistics --- - 3 packets transmitted, 3 received, 0% packet loss, time 6ms - rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms - - # check network path - vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80 - traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets - 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms - 2 * * * - 3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms - - vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90 - traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets - 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms - 2 * * * - 3 * * * - 4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms - -- VyOS-CE2-SPOKE -------> VyOS-CE-HUB - -.. code-block:: none - - # check rib - vyos@rt-ce2-SPOKE:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - - B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h - C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h - B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m - C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h - B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m - - # check icmp - vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4 - PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data. - 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms - 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms - 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms - 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms - - --- 10.0.0.100 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 9ms - rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms - - # check network path - vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100 - traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets - 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms - 2 * * * - 3 * * * - 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms - -.. start_vyoslinter - -**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll -see ``* * *`` for the transit routers of the mpls backbone. diff --git a/docs/configexamples/lac-lns.md b/docs/configexamples/lac-lns.md new file mode 100644 index 00000000..51a96f8b --- /dev/null +++ b/docs/configexamples/lac-lns.md @@ -0,0 +1,181 @@ +--- +lastproofread: '2024-02-21' +--- + +(examples-lac-lns)= + +# PPPoE over L2TP + +This document is to describe a basic setup using PPPoE over L2TP. +LAC and LNS are components of the broadband topology. +LAC - L2TP access concentrator +LNS - L2TP Network Server +LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and +forward them to LNS. LNS is the termination point that comes from PPP packets +from the remote client. + +In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC. +All users with domain **vyos.io** will be tunneled to LNS via L2TP. + +## Network Topology + +```{image} /_static/images/lac-lns-diagram.webp +:align: center +:alt: Network Topology Diagram +:width: 60% +``` + + +## Configurations + +### LAC + +```none +aaa new-model +! +aaa authentication ppp default local +! +vpdn enable +vpdn aaa attribute nas-ip-address vpdn-nas +! +vpdn-group LAC + request-dialin + protocol l2tp + domain vyos.io + initiate-to ip 192.168.139.100 + source-ip 192.168.139.101 + local name LAC + l2tp tunnel password 0 test123 +! +bba-group pppoe MAIN-BBA + virtual-template 1 +! +interface GigabitEthernet0/0 + description To LNS + ip address 192.168.139.101 255.255.255.0 + duplex auto + speed auto + media-type rj45 +! +interface GigabitEthernet0/1 + description To PPPoE clients + no ip address + duplex auto + speed auto + media-type rj45 + pppoe enable group MAIN-BBA +! +interface Virtual-Template1 + description pppoe MAIN-BBA + no ip address + no peer default ip address + ppp mtu adaptive + ppp authentication chap +! +``` + + +### LNS + +% stop_vyoslinter + +```none +set interfaces ethernet eth0 address '192.168.139.100/24' +set nat source rule 100 outbound-interface name 'eth0' +set nat source rule 100 source address '10.0.0.0/24' +set nat source rule 100 translation address 'masquerade' +set protocols static route 0.0.0.0/0 next-hop 192.168.139.2 +set vpn l2tp remote-access authentication mode 'radius' +set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest' +set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100' +set vpn l2tp remote-access default-pool 'TEST-POOL' +set vpn l2tp remote-access gateway-address '10.0.0.1' +set vpn l2tp remote-access lns host-name 'LAC' +set vpn l2tp remote-access lns shared-secret 'test123' +set vpn l2tp remote-access name-server '8.8.8.8' +set vpn l2tp remote-access ppp-options disable-ccp +``` + +% start_vyoslinter + +:::{note} +This setup requires the Compression Control Protocol (CCP) +being disabled, the command `set vpn l2tp remote-access ppp-options disable-ccp` +accomplishes that. +::: + +### Client + +In this lab we use Windows PPPoE client. + +```{image} /_static/images/lac-lns-winclient.webp +:align: center +:alt: Window PPPoE Client Configuration +:width: 100% +``` + + +### Monitoring + +Monitoring on LNS side + +```none +vyos@vyos:~$ show l2tp-server sessions + ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes +--------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+---------- + l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB +``` + +Monitoring on LAC side + +```none +Router#show pppoe session + 1 session in FORWARDED (FWDED) State + 1 session total +Uniq ID PPPoE RemMAC Port VT VA State + SID LocMAC VA-st Type + 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED + 0c58.88ac.0001 + +Router#show l2tp +L2TP Tunnel and Session Information Total tunnels 1 sessions 1 + +LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ + Count VPDN Group +23238 2640 LAC est 192.168.139.100 1 LAC + +LocID RemID TunID Username, Intf/ State Last Chg Uniq ID + Vcid, Circuit +25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1 +``` + +Monitoring on RADIUS Server side + +```none +root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221 +Wed Feb 21 13:37:17 2024 + User-Name = "test@vyos.io" + NAS-Port = 0 + NAS-Port-Id = "l2tp0" + NAS-Port-Type = Virtual + Service-Type = Framed-User + Framed-Protocol = PPP + Calling-Station-Id = "192.168.139.101" + Called-Station-Id = "192.168.139.100" + Acct-Status-Type = Start + Acct-Authentic = RADIUS + Acct-Session-Id = "45c731e169d9a4f1" + Acct-Session-Time = 0 + Acct-Input-Octets = 0 + Acct-Output-Octets = 0 + Acct-Input-Packets = 0 + Acct-Output-Packets = 0 + Acct-Input-Gigawords = 0 + Acct-Output-Gigawords = 0 + Framed-IP-Address = 10.0.0.2 + NAS-IP-Address = 192.168.139.100 + Event-Timestamp = "Feb 21 2024 13:37:17 UTC" + Tmp-String-9 = "ai:" + Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318" + Timestamp = 1708522637 +``` diff --git a/docs/configexamples/lac-lns.rst b/docs/configexamples/lac-lns.rst deleted file mode 100644 index 5f344d54..00000000 --- a/docs/configexamples/lac-lns.rst +++ /dev/null @@ -1,182 +0,0 @@ -:lastproofread: 2024-02-21 - -.. _examples-lac-lns: - -############### -PPPoE over L2TP -############### - -This document is to describe a basic setup using PPPoE over L2TP. -LAC and LNS are components of the broadband topology. -LAC - L2TP access concentrator -LNS - L2TP Network Server -LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and -forward them to LNS. LNS is the termination point that comes from PPP packets -from the remote client. - -In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC. -All users with domain **vyos.io** will be tunneled to LNS via L2TP. - -Network Topology -================ - -.. image:: /_static/images/lac-lns-diagram.* - :width: 60% - :align: center - :alt: Network Topology Diagram - -Configurations -============== - -LAC ---- - -.. code-block:: none - - aaa new-model - ! - aaa authentication ppp default local - ! - vpdn enable - vpdn aaa attribute nas-ip-address vpdn-nas - ! - vpdn-group LAC - request-dialin - protocol l2tp - domain vyos.io - initiate-to ip 192.168.139.100 - source-ip 192.168.139.101 - local name LAC - l2tp tunnel password 0 test123 - ! - bba-group pppoe MAIN-BBA - virtual-template 1 - ! - interface GigabitEthernet0/0 - description To LNS - ip address 192.168.139.101 255.255.255.0 - duplex auto - speed auto - media-type rj45 - ! - interface GigabitEthernet0/1 - description To PPPoE clients - no ip address - duplex auto - speed auto - media-type rj45 - pppoe enable group MAIN-BBA - ! - interface Virtual-Template1 - description pppoe MAIN-BBA - no ip address - no peer default ip address - ppp mtu adaptive - ppp authentication chap - ! - - -LNS ---- - -.. stop_vyoslinter - -.. code-block:: none - - set interfaces ethernet eth0 address '192.168.139.100/24' - set nat source rule 100 outbound-interface name 'eth0' - set nat source rule 100 source address '10.0.0.0/24' - set nat source rule 100 translation address 'masquerade' - set protocols static route 0.0.0.0/0 next-hop 192.168.139.2 - set vpn l2tp remote-access authentication mode 'radius' - set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest' - set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100' - set vpn l2tp remote-access default-pool 'TEST-POOL' - set vpn l2tp remote-access gateway-address '10.0.0.1' - set vpn l2tp remote-access lns host-name 'LAC' - set vpn l2tp remote-access lns shared-secret 'test123' - set vpn l2tp remote-access name-server '8.8.8.8' - set vpn l2tp remote-access ppp-options disable-ccp - -.. start_vyoslinter - -.. note:: This setup requires the Compression Control Protocol (CCP) - being disabled, the command - ``set vpn l2tp remote-access ppp-options disable-ccp`` - accomplishes that. - -Client ------- - -In this lab we use Windows PPPoE client. - -.. image:: /_static/images/lac-lns-winclient.* - :width: 100% - :align: center - :alt: Window PPPoE Client Configuration - -Monitoring ----------- - -Monitoring on LNS side - -.. code-block:: none - - vyos@vyos:~$ show l2tp-server sessions - ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes - --------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+---------- - l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB - -Monitoring on LAC side - -.. code-block:: none - - Router#show pppoe session - 1 session in FORWARDED (FWDED) State - 1 session total - Uniq ID PPPoE RemMAC Port VT VA State - SID LocMAC VA-st Type - 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED - 0c58.88ac.0001 - - Router#show l2tp - L2TP Tunnel and Session Information Total tunnels 1 sessions 1 - - LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ - Count VPDN Group - 23238 2640 LAC est 192.168.139.100 1 LAC - - LocID RemID TunID Username, Intf/ State Last Chg Uniq ID - Vcid, Circuit - 25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1 - -Monitoring on RADIUS Server side - -.. code-block:: none - - root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221 - Wed Feb 21 13:37:17 2024 - User-Name = "test@vyos.io" - NAS-Port = 0 - NAS-Port-Id = "l2tp0" - NAS-Port-Type = Virtual - Service-Type = Framed-User - Framed-Protocol = PPP - Calling-Station-Id = "192.168.139.101" - Called-Station-Id = "192.168.139.100" - Acct-Status-Type = Start - Acct-Authentic = RADIUS - Acct-Session-Id = "45c731e169d9a4f1" - Acct-Session-Time = 0 - Acct-Input-Octets = 0 - Acct-Output-Octets = 0 - Acct-Input-Packets = 0 - Acct-Output-Packets = 0 - Acct-Input-Gigawords = 0 - Acct-Output-Gigawords = 0 - Framed-IP-Address = 10.0.0.2 - NAS-IP-Address = 192.168.139.100 - Event-Timestamp = "Feb 21 2024 13:37:17 UTC" - Tmp-String-9 = "ai:" - Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318" - Timestamp = 1708522637 diff --git a/docs/configexamples/md-ansible.md b/docs/configexamples/md-ansible.md deleted file mode 100644 index 8bbd9306..00000000 --- a/docs/configexamples/md-ansible.md +++ /dev/null @@ -1,212 +0,0 @@ ---- -lastproofread: '2024-04-09' ---- - -(examples-ansible)= - -# Ansible example - -## Setting up Ansible on a server running the Debian operating system. - -In this example, we will set up a simple use of Ansible to configure -multiple VyOS routers. -We have four pre-configured routers with this configuration: - -Using the general schema for example: - -```{image} /_static/images/ansible.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -We have four pre-configured routers with this configuration: - -```none -set interfaces ethernet eth0 address dhcp -set service ssh -commit -save -``` - -- vyos7 - 192.0.2.105 -- vyos8 - 192.0.2.106 -- vyos9 - 192.0.2.107 -- vyos10 - 192.0.2.108 - -## Install Ansible: - -```none -# apt-get install ansible -Do you want to continue? [Y/n] y -``` - - -## Install Paramiko: - -```none -#apt-get install -y python3-paramiko -``` - - -## Check the version: - -```none -# ansible --version -ansible 2.10.8 -config file = None -configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] -ansible python module location = /usr/lib/python3/dist-packages/ansible -executable location = /usr/bin/ansible -python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110] -``` - - -## Basic configuration of ansible.cfg: - -```none -# nano /root/ansible.cfg -[defaults] -host_key_checking = no -``` - - -## Add all the VyOS hosts: - -```none -# nano /root/hosts -[vyos_hosts] -vyos7 ansible_ssh_host=192.0.2.105 -vyos8 ansible_ssh_host=192.0.2.106 -vyos9 ansible_ssh_host=192.0.2.107 -vyos10 ansible_ssh_host=192.0.2.108 -``` - - -## Add general variables: - -```none -# mkdir /root/group_vars/ -# nano /root/group_vars/vyos_hosts -ansible_python_interpreter: /usr/bin/python3 -ansible_network_os: vyos -ansible_connection: network_cli -ansible_user: vyos -ansible_ssh_pass: vyos -``` - - -## Add a simple playbook with the tasks for each router: - -```none -# nano /root/main.yml - ---- -- hosts: vyos_hosts - gather_facts: 'no' - tasks: - - name: Configure general settings for the vyos hosts group - vyos_config: - lines: - - set system name-server 192.0.2.1 - - set interfaces ethernet eth0 description '#WAN#' - - set interfaces ethernet eth1 description '#LAN#' - - set interfaces ethernet eth2 disable - - set interfaces ethernet eth3 disable - - set system host-name {{ inventory_hostname }} - save: true -``` - - -## Start the playbook: - -```none -ansible-playbook -i hosts main.yml -PLAY [vyos_hosts] ************************************************************** - -TASK [Configure general settings for the vyos hosts group] ********************* -ok: [vyos9] -ok: [vyos10] -ok: [vyos7] -ok: [vyos8] - -PLAY RECAP ********************************************************************* -vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 -vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 -vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 -vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 -``` - - -## Check the result on the vyos10 router: - -```none -vyos@vyos10:~$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 192.0.2.108/24 u/u WAN -eth1 - u/u LAN -eth2 - A/D -eth3 - A/D -lo 127.0.0.1/8 u/u - ::1/128 - -vyos@vyos10:~$ sh configuration commands | grep 192.0.2.1 -set system name-server '192.0.2.1' -``` - - -## The simple way without configuration of the hostname (one task for all routers): - -```none -# nano /root/hosts_v2 -[vyos_hosts_group] -vyos7 ansible_ssh_host=192.0.2.105 -vyos8 ansible_ssh_host=192.0.2.106 -vyos9 ansible_ssh_host=192.0.2.107 -vyos10 ansible_ssh_host=192.0.2.108 -[vyos_hosts_group:vars] -ansible_python_interpreter=/usr/bin/python3 -ansible_user=vyos -ansible_ssh_pass=vyos -ansible_network_os=vyos -ansible_connection=network_cli - -# nano /root/main_v2.yml ---- -- hosts: vyos_hosts_group - connection: network_cli - gather_facts: 'no' - tasks: - - name: Configure remote vyos_hosts_group - vyos_config: - lines: - - set system name-server 192.0.2.1 - - set interfaces ethernet eth0 description WAN - - set interfaces ethernet eth1 description LAN - - set interfaces ethernet eth2 disable - - set interfaces ethernet eth3 disable - save: true -``` - -```none -# ansible-playbook -i hosts_v2 main_v2.yml - -PLAY [vyos_hosts_group] ******************************************************** - -TASK [Configure remote vyos_hosts_group] *************************************** -ok: [vyos8] -ok: [vyos7] -ok: [vyos9] -ok: [vyos10] - -PLAY RECAP ********************************************************************* -vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 -vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 -vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 -vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 -``` - -In the next chapter of the example, we'll use Ansible with jinja2 -templates and variables. diff --git a/docs/configexamples/md-azure-vpn-bgp.md b/docs/configexamples/md-azure-vpn-bgp.md deleted file mode 100644 index 83d77e53..00000000 --- a/docs/configexamples/md-azure-vpn-bgp.md +++ /dev/null @@ -1,134 +0,0 @@ ---- -lastproofread: '2021-06-28' ---- - -(examples-azure-vpn-bgp)= - -# Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) - -This guide shows an example of a route-based IKEv2 site-to-site VPN to -Azure using VTI and BGP for dynamic routing updates. - -For redundant / active-active configurations see -{ref}`examples-azure-vpn-dual-bgp` - -## Prerequisites - -- A pair of Azure VNet Gateways deployed in active-passive - configuration with BGP enabled. -- A local network gateway deployed in Azure representing - the Vyos device, matching the below Vyos settings except for - address space, which only requires the Vyos private IP, in - this example 10.10.0.5/32 -- A connection resource deployed in Azure linking the - Azure VNet gateway and the local network gateway representing - the Vyos device. - -## Example - -```{eval-rst} -+---------------------------------------+---------------------+ -| WAN Interface | eth0 | -+---------------------------------------+---------------------+ -| On-premises address space | 10.10.0.0/16 | -+---------------------------------------+---------------------+ -| Azure address space | 10.0.0.0/16 | -+---------------------------------------+---------------------+ -| Vyos public IP | 198.51.100.3 | -+---------------------------------------+---------------------+ -| Vyos private IP | 10.10.0.5 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway public IP | 203.0.113.2 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway BGP IP | 10.0.0.4 | -+---------------------------------------+---------------------+ -| Pre-shared key | ch00s3-4-s3cur3-psk | -+---------------------------------------+---------------------+ -| Vyos ASN | 64499 | -+---------------------------------------+---------------------+ -| Azure ASN | 65540 | -+---------------------------------------+---------------------+ -``` - -## Vyos configuration - -- Configure the IKE and ESP settings to match a subset - of those supported by Azure: - -```none -set vpn ipsec esp-group AZURE lifetime '3600' -set vpn ipsec esp-group AZURE mode 'tunnel' -set vpn ipsec esp-group AZURE pfs 'dh-group2' -set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' -set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' - -set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' -set vpn ipsec ike-group AZURE dead-peer-detection interval '15' -set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' -set vpn ipsec ike-group AZURE ikev2-reauth -set vpn ipsec ike-group AZURE key-exchange 'ikev2' -set vpn ipsec ike-group AZURE lifetime '28800' -set vpn ipsec ike-group AZURE proposal 1 dh-group '2' -set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' -set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' -``` - -- Enable IPsec on eth0 - -```none -set vpn ipsec interface 'eth0' -``` - -- Configure a VTI with a dummy IP address - -```none -set interfaces vti vti1 address '10.10.1.5/32' -set interfaces vti vti1 description 'Azure Tunnel' -``` - -- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. - -```none -set interfaces vti vti1 ip adjust-mss 1350 -``` - -- Configure the VPN tunnel - -```none -set vpn ipsec authentication psk azure id '198.51.100.3' -set vpn ipsec authentication psk azure id '203.0.113.2' -set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' -set vpn ipsec site-to-site peer 203.0.113.2 authentication local-id '198.51.100.3' -set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' -set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate' -set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' -set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' -set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' -set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' -set vpn ipsec site-to-site peer 203.0.113.2 remote-address '203.0.113.2' -set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' -set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' -``` - -- **Important**: Add an interface route to reach Azure's BGP listener - -```none -set protocols static route 10.0.0.4/32 interface vti1 -``` - -- Configure your BGP settings - -```none -set protocols bgp system-as 64499 -set protocols bgp neighbor 10.0.0.4 remote-as '65540' -set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' -set protocols bgp neighbor 10.0.0.4 timers holdtime '30' -set protocols bgp neighbor 10.0.0.4 timers keepalive '10' -``` - -- **Important**: Disable connected check - -```none -set protocols bgp neighbor 10.0.0.4 disable-connected-check -``` diff --git a/docs/configexamples/md-azure-vpn-dual-bgp.md b/docs/configexamples/md-azure-vpn-dual-bgp.md deleted file mode 100644 index 967debd4..00000000 --- a/docs/configexamples/md-azure-vpn-dual-bgp.md +++ /dev/null @@ -1,160 +0,0 @@ ---- -lastproofread: '2021-06-28' ---- - -(examples-azure-vpn-dual-bgp)= - -# Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) - -This guide shows an example of a redundant (active-active) route-based IKEv2 -site-to-site VPN to Azure using VTI -and BGP for dynamic routing updates. - -## Prerequisites - -- A pair of Azure VNet Gateways deployed in active-active - configuration with BGP enabled. -- A local network gateway deployed in Azure representing - the Vyos device, matching the below Vyos settings except for - address space, which only requires the Vyos private IP, in - this example 10.10.0.5/32 -- A connection resource deployed in Azure linking the - Azure VNet gateway and the local network gateway representing - the Vyos device. - -## Example - -```{eval-rst} -+---------------------------------------+---------------------+ -| WAN Interface | eth0 | -+---------------------------------------+---------------------+ -| On-premises address space | 10.10.0.0/16 | -+---------------------------------------+---------------------+ -| Azure address space | 10.0.0.0/16 | -+---------------------------------------+---------------------+ -| Vyos public IP | 198.51.100.3 | -+---------------------------------------+---------------------+ -| Vyos private IP | 10.10.0.5 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway 1 public IP | 203.0.113.2 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway 2 public IP | 203.0.113.3 | -+---------------------------------------+---------------------+ -| Azure VNet Gateway BGP IP | 10.0.0.4,10.0.0.5 | -+---------------------------------------+---------------------+ -| Pre-shared key | ch00s3-4-s3cur3-psk | -+---------------------------------------+---------------------+ -| Vyos ASN | 64499 | -+---------------------------------------+---------------------+ -| Azure ASN | 65540 | -+---------------------------------------+---------------------+ -``` - -## Vyos configuration - -- Configure the IKE and ESP settings to match a subset - of those supported by Azure: - -```none -set vpn ipsec esp-group AZURE lifetime '3600' -set vpn ipsec esp-group AZURE mode 'tunnel' -set vpn ipsec esp-group AZURE pfs 'dh-group2' -set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' -set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' - -set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' -set vpn ipsec ike-group AZURE dead-peer-detection interval '15' -set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' -set vpn ipsec ike-group AZURE ikev2-reauth -set vpn ipsec ike-group AZURE key-exchange 'ikev2' -set vpn ipsec ike-group AZURE lifetime '28800' -set vpn ipsec ike-group AZURE proposal 1 dh-group '2' -set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' -set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' -``` - -- Enable IPsec on eth0 - -```none -set vpn ipsec interface 'eth0' -``` - -- Configure two VTIs with a dummy IP address each - -```none -set interfaces vti vti1 address '10.10.1.5/32' -set interfaces vti vti1 description 'Azure Primary Tunnel' - -set interfaces vti vti2 address '10.10.1.6/32' -set interfaces vti vti2 description 'Azure Secondary Tunnel' -``` - -- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. - -```none -set interfaces vti vti1 ip adjust-mss 1350 -set interfaces vti vti2 ip adjust-mss 1350 -``` - -- Configure the VPN tunnels - -```none -set vpn ipsec authentication psk azure id '198.51.100.3' -set vpn ipsec authentication psk azure id '203.0.113.2' -set vpn ipsec authentication psk azure id '203.0.113.3' -set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' - -set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3' -set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2' -set vpn ipsec site-to-site peer azure-primary connection-type 'initiate' -set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL' -set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE' -set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit' -set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5' -set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2' -set vpn ipsec site-to-site peer azure-primary vti bind 'vti1' -set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE' - -set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3' -set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3' -set vpn ipsec site-to-site peer azure-secondary connection-type 'initiate' -set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL' -set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE' -set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit' -set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5' -set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3' -set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2' -set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE' -``` - -- **Important**: Add an interface route to reach both Azure's BGP listeners - -```none -set protocols static route 10.0.0.4/32 interface vti1 -set protocols static route 10.0.0.5/32 interface vti2 -``` - -- Configure your BGP settings - -```none -set protocols bgp system-as 64499 -set protocols bgp neighbor 10.0.0.4 remote-as '65540' -set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' -set protocols bgp neighbor 10.0.0.4 timers holdtime '30' -set protocols bgp neighbor 10.0.0.4 timers keepalive '10' - -set protocols bgp neighbor 10.0.0.5 remote-as '65540' -set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound' -set protocols bgp neighbor 10.0.0.5 timers holdtime '30' -set protocols bgp neighbor 10.0.0.5 timers keepalive '10' -``` - -- **Important**: Disable connected check, otherwise the routes learned - from Azure will not be imported into the routing table. - -```none -set protocols bgp neighbor 10.0.0.4 disable-connected-check -set protocols bgp neighbor 10.0.0.5 disable-connected-check -``` diff --git a/docs/configexamples/md-bgp-ipv6-unnumbered.md b/docs/configexamples/md-bgp-ipv6-unnumbered.md deleted file mode 100644 index 4fa29834..00000000 --- a/docs/configexamples/md-bgp-ipv6-unnumbered.md +++ /dev/null @@ -1,174 +0,0 @@ ---- -lastproofread: '2021-06-28' ---- - -(examples-bgp-ipv6-unnumbered)= - -# BGP IPv6 unnumbered with extended nexthop - -General information can be found in the {ref}`routing-bgp` chapter. - -## Configuration - -- Router A: - -```none -set protocols bgp system-as 64496 -set protocols bgp address-family ipv4-unicast redistribute connected -set protocols bgp address-family ipv6-unicast redistribute connected -set protocols bgp neighbor eth1 interface v6only -set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' -set protocols bgp neighbor eth2 interface v6only -set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' -set protocols bgp parameters bestpath as-path multipath-relax -set protocols bgp parameters bestpath compare-routerid -set protocols bgp parameters default no-ipv4-unicast -set protocols bgp parameters router-id '192.168.0.1' -set protocols bgp peer-group fabric address-family ipv4-unicast -set protocols bgp peer-group fabric address-family ipv6-unicast -set protocols bgp peer-group fabric capability extended-nexthop -set protocols bgp peer-group fabric remote-as 'external' -``` - -- Router B: - -```none -set protocols bgp system-as 64499 -set protocols bgp address-family ipv4-unicast redistribute connected -set protocols bgp address-family ipv6-unicast redistribute connected -set protocols bgp neighbor eth1 interface v6only -set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' -set protocols bgp neighbor eth2 interface v6only -set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' -set protocols bgp parameters bestpath as-path multipath-relax -set protocols bgp parameters bestpath compare-routerid -set protocols bgp parameters default no-ipv4-unicast -set protocols bgp parameters router-id '192.168.0.2' -set protocols bgp peer-group fabric address-family ipv4-unicast -set protocols bgp peer-group fabric address-family ipv6-unicast -set protocols bgp peer-group fabric capability extended-nexthop -set protocols bgp peer-group fabric remote-as 'external' -``` - - -## Results - -- Router A: - -```none -vyos@vyos:~$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 198.51.100.34/24 u/u -eth1 - u/u -eth2 - u/u -lo 127.0.0.1/8 u/u - 192.168.0.1/32 - ::1/128 -``` - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route - -S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53 -C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53 -C>* 192.168.0.1/32 is directly connected, lo, 03:21:56 -B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07 - * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07 -``` - -```none -vyos@vyos:~$ ping 192.168.0.2 -PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data. -64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms -64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms -64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms -64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms -64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms - ---- 192.168.0.2 ping statistics --- -5 packets transmitted, 5 received, 0% packet loss, time 4086ms -rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms -``` - -```none -vyos@vyos:~$ show ip bgp summary - -IPv4 Unicast Summary: -BGP router identifier 192.168.0.1, local AS number 64496 vrf-id 0 -BGP table version 4 -RIB entries 5, using 800 bytes of memory -Peers 2, using 41 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd -eth1 4 64499 13 13 0 0 0 00:05:33 2 -eth2 4 64499 13 14 0 0 0 00:05:29 2 - -Total number of neighbors 2 -``` - -- Router B: - -```none -vyos@vyos:~$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 198.51.100.33/24 u/u -eth1 - u/u -eth2 - u/u -lo 127.0.0.1/8 u/u - 192.168.0.2/32 - ::1/128 -``` - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route - -S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08 -C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09 -B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18 - * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18 -C>* 192.168.0.2/32 is directly connected, lo, 00:44:11 -``` - -```none -vyos@vyos:~$ ping 192.168.0.1 -PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. -64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms -64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms -64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms -64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms - ---- 192.168.0.1 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3051ms -rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms -``` - -```none -vyos@vyos:~$ show ip bgp summary -IPv4 Unicast Summary: -BGP router identifier 192.168.0.2, local AS number 64499 vrf-id 0 -BGP table version 4 -RIB entries 5, using 800 bytes of memory -Peers 2, using 41 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd -eth1 4 64496 14 14 0 0 0 00:06:40 2 -eth2 4 64496 14 14 0 0 0 00:06:37 2 - -Total number of neighbors 2 -``` diff --git a/docs/configexamples/md-dmvpn-dualhub-dualcloud.md b/docs/configexamples/md-dmvpn-dualhub-dualcloud.md deleted file mode 100644 index 20c1a064..00000000 --- a/docs/configexamples/md-dmvpn-dualhub-dualcloud.md +++ /dev/null @@ -1,552 +0,0 @@ ---- -lastproofread: '2024-02-21' ---- - -(examples-dmvpn-dualhub-dualcloud)= - -# DMVPN Dual HUB Dual Cloud - -This document is to describe a basic setup to build DMVPN network with two Hubs and two clouds using DMVPN Phase3. -OSPF is used as routing protocol inside DMVPN. - -In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) -as a Spoke. - -## Network Topology - -```{image} /_static/images/dual-hub-DMVPN.webp -:align: center -:alt: DMVPN Network Topology -:width: 80% -``` - - -## Configurations - -### Underlay configuration - -Networks 192.168.X.0/24 are used as LANs for every spoke. - -HUB-1 - -```none -set interfaces ethernet eth0 address '10.0.0.2/30' -set protocols static route 0.0.0.0/0 next-hop 10.0.0.1 -``` - -HUB-2 - -```none -set interfaces ethernet eth0 address '10.0.1.2/30' -set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 -``` - -Spoke-1 - -```none -interface GigabitEthernet0/0 - ip address 10.0.11.2 255.255.255.252 - duplex auto - speed auto - media-type rj45 -! -interface GigabitEthernet0/1 - ip address 192.168.11.1 255.255.255.0 - ip ospf 1 area 0 - duplex auto - speed auto - media-type rj45 -! -ip route 0.0.0.0 0.0.0.0 10.0.11.1 -``` - -Spoke-2 - -```none -set interfaces ethernet eth0 address '10.0.12.2/30' -set interfaces ethernet eth1 address '192.168.12.1/24' -set protocols static route 0.0.0.0/0 next-hop 10.0.12.1 -``` - -Spoke-3 - -```none -set interfaces ethernet eth0 address '10.0.13.2/30' -set interfaces ethernet eth1 address '192.168.13.1/24' -set protocols static route 0.0.0.0/0 next-hop 10.0.13.1 -``` - - -### NHRP configuration - -The next step is to configure the NHRP protocol. In a Dual cloud network, every HUB has to be configured with one GRE -multipoint tunnel interface and every spoke has to be configured with two tunnel interfaces, one tunnel to each hub. -In this example tunnel networks are 10.100.100.0/24 for the first cloud and 10.100.101.0/24 for the second cloud. -But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32. - -HUB-1 - -```none -set interfaces tunnel tun100 address '10.100.100.1/32' -set interfaces tunnel tun100 enable-multicast -set interfaces tunnel tun100 encapsulation 'gre' -set interfaces tunnel tun100 ip adjust-mss '1360' -set interfaces tunnel tun100 mtu '1436' -set interfaces tunnel tun100 parameters ip key '42' -set interfaces tunnel tun100 source-interface 'eth0' -set protocols nhrp tunnel tun100 authentication 'vyos' -set protocols nhrp tunnel tun100 holdtime '300' -set protocols nhrp tunnel tun100 multicast 'dynamic' -set protocols nhrp tunnel tun100 network-id '1' -set protocols nhrp tunnel tun100 redirect -set protocols nhrp tunnel tun100 registration-no-unique -``` - -HUB-2 - -```none -set interfaces tunnel tun101 address '10.100.101.1/32' -set interfaces tunnel tun101 enable-multicast -set interfaces tunnel tun101 encapsulation 'gre' -set interfaces tunnel tun101 ip adjust-mss '1360' -set interfaces tunnel tun101 mtu '1436' -set interfaces tunnel tun101 parameters ip key '43' -set interfaces tunnel tun101 source-interface 'eth0' -set protocols nhrp tunnel tun101 authentication 'vyos' -set protocols nhrp tunnel tun101 holdtime '300' -set protocols nhrp tunnel tun101 multicast 'dynamic' -set protocols nhrp tunnel tun101 network-id '2' -set protocols nhrp tunnel tun101 redirect -set protocols nhrp tunnel tun101 registration-no-unique -``` - -Spoke-1 - -```none -interface Tunnel100 - ip address 10.100.100.11 255.255.255.0 - no ip redirects - ip mtu 1436 - ip nhrp authentication vyos - ip nhrp map multicast 10.0.0.2 - ip nhrp network-id 1 - ip nhrp holdtime 300 - ip nhrp nhs 10.100.100.1 nbma 10.0.0.2 - ip nhrp shortcut - ip tcp adjust-mss 1360 - tunnel source GigabitEthernet0/0 - tunnel mode gre multipoint - tunnel key 42 -! -interface Tunnel101 - ip address 10.100.101.11 255.255.255.0 - no ip redirects - ip mtu 1436 - ip nhrp authentication vyos - ip nhrp map multicast 10.0.1.2 - ip nhrp network-id 2 - ip nhrp holdtime 300 - ip nhrp nhs 10.100.101.1 nbma 10.0.1.2 - ip nhrp shortcut - ip tcp adjust-mss 1360 - tunnel source GigabitEthernet0/0 - tunnel mode gre multipoint - tunnel key 43 -``` - -Spoke-2 - -```none -set interfaces tunnel tun100 address '10.100.100.12/32' -set interfaces tunnel tun100 enable-multicast -set interfaces tunnel tun100 encapsulation 'gre' -set interfaces tunnel tun100 ip adjust-mss '1360' -set interfaces tunnel tun100 mtu '1436' -set interfaces tunnel tun100 parameters ip key '42' -set interfaces tunnel tun100 source-interface 'eth0' -set interfaces tunnel tun101 address '10.100.101.12/32' -set interfaces tunnel tun101 enable-multicast -set interfaces tunnel tun101 encapsulation 'gre' -set interfaces tunnel tun101 ip adjust-mss '1360' -set interfaces tunnel tun101 mtu '1436' -set interfaces tunnel tun101 parameters ip key '43' -set interfaces tunnel tun101 source-interface 'eth0' -set protocols nhrp tunnel tun100 authentication 'vyos' -set protocols nhrp tunnel tun100 holdtime '300' -set protocols nhrp tunnel tun100 multicast '10.0.0.2' -set protocols nhrp tunnel tun100 network-id '1' -set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' -set protocols nhrp tunnel tun100 registration-no-unique -set protocols nhrp tunnel tun100 shortcut -set protocols nhrp tunnel tun101 authentication 'vyos' -set protocols nhrp tunnel tun101 holdtime '300' -set protocols nhrp tunnel tun101 multicast '10.0.1.2' -set protocols nhrp tunnel tun101 network-id '2' -set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' -set protocols nhrp tunnel tun101 registration-no-unique -set protocols nhrp tunnel tun101 shortcut -``` - -Spoke-3 - -```none -set protocols nhrp tunnel tun100 authentication 'vyos' -set protocols nhrp tunnel tun100 holdtime '300' -set protocols nhrp tunnel tun100 multicast '10.0.0.2' -set protocols nhrp tunnel tun100 network-id '1' -set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' -set protocols nhrp tunnel tun100 registration-no-unique -set protocols nhrp tunnel tun100 shortcut -set protocols nhrp tunnel tun101 authentication 'vyos' -set protocols nhrp tunnel tun101 holdtime '300' -set protocols nhrp tunnel tun101 multicast '10.0.1.2' -set protocols nhrp tunnel tun101 network-id '2' -set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' -set protocols nhrp tunnel tun101 registration-no-unique -set protocols nhrp tunnel tun101 shortcut -``` - - -### Overlay configuration - -The last step is to configure the routing protocol. In this scenario, OSPF was chosen as the dynamic routing protocol. -But you can use iBGP or eBGP. To form fast convergence it is possible to use BFD protocol. - -HUB-1 - -```none -set protocols ospf interface tun100 area '0' -set protocols ospf interface tun100 network 'point-to-multipoint' -set protocols ospf interface tun100 passive disable -set protocols ospf passive-interface 'default' -``` - -HUB-2 - -```none -set protocols ospf interface tun101 area '0' -set protocols ospf interface tun101 network 'point-to-multipoint' -set protocols ospf interface tun101 passive disable -set protocols ospf passive-interface 'default' -``` - -Spoke-1 - -```none -interface Tunnel100 - ip ospf network point-to-multipoint - ip ospf dead-interval 40 - ip ospf hello-interval 10 - ip ospf 1 area 0 -! -interface Tunnel101 - ip ospf network point-to-multipoint - ip ospf dead-interval 40 - ip ospf hello-interval 10 - ip ospf 1 area 0 -! -router ospf 1 - passive-interface default - no passive-interface Tunnel100 - no passive-interface Tunnel101 -``` - -Spoke-2 - -```none -set protocols ospf interface eth1 area '0' -set protocols ospf interface tun100 area '0' -set protocols ospf interface tun100 network 'point-to-multipoint' -set protocols ospf interface tun100 passive disable -set protocols ospf interface tun101 area '0' -set protocols ospf interface tun101 network 'point-to-multipoint' -set protocols ospf interface tun101 passive disable -set protocols ospf passive-interface 'default' -``` - -Spoke-3 - -```none -set protocols ospf interface eth1 area '0' -set protocols ospf interface tun100 area '0' -set protocols ospf interface tun100 network 'point-to-multipoint' -set protocols ospf interface tun100 passive disable -set protocols ospf interface tun101 area '0' -set protocols ospf interface tun101 network 'point-to-multipoint' -set protocols ospf interface tun101 passive disable -set protocols ospf passive-interface 'default' -``` - - -### Security configuration - -Tunnels can be encrypted by IPSEC for security. - -HUB-1 - -```{eval-rst} - .. code-block:: none - - set vpn ipsec esp-group ESP-HUB lifetime '1800' - set vpn ipsec esp-group ESP-HUB mode 'transport' - set vpn ipsec esp-group ESP-HUB pfs 'disable' - set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' - set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' - set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' - set vpn ipsec ike-group IKE-HUB lifetime '3600' - set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' - set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' - set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' - set vpn ipsec interface 'eth0' - set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' - set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' - set vpn ipsec profile NHRPVPN bind tunnel 'tun100' - set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' - set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' -``` - -HUB-2 - -```{eval-rst} - .. code-block:: none - - set vpn ipsec esp-group ESP-HUB lifetime '1800' - set vpn ipsec esp-group ESP-HUB mode 'transport' - set vpn ipsec esp-group ESP-HUB pfs 'disable' - set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' - set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' - set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' - set vpn ipsec ike-group IKE-HUB lifetime '3600' - set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' - set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' - set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' - set vpn ipsec interface 'eth0' - set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' - set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' - set vpn ipsec profile NHRPVPN bind tunnel 'tun101' - set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' - set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' -``` - -VyOS Spokes have the same configuration - -```{eval-rst} - .. code-block:: none - - set vpn ipsec esp-group ESP-HUB lifetime '1800' - set vpn ipsec esp-group ESP-HUB mode 'transport' - set vpn ipsec esp-group ESP-HUB pfs 'disable' - set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' - set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' - set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' - set vpn ipsec ike-group IKE-HUB lifetime '3600' - set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' - set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' - set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' - set vpn ipsec interface 'eth0' - set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' - set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' - set vpn ipsec profile NHRPVPN bind tunnel 'tun100' - set vpn ipsec profile NHRPVPN bind tunnel 'tun101' - set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' - set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' -``` - -SPOKE-1 - -```{eval-rst} - .. code-block:: none - - crypto isakmp policy 1 - encr aes 256 - authentication pre-share - group 2 - lifetime 3600 - crypto isakmp key secret address 0.0.0.0 - ! - ! - crypto ipsec transform-set ESP_TRANSFORMSET esp-aes 256 esp-sha-hmac - mode transport - ! - ! - crypto ipsec profile gre_protection - set security-association lifetime seconds 1800 - set transform-set ESP_TRANSFORMSET - ! - interface Tunnel100 - tunnel protection ipsec profile gre_protection shared - ! - interface Tunnel101 - tunnel protection ipsec profile gre_protection shared -``` - - -## Monitoring - -All spokes created IPSec tunnels to Hubs, are registered on Hubs using NHRP protocol and formed adjacency in OSPF. - -```none -vyos@HUB-1:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal --------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------ -dmvpn-NHRPVPN-tun100-child up 6m1s 4K/5K 51/56 10.0.13.2 10.0.13.2 AES_CBC_256/HMAC_SHA1_96 -dmvpn-NHRPVPN-tun100-child up 6m36s 4K/6K 56/65 10.0.12.2 10.0.12.2 AES_CBC_256/HMAC_SHA1_96 -dmvpn-NHRPVPN-tun100-child up 8m49s 6K/6K 73/77 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96 - -vyos@HUB-1:~$ show ip nhrp cache -Iface Type Protocol NBMA Claimed NBMA Flags Identity -tun100 dynamic 10.100.100.12 10.0.12.2 10.0.12.2 T 10.0.12.2 -tun100 dynamic 10.100.100.13 10.0.13.2 10.0.13.2 T 10.0.13.2 -tun100 dynamic 10.100.100.11 10.0.11.2 10.0.11.2 T 10.0.11.2 -tun100 local 10.100.100.1 10.0.0.2 10.0.0.2 - - -vyos@HUB-1:~$ show ip ospf neighbor - -Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL -192.168.11.1 1 Full/DROther 17m01s 36.201s 10.100.100.11 tun100:10.100.100.1 0 0 0 -192.168.12.1 1 Full/DROther 9m42s 37.443s 10.100.100.12 tun100:10.100.100.1 0 0 0 -192.168.13.1 1 Full/DROther 9m15s 35.053s 10.100.100.13 tun100:10.100.100.1 0 0 0 -``` - -First, we see that LANs are accessible through hubs using OSPF routes. - -```none -SPOKE-1#show ip route -Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP - D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area - N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 - E1 - OSPF external type 1, E2 - OSPF external type 2 - i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 - ia - IS-IS inter area, * - candidate default, U - per-user static route - o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP - a - application route - + - replicated route, % - next hop override, p - overrides from PfR - -Gateway of last resort is 10.0.11.1 to network 0.0.0.0 -..... - 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks -C 192.168.11.0/24 is directly connected, GigabitEthernet0/1 -L 192.168.11.1/32 is directly connected, GigabitEthernet0/1 -O 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101 - [110/1002] via 10.100.100.1, 00:16:13, Tunnel100 -O 192.168.13.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101 - [110/1002] via 10.100.100.1, 00:15:45, Tunnel100 - - -vyos@SPOKE-2:~$ show ip route -Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -...... -O>* 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36 - * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36 -O 192.168.12.0/24 [110/1] is directly connected, eth1, weight 1, 01:24:40 -C>* 192.168.12.0/24 is directly connected, eth1, weight 1, 01:24:43 -L>* 192.168.12.1/32 is directly connected, eth1, weight 1, 01:24:43 -O>* 192.168.13.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36 - * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36 -``` - -After initiating traffic between SPOKES sites, Phase 3 of DMVPN will work. -For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1 - -```none -PC-SPOKE-2 : 192.168.12.2 255.255.255.0 gateway 192.168.12.1 - -PC-SPOKE-2> trace 192.168.11.2 -trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop - 1 192.168.12.1 0.558 ms 0.378 ms 0.561 ms - 2 10.100.101.1 1.768 ms 1.158 ms 1.744 ms - 3 10.100.101.11 7.196 ms 4.971 ms 4.793 ms - 4 *192.168.11.2 7.747 ms (ICMP type:3, code:3, Destination port unreachable) - -PC-SPOKE-2> trace 192.168.11.2 -trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop - 1 192.168.12.1 0.562 ms 0.396 ms 0.364 ms - 2 10.100.100.11 4.401 ms 4.399 ms 4.174 ms - 3 *192.168.11.2 3.241 ms (ICMP type:3, code:3, Destination port unreachable) -``` - -First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2. -Now routing tables are changed. LAN networks 192.168.12.0/24 and 192.168.11.0/24 available directly via SPOKES. - -```none -vyos@SPOKE-2:~$ show ip route -Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -N>* 192.168.11.0/24 [10/0] via 10.100.100.11, tun100 onlink, weight 1, 00:00:14 -O 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:00:54 - via 10.100.101.1, tun101 onlink, weight 1, 00:00:54 - - -SPOKE-1# show ip route next-hop-override -Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP - D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area - N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 - E1 - OSPF external type 1, E2 - OSPF external type 2 - i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 - ia - IS-IS inter area, * - candidate default, U - per-user static route - o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP - a - application route - + - replicated route, % - next hop override, p - overrides from PfR - -Gateway of last resort is 10.0.11.1 to network 0.0.0.0 - -O % 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:24:09, Tunnel101 - [110/1002] via 10.100.100.1, 00:25:46, Tunnel100 - [NHO][110/1] via 10.100.100.12, 00:00:03, Tunnel100 -``` - -NHRP shows shortcuts on Spokes - -```none -vyos@SPOKE-2:~$ show ip nhrp shortcut -Type Prefix Via Identity -dynamic 192.168.11.0/24 10.100.100.11 10.0.11.2 - -SPOKE-1# show ip nhrp shortcut -10.100.100.12/32 via 10.100.100.12 - Tunnel100 created 00:09:59, expire 00:02:21 - Type: dynamic, Flags: router nhop rib nho - NBMA address: 10.0.12.2 -192.168.12.0/24 via 10.100.100.12 - Tunnel100 created 00:02:38, expire 00:02:21 - Type: dynamic, Flags: router rib nho - NBMA address: 10.0.12.2 -``` - -A new Spoke to Spoke IPSec tunnel is created - -```none -SPOKE-1#show crypto isakmp sa -IPv4 Crypto ISAKMP SA -dst src state conn-id status -10.0.0.2 10.0.11.2 QM_IDLE 1002 ACTIVE -10.0.12.2 10.0.11.2 QM_IDLE 1004 ACTIVE -10.0.1.2 10.0.11.2 QM_IDLE 1003 ACTIVE - -vyos@SPOKE-2:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal --------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------ -dmvpn-NHRPVPN-tun100-child up 7m26s 4K/4K 57/53 10.0.0.2 10.0.0.2 AES_CBC_256/HMAC_SHA1_96 -dmvpn-NHRPVPN-tun100-child up 11m48s 316B/1K 3/15 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96 -dmvpn-NHRPVPN-tun101-child up 5m58s 5K/4K 62/51 10.0.1.2 10.0.1.2 AES_CBC_256/HMAC_SHA1_96 -``` - - -## Summary - -If one of the Hubs loses connectivity to the Internet, the other Hub will be available and take the main role. -This is a simple example where only one internet connection is used. But in the real world, there can be two -connections to the Internet. In this case, there is a recommendation to build each tunnel via each Internet connection, -choose the main cloud, and manipulate traffic via a routing protocol. It allows the creation failover on link-level -connections too. diff --git a/docs/configexamples/md-firewall.md b/docs/configexamples/md-firewall.md deleted file mode 100644 index 5d170511..00000000 --- a/docs/configexamples/md-firewall.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -lastproofread: '2024-09-11' ---- - -# Firewall Examples - -This section contains examples of firewall configurations for various -deployments. - -```{toctree} -:maxdepth: 2 - -fwall-and-vrf -fwall-and-bridge -zone-policy -``` diff --git a/docs/configexamples/md-fwall-and-bridge.md b/docs/configexamples/md-fwall-and-bridge.md deleted file mode 100644 index 5eb7a7fd..00000000 --- a/docs/configexamples/md-fwall-and-bridge.md +++ /dev/null @@ -1,490 +0,0 @@ ---- -lastproofread: '2024-09-11' ---- - -# Bridge and firewall example - -## Scenario and requirements - -This example shows how to configure a VyOS router with bridge interfaces and -firewall rules. - -Three non VLAN-aware bridges are going to be configured, and each one has its -own requirements. - -- Bridge br0: - : - Isolated layer 2 bridge. - - Accept only IPv6 communication within the bridge. -- Bridge br1: - : - Drop all DHCP discover packets. - - Accept all ARP packets. - - Within the bridge, accept only new IPv4 connections from host 10.1.1.102 - - Drop all other IPv4 connections. - - Drop all IPv6 connections. - - Accept access to router itself. - - Allow connections to internet - - Drop connections to other LANs. -- Bridge br2: - : - Accept all DHCP discover packets. - - Accept only DHCP offers from valid server and|or trusted bridge port. - - Accept all ARP packets. - - Accept all IPv4 connections. - - Drop all IPv6 connections. - - Deny access to the router. - - Allow connections to internet. - - Allow connections to bridge br1. - -## Configuration - -### Bridges and interfaces configuration - -First, we need to configure the interfaces and bridges: - -```none -# Bridge br0 -set interfaces bridge br0 description 'Isolated L2 bridge' -set interfaces bridge br0 member interface eth1 -set interfaces bridge br0 member interface eth2 -set interfaces ethernet eth1 description 'br0' -set interfaces ethernet eth2 description 'br0' - -# Bridge br1: -set interfaces bridge br1 address '10.1.1.1/24' -set interfaces bridge br1 description 'L3 bridge br1' -set interfaces bridge br1 member interface eth3 -set interfaces bridge br1 member interface eth4 -set interfaces ethernet eth3 description 'br1' -set interfaces ethernet eth4 description 'br1' - -# Bridge br2: -set interfaces bridge br2 address '10.2.2.1/24' -set interfaces bridge br2 description 'L3 bridge br2' -set interfaces bridge br2 member interface eth5 -set interfaces bridge br2 member interface eth6 -set interfaces bridge br2 member interface eth7 -set interfaces ethernet eth5 description 'br2 - Host' -set interfaces ethernet eth6 description 'br2 - Trusted DHCP Server' -set interfaces ethernet eth7 description 'br2' -``` - - -### Bridge firewall configuration - -In this section, we are going to configure the firewall rules that will be used -in bridge firewall, and will control the traffic within each bridge. - -We are going to use custom firewall rulesets, one for each bridge that will -be used in `prerouting`, and one for each bridge that will be used in the -`forward` chain. - -Also, we are going to use firewall interface groups in order to simplify the -firewall configuration. - -So first, let's create the required firewall interface groups: - -```none -# Bridge br0 interface-group: -set firewall group interface-group br0-ifaces interface 'br0' -set firewall group interface-group br0-ifaces interface 'eth1' -set firewall group interface-group br0-ifaces interface 'eth2' - -# Bridge br1 interface-group: -set firewall group interface-group br1-ifaces interface 'br1' -set firewall group interface-group br1-ifaces interface 'eth3' -set firewall group interface-group br1-ifaces interface 'eth4' - -# Bridge br2 interface-group: -set firewall group interface-group br2-ifaces interface 'br2' -set firewall group interface-group br2-ifaces interface 'eth5' -set firewall group interface-group br2-ifaces interface 'eth6' -set firewall group interface-group br2-ifaces interface 'eth7' -``` - -As said before, we are going to create custom firewall rulesets for each -bridge, that will be used in the `prerouting` chain, in order to drop as much -unwanted traffic as early as possible. So, custom rulesets used in -`prerouting` chain are going to be `br0-pre`, `br1-pre`, and `br2-pre`: - -```none -# Prerouting - Catch all traffic for br0 -set firewall bridge prerouting filter rule 10 action 'jump' -set firewall bridge prerouting filter rule 10 description 'br0 traffic' -set firewall bridge prerouting filter rule 10 inbound-interface group 'br0-ifaces' -set firewall bridge prerouting filter rule 10 jump-target 'br0-pre' - -# Prerouting - Catch all traffic for br1 -set firewall bridge prerouting filter rule 20 action 'jump' -set firewall bridge prerouting filter rule 20 description 'br1 traffic' -set firewall bridge prerouting filter rule 20 inbound-interface group 'br1-ifaces' -set firewall bridge prerouting filter rule 20 jump-target 'br1-pre' - -# Prerouting - Catch all traffic for br2 -set firewall bridge prerouting filter rule 30 action 'jump' -set firewall bridge prerouting filter rule 30 description 'br2 traffic' -set firewall bridge prerouting filter rule 30 inbound-interface group 'br2-ifaces' -set firewall bridge prerouting filter rule 30 jump-target 'br2-pre' -``` - -And then create the custom rulesets: - -```none -### br0 - br0-pre - # Requirements: accept only IPv6 communication within the bridge -set firewall bridge name br0-pre rule 10 description 'Accept IPv6 traffic' -set firewall bridge name br0-pre rule 10 action 'accept' -set firewall bridge name br0-pre rule 10 ethernet-type 'ipv6' - # And drop everything else -set firewall bridge name br0-pre default-action 'drop' - -### br1 - br1-pre - # Requirements: drop all DHCP discover packets -set firewall bridge name br1-pre rule 10 description 'Drop DHCP discover' -set firewall bridge name br1-pre rule 10 action 'drop' -set firewall bridge name br1-pre rule 10 protocol 'udp' -set firewall bridge name br1-pre rule 10 source port '68' -set firewall bridge name br1-pre rule 10 destination port '67' -set firewall bridge name br1-pre rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff' -set firewall bridge name br1-pre rule 10 log - # Requirement: drop all IPv6 connections -set firewall bridge name br1-pre rule 20 description 'Drop IPv6 traffic' -set firewall bridge name br1-pre rule 20 action 'drop' -set firewall bridge name br1-pre rule 20 ethernet-type 'ipv6' - # Accept everything else so it can be parsed later -set firewall bridge name br1-pre default-action 'accept' - -### br2 - br2-pre - # Requirements: drop all IPv6 connections -set firewall bridge name br2-pre rule 10 description 'Drop IPv6 traffic' -set firewall bridge name br2-pre rule 10 action 'drop' -set firewall bridge name br2-pre rule 10 ethernet-type 'ipv6' - # Accept everything else so it can be parsed later -set firewall bridge name br2-pre default-action 'accept' -``` - -Now, in the `forward` chain, we are going to define state policies, and -custom rulesets for each bridge that would be used in the `forward` chain. -These rulesets are `br0-fwd`, `br1-fwd`, and `br2-fwd`: - -```none -# Forward - State policies if not defined globally -set firewall bridge forward filter rule 5 action 'accept' -set firewall bridge forward filter rule 5 state 'established' -set firewall bridge forward filter rule 5 state 'related' -set firewall bridge forward filter rule 10 action 'drop' -set firewall bridge forward filter rule 10 state 'invalid' - -# Forward - Catch all traffic for br0 -set firewall bridge forward filter rule 110 description 'br0 traffic' -set firewall bridge forward filter rule 110 action 'jump' -set firewall bridge forward filter rule 110 inbound-interface group 'br0-ifaces' -set firewall bridge forward filter rule 110 jump-target 'br0-fwd' - -# Forward - Catch all traffic for br1 -set firewall bridge forward filter rule 120 description 'br1 traffic' -set firewall bridge forward filter rule 120 action 'jump' -set firewall bridge forward filter rule 120 inbound-interface group 'br1-ifaces' -set firewall bridge forward filter rule 120 jump-target 'br1-fwd' - -# Forward - Catch all traffic for br2 -set firewall bridge forward filter rule 130 description 'br2 traffic' -set firewall bridge forward filter rule 130 action 'jump' -set firewall bridge forward filter rule 130 inbound-interface group 'br2-ifaces' -set firewall bridge forward filter rule 130 jump-target 'br2-fwd' - -# Forward - Default action drop: -set firewall bridge forward filter default-action 'drop' -``` - -And the content of the custom rulesets: - -```none -### br0 - br0-fwd - # Accept everything that wasn't dropped in prerouting -set firewall bridge name br0-fwd default-action 'accept' - -### br1 - br1-fwd - # Requirement: Accept all ARP packets -set firewall bridge name br1-fwd rule 10 description 'Accept ARP' -set firewall bridge name br1-fwd rule 10 action 'accept' -set firewall bridge name br1-fwd rule 10 ethernet-type 'arp' - # Requirement: Accept only new IPv4 connections from host 10.1.1.102 -set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host' -set firewall bridge name br1-fwd rule 20 action 'accept' -set firewall bridge name br1-fwd rule 20 source address '10.1.1.102' -set firewall bridge name br1-fwd rule 20 state 'new' - # Drop everything else within the bridge: -set firewall bridge name br1-fwd default-action 'drop' - -### br2 - br2-fwd - # Requirement: Accept all DHCP discover packets -set firewall bridge name br2-fwd rule 10 description 'Accept DHCP discover' -set firewall bridge name br2-fwd rule 10 action 'accept' -set firewall bridge name br2-fwd rule 10 protocol 'udp' -set firewall bridge name br2-fwd rule 10 source port '68' -set firewall bridge name br2-fwd rule 10 destination port '67' -set firewall bridge name br2-fwd rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff' - # Requirement: Accept only DHCP offers from valid server on port eth6 -set firewall bridge name br2-fwd rule 20 description 'Accept DHCP offers from trusted interface' -set firewall bridge name br2-fwd rule 20 action 'accept' -set firewall bridge name br2-fwd rule 20 protocol 'udp' -set firewall bridge name br2-fwd rule 20 source port '67' -set firewall bridge name br2-fwd rule 20 destination port '68' -set firewall bridge name br2-fwd rule 20 inbound-interface name 'eth6' -set firewall bridge name br2-fwd rule 22 description 'Drop all other DHCP offers' -set firewall bridge name br2-fwd rule 22 action 'drop' -set firewall bridge name br2-fwd rule 22 protocol 'udp' -set firewall bridge name br2-fwd rule 22 source port '67' -set firewall bridge name br2-fwd rule 22 destination port '68' -set firewall bridge name br2-fwd rule 22 log - - # Accept all ARP packets -set firewall bridge name br2-fwd rule 30 description 'Accept ARP' -set firewall bridge name br2-fwd rule 30 action 'accept' -set firewall bridge name br2-fwd rule 30 ethernet-type 'arp' - # Accept all IPv4 connections -set firewall bridge name br2-fwd rule 40 description 'Accept ipv4' -set firewall bridge name br2-fwd rule 40 action 'accept' -set firewall bridge name br2-fwd rule 40 ethernet-type 'ipv4' - # Drop everything else -set firewall bridge name br2-fwd default-action 'drop' -``` - - -### IP firewall configuration - -Since some of the requirements listed above exceed the capabilities of the -bridge firewall, we need to use the IP firewall to implement them. -For bridge br1 and br2, we need to control the traffic that is going to the -router itself, to other local networks, and to the Internet. - -As a reminder, here's a link to the {doc}`firewall documentation -`, where you can find more information about -the packet flow for traffic that comes from bridge layer and should be analyzed -by the IP firewall. - -Access to the router itself is controlled by the base chain `input`, and -rules to accomplish all the requirements are: - -```none -# First of all, if not using global state policies, we need to define them: -set firewall ipv4 input filter rule 10 state 'established' -set firewall ipv4 input filter rule 10 state 'related' -set firewall ipv4 input filter rule 10 action 'accept' -set firewall ipv4 input filter rule 20 state 'invalid' -set firewall ipv4 input filter rule 20 action 'drop' - -# Input - br1 - Accept access to router itself -set firewall ipv4 input filter rule 110 description "Accept access from br1" -set firewall ipv4 input filter rule 110 action 'accept' -set firewall ipv4 input filter rule 110 inbound-interface group 'br1-ifaces' - -# Input - br2 - Deny access to the router -set firewall ipv4 input filter rule 120 description "Deny access from br2" -set firewall ipv4 input filter rule 120 action 'drop' -set firewall ipv4 input filter rule 120 inbound-interface group 'br2-ifaces' -``` - -And for traffic that is going to other local networks, and to he Internet, we -need to use the base chain `forward`. As in the bridge firewall, we are -going to use custom rulesets for each bridge, that would be used in the -`forward` chain. Those rulesets are `ip-br1-fwd` and `ip-br2-fwd`: - -```none -# First of all, if not using global state policies, we need to define them: -set firewall ipv4 forward filter rule 5 action 'accept' -set firewall ipv4 forward filter rule 5 state 'established' -set firewall ipv4 forward filter rule 5 state 'related' -set firewall ipv4 forward filter rule 10 action 'drop' -set firewall ipv4 forward filter rule 10 state 'invalid' - -# Forward - Catch all traffic for br1 -set firewall ipv4 forward filter rule 110 description 'br1 traffic' -set firewall ipv4 forward filter rule 110 action 'jump' -set firewall ipv4 forward filter rule 110 inbound-interface group 'br1-ifaces' -set firewall ipv4 forward filter rule 110 jump-target 'ip-br1-fwd' - -# Forward - Catch all traffic for br2 -set firewall ipv4 forward filter rule 120 description 'br2 traffic' -set firewall ipv4 forward filter rule 120 action 'jump' -set firewall ipv4 forward filter rule 120 inbound-interface group 'br2-ifaces' -set firewall ipv4 forward filter rule 120 jump-target 'ip-br2-fwd' - -# Forward - Default action drop: -set firewall ipv4 forward filter default-action 'drop' -``` - -And the content of the custom rulesets: - -```none -### br1 - ip-br1-fwd - # Requirement: Allow connections to internet -set firewall ipv4 name ip-br1-fwd rule 10 description 'br1 - allow internet access' -set firewall ipv4 name ip-br1-fwd rule 10 action 'accept' -set firewall ipv4 name ip-br1-fwd rule 10 outbound-interface name 'eth0' - # Requirement: Drop all other connections -set firewall ipv4 name ip-br1-fwd default-action 'drop' - -### br2 - ip-br2-fwd - # Requirement: Allow connections to internet -set firewall ipv4 name ip-br2-fwd rule 10 description 'br2 - allow internet access' -set firewall ipv4 name ip-br2-fwd rule 10 action 'accept' -set firewall ipv4 name ip-br2-fwd rule 10 outbound-interface name 'eth0' - # Requirement: Allow connections to br1 -set firewall ipv4 name ip-br2-fwd rule 20 description 'br2 - allow access to br1' -set firewall ipv4 name ip-br2-fwd rule 20 action 'accept' -set firewall ipv4 name ip-br2-fwd rule 20 outbound-interface group 'br1-ifaces' - # Requirement: Drop all other connections -set firewall ipv4 name ip-br2-fwd default-action 'drop' -``` - - -## Validation - -While testing the configuration, we can check logs in order to ensure that -we are accepting and/or blocking the correct traffic. - -For example, while a host tries to get an IP address from a DHCP server in -br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from -untrusted servers are dropped: - -```none -vyos@bridge:~$ show log firewall bridge -Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302 -Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 -Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 -``` - -And with operational mode commands, we can check rules matchers, actions, and -counters. - -Bridge firewall ruleset: - -```none -vyos@bri:~$ show firewall bridge -Rulesets bridge Information - ---------------------------------- -bridge Firewall "forward filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ----------------------------------------- -5 accept all 19 1916 ct state { established, related } accept -10 drop all 0 0 ct state invalid -110 jump all 2 208 iifname @I_br0-ifaces jump NAME_br0-fwd -120 jump all 10 670 iifname @I_br1-ifaces jump NAME_br1-fwd -130 jump all 12 3086 iifname @I_br2-ifaces jump NAME_br2-fwd -default drop all 0 0 - ---------------------------------- -bridge Firewall "name br0-fwd" - -Rule Action Protocol Packets Bytes -------- -------- ---------- --------- ------- -default accept all 2 208 - ---------------------------------- -bridge Firewall "name br0-pre" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------- -10 accept all 18 1872 ether type ip6 accept -default drop all 9 1476 - ---------------------------------- -bridge Firewall "name br1-fwd" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------------------------- -10 accept all 5 250 ether type arp accept -20 accept all 3 252 ct state new ip saddr 10.1.1.102 accept -default drop all 2 168 - ---------------------------------- -bridge Firewall "name br1-pre" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------------------------------------------------------------------------- -10 drop udp 3 1176 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 prefix "[bri-NAM-br1-pre-10-D]" -20 drop all 0 0 ether type ip6 -default accept all 58 4430 - ---------------------------------- -bridge Firewall "name br2-fwd" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- --------------------------------------------------------------- -10 accept udp 4 1312 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 accept -20 accept udp 2 656 udp sport 67 udp dport 68 iifname "eth6" accept -22 drop udp 1 322 udp sport 67 udp dport 68 prefix "[bri-NAM-br2-fwd-22-D]" -30 accept all 2 92 ether type arp accept -40 accept all 3 704 ether type ip accept -default drop all 0 0 - ---------------------------------- -bridge Firewall "name br2-pre" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- -------------- -10 drop all 7 728 ether type ip6 -default accept all 77 7548 - ---------------------------------- -bridge Firewall "prerouting filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------------------------- -10 jump all 27 3348 iifname @I_br0-ifaces jump NAME_br0-pre -20 jump all 61 5606 iifname @I_br1-ifaces jump NAME_br1-pre -30 jump all 84 8276 iifname @I_br2-ifaces jump NAME_br2-pre -default drop all 0 0 - -vyos@bridge:~$ -``` - -IPv4 firewall ruleset: - -```none -vyos@bridge:~$ show firewall ipv4 -Rulesets ipv4 Information - ---------------------------------- -ipv4 Firewall "forward filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ------------------------------------------- -5 accept all 76 6384 ct state { established, related } accept -10 drop all 0 0 ct state invalid -110 jump all 13 1092 iifname @I_br1-ifaces jump NAME_ip-br1-fwd -120 jump all 3 252 iifname @I_br2-ifaces jump NAME_ip-br2-fwd -default drop all 0 0 - ---------------------------------- -ipv4 Firewall "input filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ----------------------------------------- -10 accept all 0 0 ct state { established, related } accept -20 drop all 0 0 ct state invalid -110 accept all 10 720 iifname @I_br1-ifaces accept -120 drop all 26 2672 iifname @I_br2-ifaces -default accept all 3037 991621 - ---------------------------------- -ipv4 Firewall "name ip-br1-fwd" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------- -10 accept all 5 420 oifname "eth0" accept -default drop all 8 672 - ---------------------------------- -ipv4 Firewall "name ip-br2-fwd" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ----------------------------- -10 accept all 1 84 oifname "eth0" accept -20 accept all 2 168 oifname @I_br1-ifaces accept -default drop all 0 0 - -vyos@bridge:~$ -``` diff --git a/docs/configexamples/md-fwall-and-vrf.md b/docs/configexamples/md-fwall-and-vrf.md deleted file mode 100644 index da9949db..00000000 --- a/docs/configexamples/md-fwall-and-vrf.md +++ /dev/null @@ -1,121 +0,0 @@ -# VRF and firewall example - -## Scenario and requirements - -This example shows how to configure a VyOS router with VRFs and firewall rules. - -Diagram used in this example: - -```{image} /_static/images/firewall-and-vrf-blueprints.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -As exposed in the diagram, there are four VRFs. These VRFs are `MGMT`, -`WAN`, `LAN` and `PROD`, and their requirements are: - -```{eval-rst} -* VRF MGMT: - * Allow connections to LAN and PROD. - * Deny connections to internet(WAN). - * Allow connections to the router. -* VRF LAN: - * Allow connections to PROD. - * Allow connections to internet(WAN). -* VRF PROD: - * Only accepts connections. -* VRF WAN: - * Allow connection to PROD. -``` - -## Configuration - -First, we need to configure the interfaces and VRFs: - -```none -set interfaces ethernet eth1 address '10.100.100.1/24' -set interfaces ethernet eth1 vrf 'MGMT' -set interfaces ethernet eth2 vif 150 address '10.150.150.1/24' -set interfaces ethernet eth2 vif 150 vrf 'LAN' -set interfaces ethernet eth2 vif 160 address '10.160.160.1/24' -set interfaces ethernet eth2 vif 160 vrf 'LAN' -set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24' -set interfaces ethernet eth2 vif 3500 vrf 'PROD' -set interfaces loopback lo -set interfaces pppoe pppoe0 authentication password 'p4ssw0rd' -set interfaces pppoe pppoe0 authentication username 'vyos' -set interfaces pppoe pppoe0 source-interface 'eth0' -set interfaces pppoe pppoe0 vrf 'WAN' -set vrf bind-to-all -set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' -set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' -set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' -set vrf name LAN table '103' -set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' -set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' -set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' -set vrf name MGMT table '102' -set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' -set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' -set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' -set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' -set vrf name PROD table '104' -set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' -set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' -set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' -set vrf name WAN table '101' -``` - -And before firewall rules are shown, we need to pay attention how to configure -and match interfaces and VRFs. In case where an interface is assigned to a -non-default VRF, if we want to use inbound-interface or outbound-interface in -firewall rules, we need to: - -- For **inbound-interface**: use the interface name with the VRF name, like - `MGMT` or `LAN`. -- For **outbound-interface**: use the interface name, like `eth0`, `vtun0`, - `eth2*` or similar. - -Next, we need to configure the firewall rules. First we will define all rules -for transit traffic between VRFs. - -```none -set firewall ipv4 forward filter default-action 'drop' -set firewall ipv4 forward filter default-log -set firewall ipv4 forward filter rule 10 action 'accept' -set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD' -set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT' -set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*' -set firewall ipv4 forward filter rule 99 action 'drop' -set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt' -set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1' -set firewall ipv4 forward filter rule 120 action 'accept' -set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD' -set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN' -set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500' -set firewall ipv4 forward filter rule 130 action 'accept' -set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet' -set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN' -set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0' -``` - -Also, we are adding global state policies, in order to allow established and -related traffic, in order not to drop valid responses: - -```none -set firewall global-options state-policy established action 'accept' -set firewall global-options state-policy invalid action 'drop' -set firewall global-options state-policy related action 'accept' -``` - -And finally, we need to allow input connections to the router itself only from -vrf MGMT: - -```none -set firewall ipv4 input filter default-action 'drop' -set firewall ipv4 input filter default-log -set firewall ipv4 input filter rule 10 action 'accept' -set firewall ipv4 input filter rule 10 description 'MGMT - Allow input' -set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT' -``` diff --git a/docs/configexamples/md-ha.md b/docs/configexamples/md-ha.md deleted file mode 100644 index c3fd4f84..00000000 --- a/docs/configexamples/md-ha.md +++ /dev/null @@ -1,556 +0,0 @@ ---- -lastproofread: '2021-06-28' ---- - -(example-high-availability)= - -# High Availability Walkthrough - -This document walks you through a complete HA setup of two VyOS machines. This -design is based on a VM as the primary router and a physical machine as a -backup, using VRRP, BGP, OSPF, and conntrack sharing. - -This document aims to walk you through setting everything up, so -at a point where you can reboot any machine and not lose more than a few -seconds worth of connectivity. - -## Design - -This is based on a real-life production design. One of the complex issues -is ensuring you have redundant data INTO your network. We do this with a pair -of Cisco Nexus switches and using Virtual PortChannels that are spanned across -them. As a bonus, this also allows for complete switch failure without -an outage. How you achieve this yourself is left as an exercise to the reader. -But our setup is documented here. - -### Walkthrough suggestion - -The `commit` command is implied after every section. If you make an error, -`commit` will warn you and you can fix it before getting too far into things. -Please ensure you commit early and commit often. - -If you are following through this document, it is strongly suggested you -complete the entire document, ONLY doing the virtual router1 steps, and then -come back and walk through it AGAIN on the backup hardware router. - -This ensures you don't go too fast or miss a step. However, it will make your -life easier to configure the fixed IP address and default route now on the -hardware router. - -### Example Network - -In this document, we have been allocated 203.0.113.0/24 by our upstream -provider, which we are publishing on VLAN100. - -They want us to establish a BGP session to their routers on 192.0.2.11 and -192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and -we are AS 65551. - -Our routers are going to have a floating IP address of 203.0.113.1, and use -.2 and .3 as their fixed IPs. - -We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201. - -When traffic is originated from the 10.200.201.0/24 network, it will be -masqueraded to 203.0.113.1 - -For connection between sites, we are running a WireGuard link to two REMOTE -routers and using OSPF over those links to distribute routes. That remote -site is expected to send traffic from anything in 10.201.0.0/16 - -### VLANs - -These are the vlans we will be using: - -- 50: Upstream, using the 192.0.2.0/24 network allocated by them. -- 100: 'Public' network, using our 203.0.113.0/24 network. -- 201: 'Internal' network, using 10.200.201.0/24 - -### Hardware - -- switch1 (Nexus 10gb Switch) -- switch2 (Nexus 10gb Switch) -- compute1 (VMware ESXi 6.5) -- compute2 (VMware ESXi 6.5) -- compute3 (VMware ESXi 6.5) -- router2 (Random 1RU machine with 4 NICs) - -Note that router1 is a VM that runs on one of the compute nodes. - -### Network Cabling - -- From Datacenter - This connects into port 1 on both switches, and is tagged - as VLAN 50 -- Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch -- Hardware Router - Port 8 of each switch -- compute1 - Port 9 of each switch -- compute2 - Port 10 of each switch -- compute3 - Port 11 of each switch - -This is ignoring the extra Out-of-band management networking, which should be -on totally different switches, and a different feed into the rack, and is out -of scope of this. - -:::{note} -Our implementation uses VMware's Distributed Port Groups, which allows -VMware to use LACP. This is a part of the ENTERPRISE licence, and is not -available on a free licence. If you are implementing this and do not have -access to DPGs, you should not use VMware, and use some other virtualization -platform instead. -::: - -## Basic Setup (via console) - -Create your router1 VM. So it can withstand a VM Host failing or a -network link failing. Using VMware, this is achieved by enabling vSphere DRS, -vSphere Availability, and creating a Distributed Port Group that uses LACP. - -Many other Hypervisors do this, and I'm hoping that this document will be -expanded to document how to do this for others. - -Create an 'All VLANs' network group, that passes all trunked traffic through -to the VM. Attach this network group to router1 as eth0. - -:::{note} -VMware: You must DISABLE SECURITY on this Port group. Make sure that -`Promiscuous Mode`, `MAC address changes` and `Forged transmits` are -enabled. All of these will be done as part of failover. -::: - -### Bonding on Hardware Router - -Create a LACP bond on the hardware router. We are assuming that eth0 and eth1 -are connected to port 8 on both switches, and that those ports are configured -as a Port-Channel. - -```none -set interfaces bonding bond0 description 'Switch Port-Channel' -set interfaces bonding bond0 hash-policy 'layer2' -set interfaces bonding bond0 member interface 'eth0' -set interfaces bonding bond0 member interface 'eth1' -set interfaces bonding bond0 mode '802.3ad' -``` - - -### Assign external IP addresses - -VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this -is talking directly to upstream. Create our IP address on vlan50. - -For the hardware router, replace `eth0` with `bond0`. As (almost) every -command is identical, this will not be specified unless different things need -to be performed on different hosts. - -```none -set interfaces ethernet eth0 vif 50 address '192.0.2.21/24' -``` - -In this case, the hardware router has a different IP, so it would be - -```none -set interfaces ethernet bond0 vif 50 address '192.0.2.22/24' -``` - - -### Add (temporary) default route - -It is assumed that the routers provided by upstream are capable of acting as a -default router, add that as a static route. - -```none -set protocols static route 0.0.0.0/0 next-hop 192.0.2.11 -commit -save -``` - - -### Enable SSH - -Enable SSH so you can now SSH into the routers, rather than using the console. - -```none -set service ssh -commit -save -``` - -At this point, you should be able to SSH into both of them, and will no longer -need access to the console (unless you break something!) - -## VRRP Configuration - -We are setting up VRRP so that it does NOT fail back when a machine returns into -service, and it prioritizes router1 over router2. - -### Internal Network - -This has a floating IP address of 10.200.201.1/24, using virtual router ID 201. -The difference between them is the interface name, hello-source-address, and -peer-address. - -**router1** - -```none -set interfaces ethernet eth0 vif 201 address 10.200.201.2/24 -set high-availability vrrp group int hello-source-address '10.200.201.2' -set high-availability vrrp group int interface 'eth0.201' -set high-availability vrrp group int peer-address '10.200.201.3' -set high-availability vrrp group int no-preempt -set high-availability vrrp group int priority '200' -set high-availability vrrp group int address '10.200.201.1/24' -set high-availability vrrp group int vrid '201' -``` - -**router2** - -```none -set interfaces ethernet bond0 vif 201 address 10.200.201.3/24 -set high-availability vrrp group int hello-source-address '10.200.201.3' -set high-availability vrrp group int interface 'bond0.201' -set high-availability vrrp group int peer-address '10.200.201.2' -set high-availability vrrp group int no-preempt -set high-availability vrrp group int priority '100' -set high-availability vrrp group int address '10.200.201.1/24' -set high-availability vrrp group int vrid '201' -``` - - -### Public Network - -This has a floating IP address of 203.0.113.1/24, using virtual router ID 113. -The virtual router ID is just a random number between 1 and 254, and can be set -to whatever you want. Best practices suggest you try to keep them unique -enterprise-wide. - -**router1** - -```none -set interfaces ethernet eth0 vif 100 address 203.0.113.2/24 -set high-availability vrrp group public hello-source-address '203.0.113.2' -set high-availability vrrp group public interface 'eth0.100' -set high-availability vrrp group public peer-address '203.0.113.3' -set high-availability vrrp group public no-preempt -set high-availability vrrp group public priority '200' -set high-availability vrrp group public address '203.0.113.1/24' -set high-availability vrrp group public vrid '113' -``` - -**router2** - -```none -set interfaces ethernet bond0 vif 100 address 203.0.113.3/24 -set high-availability vrrp group public hello-source-address '203.0.113.3' -set high-availability vrrp group public interface 'bond0.100' -set high-availability vrrp group public peer-address '203.0.113.2' -set high-availability vrrp group public no-preempt -set high-availability vrrp group public priority '100' -set high-availability vrrp group public address '203.0.113.1/24' -set high-availability vrrp group public vrid '113' -``` - - -### Create VRRP sync-group - -The sync group is used to replicate connection tracking. It needs to be assigned -to a random VRRP group, and we are creating a sync group called `sync` using -the vrrp group `int`. - -```none -set high-availability vrrp sync-group sync member 'int' -``` - - -### Testing - -At this point, you should be able to see both IP addresses when you run -`show interfaces`, and `show vrrp` should show both interfaces in MASTER -state (and SLAVE state on router2). - -```none -vyos@router1:~$ show vrrp -Name Interface VRID State Last Transition --------- ----------- ------ ------- ----------------- -int eth0.201 201 MASTER 100s -public eth0.100 113 MASTER 200s -vyos@router1:~$ -``` - -You should be able to ping to and from all the IPs you have allocated. - -## NAT and conntrack-sync - -Masquerade Traffic originating from 10.200.201.0/24 that is heading out the -public interface. - -:::{note} -We explicitly exclude the primary upstream network so that BGP or -OSPF traffic doesn't accidentally get NAT'ed. -::: - -```none -set nat source rule 10 destination address '!192.0.2.0/24' -set nat source rule 10 outbound-interface name 'eth0.50' -set nat source rule 10 source address '10.200.201.0/24' -set nat source rule 10 translation address '203.0.113.1' -``` - - -### Configure conntrack-sync and enable helpers - -Conntrack helper modules are enabled by default, but they tend to cause more -problems than they're worth in complex networks. You can disable all of them -at one go. - -```none -delete system conntrack modules -``` - -Now enable replication between nodes. Replace eth0.201 with bond0.201 on the -hardware router. - -```none -set service conntrack-sync accept-protocol 'tcp,udp,icmp' -set service conntrack-sync event-listen-queue-size '8' -set service conntrack-sync failover-mechanism vrrp sync-group 'sync' -set service conntrack-sync interface eth0.201 -set service conntrack-sync mcast-group '224.0.0.50' -set service conntrack-sync sync-queue-size '8' -``` - -(ha-contracktesting)= - -### Testing - -The simplest way to test is to look at the connection tracking stats on the -standby hardware router with the command `show conntrack-sync statistics`. -The numbers should be very close to the numbers on the primary router. - -When you have both routers up, you should be able to establish a connection -from a NAT'ed machine out to the internet, reboot the active machine, and that -connection should be preserved, and will not drop out. - -## OSPF Over WireGuard - -Wireguard doesn't have the concept of an up or down link, due to its design. -This complicates AND simplifies using it for network transport, as for reliable -state detection you need to use SOMETHING to detect when the link is down. - -If you use a routing protocol itself, you solve two problems at once. This is -only a basic example, and is provided as a starting point. - -### Configure Wireguard - -There is plenty of instructions and documentation on setting up Wireguard. The -only important thing you need to remember is to only use one WireGuard -interface per OSPF connection. - -We use small /30's from 10.254.60/24 for the point-to-point links. - -**router1** - -Replace the 203.0.113.3 with whatever the other router's IP address is. - -```none -set interfaces wireguard wg01 address '10.254.60.1/30' -set interfaces wireguard wg01 description 'router1-to-offsite1' -set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' -set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001' -set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' -set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' -set interfaces wireguard wg01 port '50001' -set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' -set protocols ospf interface wg01 cost '11' -set protocols ospf interface wg01 dead-interval '5' -set protocols ospf interface wg01 hello-interval '1' -set protocols ospf interface wg01 network 'point-to-point' -set protocols ospf interface wg01 priority '1' -set protocols ospf interface wg01 retransmit-interval '5' -set protocols ospf interface wg01 transmit-delay '1' -``` - -**offsite1** - -This is connecting back to the STATIC IP of router1, not the floating. - -```none -set interfaces wireguard wg01 address '10.254.60.2/30' -set interfaces wireguard wg01 description 'offsite1-to-router1' -set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0' -set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001' -set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15' -set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=' -set interfaces wireguard wg01 port '50001' -set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' -set protocols ospf interface wg01 cost '11' -set protocols ospf interface wg01 dead-interval '5' -set protocols ospf interface wg01 hello-interval '1' -set protocols ospf interface wg01 network 'point-to-point' -set protocols ospf interface wg01 priority '1' -set protocols ospf interface wg01 retransmit-interval '5' -set protocols ospf interface wg01 transmit-delay '1' -``` - - -### Test WireGuard - -Make sure you can ping 10.254.60.1 and .2 from both routers. - -### Create Export Filter - -We only want to export the networks we know. Always do a whitelist on your route -filters, both importing and exporting. A good rule of thumb is -**'If you are not the default router for a network, don't advertise -it'**. This means we explicitly do not want to advertise the 192.0.2.0/24 -network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE -the default route for). This filter is applied to `redistribute connected`. -If we WERE to advertise it, the remote machines would see 192.0.2.21 available -via their default route, establish the connection, and then OSPF would say -'192.0.2.0/24 is available via this tunnel', at which point the tunnel would -break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via -default again. This is called 'flapping'. - -```none -set policy access-list 150 description 'Outbound OSPF Redistribution' -set policy access-list 150 rule 10 action 'permit' -set policy access-list 150 rule 10 destination any -set policy access-list 150 rule 10 source inverse-mask '0.0.0.255' -set policy access-list 150 rule 10 source network '10.200.201.0' -set policy access-list 150 rule 20 action 'permit' -set policy access-list 150 rule 20 destination any -set policy access-list 150 rule 20 source inverse-mask '0.0.0.255' -set policy access-list 150 rule 20 source network '203.0.113.0' -set policy access-list 150 rule 100 action 'deny' -set policy access-list 150 rule 100 destination any -set policy access-list 150 rule 100 source any -``` - - -### Create Import Filter - -We only want to import networks we know. Our OSPF peer should only be -advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE -MATCH. You deny in access-list 100 to accept the route. - -```none -set policy access-list 100 description 'Inbound OSPF Routes from Peers' -set policy access-list 100 rule 10 action 'deny' -set policy access-list 100 rule 10 destination any -set policy access-list 100 rule 10 source inverse-mask '0.0.255.255' -set policy access-list 100 rule 10 source network '10.201.0.0' -set policy access-list 100 rule 100 action 'permit' -set policy access-list 100 rule 100 destination any -set policy access-list 100 rule 100 source any -set policy route-map PUBOSPF rule 100 action 'deny' -set policy route-map PUBOSPF rule 100 match ip address access-list '100' -set policy route-map PUBOSPF rule 500 action 'permit' -``` - - -### Enable OSPF - -Every router **must** have a unique router-id. -The 'reference-bandwidth' is used because when OSPF was originally designed, -the idea of a link faster than 1gbit was unheard of, and it does not scale -correctly. - -```none -set protocols ospf area 0.0.0.0 authentication 'md5' -set protocols ospf area 0.0.0.0 network '10.254.60.0/24' -set protocols ospf auto-cost reference-bandwidth '10000' -set protocols ospf log-adjacency-changes -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.254.60.2' -set system ip protocol ospf route-map PUBOSPF -``` - - -### Test OSPF - -When you have enabled OSPF on both routers, you should be able to see each -other with the command `show ip ospf neighbour`. The state must be 'Full' -or '2-Way'. If it is not, then there is a network connectivity issue between the -hosts. This is often caused by NAT or MTU issues. You should not see any new -routes (unless this is the second pass) in the output of `show ip route` - -## Advertise connected routes - -As a reminder, only advertise routes that you are the default router for. This -is why we are NOT announcing the 192.0.2.0/24 network, because if that was -announced into OSPF, the other routers would try to connect to that network -over a tunnel that connects to that network! - -```none -set protocols ospf access-list 150 export 'connected' -set protocols ospf redistribute connected -``` - -You should now be able to see the advertised network on the other host. - -### Duplicate configuration - -At this point, you now need to create the X link between all four routers. -Use a different /30 for each link. - -### Priorities - -Set the cost on the secondary links to be 200. This means that they will not -be used unless the primary links are down. - -```none -set protocols ospf interface wg01 cost '10' -set protocols ospf interface wg01 cost '200' -``` - -This will be visible in 'show ip route'. - -## BGP - -BGP is an extremely complex network protocol. An example is provided here. - -:::{note} -Router id's must be unique. -::: - -**router1** - -The `redistribute ospf` command is there purely as an example of how this can -be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as -it is not 203.0.113.0/24. - -```none -set policy prefix-list BGPOUT description 'BGP Export List' -set policy prefix-list BGPOUT rule 10 action 'deny' -set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' -set policy prefix-list BGPOUT rule 10 ge '25' -set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' -set policy prefix-list BGPOUT rule 100 action 'permit' -set policy prefix-list BGPOUT rule 100 description 'Our network' -set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' -set policy prefix-list BGPOUT rule 10000 action 'deny' -set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' - -set policy route-map BGPOUT description 'BGP Export Filter' -set policy route-map BGPOUT rule 10 action 'permit' -set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT' -set policy route-map BGPOUT rule 10000 action 'deny' -set policy route-map BGPPREPENDOUT description 'BGP Export Filter' -set policy route-map BGPPREPENDOUT rule 10 action 'permit' -set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' -set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT' -set policy route-map BGPPREPENDOUT rule 10000 action 'deny' - -set protocols bgp system-as 65551 -set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 -set protocols bgp address-family ipv4-unicast redistribute connected metric '50' -set protocols bgp address-family ipv4-unicast redistribute ospf metric '50' -set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT' -set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound -set protocols bgp neighbor 192.0.2.11 remote-as '65550' -set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21' -set protocols bgp parameters router-id '192.0.2.21' -``` - -**router2** - -This is identical, but you use the BGPPREPENDOUT route-map to advertise the -route with a longer path. diff --git a/docs/configexamples/md-index.md b/docs/configexamples/md-index.md deleted file mode 100644 index e5a81305..00000000 --- a/docs/configexamples/md-index.md +++ /dev/null @@ -1,60 +0,0 @@ -(examples)= - -# Configuration Blueprints - -This chapter contains various configuration examples: - -```{toctree} -:maxdepth: 2 - -firewall -bgp-ipv6-unnumbered -ospf-unnumbered -azure-vpn-bgp -azure-vpn-dual-bgp -ha -wan-load-balancing -pppoe-ipv6-basic -l3vpn-hub-and-spoke -lac-lns -inter-vrf-routing-vrf-lite -dmvpn-dualhub-dualcloud -qos -segment-routing-isis -nmp -ansible -ipsec-cisco-policy-based -ipsec-cisco-route-based -ipsec-pa-route-based -policy-based-ipsec-and-firewall -site-2-site-cisco -``` - - -## Configuration Blueprints (autotest) - -The next pages contain fully automated configuration examples. - -Each lab will build and test from an external script. -The page content is generated, so changes will not take effect. - -A host `vyos-oobm` will be used as an SSH proxy. This host is just -necessary for the lab tests. - -The process will do the following steps: -1. create the lab on a eve-ng server -2. configure each host in the lab -3. do some defined tests -4. optional do an upgrade to a higher version and do step 3 again. -5. generate the documentation and include files -6. shutdown and destroy the lab, if there is no error - -```{toctree} -:maxdepth: 1 - -autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE -autotest/tunnelbroker/tunnelbroker -autotest/L3VPN_EVPN/L3VPN_EVPN -autotest/Wireguard/Wireguard -autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP -``` diff --git a/docs/configexamples/md-inter-vrf-routing-vrf-lite.md b/docs/configexamples/md-inter-vrf-routing-vrf-lite.md deleted file mode 100644 index 2ac36904..00000000 --- a/docs/configexamples/md-inter-vrf-routing-vrf-lite.md +++ /dev/null @@ -1,797 +0,0 @@ -# Inter-VRF Routing over VRF Lite - -**Virtual Routing and Forwarding** is a technology that allow multiple instance -of a routing table to exist within a single device. One of the key aspect of -**VRFs** is that do not share the same routes or interfaces, therefore packets -are forwarded between interfaces that belong to the same VRF only. - -Any information related to a VRF is not exchanged between devices -or in the -same device- by default, this is a technique called **VRF-Lite**. - -Keep networks isolated is -in general- a good principle, but there are cases -where you might need that some network can access other in a different VRF. - -The scope of this document is to cover such cases in a dynamic way without the -use of MPLS-LDP. - -General information about L3VPNs can be found in the {ref}`configuration/vrf/index:L3VPN VRFs` chapter. - -## Overview - -Let’s say we have a requirement to have multiple networks. - -- LAN 1 -- LAN 2 -- Management -- Internet - -Both LANs have to be able to route between each other, both will have managed -devices through a dedicated management network and both will need Internet -access yet the LAN2 will need access to some set of outside networks, not all. -The management network will need access to both LANs but cannot have access -to/from the outside. - -This scenario could be a nightmare applying regular routing and might need -filtering in multiple interfaces. - -A simple solution could be using different routing tables, or VRFs -for all the networks so we can keep the routing restrictions. -But for us to route between the different VRFs we would need a cable or a -logical connection between each other: - -- One cable/logical connection between LAN1 and LAN2 -- One cable/logical connection between LAN1 and Internet -- One cable/logical connection between LAN2 and Internet -- One cable/logical connection between LAN1 and Management -- One cable/logical connection between LAN2 and Management - -As we can see this is unpractical. - -To address this scenario we will use to our advantage an extension of the BGP -routing protocol that will help us in the “Export” between VRFs without the -need for MPLS. - -MP-BGP or MultiProtocol BGP introduces two main concepts to solve this -limitation: -\- Route Distinguisher (RD): Is used to distinguish between different VRFs -–called VPNs- inside the BGP Process. The RD is appended to each IPv4 Network -that is advertised into BGP for that VPN making it a unique VPNv4 route. -\- Route Target (RT): This is an extended BGP community append to the VPNv4 route -in the Import/Export process. When a route passes from the VRF routing table -into the BGP process it will add the configured export extended community(ies) -for that VPN. When that route needs to go from BGP into the VRF routing table -will only pass if that given VPN import policy matches any of the appended -community(ies) into that prefix. - -## Topology - -```{image} /_static/images/inter-vrf-routing-vrf-lite.webp -:align: center -:alt: Network Topology Diagram -:width: 70% -``` - - -### IP Schema - -```{eval-rst} -+----------+------------+----------------+------------------+ -| Device-A | Device-B | IPv4 Network | IPv6 Network | -+----------+------------+----------------+------------------+ -| Core | LAN1 | 10.1.1.0/30 | 2001:db8::/127 | -+----------+------------+----------------+------------------+ -| Core | LAN2 | 172.16.2.0/30 | 2001:db8::2/127 | -+----------+------------+----------------+------------------+ -| Core | Management | 192.168.3.0/30 | 2001:db8::4/127 | -+----------+------------+----------------+------------------+ -| Core | ISP | 10.2.2.0/30 | 2001:db8::6/127 | -+----------+------------+----------------+------------------+ -``` - -### RD & RT Schema - -```{eval-rst} -+------------+-----------+-----------+ -| VRF | RD | RT | -+------------+-----------+-----------+ -| LAN1 | 64496:1 | 64496:1 | -+------------+-----------+-----------+ -| LAN2 | 64496:2 | 64496:2 | -+------------+-----------+-----------+ -| Management | 64496:50 | 64496:50 | -+------------+-----------+-----------+ -| Internet | 64496:100 | 64496:100 | -+------------+-----------+-----------+ -``` - -## Configurations - -:::{note} -We use a static route configuration in between the Core and each -LAN and Management router, and BGP between the Core router and the ISP router -but any dynamic routing protocol can be used. -::: - -### Remote Networks - -The following template configuration can be used in each remote router based -in our topology. - -```none -# Interface Configuration -set interface eth eth address - -# Static default route back to Core -set protocols static route 0.0.0.0/0 next-hop -``` - - -### Core Router - -#### Step 1: VRF and Configurations to remote networks - -- Configuration - -Set the VRF name and Table ID, set interface address and bind it to the VRF. -Last add the static route to the remote network. - -```none -# VRF name and table ID (MANDATORY) -set vrf name table - -# Interface Configuration -set interface eth eth address - -# Assign interface to VRF -set interface eth eth vrf - -# Static route to remote Network -set vrf name protocols static route next-hop -``` - -- Verification - -Checking the routing table of the VRF should reveal both static and connected -entries active. A PING test between the Core and remote router is a way to -validate connectivity within the VRF. - -```none -# show ip route vrf -# show ipv6 route vrf - -vyos@Core:~$ show ip route vrf LAN1 -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF LAN1: -S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41 -C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44 - -vyos@Core:~$ show ipv6 route vrf LAN1 -Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF LAN1: -C>* 2001:db8::/127 is directly connected, eth0, 00:18:43 -S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03 -C>* fe80::/64 is directly connected, eth0, 00:18:43 - -# ping vrf - -vyos@Core:~$ ping 10.1.1.2 vrf LAN1 -PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data. -64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms -64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms -^C ---- 10.1.1.2 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1002ms -rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms -vyos@Core:~$ ping 10.0.0.1 vrf LAN1 -PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. -64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms -64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms -^C ---- 10.0.0.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1002ms -rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms - -vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1 -PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes -64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms -64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms -64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms -^C ---- 2001:db8:0:1::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2004ms -rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms -``` - - -#### Step 2: BGP Configuration for VRF-Lite - -- Configuration - -Setting BGP global local-as as well inside the VRF. Redistribute static -routes to inject configured networks into the BGP process but still inside -the VRF. - -```none -# set BGP global local-as -set protocols bgp system-as - -# set BGP VRF local-as and redistribution -set vrf name protocols bgp address-family redistribute static -``` - -- Verification - -Check the BGP VRF table and verify if the static routes are injected showing -the correct next-hop information. - -```none -# show ip bgp vrf -# show bgp vrf ipv6 - -vyos@Core:~$ show ip bgp vrf LAN1 -BGP table version is 3, local router ID is 10.1.1.1, vrf id 8 -Default local pref 100, local AS 64496 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete -RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path -*> 10.0.0.0/24 10.1.1.2 0 32768 ? - -vyos@Core# run show bgp vrf LAN1 ipv6 -BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 -Default local pref 100, local AS 64496 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete -RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path -*> 2001:db8:0:1::/64 - 2001:db8::1 0 32768 ? -``` - - -#### Step 3: VPN Configuration - -- Configuration - -Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT), -then we enable the export/import VPN. - -```none -# set Route-distinguisher -set vrf name protocols bgp address-family rd vpn export '' - -# set route-target for import/export -# Note: RT are a list that can be more than one community between apostrophe -# and separated by blank space. Ex: ' ' -set vrf name protocols bgp address-family route-target vpn export '' -set vrf name protocols bgp address-family route-target vpn import '' - -# Enable VPN export/import under this VRF -set vrf name protocols bgp address-family export vpn -set vrf name protocols bgp address-family import vpn -``` - -A key point to understand is that if we need two VRFs to communicate between -each other EXPORT rt from VRF1 has to be in the IMPORT rt list from VRF2. But -this is only in ONE direction, to complete the communication the EXPORT rt from -VRF2 has to be in the IMPORT rt list from VRF1. - -There are some cases where this is not needed -for example, in some -DDoS appliance- but most inter-vrf routing designs use the above configurations. - -- Verification - -After configured all the VRFs involved in this topology we take a deeper look -at both BGP and Routing table for the VRF LAN1 - -```none -# show ip bgp vrf -# show bgp vrf ipv6 - -vyos@Core# run show ip bgp vrf LAN1 -BGP table version is 53, local router ID is 10.1.1.1, vrf id 8 -Default local pref 100, local AS 64496 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete -RPKI validation codes: V valid, I invalid, N Not found - - Network Next Hop Metric LocPrf Weight Path -*> 0.0.0.0/0 10.2.2.2@7< 0 64497 i -*> 10.0.0.0/24 10.1.1.2 0 32768 ? -*> 10.2.2.0/30 10.2.2.2@7< 0 0 64497 ? -*> 192.0.2.0/24 10.2.2.2@7< 0 0 64497 ? -*> 192.168.0.0/24 192.168.3.2@11< 0 32768 ? -*> 198.51.100.0/24 10.2.2.2@7< 0 0 64497 ? -*> 203.0.113.0/24 10.2.2.2@7< 0 0 64497 ? - -vyos@Core# run show bgp vrf LAN1 ipv6 -BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 -Default local pref 100, local AS 64496 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete -RPKI validation codes: V valid, I invalid, N Not found - -Network Next Hop Metric LocPrf Weight Path -*> ::/0 fe80::5200:ff:fe02:3@7< - 0 64497 i -*> 2001:db8::6/127 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? -*> 2001:db8:0:1::/64 - 2001:db8::1 0 32768 ? -*> 2001:db8:0:3::/64 - 2001:db8::5@11< 0 32768 ? -*> 2001:db8:1::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? -*> 2001:db8:2::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? -*> 2001:db8:3::/48 fe80::5200:ff:fe02:3@7< - 0 0 64497 ? - -# show ip route vrf -# show ipv6 route vrf - -vyos@Core:~$ show ip route vrf LAN1 -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF LAN1: -B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 -S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57 -C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59 -B 10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38 -B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38 -B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 -B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 -B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 - -vyos@Core# run show ipv6 route vrf LAN1 -Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -VRF LAN1: -B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -C>* 2001:db8::/127 is directly connected, eth0, 05:33:43 -B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03 -B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50 -B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 -C>* fe80::/64 is directly connected, eth0, 05:33:43 -``` - -As we can see in the BGP table any imported route has been injected with a "@" -followed by the VPN id; In the routing table of the VRF, if the route was -installed, we can see -between round brackets- the exported VRF table. - -#### Step 4: End to End verification - -Now we perform some end-to-end testing -- From Management to LAN1/LAN2 - -```none -vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1 -PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data. -64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms -64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms -64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms -^C ---- 10.0.0.1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2005ms -rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms -vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1 -PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data. -64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms -64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms -^C ---- 172.16.0.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1001ms -rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms -vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1 -PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes -64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms -64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms -64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms -^C ---- 2001:db8:0:1::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2003ms -rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms -vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1 -PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes -64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms -^C ---- 2001:db8:0:2::1 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3005ms -rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms -``` - -- From Management to Outside (fails as intended) - -```none -vyos@Management:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58 -C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05 -C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03 -vyos@Management:~$ ping 192.0.2.1 -PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data. -From 192.168.3.1 icmp_seq=1 Destination Net Unreachable -From 192.168.3.1 icmp_seq=2 Destination Net Unreachable -^C ---- 192.0.2.1 ping statistics --- -2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - -vyos@Management:~$ ping 195.51.100.1 -PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data. -From 192.168.3.1 icmp_seq=1 Destination Net Unreachable -From 192.168.3.1 icmp_seq=2 Destination Net Unreachable -From 192.168.3.1 icmp_seq=3 Destination Net Unreachable -^C ---- 195.51.100.1 ping statistics --- -3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms - -vyos@Management:~$ ping 2001:db8:1::1 -PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes -From 2001:db8::4 icmp_seq=1 Destination unreachable: No route -From 2001:db8::4 icmp_seq=2 Destination unreachable: No route -^C ---- 2001:db8:1::1 ping statistics --- -2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms - -vyos@Management:~$ ping 2001:db8:2::1 -PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes -From 2001:db8::4 icmp_seq=1 Destination unreachable: No route -From 2001:db8::4 icmp_seq=2 Destination unreachable: No route -^C ---- 2001:db8:2::1 ping statistics --- -2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms -``` - -- LAN1 to Outside - -```none -vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1 -PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data. -64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms -64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms -64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms -^C ---- 192.0.2.1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2004ms -rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms -vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1 -PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data. -64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms -64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms -^C ---- 198.51.100.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1002ms -rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms -vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1 -PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data. -64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms -64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms -^C ---- 203.0.113.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1003ms -rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms -vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1 -PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes -64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms -64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms -64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms -^C ---- 2001:db8:1::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2004ms -rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms -vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1 -PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes -64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms -64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms -64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms -^C ---- 2001:db8:2::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2003ms -rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms -``` - -:::{note} -we are using "source-address" option cause we are not redistributing -connected interfaces into BGP on the Core router hence there is no comeback -route and ping will fail. -::: - -- LAN1 to LAN2 - -```none -vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1 -PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data. -64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms -64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms -^C ---- 172.16.0.1 ping statistics --- -2 packets transmitted, 2 received, 0% packet loss, time 1002ms -rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms -vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1 -PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes -64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms -64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms -^C ---- 2001:db8:0:2::1 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 2003ms -rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms -``` - - -## Conclusions - -Inter-VRF routing is a well-known solution to address complex routing scenarios -that enable -in a dynamic way- to leak routes between VRFs. Is recommended to -take special consideration while designing route-targets and its application as -it can minimize future interventions while creating a new VRF will automatically -take the desired effect in its propagation. - -## Appendix-A - -### Full configuration from all devices - -- Core - -```none -set interfaces ethernet eth0 address '10.1.1.1/30' -set interfaces ethernet eth0 address '2001:db8::/127' -set interfaces ethernet eth0 vrf 'LAN1' -set interfaces ethernet eth1 address '172.16.2.1/30' -set interfaces ethernet eth1 address '2001:db8::2/127' -set interfaces ethernet eth1 vrf 'LAN2' -set interfaces ethernet eth2 address '192.168.3.1/30' -set interfaces ethernet eth2 address '2001:db8::4/127' -set interfaces ethernet eth2 vrf 'Management' -set interfaces ethernet eth3 address '10.2.2.1/30' -set interfaces ethernet eth3 address '2001:db8::6/127' -set interfaces ethernet eth3 vrf 'Internet' -set protocols bgp address-family ipv4-unicast -set protocols bgp system-as '64496' -set vrf name Internet protocols bgp address-family ipv4-unicast export vpn -set vrf name Internet protocols bgp address-family ipv4-unicast import vpn -set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' -set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' -set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' -set vrf name Internet protocols bgp address-family ipv6-unicast export vpn -set vrf name Internet protocols bgp address-family ipv6-unicast import vpn -set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' -set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' -set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' -set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast -set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497' -set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast -set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497' -set vrf name Internet table '104' -set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn -set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn -set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' -set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static -set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' -set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' -set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn -set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn -set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' -set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static -set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' -set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' -set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2 -set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1 -set vrf name LAN1 table '101' -set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn -set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn -set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' -set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static -set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' -set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' -set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn -set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn -set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' -set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static -set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' -set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' -set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2 -set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3 -set vrf name LAN2 table '102' -set vrf name Management protocols bgp address-family ipv4-unicast export vpn -set vrf name Management protocols bgp address-family ipv4-unicast import vpn -set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' -set vrf name Management protocols bgp address-family ipv4-unicast redistribute static -set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' -set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' -set vrf name Management protocols bgp address-family ipv6-unicast export vpn -set vrf name Management protocols bgp address-family ipv6-unicast import vpn -set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' -set vrf name Management protocols bgp address-family ipv6-unicast redistribute static -set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' -set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' -set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2 -set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5 -set vrf name Management table '103' -``` - -- LAN1 - -```none -set interfaces dummy dum0 address '10.0.0.1/24' -set interfaces dummy dum0 address '2001:db8:0:1::1/64' -set interfaces ethernet eth0 address '10.1.1.2/30' -set interfaces ethernet eth0 address '2001:db8::1/127' -set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 -set protocols static route6 ::/0 next-hop 2001:db8::1 -``` - -- LAN2 - -```none -set interfaces dummy dum0 address '172.16.0.1/24' -set interfaces dummy dum0 address '2001:db8:0:2::1/64' -set interfaces ethernet eth0 hw-id '50:00:00:03:00:00' -set interfaces ethernet eth1 address '172.16.2.2/30' -set interfaces ethernet eth1 address '2001:db8::3/127' -set protocols static route 0.0.0.0/0 next-hop 172.16.2.1 -set protocols static route6 ::/0 next-hop 2001:db8::2 -``` - -- Management - -```none -set interfaces dummy dum0 address '192.168.0.1/24' -set interfaces dummy dum0 address '2001:db8:0:3::1/64' -set interfaces ethernet eth2 address '192.168.3.2/30' -set interfaces ethernet eth2 address '2001:db8::5/127' -set protocols static route 0.0.0.0/0 next-hop 192.168.3.1 -set protocols static route6 ::/0 next-hop 2001:db8::4 -``` - -- ISP - -```none -set interfaces dummy dum0 address '192.0.2.1/24' -set interfaces dummy dum0 address '2001:db8:1::1/48' -set interfaces dummy dum1 address '198.51.100.1/24' -set interfaces dummy dum1 address '2001:db8:2::1/48' -set interfaces dummy dum2 address '203.0.113.1/24' -set interfaces dummy dum2 address '2001:db8:3::1/48' -set interfaces ethernet eth3 address '10.2.2.2/30' -set interfaces ethernet eth3 address '2001:db8::7/127' -set protocols bgp address-family ipv4-unicast redistribute connected -set protocols bgp address-family ipv6-unicast redistribute connected -set protocols bgp system-as '64497' -set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate -set protocols bgp neighbor 10.2.2.1 remote-as '64496' -set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate -set protocols bgp neighbor 2001:db8::6 remote-as '64496' -set protocols static route 0.0.0.0/0 next-hop 10.2.2.1 -set protocols static route6 ::/0 next-hop 2001:db8::6 -``` - - -## Appendix-B - -### Route-Filtering - -When importing routes using MP-BGP it is possible to filter a subset of them -before are injected in the BGP table. One of the most common case is to use a -route-map with an prefix-list. -- Configuration - -We create a prefix-list first and add all the routes we need to. - -```none -# set both ipv4 and ipv6 policies - -set policy prefix-list LAN2-Internet rule 1 action 'permit' -set policy prefix-list LAN2-Internet rule 1 le '24' -set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16' -set policy prefix-list LAN2-Internet rule 2 action 'permit' -set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24' -set policy prefix-list LAN2-Internet rule 3 action 'permit' -set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24' -set policy prefix-list LAN2-Internet rule 4 action 'permit' -set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24' - -set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit' -set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48' -set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit' -set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48' -set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit' -set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64' -set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' -set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' -``` - -Then add a route-map and reference to above prefix. Consider that the actions -taken inside the prefix will MATCH the routes that will be affected by the -actions inside the rules of the route-map. - -```none -set policy route-map LAN2-Internet rule 1 action 'permit' -set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet' - -set policy route-map LAN2-Internet-v6 rule 1 action 'permit' -set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-Internet-v6' -``` - -We are using a "white list" approach by allowing only what is necessary. In case -that need to implement a "black list" approach then you will need to change the -action in the route-map for a deny BUT you need to add a rule that permits the -rest due to the implicit deny in the route-map. - -Then we need to attach the policy to the BGP process. This needs to be under -the import statement in the vrf we need to filter. - -```none -set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet' -set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6' -``` - -- Verification - -```none -# show ip route vrf LAN2 - -B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28 -S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32 -C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39 -B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 -B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Management), weight 1, 00:45:27 -B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 - -# show ipv6 route vrf LAN2 - -C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26 -B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17 -S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21 -B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:46:16 -B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 -B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 -C>* fe80::/64 is directly connected, eth1, 00:46:27 -``` - -As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able -to select which routes are effectively imported and installed. diff --git a/docs/configexamples/md-ipsec-cisco-policy-based.md b/docs/configexamples/md-ipsec-cisco-policy-based.md deleted file mode 100644 index 7a31601d..00000000 --- a/docs/configexamples/md-ipsec-cisco-policy-based.md +++ /dev/null @@ -1,363 +0,0 @@ ---- -lastproofread: '2025-06-26' ---- - -(examples-ipsec-cisco-policy-based)= - -# Policy-based Site-to-Site VPN IPsec between VyOS and Cisco - -This document is to describe a basic setup using policy-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -Cisco IOS. Cisco initiates IPsec connection only if interesting -traffic present. For stable work we recommend configuring an -initiator role on VyOS side. - -## Network Topology - -```{image} /_static/images/cisco-vpn-ipsec.webp -:align: center -:alt: Network Topology Diagram -``` - - -## Prerequirements - -**VyOS:** - -```{eval-rst} -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ -``` - -**Cisco:** - -```{eval-rst} -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ -``` - -**IKE parameters:** - -```{eval-rst} -+-------------------+---------+ -| Encryption | AES-256 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 2 | -+-------------------+---------+ -``` - -**IPsec parameters:** - -```{eval-rst} -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ -``` - -```{eval-rst} -**Traffic Selectors** - 192.168.0.0/24 <==> 192.168.10.0/24 - - 192.168.1.0/24 <==> 192.168.11.0/24 -``` - -**Hosts configuration** - -```{eval-rst} -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ -``` - -## Configuration - -:::{note} -Pfs is disabled in Cisco by default. -::: - -### VyOS - -```none -set interfaces ethernet eth0 address '10.0.1.2/30' -set interfaces ethernet eth1 address '192.168.0.1/24' -set interfaces ethernet eth2 address '192.168.1.1/24' -set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 -set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' -set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' -set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' -set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' -set vpn ipsec esp-group ESP-GROUP lifetime '3600' -set vpn ipsec esp-group ESP-GROUP pfs 'disable' -set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' -set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' -set vpn ipsec ike-group IKE-GROUP close-action 'start' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' -set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' -set vpn ipsec ike-group IKE-GROUP lifetime '28800' -set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' -set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes256' -set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' -set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' -set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' -set vpn ipsec site-to-site peer CISCO connection-type 'initiate' -set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' -set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' -set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' -set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' -set vpn ipsec site-to-site peer CISCO tunnel 1 local prefix '192.168.0.0/24' -set vpn ipsec site-to-site peer CISCO tunnel 1 remote prefix '192.168.10.0/24' -set vpn ipsec site-to-site peer CISCO tunnel 2 local prefix '192.168.1.0/24' -set vpn ipsec site-to-site peer CISCO tunnel 2 remote prefix '192.168.11.0/24' -``` - - -### Cisco - -```none -crypto ikev2 proposal aes-cbc-256-proposal - encryption aes-cbc-256 - integrity sha1 - group 14 -! -crypto ikev2 policy policy1 - match address local 10.0.2.2 - proposal aes-cbc-256-proposal -! -crypto ikev2 keyring keys - peer VyOS - address 10.0.1.2 - pre-shared-key local test - pre-shared-key remote test -! -crypto ikev2 profile IKEv2-profile - match identity remote address 10.0.1.2 255.255.255.255 - authentication remote pre-share - authentication local pre-share - keyring local keys - lifetime 28800 -! -crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac - mode tunnel -! -crypto map IPSEC-map 10 ipsec-isakmp - set peer 10.0.1.2 - set security-association lifetime seconds 3600 - set transform-set TS - set ikev2-profile IKEv2-profile - match address cryptoacl -! -interface GigabitEthernet0/0 - ip address 10.0.2.2 255.255.255.252 - crypto map IPSEC-map -! -interface GigabitEthernet0/1 - ip address 192.168.10.1 255.255.255.0 -! -interface GigabitEthernet0/2 - ip address 192.168.11.1 255.255.255.0 -! -ip route 0.0.0.0 0.0.0.0 10.0.2.1 -! -ip access-list extended cryptoacl - permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255 - permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255 -``` - - -## Monitoring - -### Monitoring on VyOS side - -IKE SAs: - -```none -vyos@vyos:~$ show vpn ike sa -Peer ID / IP Local ID / IP ------------- ------------- -10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv2 AES_CBC_256 HMAC_SHA1_96 MODP_2048 no 304 26528 -``` - -IPsec SAs: - -```none -vyos@vyos:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal --------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- -CISCO-tunnel-1 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 -CISCO-tunnel-2 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 -``` - - -### Monitoring on Cisco side - -IKE SAs: - -```none -Cisco#show crypto ikev2 sa - IPv4 Crypto IKEv2 SA - -Tunnel-id Local Remote fvrf/ivrf Status -1 10.0.2.2/4500 10.0.1.2/4500 none/none READY - Encr: AES-CBC, keysize: 256, PRF: SHA1, Hash: SHA96, DH Grp:14, Auth sign: PSK, Auth verify: PSK - Life/Active Time: 28800/471 sec - - IPv6 Crypto IKEv2 SA -``` - -IPsec SAs: - -```none - Cisco#show crypto ipsec sa - -interface: GigabitEthernet0/0 - Crypto map tag: IPSEC-map, local addr 10.0.2.2 - - protected vrf: (none) - local ident (addr/mask/prot/port): (192.168.11.0/255.255.255.0/0/0) - remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) - current_peer 10.0.1.2 port 4500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 - #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC81F83DA(3357508570) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x8C63C51E(2355348766) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 23, flow_id: SW:23, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4231729/3585) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC81F83DA(3357508570) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 24, flow_id: SW:24, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4231729/3585) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: - - protected vrf: (none) - local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0) - remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0) - current_peer 10.0.1.2 port 4500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 - #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC40C7A20(3289152032) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x2948B6CB(692631243) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 21, flow_id: SW:21, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4194891/3581) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC40C7A20(3289152032) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 22, flow_id: SW:22, sibling_flags 80000040, crypto map: IPSEC-map - sa timing: remaining key lifetime (k/sec): (4194891/3581) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: -``` - - -### Checking Connectivity - -ICMP packets from PC1 to PC3. - -```none -PC1> ping 192.168.10.2 - -84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms -84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms -84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms -84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms -84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms -``` - -ICMP packets from PC2 to PC4. - -```none -PC2> ping 192.168.11.2 - -84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms -84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms -84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms -``` diff --git a/docs/configexamples/md-ipsec-cisco-route-based.md b/docs/configexamples/md-ipsec-cisco-route-based.md deleted file mode 100644 index 40a3985b..00000000 --- a/docs/configexamples/md-ipsec-cisco-route-based.md +++ /dev/null @@ -1,406 +0,0 @@ ---- -lastproofread: '2025-06-26' ---- - -(examples-ipsec-cisco-route-based)= - -# Route-based Site-to-Site VPN IPsec between VyOS and Cisco - -This document is to describe a basic setup using route-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -Cisco IOS. Cisco initiates IPsec connection only if interesting -traffic present. For stable work we recommend configuring an -initiator role on VyOS side. OSPF is selected as routing protocol -inside the tunnel. - -## Network Topology - -```{eval-rst} -.. image:: /_static/images/cisco-vpn-ipsec.webp - :align: center - :alt: Network Topology Diagram -``` - - -## Prerequirements - -**VyOS:** - -```{eval-rst} -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ -``` - -**Cisco:** - -```{eval-rst} -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ -``` - -**IKE parameters:** - -```{eval-rst} -+-------------------+---------+ -| Encryption | AES-128 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 1 | -+-------------------+---------+ -``` - -**IPsec parameters:** - -```{eval-rst} -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ -``` - -**Hosts configuration** - -```{eval-rst} -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ -``` - -## Configuration - -:::{note} -Pfs is disabled in Cisco by default. -::: - -### VyOS - -```none -set interfaces ethernet eth0 address '10.0.1.2/30' -set interfaces ethernet eth1 address '192.168.0.1/24' -set interfaces ethernet eth2 address '192.168.1.1/24' -set interfaces vti vti1 address '10.100.100.1/30' -set interfaces vti vti1 mtu '1438' -set protocols ospf area 0 network '10.100.100.0/30' -set protocols ospf area 0 network '192.168.0.0/24' -set protocols ospf area 0 network '192.168.1.0/24' -set protocols ospf interface eth1 passive -set protocols ospf interface eth2 passive -set protocols ospf interface vti1 network 'point-to-point' -set protocols ospf parameters router-id '2.2.2.2' -set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 -set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' -set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' -set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' -set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' -set vpn ipsec esp-group ESP-GROUP lifetime '3600' -set vpn ipsec esp-group ESP-GROUP pfs 'disable' -set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' -set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' -set vpn ipsec ike-group IKE-GROUP close-action 'start' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' -set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' -set vpn ipsec ike-group IKE-GROUP lifetime '28800' -set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' -set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' -set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' -set vpn ipsec options disable-route-autoinstall -set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' -set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' -set vpn ipsec site-to-site peer CISCO connection-type 'initiate' -set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' -set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' -set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' -set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' -set vpn ipsec site-to-site peer CISCO vti bind 'vti1' -``` - - -### Cisco - -```none -crypto isakmp policy 10 - encr aes - authentication pre-share - group 14 - lifetime 28800 -crypto isakmp key test address 10.0.1.2 -! -! -crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac - mode transport -! -crypto ipsec profile IPsec-profile - set transform-set TS -! -! -! -! -! -! -! -interface Loopback0 - ip address 1.1.1.1 255.255.255.255 -! -interface Tunnel10 - ip address 10.100.100.2 255.255.255.252 - ip ospf network point-to-point - tunnel source GigabitEthernet0/0 - tunnel mode ipsec ipv4 - tunnel destination 10.0.1.2 - tunnel protection ipsec profile IPsec-profile -! -interface GigabitEthernet0/0 - ip address 10.0.2.2 255.255.255.252 - duplex auto - speed auto - media-type rj45 -! -interface GigabitEthernet0/1 - ip address 192.168.10.1 255.255.255.0 - duplex auto - speed auto - media-type rj45 -! -interface GigabitEthernet0/2 - ip address 192.168.11.1 255.255.255.0 - duplex auto - speed auto - media-type rj45 -! -router ospf 1 - router-id 1.1.1.1 - passive-interface GigabitEthernet0/1 - passive-interface GigabitEthernet0/2 - network 10.100.100.0 0.0.0.3 area 0 - network 192.168.10.0 0.0.0.255 area 0 - network 192.168.11.0 0.0.0.255 area 0 -! -ip route 0.0.0.0 0.0.0.0 10.0.2.1 -``` - - -## Monitoring - -### Monitoring on VyOS side - -IKE SAs: - -```none -vyos@vyos:~$ show vpn ike sa -Peer ID / IP Local ID / IP ------------- ------------- -10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 8175 18439 -``` - -IPsec SAs: - -```none -vyos@vyos:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- -CISCO-vti up 34m59s 17K/14K 224/213 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 -``` - -OSPF Neighbor Status: - -```none -vyos@vyos:~$ show ip ospf neighbor - -Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL -1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 -``` - -Routing Table: - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure -S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54 -C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59 -L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59 -O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50 -C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50 -L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50 -O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54 -C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59 -L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59 -O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54 -C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59 -L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59 -O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 -O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 -``` - - -### Monitoring on Cisco side - -IKE SAs: - -```none -Cisco#show crypto isakmp sa -IPv4 Crypto ISAKMP SA -dst src state conn-id status -10.0.1.2 10.0.2.2 QM_IDLE 1002 ACTIVE - -IPv6 Crypto ISAKMP SA -``` - -IPsec SAs: - -```none -Cisco#show crypto ipsec sa - -interface: Tunnel10 - Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2 - - protected vrf: (none) - local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) - remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) - current_peer 10.0.1.2 port 500 - PERMIT, flags={origin_is_acl,} - #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295 - #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238 - #pkts compressed: 0, #pkts decompressed: 0 - #pkts not compressed: 0, #pkts compr. failed: 0 - #pkts not decompressed: 0, #pkts decompress failed: 0 - #send errors 0, #recv errors 0 - - local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 - plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 - current outbound spi: 0xC3E9B307(3286872839) - PFS (Y/N): N, DH group: none - - inbound esp sas: - spi: 0x2740C328(658555688) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0 - sa timing: remaining key lifetime (k/sec): (4173824/1401) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - inbound ah sas: - - inbound pcp sas: - - outbound esp sas: - spi: 0xC3E9B307(3286872839) - transform: esp-256-aes esp-sha256-hmac , - in use settings ={Tunnel, } - conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0 - sa timing: remaining key lifetime (k/sec): (4173819/1401) - IV size: 16 bytes - replay detection support: Y - Status: ACTIVE(ACTIVE) - - outbound ah sas: - - outbound pcp sas: -``` - -OSPF Neighbor Status: - -```none -Cisco# show ip ospf neighbor - -Neighbor ID Pri State Dead Time Address Interface -2.2.2.2 0 FULL/ - 00:00:35 10.100.100.1 Tunnel10 -``` - -Routing Table: - -```none -Cisco#show ip route -Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP - D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area - N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 - E1 - OSPF external type 1, E2 - OSPF external type 2 - i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 - ia - IS-IS inter area, * - candidate default, U - per-user static route - o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP - a - application route - + - replicated route, % - next hop override, p - overrides from PfR - -Gateway of last resort is 10.0.2.1 to network 0.0.0.0 - -S* 0.0.0.0/0 [1/0] via 10.0.2.1 - 1.0.0.0/32 is subnetted, 1 subnets -C 1.1.1.1 is directly connected, Loopback0 - 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks -C 10.0.2.0/30 is directly connected, GigabitEthernet0/0 -L 10.0.2.2/32 is directly connected, GigabitEthernet0/0 -C 10.100.100.0/30 is directly connected, Tunnel10 -L 10.100.100.2/32 is directly connected, Tunnel10 -O 192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 -O 192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 - 192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks -C 192.168.10.0/24 is directly connected, GigabitEthernet0/1 -L 192.168.10.1/32 is directly connected, GigabitEthernet0/1 - 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks -C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 -L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 -``` - - -### Checking Connectivity - -ICMP packets from PC1 to PC3. - -```none -PC1> ping 192.168.10.2 - -84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms -84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms -84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms -84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms -84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms -``` - -ICMP packets from PC2 to PC4. - -```none -PC2> ping 192.168.11.2 - -84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms -84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms -84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms -``` diff --git a/docs/configexamples/md-ipsec-pa-route-based.md b/docs/configexamples/md-ipsec-pa-route-based.md deleted file mode 100644 index c4a9e06c..00000000 --- a/docs/configexamples/md-ipsec-pa-route-based.md +++ /dev/null @@ -1,412 +0,0 @@ ---- -lastproofread: '2025-06-26' ---- - -(examples-ipsec-pa-route-based)= - -# Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto - -This document is to describe a basic setup using route-based -site-to-site VPN IPsec. In this example we use VyOS 1.5 and -PA 11.0.0. OSPF is selected as routing protocol inside the -tunnel. - -Since this example focuses on IPsec configuration it does not -include firewall configuration. - -## Network Topology - -```{image} /_static/images/ipsec-vyos-pa.webp -:align: center -:alt: Network Topology Diagram -``` - - -## Prerequirements - -**VyOS:** - -```{eval-rst} -+---------+----------------+ -| WAN IP | 10.0.1.2/30 | -+---------+----------------+ -| LAN1 IP | 192.168.0.1/24 | -+---------+----------------+ -| LAN2 IP | 192.168.1.1/24 | -+---------+----------------+ -``` - -**Palo Alto:** - -```{eval-rst} -+---------+-----------------+ -| WAN IP | 10.0.2.2/30 | -+---------+-----------------+ -| LAN1 IP | 192.168.10.1/24 | -+---------+-----------------+ -| LAN2 IP | 192.168.11.1/24 | -+---------+-----------------+ -``` - -**IKE parameters:** - -```{eval-rst} -+-------------------+---------+ -| Encryption | AES-128 | -+-------------------+---------+ -| HASH | SHA-1 | -+-------------------+---------+ -| Diff-Helman Group | 14 | -+-------------------+---------+ -| Life-Time | 28800 | -+-------------------+---------+ -| IKE Version | 1 | -+-------------------+---------+ -``` - -**IPsec parameters:** - -```{eval-rst} -+------------+---------+ -| Encryption | AES-256 | -+------------+---------+ -| HASH | SHA-256 | -+------------+---------+ -| Life-Time | 3600 | -+------------+---------+ -| PFS | disable | -+------------+---------+ -``` - -**Hosts configuration** - -```{eval-rst} -+--------+--------------+ -| PC1 IP | 192.168.0.2 | -+--------+--------------+ -| PC2 IP | 192.168.1.2 | -+--------+--------------+ -| PC3 IP | 192.168.10.2 | -+--------+--------------+ -| PC4 IP | 192.168.11.2 | -+--------+--------------+ -``` - -## Configuration - -### VyOS - -```none -set interfaces ethernet eth0 address '10.0.1.2/30' -set interfaces ethernet eth1 address '192.168.0.1/24' -set interfaces ethernet eth2 address '192.168.1.1/24' -set interfaces vti vti1 address '10.100.100.1/30' -set interfaces vti vti1 mtu '1438' -set protocols ospf area 0 network '10.100.100.0/30' -set protocols ospf area 0 network '192.168.0.0/24' -set protocols ospf area 0 network '192.168.1.0/24' -set protocols ospf interface eth1 passive -set protocols ospf interface eth2 passive -set protocols ospf interface vti1 network 'point-to-point' -set protocols ospf parameters router-id '2.2.2.2' -set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 -set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' -set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' -set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' -set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' -set vpn ipsec esp-group ESP-GROUP lifetime '3600' -set vpn ipsec esp-group ESP-GROUP pfs 'disable' -set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' -set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' -set vpn ipsec ike-group IKE-GROUP close-action 'start' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' -set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' -set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' -set vpn ipsec ike-group IKE-GROUP lifetime '28800' -set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' -set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' -set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' -set vpn ipsec options disable-route-autoinstall -set vpn ipsec site-to-site peer PA authentication local-id '10.0.1.2' -set vpn ipsec site-to-site peer PA authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer PA authentication remote-id '10.0.2.2' -set vpn ipsec site-to-site peer PA connection-type 'initiate' -set vpn ipsec site-to-site peer PA default-esp-group 'ESP-GROUP' -set vpn ipsec site-to-site peer PA ike-group 'IKE-GROUP' -set vpn ipsec site-to-site peer PA local-address '10.0.1.2' -set vpn ipsec site-to-site peer PA remote-address '10.0.2.2' -set vpn ipsec site-to-site peer PA vti bind 'vti1' -``` - - -### Palo Alto - -```{eval-rst} -GUI Configuration: - Network -> Network Profiles -> IKE Crypto - - .. image:: /_static/images/PA-IKE-group.webp - :align: center - - Network -> Network Profiles -> IKE Gateways - - .. image:: /_static/images/PA-IKE-GW-1.webp - :align: center - - .. image:: /_static/images/PA-IKE-GW-2.webp - :align: center - - Network -> Network Profiles -> IPSec Crypto - - .. image:: /_static/images/PA-ESP-group.webp - :align: center - - Network -> Interfaces - - .. image:: /_static/images/PA-tunnel-1.webp - :align: center - - .. image:: /_static/images/PA-tunnel-2.webp - :align: center - - .. image:: /_static/images/PA-tunnel-3.webp - :align: center - - Network -> IPSec Tunnels - - .. image:: /_static/images/PA-IPsec-tunnel.webp - :align: center -``` -CLI configuration with OSPF: -```none -set network interface ethernet ethernet1/1 layer3 ip 10.0.2.2/30 -set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow -set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24 -set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow -set network interface ethernet ethernet1/3 layer3 ip 192.168.11.1/24 -set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow -set network interface tunnel units tunnel.1 ip 10.100.100.2/30 -set network interface tunnel units tunnel.1 interface-management-profile Allow -set network interface tunnel units tunnel.1 mtu 1438 -set network profiles interface-management-profile Allow ping yes -set network ike crypto-profiles ike-crypto-profiles IKE-GROUP hash sha1 -set network ike crypto-profiles ike-crypto-profiles IKE-GROUP dh-group group14 -set network ike crypto-profiles ike-crypto-profiles IKE-GROUP encryption aes-128-cbc -set network ike crypto-profiles ike-crypto-profiles IKE-GROUP lifetime seconds 28800 -set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp authentication sha256 -set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp encryption aes-256-cbc -set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP lifetime seconds 3600 -set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP dh-group no-pfs -set network ike gateway VyOS authentication pre-shared-key key test -set network ike gateway VyOS protocol ikev1 dpd enable yes -set network ike gateway VyOS protocol ikev1 exchange-mode main -set network ike gateway VyOS protocol ikev1 ike-crypto-profile IKE-GROUP -set network ike gateway VyOS protocol ikev2 dpd enable yes -set network ike gateway VyOS protocol version ikev1 -set network ike gateway VyOS protocol-common nat-traversal enable yes -set network ike gateway VyOS protocol-common fragmentation enable no -set network ike gateway VyOS protocol-common passive-mode yes -set network ike gateway VyOS local-address interface ethernet1/1 -set network ike gateway VyOS peer-address ip 10.0.1.2 -set network ike gateway VyOS local-id id 10.0.2.2 -set network ike gateway VyOS local-id type ipaddr -set network ike gateway VyOS peer-id id 10.0.1.2 -set network ike gateway VyOS peer-id type ipaddr -set network tunnel ipsec VyOS-tunnel auto-key ike-gateway VyOS -set network tunnel ipsec VyOS-tunnel auto-key ipsec-crypto-profile ESP-GROUP -set network tunnel ipsec VyOS-tunnel tunnel-monitor enable no -set network tunnel ipsec VyOS-tunnel tunnel-interface tunnel.1 -set network tunnel ipsec VyOS-tunnel anti-replay no -set network virtual-router default protocol ospf enable yes -set network virtual-router default protocol ospf area 0.0.0.0 type normal -set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 enable yes -set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 passive no -set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 link-type p2p -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 enable yes -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 passive yes -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 link-type broadcast -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 enable yes -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 passive yes -set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 link-type broadcast -set network virtual-router default protocol ospf router-id 1.1.1.1 -set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] -``` - -## Monitoring -### Monitoring on VyOS side - -IKE SAs: - -```none -vyos@vyos:~$ show vpn ike sa -Peer ID / IP Local ID / IP ------------- ------------- -10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 - - State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time - ----- ------ ------- ---- --------- ----- ------ ------ - up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 1372 25802 -``` - -IPsec SAs: - -```none -vyos@vyos:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- -PA-vti up 23m27s 9K/10K 149/151 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 -``` - -OSPF Neighbor Status: - -```none -vyos@vyos:~$ show ip ospf neighbor - -Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL -1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 -``` - -Routing Table: - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, L - local, S - static, - R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, t - Table-Direct, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:27:30 -C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:27:34 -L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:27:34 -O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:24:34 -C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:24:34 -L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:24:34 -O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:27:29 -C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:27:34 -L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:27:34 -O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:27:29 -C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:27:34 -L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:27:34 -O>* 192.168.10.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 -O>* 192.168.11.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 -``` - -### Monitoring on Palo Alto side - -IKE SAs: - -```none -admin@PA-VM> show vpn ike-sa - -IKEv1 phase-1 SAs -GwID/client IP Peer-Address Gateway Name Role Mode Algorithm Established Expiration V ST Xt Phase2 --------------- ------------ ------------ ---- ---- --------- ----------- ---------- - -- -- ------ -1 10.0.1.2 VyOS Resp Main PSK/DH14/A128/SHA1 Jul.31 01:35:00 Jul.31 09:35:00 v1 13 1 1 - -Show IKEv1 IKE SA: Total 1 gateways found. 1 ike sa found. - - -IKEv1 phase-2 SAs -Gateway Name TnID Tunnel GwID/IP Role Algorithm SPI(in) SPI(out) MsgID ST Xt ------------- ---- ------ ------- ---- --------- ------- -------- ----- -- -- -VyOS 1 VyOS-tunnel 1 Resp ESP/ /tunl/SHA2 8827A3D9 C204F4FA BD202829 9 1 - -Show IKEv1 phase2 SA: Total 1 gateways found. 1 ike sa found. - - -There is no IKEv2 SA found. -``` - -IPsec SAs: - -```none -admin@PA-VM> show vpn ipsec-sa - -GwID/client IP TnID Peer-Address Tunnel(Gateway) Algorithm SPI(in) SPI(out) life(Sec/KB) remain-time(Sec) --------------- ---- ------------ --------------- --------- ------- -------- ------------ ---------------- -1 1 10.0.1.2 VyOS-tunnel(VyOS) ESP/A256/SHA256 8827A3D9 C204F4FA 3600/Unlimited 2733 - -Show IPSec SA: Total 1 tunnels found. 1 ipsec sa found. -``` - -OSPF Neighbor Status: - -```none -admin@PA-VM> show routing protocol ospf neighbor - - Options: 0x80:reserved, O:Opaq-LSA capability, DC:demand circuits, EA:Ext-Attr LSA capability, - N/P:NSSA option, MC:multicase, E:AS external LSA capability, T:TOS capability - ========== - virtual router: default - neighbor address: 10.100.100.1 - local address binding: 0.0.0.0 - type: dynamic - status: full - neighbor router ID: 2.2.2.2 - area id: 0.0.0.0 - neighbor priority: 1 - lifetime remain: 32 - messages pending: 0 - LSA request pending: 0 - options: 0x02: E - hello suppressed: no - restart helper status: not helping - restart helper time remaining: 0 - restart helper exit reason: none -``` - -Routing Table: - -```none -admin@PA-VM> show routing route - -flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, - Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast - - -VIRTUAL ROUTER: default (id 1) - ========== -destination nexthop metric flags age interface next-AS -0.0.0.0/0 10.0.2.1 10 A S ethernet1/1 -10.0.2.0/30 10.0.2.2 0 A C ethernet1/1 -10.0.2.2/32 0.0.0.0 0 A H -10.100.100.0/30 0.0.0.0 10 Oi 1273 tunnel.1 -10.100.100.0/30 10.100.100.2 0 A C tunnel.1 -10.100.100.2/32 0.0.0.0 0 A H -192.168.0.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 -192.168.1.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 -192.168.10.0/24 0.0.0.0 10 Oi 1273 ethernet1/2 -192.168.10.0/24 192.168.10.1 0 A C ethernet1/2 -192.168.10.1/32 0.0.0.0 0 A H -192.168.11.0/24 0.0.0.0 10 Oi 1273 ethernet1/3 -192.168.11.0/24 192.168.11.1 0 A C ethernet1/3 -192.168.11.1/32 0.0.0.0 0 A H -total routes shown: 14 -``` - -### Checking Connectivity - -ICMP packets from PC1 to PC3. - -```none -PC1> ping 192.168.10.2 - -84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms -84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms -84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms -84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms -84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms -``` - -ICMP packets from PC2 to PC4. - -```none -PC2> ping 192.168.11.2 - -84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms -84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms -84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms -``` diff --git a/docs/configexamples/md-l3vpn-hub-and-spoke.md b/docs/configexamples/md-l3vpn-hub-and-spoke.md deleted file mode 100644 index 3c719926..00000000 --- a/docs/configexamples/md-l3vpn-hub-and-spoke.md +++ /dev/null @@ -1,1091 +0,0 @@ -# L3VPN for Hub-and-Spoke connectivity with VyOS - -IP/MPLS technology is widely used by various service providers and large -enterprises in order to achieve better network scalability, manageability -and flexibility. It also provides the possibility to deliver different -services for the customers in a seamless manner. -Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered -through OSI layer 3 networking technologies. Often the border gateway -protocol (BGP) is used to send and receive VPN-related data that is -responsible for the control plane. L3VPN utilizes virtual routing and -forwarding (VRF) techniques to receive and deliver user data as well as -separate data planes of the end-users. It is built using a combination of -IP- and MPLS-based information. Generally, L3VPNs are used to send data -on back-end VPN infrastructures, such as for VPN connections between data -centres, HQs and branches. - -An L3VPN consists of multiple access links, multiple VPN routing and -forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs. -An L3VPN can be configured to connect two or more customer sites. -In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have -unique Route Distinguishers (RDs). In order to use the hub site as a -transit point for connectivity in such an environment, the spoke sites -export their routes to the hub. Spokes can talk to hubs, but never have -direct paths to other spokes. All traffic between spokes is controlled -and delivered over the hub site. - -To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple -requirements in order to properly implement the solution. -We'll use the following nodes in our LAB environment: - -- 2 x Route reflectors (VyOS-RRx) -- 4 x Provider routers (VyOS-Px) -- 3 x Provider Edge (VyOs-PEx) -- 3 x Customer Edge (VyOS-CEx) - -The following software was used in the creation of this document: - -- Operating system: VyOS -- Version: 1.4-rolling-202110310317 -- Image name: vyos-1.4-rolling-202110310317-amd64.iso - -**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) -– The configurations below are specifically for VyOS 1.4.x. - -General information can be found in the -{ref}`configuration/vrf/index:L3VPN VRFs` chapter. - -## Topology - -```{image} /_static/images/L3VPN_hub_and_spoke.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - - -## How does it work? - -As we know the main assumption of L3VPN “Hub and Spoke” is, that the -traffic between spokes have to pass via hub, in our scenario VyOS-PE2 -is the Hub PE -and the VyOS-CE1-HUB is the central customer office device that is responsible -for controlling access between all spokes and announcing its network prefixes -(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its -own Route-Distinguisher(RD) and route-target import/export lists. -Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to -the nodes across network where PEs Spokes import the route-target 60535:1030 -(this is export route-target of vrf BLUE_HUB) and export its own route-target -60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the -Customer edge nodes can only learn the network prefixes of the HUB site -[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes -[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. -Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network -routes exchange and minimize iBGP peerings between devices. - -L3VPN configuration parameters table: - -```{eval-rst} -+----------+-------+------------+-----------------+-------------+-------------+ -| Node | Role | VRF | RD | RT import | RT export | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE2 | Hub | BLUE_HUB | 10.80.80.1:1011 | 65035:1011 | 65035:1030 | -| | | | | 65035:1030 | | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030 | 65035:1011 | -+----------+-------+------------+-----------------+-------------+-------------+ -| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030 | 65035:1011 | -+----------+-------+------------+-----------------+-------------+-------------+ -``` - -## Configuration - -### Step-1: Configuring IGP and enabling MPLS LDP - -At the first step we need to configure the IP/MPLS backbone network using OSPF -as IGP protocol and LDP as label-switching protocol for the base connectivity -between **P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R** -(eflector) nodes: -- VyOS-P1: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.3/32' -set interfaces ethernet eth0 address '172.16.30.1/24' -set interfaces ethernet eth1 address '172.16.40.1/24' -set interfaces ethernet eth2 address '172.16.90.1/24' -set interfaces ethernet eth3 address '172.16.10.1/24' -set interfaces ethernet eth5 address '172.16.100.1/24' - -# protocols ospf+ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set protocols mpls interface 'eth5' -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp interface 'eth3' -set protocols mpls ldp interface 'eth5' -set protocols mpls ldp router-id '10.0.0.3' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.3' -``` - -- VyOS-P2: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.4/32' -set interfaces ethernet eth0 address '172.16.30.2/24' -set interfaces ethernet eth1 address '172.16.20.1/24' -set interfaces ethernet eth2 address '172.16.120.1/24' -set interfaces ethernet eth3 address '172.16.60.1/24' - -# protocols ospf+ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp interface 'eth3' -set protocols mpls ldp router-id '10.0.0.4' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.4' -``` - -- VyOS-P3: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.5/32' -set interfaces ethernet eth0 address '172.16.110.1/24' -set interfaces ethernet eth1 address '172.16.40.2/24' -set interfaces ethernet eth2 address '172.16.50.1/24' -set interfaces ethernet eth3 address '172.16.70.1/24' - -# protocols ospf + ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp interface 'eth3' -set protocols mpls ldp router-id '10.0.0.5' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.5' -``` - -- VyOS-P4: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.6/32' -set interfaces ethernet eth0 address '172.16.80.2/24' -set interfaces ethernet eth1 address '172.16.130.1/24' -set interfaces ethernet eth2 address '172.16.50.2/24' -set interfaces ethernet eth3 address '172.16.60.2/24' -set interfaces ethernet eth5 address '172.16.140.1/24' - - -# protocols ospf + ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set protocols mpls interface 'eth0' -set protocols mpls interface 'eth5' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp interface 'eth3' -set protocols mpls ldp interface 'eth5' -set protocols mpls ldp router-id '10.0.0.6' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.6' -``` - -- VyOS-PE1: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.7/32' -set interfaces ethernet eth0 address '172.16.90.2/24' - -# protocols ospf + ldp -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp router-id '10.0.0.7' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.7' -``` - -- VyOS-PE2: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.8/32' -set interfaces ethernet eth0 address '172.16.110.2/24' -set interfaces ethernet eth1 address '172.16.100.2/24' -set interfaces ethernet eth2 address '172.16.80.1/24' - -# protocols ospf + ldp -set protocols mpls interface 'eth0' -set protocols mpls interface 'eth1' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp router-id '10.0.0.8' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.8' -``` - -- VyOS-PE3: - -```none -# interfaces -set interfaces dummy dum10 address '10.0.0.10/32' -set interfaces ethernet eth0 address '172.16.140.2/24' - -# protocols ospf + ldp -set protocols mpls interface 'eth0' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp router-id '10.0.0.10' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.10' -``` - -- VyOS-RR1: - -```none -# interfaces -set interfaces ethernet eth1 address '172.16.20.2/24' -set interfaces ethernet eth2 address '172.16.10.2/24' -set interfaces dummy dum10 address '10.0.0.1/32' - -# protocols ospf + ldp -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth2' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth2' -set protocols mpls ldp router-id '10.0.0.1' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.1' -``` - -- VyOS-RR2: - -```none -# interfaces -set interfaces ethernet eth0 address '172.16.80.1/24' -set interfaces ethernet eth1 address '172.16.70.2/24' -set interfaces dummy dum10 address '10.0.0.2/32' - -# protocols ospf + ldp -set protocols mpls interface 'eth0' -set protocols mpls interface 'eth1' -set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' -set protocols mpls ldp interface 'eth1' -set protocols mpls ldp interface 'eth0' -set protocols mpls ldp router-id '10.0.0.2' -set protocols ospf area 0 network '0.0.0.0/0' -set protocols ospf parameters abr-type 'cisco' -set protocols ospf parameters router-id '10.0.0.2' -``` - - -### Step-2: Configuring iBGP for L3VPN control-plane - -At this step we are going to enable iBGP protocol on MPLS nodes and -Route Reflectors (two routers for redundancy) that will deliver IPv4 -VPN (L3VPN) routes between them: -- VyOS-RR1: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' -set protocols bgp parameters cluster-id '10.0.0.1' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.1' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - -- VyOS-RR2: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client -set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' -set protocols bgp parameters cluster-id '10.0.0.1' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.2' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - -- VyOS-PE1: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.7' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - -- VyOS-PE2: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.8' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - -- VyOS-PE3: - -```none -set protocols bgp system-as '65001' -set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' -set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self -set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.0.0.10' -set protocols bgp peer-group RR_VPNv4 remote-as '65001' -set protocols bgp peer-group RR_VPNv4 update-source 'dum10' -``` - - -### Step-3: Configuring L3VPN VRFs on PE nodes - -This section provides configuration steps for setting up VRFs on our -PE nodes including CE facing interfaces, BGP, rd and route-target -import/export based on the pre-defined parameters. -- VyOS-PE1: - -```none -# VRF settings -set vrf name BLUE_SPOKE table '200' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' -set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override -set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035' - -# interfaces -set interfaces ethernet eth3 address '10.50.50.1/24' -set interfaces ethernet eth3 vrf 'BLUE_SPOKE' -``` - -- VyOS-PE2: - -```none -# VRF settings -set vrf name BLUE_HUB table '400' -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' -set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' -set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override -set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035' - -# interfaces -set interfaces ethernet eth3 address '10.80.80.1/24' -set interfaces ethernet eth3 vrf 'BLUE_HUB' -``` - -- VyOS-PE3: - -```none -# VRF settings -set vrf name BLUE_SPOKE table '200' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' -set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' -set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override -set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035' - -# interfaces -set interfaces ethernet eth3 address '10.60.60.1/24' -set interfaces ethernet eth3 vrf 'BLUE_SPOKE' -``` - - -### Step-4: Configuring CE nodes - -Dynamic routing used between CE and PE nodes and eBGP peering -established for the route exchanging between them. All routes -received by PEs are then exported to L3VPN and delivered from -Spoke sites to Hub and vise-versa based on previously -configured L3VPN parameters. -- VyOS-CE1-SPOKE: - -```none -# interfaces -set interfaces dummy dum20 address '10.0.0.80/32' -set interfaces ethernet eth0 address '10.50.50.2/24' - -# BGP for peering with PE -set protocols bgp system-as 65035 -set protocols bgp address-family ipv4-unicast network 10.0.0.80/32 -set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2' -set protocols bgp neighbor 10.50.50.1 remote-as '65001' -set protocols bgp neighbor 10.50.50.1 update-source 'eth0' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.50.50.2' -``` - -- VyOS-CE1-HUB: - -```none -# interfaces -set interfaces dummy dum20 address '10.0.0.100/32' -set interfaces ethernet eth0 address '10.80.80.2/24' - -# BGP for peering with PE -set protocols bgp system-as 65035 -set protocols bgp address-family ipv4-unicast network 10.0.0.100/32 -set protocols bgp address-family ipv4-unicast redistribute connected -set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2' -set protocols bgp neighbor 10.80.80.1 remote-as '65001' -set protocols bgp neighbor 10.80.80.1 update-source 'eth0' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.80.80.2' -``` - -- VyOS-CE2-SPOKE: - -```none -# interfaces -set interfaces dummy dum20 address '10.0.0.90/32' -set interfaces ethernet eth0 address '10.60.60.2/24' - -# BGP for peering with PE -set protocols bgp system-as 65035 -set protocols bgp address-family ipv4-unicast network 10.0.0.90/32 -set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2' -set protocols bgp neighbor 10.60.60.1 remote-as '65001' -set protocols bgp neighbor 10.60.60.1 update-source 'eth0' -set protocols bgp parameters log-neighbor-changes -set protocols bgp parameters router-id '10.60.60.2' -``` - - -### Step-5: Verification - -This section describes verification commands for MPLS/BGP/LDP -protocols and L3VPN related routes as well as diagnosis and -reachability checks between CE nodes. - -Let’s check IPv4 routing and MPLS information on provider nodes -(same procedure for all P nodes): -- “show ip ospf neighbor” for checking ospf relationship - -```none -vyos@VyOS-P1:~$ show ip ospf neighbor - -Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL -10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 -10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 -10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 -10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 -10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 -``` - -- “show mpls ldp neighbor “ for checking ldp neighbors - -```none -vyos@VyOS-P1:~$ show mpls ldp neighbor -AF ID State Remote Address Uptime -ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h -ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h -ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h -ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h -ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h -``` - -- “show mpls ldp binding” for checking mpls label assignment - -```none -vyos@VyOS-P1:~$ show mpls ldp discovery -AF Destination Nexthop Local Label Remote Label In Use -ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes -ipv4 10.0.0.1/32 10.0.0.4 23 20 no -ipv4 10.0.0.1/32 10.0.0.5 23 17 no -ipv4 10.0.0.1/32 10.0.0.7 23 16 no -ipv4 10.0.0.1/32 10.0.0.8 23 16 no -ipv4 10.0.0.2/32 10.0.0.1 20 16 no -ipv4 10.0.0.2/32 10.0.0.4 20 22 no -ipv4 10.0.0.2/32 10.0.0.5 20 24 yes -ipv4 10.0.0.2/32 10.0.0.7 20 17 no -ipv4 10.0.0.2/32 10.0.0.8 20 17 no -ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no -ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no -ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no -ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no -ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no -ipv4 10.0.0.4/32 10.0.0.1 16 18 no -ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes -ipv4 10.0.0.4/32 10.0.0.5 16 19 no -ipv4 10.0.0.4/32 10.0.0.7 16 19 no -ipv4 10.0.0.4/32 10.0.0.8 16 19 no -ipv4 10.0.0.5/32 10.0.0.1 21 19 no -ipv4 10.0.0.5/32 10.0.0.4 21 17 no -ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes -ipv4 10.0.0.5/32 10.0.0.7 21 20 no -ipv4 10.0.0.5/32 10.0.0.8 21 20 no -ipv4 10.0.0.6/32 10.0.0.1 17 20 no -ipv4 10.0.0.6/32 10.0.0.4 17 23 yes -ipv4 10.0.0.6/32 10.0.0.5 17 21 yes -ipv4 10.0.0.6/32 10.0.0.7 17 21 no -ipv4 10.0.0.6/32 10.0.0.8 17 21 no -ipv4 10.0.0.7/32 10.0.0.1 22 21 no -ipv4 10.0.0.7/32 10.0.0.4 22 18 no -ipv4 10.0.0.7/32 10.0.0.5 22 20 no -ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes -ipv4 10.0.0.7/32 10.0.0.8 22 22 no -ipv4 10.0.0.8/32 10.0.0.1 24 22 no -ipv4 10.0.0.8/32 10.0.0.4 24 19 no -ipv4 10.0.0.8/32 10.0.0.5 24 16 no -ipv4 10.0.0.8/32 10.0.0.7 24 22 no -ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes -ipv4 10.0.0.9/32 10.0.0.1 18 23 no -ipv4 10.0.0.9/32 10.0.0.4 18 21 yes -ipv4 10.0.0.9/32 10.0.0.5 18 22 no -ipv4 10.0.0.9/32 10.0.0.7 18 23 no -ipv4 10.0.0.9/32 10.0.0.8 18 23 no -ipv4 10.0.0.10/32 10.0.0.1 19 24 no -ipv4 10.0.0.10/32 10.0.0.4 19 24 yes -ipv4 10.0.0.10/32 10.0.0.5 19 23 yes -ipv4 10.0.0.10/32 10.0.0.7 19 24 no -ipv4 10.0.0.10/32 10.0.0.8 19 24 no -``` - -Now we’re checking iBGP status and routes from route-reflector -nodes to other devices: -- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors: - -```none -vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary -BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0 -BGP table version 0 -RIB entries 9, using 1728 bytes of memory -Peers 4, using 85 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 -10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 -10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 -10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 - -Total number of neighbors 4 -``` - -- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information: - -```none -vyos@VyOS-RR1:~$ show bgp ipv4 vpn -BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 -Default local pref 100, local AS 65001 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path -Route Distinguisher: 10.50.50.1:1011 -*>i10.50.50.0/24 10.0.0.7 0 100 0 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 -*>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i - UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 -Route Distinguisher: 10.60.60.1:1011 -*>i10.60.60.0/24 10.0.0.10 0 100 0 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 -*>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i - UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 -Route Distinguisher: 10.80.80.1:1011 -*>i10.80.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 -*>i100.100.100.100/32 - 10.0.0.8 0 100 0 65035 i - UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 -Route Distinguisher: 172.16.80.1:2011 -*>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 -*>i172.16.80.0/24 10.0.0.8 0 100 0 i - UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 -Route Distinguisher: 172.16.100.1:2011 -*>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 -*>i172.16.100.0/24 10.0.0.9 0 100 0 i - UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 -``` - -- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected - for specific VPNv4 destination - -```none -vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32 -BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 -not allocated -Paths: (1 available, best #1) - Advertised to non peer-group peers: - 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 - 65035, (Received from a RR-client) - 10.0.0.8 from 10.0.0.8 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) - Extended Community: RT:65035:1030 - Remote label: 80 - Last update: Tue Oct 19 13:45:32 202 -``` - -Also we can verify how PE devices receives VPNv4 networks from the RRs -and installing them to the specific customer VRFs: -- “show bgp ipv4 vpn summary” for checking iBGP neighbors against - route-reflector devices: - -```none -vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary -BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0 -BGP table version 0 -RIB entries 9, using 1728 bytes of memory -Peers 2, using 43 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 -10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 -``` - -- “show bgp vrf all” for checking all the prefix learning on BGP - : within VRFs: - -```none -vyos@VyOS-PE1:~$ show bgp vrf all - -Instance default: -No BGP prefixes displayed, 0 exist - -Instance BLUE_SPOKE: -BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 -Default local pref 100, local AS 65001 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path -* 10.50.50.0/24 0.0.0.0 0 32768 ? -*> 0.0.0.0 0 32768 i -*> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i -* 10.0.0.8@0< 0 100 0 i -*> 10.0.0.80/32 10.50.50.2 0 0 65035 i -*> 10.0.0.100/32 - 10.0.0.8@0< 0 100 0 65035 ? -* 10.0.0.8@0< 0 100 0 65035 ? -``` - -- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor - : information between PE and CE: - -```none -vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary - -IPv4 Unicast Summary: -BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6 -BGP table version 8 -RIB entries 7, using 1344 bytes of memory -Peers 1, using 21 KiB of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 - -Total number of neighbors 1 -``` - -- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. - : Using this command we are also able to check the transport and - customer label (inner/outer) for Hub network prefix (10.0.0.100/32): - -```none -vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE - -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - -VRF BLUE_SPOKE: -K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h -C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h -B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 -B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m -B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 - * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 -``` - -- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the - : specific VPNv4 destination including extended community and - remotelabel information. This procedure is the same on all Spoke nodes: - -```none -vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32 -BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 -not allocated -Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.8 from 10.0.0.1 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Tue Oct 19 13:45:26 2021 - 65035 - 10.0.0.8 from 10.0.0.2 (10.0.0.8) - Origin incomplete, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1030 - Originator: 10.0.0.8, Cluster list: 10.0.0.1 - Remote label: 80 - Last update: Wed Oct 13 12:39:34 202 -``` - -Now, let’s check routing information on out Hub PE: -- “show bgp ipv4 vpn summary” for checking iBGP neighbors again - : VyOS-RR1/RR2 - -```none -vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary -BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0 -BGP table version 0 -RIB entries 9, using 1728 bytes of memory -Peers 2, using 43 KiB of memory -Peer groups 1, using 64 bytes of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 -10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 - -Total number of neighbors -``` - -- “show bgp vrf all” for checking all the prefixes learning on BGP - -```none -vyos@VyOS-PE2:~$ show bgp vrf all - -Instance default: -No BGP prefixes displayed, 0 exist - -Instance BLUE_HUB: -BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 -Default local pref 100, local AS 65001 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path -*> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i -* 10.0.0.7@0< 0 100 0 i -*> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i -* 10.0.0.10@0< 0 100 0 i -* 10.80.80.0/24 10.80.80.2 0 0 65035 ? -* 0.0.0.0 0 32768 i -*> 0.0.0.0 0 32768 ? -*> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i -*> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i -* 10.0.0.9@0< 0 100 0 65050 i -*> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i -* 10.0.0.7@0< 0 100 0 65035 i -*> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i -* 10.0.0.10@0< 0 100 0 65035 i -*> 10.0.0.100/32 - 10.80.80.2 0 0 65035 ? -*> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? - 0.0.0.0@9< 0 32768 i -*> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i -* 10.0.0.9@0< 0 100 0 i -``` - -- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor - : CE Hub device - -```none -vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary - -IPv4 Unicast Summary: -BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8 -BGP table version 50 -RIB entries 19, using 3648 bytes of memory -Peers 1, using 21 KiB of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt -10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 -``` - -- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. - : With this command we are able to check the transport and - customer label (inner/outer) for network spokes prefixes - 10.0.0.80/32 - 10.0.0.90/32 - -```none -vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB - -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - -VRF BLUE_HUB: -K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h -B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 -B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 -C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h -B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h -B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 -B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 -B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 -B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h -B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h -B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 - * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 - * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 -``` - -- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, - : extended community and remote label of specific destination - -```none -vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32 -BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32 -not allocated -Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.7 from 10.0.0.1 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 - 65035 - 10.0.0.7 from 10.0.0.2 (10.0.0.7) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.7, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:39:37 2021 - -vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 -BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 -not allocated -Paths: (2 available, best #1) - Not advertised to any peer - 65035 - 10.0.0.10 from 10.0.0.1 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Tue Oct 19 13:45:30 2021 - 65035 - 10.0.0.10 from 10.0.0.2 (10.0.0.10) - Origin IGP, metric 0, localpref 100, valid, internal - Extended Community: RT:65035:1011 - Originator: 10.0.0.10, Cluster list: 10.0.0.1 - Remote label: 144 - Last update: Wed Oct 13 12:45:44 2021 -``` - -Finally, let’s check the reachability between CEs: -- VyOS-CE1-SPOKE -----> VyOS-CE-HUB - -```none -# check rib -vyos@VyOS-CE1-SPOKE:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - -B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m -C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h -B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m -C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h -B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m - -# check icmp -vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80 -PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data. -64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms -64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms -64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms -64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms -^C ---- 10.0.0.100 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 8ms -rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms - -# check network path -vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100 -traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets - 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms - 2 * * * - 3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m -``` - -- VyOS-CE-HUB -------> VyOS-CE1-SPOKE -- VyOS-CE-HUB -------> VyOS-CE2-SPOKE - -```none -# check rib -vyos@VyOS-CE-HUB:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - -B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m -B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m -C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h -B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h -B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m -B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m -B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m -C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h -B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h -B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m - -# check icmp -vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4 -PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data. -64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms -64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms -64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms -64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms - ---- 10.0.0.80 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 9ms -rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms - -vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4 -PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data. -64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms -64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms -64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms -^C ---- 10.0.0.90 ping statistics --- -3 packets transmitted, 3 received, 0% packet loss, time 6ms -rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms - -# check network path -vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80 -traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets - 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms - 2 * * * - 3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms - -vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90 -traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets - 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms - 2 * * * - 3 * * * - 4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms -``` - -- VyOS-CE2-SPOKE -------> VyOS-CE-HUB - -```none -# check rib -vyos@rt-ce2-SPOKE:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - -B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h -C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h -B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m -C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h -B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m - -# check icmp -vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4 -PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data. -64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms -64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms -64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms -64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms - ---- 10.0.0.100 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 9ms -rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms - -# check network path -vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100 -traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets - 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms - 2 * * * - 3 * * * - 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms -``` - -**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll -see `* * *` for the transit routers of the mpls backbone. diff --git a/docs/configexamples/md-lac-lns.md b/docs/configexamples/md-lac-lns.md deleted file mode 100644 index 51a96f8b..00000000 --- a/docs/configexamples/md-lac-lns.md +++ /dev/null @@ -1,181 +0,0 @@ ---- -lastproofread: '2024-02-21' ---- - -(examples-lac-lns)= - -# PPPoE over L2TP - -This document is to describe a basic setup using PPPoE over L2TP. -LAC and LNS are components of the broadband topology. -LAC - L2TP access concentrator -LNS - L2TP Network Server -LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and -forward them to LNS. LNS is the termination point that comes from PPP packets -from the remote client. - -In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC. -All users with domain **vyos.io** will be tunneled to LNS via L2TP. - -## Network Topology - -```{image} /_static/images/lac-lns-diagram.webp -:align: center -:alt: Network Topology Diagram -:width: 60% -``` - - -## Configurations - -### LAC - -```none -aaa new-model -! -aaa authentication ppp default local -! -vpdn enable -vpdn aaa attribute nas-ip-address vpdn-nas -! -vpdn-group LAC - request-dialin - protocol l2tp - domain vyos.io - initiate-to ip 192.168.139.100 - source-ip 192.168.139.101 - local name LAC - l2tp tunnel password 0 test123 -! -bba-group pppoe MAIN-BBA - virtual-template 1 -! -interface GigabitEthernet0/0 - description To LNS - ip address 192.168.139.101 255.255.255.0 - duplex auto - speed auto - media-type rj45 -! -interface GigabitEthernet0/1 - description To PPPoE clients - no ip address - duplex auto - speed auto - media-type rj45 - pppoe enable group MAIN-BBA -! -interface Virtual-Template1 - description pppoe MAIN-BBA - no ip address - no peer default ip address - ppp mtu adaptive - ppp authentication chap -! -``` - - -### LNS - -% stop_vyoslinter - -```none -set interfaces ethernet eth0 address '192.168.139.100/24' -set nat source rule 100 outbound-interface name 'eth0' -set nat source rule 100 source address '10.0.0.0/24' -set nat source rule 100 translation address 'masquerade' -set protocols static route 0.0.0.0/0 next-hop 192.168.139.2 -set vpn l2tp remote-access authentication mode 'radius' -set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest' -set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100' -set vpn l2tp remote-access default-pool 'TEST-POOL' -set vpn l2tp remote-access gateway-address '10.0.0.1' -set vpn l2tp remote-access lns host-name 'LAC' -set vpn l2tp remote-access lns shared-secret 'test123' -set vpn l2tp remote-access name-server '8.8.8.8' -set vpn l2tp remote-access ppp-options disable-ccp -``` - -% start_vyoslinter - -:::{note} -This setup requires the Compression Control Protocol (CCP) -being disabled, the command `set vpn l2tp remote-access ppp-options disable-ccp` -accomplishes that. -::: - -### Client - -In this lab we use Windows PPPoE client. - -```{image} /_static/images/lac-lns-winclient.webp -:align: center -:alt: Window PPPoE Client Configuration -:width: 100% -``` - - -### Monitoring - -Monitoring on LNS side - -```none -vyos@vyos:~$ show l2tp-server sessions - ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes ---------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+---------- - l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB -``` - -Monitoring on LAC side - -```none -Router#show pppoe session - 1 session in FORWARDED (FWDED) State - 1 session total -Uniq ID PPPoE RemMAC Port VT VA State - SID LocMAC VA-st Type - 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED - 0c58.88ac.0001 - -Router#show l2tp -L2TP Tunnel and Session Information Total tunnels 1 sessions 1 - -LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ - Count VPDN Group -23238 2640 LAC est 192.168.139.100 1 LAC - -LocID RemID TunID Username, Intf/ State Last Chg Uniq ID - Vcid, Circuit -25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1 -``` - -Monitoring on RADIUS Server side - -```none -root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221 -Wed Feb 21 13:37:17 2024 - User-Name = "test@vyos.io" - NAS-Port = 0 - NAS-Port-Id = "l2tp0" - NAS-Port-Type = Virtual - Service-Type = Framed-User - Framed-Protocol = PPP - Calling-Station-Id = "192.168.139.101" - Called-Station-Id = "192.168.139.100" - Acct-Status-Type = Start - Acct-Authentic = RADIUS - Acct-Session-Id = "45c731e169d9a4f1" - Acct-Session-Time = 0 - Acct-Input-Octets = 0 - Acct-Output-Octets = 0 - Acct-Input-Packets = 0 - Acct-Output-Packets = 0 - Acct-Input-Gigawords = 0 - Acct-Output-Gigawords = 0 - Framed-IP-Address = 10.0.0.2 - NAS-IP-Address = 192.168.139.100 - Event-Timestamp = "Feb 21 2024 13:37:17 UTC" - Tmp-String-9 = "ai:" - Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318" - Timestamp = 1708522637 -``` diff --git a/docs/configexamples/md-nmp.md b/docs/configexamples/md-nmp.md deleted file mode 100644 index 63231a09..00000000 --- a/docs/configexamples/md-nmp.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -lastproofread: '2023-03-26' ---- - -(examples-nmp)= - -# NMP example - -Consider how to quickly set up NMP and VyOS for monitoring. -NMP is multi-vendor network monitoring from 'SolarWinds' built to -scale and expand with the needs of your network. - -## Configuration 'VyOS' - -First prepare our VyOS router for connection to NMP. We have to set -up the SNMP protocol and connectivity between the router and NMP. - -% stop_vyoslinter - -```none -set interfaces ethernet eth0 address 'dhcp' -set system name-server '8.8.8.8' -set service snmp community router authorization 'test' -set service snmp community router network '0.0.0.0/0' -``` - -% start_vyoslinter - - -## Configuration 'NMP' - -Next, you should just follow the pictures: - -```{image} /_static/images/nmp1.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp2.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp3.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp4.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp5.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp6.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```{image} /_static/images/nmp7.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -In the end, you'll get a powerful instrument for monitoring the VyOS systems. diff --git a/docs/configexamples/md-ospf-unnumbered.md b/docs/configexamples/md-ospf-unnumbered.md deleted file mode 100644 index 9174d1b4..00000000 --- a/docs/configexamples/md-ospf-unnumbered.md +++ /dev/null @@ -1,118 +0,0 @@ ---- -lastproofread: '2021-06-29' ---- - -(examples-ospf-unnumbered)= - -# OSPF unnumbered with ECMP - -General information can be found in the {ref}`routing-ospf` chapter. - -## Configuration - -- Router A: - -```none -set interfaces ethernet eth0 address '10.0.0.1/24' -set interfaces ethernet eth1 address '192.168.0.1/32' -set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' -set interfaces ethernet eth1 ip ospf network 'point-to-point' -set interfaces ethernet eth2 address '192.168.0.1/32' -set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' -set interfaces ethernet eth2 ip ospf network 'point-to-point' -set interfaces loopback lo address '192.168.0.1/32' -set protocols ospf area 0.0.0.0 authentication 'md5' -set protocols ospf area 0.0.0.0 network '192.168.0.1/32' -set protocols ospf parameters router-id '192.168.0.1' -set protocols ospf redistribute connected -``` - -- Router B: - -```none -set interfaces ethernet eth0 address '10.0.0.2/24' -set interfaces ethernet eth1 address '192.168.0.2/32' -set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' -set interfaces ethernet eth1 ip ospf network 'point-to-point' -set interfaces ethernet eth2 address '192.168.0.2/32' -set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' -set interfaces ethernet eth2 ip ospf network 'point-to-point' -set interfaces loopback lo address '192.168.0.2/32' -set protocols ospf area 0.0.0.0 authentication 'md5' -set protocols ospf area 0.0.0.0 network '192.168.0.2/32' -set protocols ospf parameters router-id '192.168.0.2' -set protocols ospf redistribute connected -``` - - -## Results - -- Router A: - -```none -vyos@vyos:~$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 10.0.0.1/24 u/u -eth1 192.168.0.1/32 u/u -eth2 192.168.0.1/32 u/u -lo 127.0.0.1/8 u/u - 192.168.0.1/32 - ::1/128 -``` - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - -S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 -O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21 - via 192.168.0.2, eth2 onlink, 00:13:21 -C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 -O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53 -C * 192.168.0.1/32 is directly connected, eth2, 00:56:31 -C * 192.168.0.1/32 is directly connected, eth1, 00:56:31 -C>* 192.168.0.1/32 is directly connected, lo, 00:57:36 -O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03 - * via 192.168.0.2, eth2 onlink, 00:29:03 -``` - -- Router B: - -```none -vyos@vyos:~$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 10.0.0.2/24 u/u -eth1 192.168.0.2/32 u/u -eth2 192.168.0.2/32 u/u -lo 127.0.0.1/8 u/u - 192.168.0.2/32 - ::1/128 -``` - -```none -vyos@vyos:~$ show ip route -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - -S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 -O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21 - via 192.168.0.1, eth2 onlink, 00:13:21 -C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 -O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53 -C * 192.168.0.2/32 is directly connected, eth2, 00:56:31 -C * 192.168.0.2/32 is directly connected, eth1, 00:56:31 -C>* 192.168.0.2/32 is directly connected, lo, 00:57:36 -O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03 - * via 192.168.0.1, eth2 onlink, 00:29:03 -``` diff --git a/docs/configexamples/md-policy-based-ipsec-and-firewall.md b/docs/configexamples/md-policy-based-ipsec-and-firewall.md deleted file mode 100644 index 86bc9318..00000000 --- a/docs/configexamples/md-policy-based-ipsec-and-firewall.md +++ /dev/null @@ -1,269 +0,0 @@ -(examples-policy-based-ipsec-and-firewall)= - -# Policy-Based Site-to-Site VPN and Firewall Configuration - -This guide shows an example policy-based IKEv2 site-to-site VPN between two -VyOS routers, and firewall configuration. - -For simplicity, configuration and tests are done only using IPv4, and firewall -configuration is done only on one router. - -## Network Topology and requirements - -This configuration example and the requirements consists of: - -- Two VyOS routers with public IP address. - -- 2 private subnets on each site. - -- Local subnets should be able to reach internet using source NAT. - -- Communication between private subnets should be done through IPSec tunnel - without NAT. - -- Configuration of basic firewall in one site, in order to: - - > - Protect the router on 'WAN' interface, allowing only IPSec connections - > and SSH access from trusted IPs. - > - Allow access to the router only from trusted networks. - > - Allow DNS requests only only for local networks. - > - Allow ICMP on all interfaces. - > - Allow all new connections from local subnets. - > - Allow connections from LANs to LANs through the tunnel. - -```{image} /_static/images/policy-based-ipsec-and-firewall.webp -``` - - -## Configuration - -Interface and routing configuration: - -```none -# LEFT router: -set interfaces ethernet eth0 address '198.51.100.14/30' -set interfaces ethernet eth1 vif 111 address '10.1.11.1/24' -set interfaces ethernet eth2 vif 112 address '10.1.12.1/24' -set protocols static route 0.0.0.0/0 next-hop 198.51.100.13 - -# RIGHT router: -set interfaces ethernet eth0 address '192.0.2.130/30' -set interfaces ethernet eth1 vif 221 address '10.2.21.1/24' -set interfaces ethernet eth2 vif 222 address '10.2.22.1/24' -``` - -IPSec configuration: - -```none -# LEFT router: -set vpn ipsec authentication psk RIGHT id '198.51.100.14' -set vpn ipsec authentication psk RIGHT id '192.0.2.130' -set vpn ipsec authentication psk RIGHT secret 'p4ssw0rd' -set vpn ipsec esp-group ESP-GROUP mode 'tunnel' -set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256' -set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256' -set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' -set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14' -set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256' -set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256' -set vpn ipsec interface 'eth0' -set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer RIGHT connection-type 'initiate' -set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP' -set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP' -set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14' -set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130' -set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24' -set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24' -set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24' -set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24' -set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24' -set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24' -set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24' -set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24' - -# RIGHT router: -set vpn ipsec authentication psk LEFT id '192.0.2.130' -set vpn ipsec authentication psk LEFT id '198.51.100.14' -set vpn ipsec authentication psk LEFT secret 'p4ssw0rd' -set vpn ipsec esp-group ESP-GROUP mode 'tunnel' -set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256' -set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256' -set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' -set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14' -set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256' -set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256' -set vpn ipsec interface 'eth0' -set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer LEFT connection-type 'none' -set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP' -set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP' -set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130' -set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14' -set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24' -set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24' -set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24' -set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24' -set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24' -set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24' -set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24' -set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24' -``` - -Firewall Configuration: - -```none -# Firewall Groups: -set firewall group network-group LOCAL-NETS network '10.1.11.0/24' -set firewall group network-group LOCAL-NETS network '10.1.12.0/24' -set firewall group network-group REMOTE-NETS network '10.2.21.0/24' -set firewall group network-group REMOTE-NETS network '10.2.22.0/24' -set firewall group network-group TRUSTED network '198.51.100.125/32' -set firewall group network-group TRUSTED network '203.0.113.0/24' -set firewall group network-group TRUSTED network '10.1.11.0/24' -set firewall group network-group TRUSTED network '192.168.70.0/24' - -# Forward traffic: default drop and only allow what is needed -set firewall ipv4 forward filter default-action 'drop' - -# Forward traffic: global state policies -set firewall ipv4 forward filter rule 1 action 'accept' -set firewall ipv4 forward filter rule 1 state established 'enable' -set firewall ipv4 forward filter rule 1 state related 'enable' -set firewall ipv4 forward filter rule 2 action 'drop' -set firewall ipv4 forward filter rule 2 state invalid 'enable' - -# Forward traffic: Accept all connections from local networks -set firewall ipv4 forward filter rule 10 action 'accept' -set firewall ipv4 forward filter rule 10 source group network-group 'LOCAL-NETS' - -# Forward traffic: accept connections from remote LANs to local LANs -set firewall ipv4 forward filter rule 20 action 'accept' -set firewall ipv4 forward filter rule 20 destination group network-group 'LOCAL-NETS' -set firewall ipv4 forward filter rule 20 source group network-group 'REMOTE-NETS' - -# Input traffic: default drop and only allow what is needed -set firewall ipv4 input filter default-action 'drop' - -# Input traffic: global state policies -set firewall ipv4 input filter rule 1 action 'accept' -set firewall ipv4 input filter rule 1 state established 'enable' -set firewall ipv4 input filter rule 1 state related 'enable' -set firewall ipv4 input filter rule 2 action 'drop' -set firewall ipv4 input filter rule 2 state invalid 'enable' - -# Input traffic: add rules needed for ipsec connection -set firewall ipv4 input filter rule 10 action 'accept' -set firewall ipv4 input filter rule 10 destination port '500,4500' -set firewall ipv4 input filter rule 10 inbound-interface name 'eth0' -set firewall ipv4 input filter rule 10 protocol 'udp' -set firewall ipv4 input filter rule 15 action 'accept' -set firewall ipv4 input filter rule 15 inbound-interface name 'eth0' -set firewall ipv4 input filter rule 15 protocol 'esp' - -# Input traffic: accept ssh connection from trusted ips -set firewall ipv4 input filter rule 20 action 'accept' -set firewall ipv4 input filter rule 20 destination port '22' -set firewall ipv4 input filter rule 20 protocol 'tcp' -set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED' - -# Input traffic: accept dns requests only from local networks. -set firewall ipv4 input filter rule 25 action 'accept' -set firewall ipv4 input filter rule 25 destination port '53' -set firewall ipv4 input filter rule 25 protocol 'udp' -set firewall ipv4 input filter rule 25 source group network-group 'LOCAL-NETS' - -# Input traffic: allow icmp -set firewall ipv4 input filter rule 30 action 'accept' -set firewall ipv4 input filter rule 30 protocol 'icmp' -``` - -And NAT Configuration: - -```none -set nat source rule 10 destination group network-group 'REMOTE-NETS' -set nat source rule 10 exclude -set nat source rule 10 outbound-interface name 'eth0' -set nat source rule 10 source group network-group 'LOCAL-NETS' -set nat source rule 20 outbound-interface name 'eth0' -set nat source rule 20 source group network-group 'LOCAL-NETS' -set nat source rule 20 translation address 'masquerade' -``` - -## Checking through op-mode commands - -After some testing, we can check IPSec status, and counter on every tunnel: - -```none -vyos@LEFT:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal --------------- ------- -------- -------------- ---------------- ---------------- ----------- --------------------------------------- -RIGHT-tunnel-0 up 36m24s 840B/840B 10/10 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 -RIGHT-tunnel-1 up 36m33s 588B/588B 7/7 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 -RIGHT-tunnel-2 up 35m50s 1K/1K 15/15 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 -RIGHT-tunnel-3 up 36m54s 2K/2K 32/32 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 -vyos@LEFT:~$ -``` - -Also, we can check firewall counters: - -```none -vyos@LEFT:~$ show firewall -Rulesets Information - ---------------------------------- -IPv4 Firewall "forward filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ------------------------------------------------------ -1 accept all 681 96545 ct state { established, related } accept -2 drop all 0 0 ct state invalid -10 accept all 360 27205 ip saddr @N_LOCAL-NETS accept -20 accept all 8 648 ip daddr @N_LOCAL-NETS ip saddr @N_REMOTE-NETS accept -default drop all - ---------------------------------- -IPv4 Firewall "input filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------------------------------- -1 accept all 901 123709 ct state { established, related } accept -2 drop all 0 0 ct state invalid -10 accept udp 0 0 udp dport { 500, 4500 } iifname "eth0" accept -15 accept esp 0 0 meta l4proto esp iifname "eth0" accept -20 accept tcp 1 60 tcp dport 22 ip saddr @N_TRUSTED accept -25 accept udp 0 0 udp dport 53 ip saddr @N_LOCAL-NETS accept -30 accept icmp 0 0 meta l4proto icmp accept -default drop all - -vyos@LEFT:~$ -vyos@LEFT:~$ show firewall statistics -Rulesets Statistics - ---------------------------------- -IPv4 Firewall "forward filter" - -Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface -------- --------- ------- -------- ----------- ------------- ------------------- -------------------- -1 681 96545 accept any any any any -2 0 0 drop any any any any -10 360 27205 accept LOCAL-NETS any any any -20 8 648 accept REMOTE-NETS LOCAL-NETS any any -default N/A N/A drop any any any any - ---------------------------------- -IPv4 Firewall "input filter" - -Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface -------- --------- ------- -------- ---------- ------------- ------------------- -------------------- -1 905 124213 accept any any any any -2 0 0 drop any any any any -10 0 0 accept any any eth0 any -15 0 0 accept any any eth0 any -20 1 60 accept TRUSTED any any any -25 0 0 accept LOCAL-NETS any any any -30 0 0 accept any any any any -default N/A N/A drop any any any any - -vyos@LEFT:~$ -``` diff --git a/docs/configexamples/md-pppoe-ipv6-basic.md b/docs/configexamples/md-pppoe-ipv6-basic.md deleted file mode 100644 index 76984f4b..00000000 --- a/docs/configexamples/md-pppoe-ipv6-basic.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -lastproofread: '2021-06-29' ---- - -(examples-pppoe-ipv6-basic)= - -# PPPoE IPv6 Basic Setup for Home Network - -This document is to describe a basic setup using PPPoE with DHCPv6-PD + -SLAAC to construct a typical home network. The user can follow the steps -described here to quickly setup a working network and use this as a starting -point to further configure or fine-tune other settings. - -To achieve this, your ISP is required to support DHCPv6-PD. If you're not sure, -please contact your ISP for more information. - -## Network Topology - -```{image} /_static/images/pppoe-ipv6-pd-diagram.webp -:align: center -:alt: Network Topology Diagram -:width: 60% -``` - - -## Configurations - -### PPPoE Setup - -```none -set interfaces pppoe pppoe0 authentication password -set interfaces pppoe pppoe0 authentication username -set interfaces pppoe pppoe0 service-name -set interfaces pppoe pppoe0 source-interface 'eth0' -``` - -- Fill `password` and `user` with the credential provided by your ISP. -- `service-name` can be an arbitrary string. - -### DHCPv6-PD Setup - -During address configuration, in addition to assigning an address to the WAN -interface, ISP also provides a prefix to allow the router to configure addresses -of LAN interface and other nodes connecting to LAN, which is called prefix -delegation (PD). - -```none -set interfaces pppoe pppoe0 ipv6 address autoconf -set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' -``` - -- Here we use the prefix to configure the address of eth1 (LAN) to form - `::64`, where `64` is hexadecimal of address 100. - - - -- For home network users, most of time ISP only provides /64 prefix, hence - there is no need to set SLA ID and prefix length. See {ref}`pppoe-interface` - for more information. - -### Router Advertisement - -We need to enable router advertisement for LAN network so that PC can receive -the prefix and use SLAAC to configure the address automatically. - -```none -set service router-advert interface eth1 link-mtu '1492' -set service router-advert interface eth1 name-server -set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800' -``` - -- Set MTU in advertisement to 1492 because of PPPoE header overhead. -- Set DNS server address in the advertisement so that clients can obtain it by - using RDNSS option. Most operating systems (Windows, Linux, Mac) should - already support it. -- Here we set the prefix to `::/64` to indicate advertising any /64 prefix - the LAN interface is assigned. -- Since some ISPs disconnects continuous connection for every 2~3 days, we set - `valid-lifetime` to 2 days to allow PC for phasing out old address. - -### Basic Firewall - -To have basic protection while keeping IPv6 network functional, we need to: -- Allow all established and related traffic for router and LAN -- Allow all icmpv6 packets for router and LAN -- Allow DHCPv6 packets for router - -```none -set firewall ipv6 name WAN_IN default-action 'drop' -set firewall ipv6 name WAN_IN rule 10 action 'accept' -set firewall ipv6 name WAN_IN rule 10 state established 'enable' -set firewall ipv6 name WAN_IN rule 10 state related 'enable' -set firewall ipv6 name WAN_IN rule 20 action 'accept' -set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6' -set firewall ipv6 name WAN_LOCAL default-action 'drop' -set firewall ipv6 name WAN_LOCAL rule 10 action 'accept' -set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable' -set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable' -set firewall ipv6 name WAN_LOCAL rule 20 action 'accept' -set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6' -set firewall ipv6 name WAN_LOCAL rule 30 action 'accept' -set firewall ipv6 name WAN_LOCAL rule 30 destination port '546' -set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp' -set firewall ipv6 name WAN_LOCAL rule 30 source port '547' -set firewall ipv6 forward filter rule 10 action jump -set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN' -set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0' -set firewall ipv6 input filter rule 10 action jump -set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL' -set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0' -``` - -Note to allow the router to receive DHCPv6 response from ISP. We need to allow -packets with source port 547 (server) and destination port 546 (client). diff --git a/docs/configexamples/md-qos.md b/docs/configexamples/md-qos.md deleted file mode 100644 index e8335584..00000000 --- a/docs/configexamples/md-qos.md +++ /dev/null @@ -1,201 +0,0 @@ ---- -lastproofread: '2023-02-18' ---- - -(examples-qos)= - -# QoS example - -## Configuration 'dcsp' and shaper using QoS - -In this case, we'll try to make a simple lab using QoS and the -general ability of the VyOS system. -We recommend you to go through the main article about -[QoS](https://docs.vyos.io/en/latest/configuration/trafficpolicy/index.html) -first. - -Using the general schema for example: - -```{image} /_static/images/qos1.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -We have four hosts on the local network 172.17.1.0/24. All hosts are -labeled CS0 by default. We need to replace labels on all hosts except -vpc8. -We will replace the labels on the nearest router “VyOS3” using the IP -addresses of the sources. - -- 172.17.1.2 CS0 -> CS4 -- 172.17.1.3 CS0 -> CS5 -- 172.17.1.4 CS0 -> CS6 -- 172.17.1.40 CS0 by default - -Next, we will replace only all CS4 labels on the “VyOS2” router. - -- CS4 -> CS5 - -In the end, we will configure the traffic shaper using QoS mechanisms -on the “VYOS2” router. - -## Configuration: - -Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll -use in this case only static routes. -On the VyOS3 router, we need to change the 'dscp' labels for the -VPCs. To do this, we use this configuration. - -```none -set interfaces ethernet eth0 address '10.1.1.100/24' -set interfaces ethernet eth1 address '172.17.1.1/24' -set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 -set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' -set qos policy shaper vyos3 class 10 set-dscp 'CS4' -set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' -set qos policy shaper vyos3 class 20 set-dscp 'CS5' -set qos policy shaper vyos3 class 30 match ADDRESS30 ip source address '172.17.1.4/32' -set qos policy shaper vyos3 class 30 set-dscp 'CS6' -set qos policy shaper vyos3 default bandwidth '10%' -set qos policy shaper vyos3 default ceiling '100%' -set qos policy shaper vyos3 default priority '7' -set qos policy shaper vyos3 default queue-type 'fair-queue' -set qos interface eth0 egress 'vyos3' -``` - -Main rules: - -- ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32 -- ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32 -- ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32 - -Check the result - -```{image} /_static/images/qos2.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -Before the interface eth0 on router VyOS3 - -```{image} /_static/images/qos3.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -After the interface eth0 on router VyOS3 - -```{image} /_static/images/qos4.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -On the router, VyOS4 set all traffic as CS4. We have to configure the -default class and class for changing all labels from CS0 to CS4 - -```none -set interfaces ethernet eth0 address '10.2.1.100/24' -set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 -set qos policy shaper vyos4 class 10 bandwidth '100%' -set qos policy shaper vyos4 class 10 burst '15k' -set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' -set qos policy shaper vyos4 class 10 queue-type 'fair-queue' -set qos policy shaper vyos4 class 10 set-dscp 'CS4' -set qos policy shaper vyos4 default bandwidth '10%' -set qos policy shaper vyos4 default burst '15k' -set qos policy shaper vyos4 default ceiling '100%' -set qos policy shaper vyos4 default priority '7' -set qos policy shaper vyos4 default queue-type 'fair-queue' - set qos interface eth0 egress 'vyos4' -``` - -Next on the router VyOS2 we will change labels on all incoming -traffic only from CS4-> CS6 - -```{image} /_static/images/qos5.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -```none -set interfaces ethernet eth0 address '10.1.1.1/24' -set interfaces ethernet eth1 address '10.2.1.1/24' -set interfaces ethernet eth2 address '10.9.9.1/24' -set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 -set qos policy shaper vyos2 class 10 bandwidth '100%' -set qos policy shaper vyos2 class 10 burst '15k' -set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' -set qos policy shaper vyos2 class 10 queue-type 'fair-queue' -set qos policy shaper vyos2 class 10 set-dscp 'CS5' -set qos policy shaper vyos2 default bandwidth '100%' -set qos policy shaper vyos2 default burst '15k' -set qos policy shaper vyos2 default ceiling '100%' -set qos policy shaper vyos2 default priority '7' -set qos policy shaper vyos2 default queue-type 'fair-queue' - set qos interface eth2 egress 'vyos2' -``` - -```{image} /_static/images/qos6.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -- 172.17.1.2/24 CS0 - -```{image} /_static/images/qos7.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -- 172.17.1.2/24 CS0 - > CS4 - -```{image} /_static/images/qos8.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -- 172.17.1.2/24 CS4 - > CS5 - -```{image} /_static/images/qos9.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -In the end, on the router “VyOS2” we will set outgoing bandwidth -limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for -IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work -with the help of the “iPerf” utility. - -Set up bandwidth limits on the eth2 interface of the router “VyOS2”. - -```none -vyos@vyos2# show qos policy shaper vyos2 class 20 -bandwidth 5mbit -description "for VyOS3 eth0" -match VyOS3 { - ip { - source { - address 10.1.1.100/32 - } - } -} -``` - -Check the result. - -```{image} /_static/images/qos10.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -As we see shaper is working and the traffic will not work over 5 Mbit/s. diff --git a/docs/configexamples/md-segment-routing-isis.md b/docs/configexamples/md-segment-routing-isis.md deleted file mode 100644 index 41ba2389..00000000 --- a/docs/configexamples/md-segment-routing-isis.md +++ /dev/null @@ -1,277 +0,0 @@ ---- -lastproofread: '2023-04-10' ---- - -(examples-segment-routing-isis)= - -# Segment-routing IS-IS example - -When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this -blue print as an initial setup to get MPLS ISIS-SR working between those two -devices.The lab was build using {abbr}`EVE-NG (Emulated Virtual -Environment NG)`. - -:::{figure} /_static/images/vyos-sr-isis.webp -:alt: ISIS-SR network - -ISIS-SR example network -::: - -The below configuration is used as example where we keep focus on -VyOS-P1/VyOS-P2/XRv-P3 which we share the settings. - -## Configuration - -- VyOS-P1: - -```none -set interfaces dummy dum0 address '192.0.2.1/32' -set interfaces ethernet eth1 address '192.0.2.5/30' -set interfaces ethernet eth1 mtu '8000' -set interfaces ethernet eth3 address '192.0.2.21/30' -set interfaces ethernet eth3 mtu '8000' -set protocols isis interface dum0 passive -set protocols isis interface eth1 network point-to-point -set protocols isis interface eth3 network point-to-point -set protocols isis level 'level-2' -set protocols isis log-adjacency-changes -set protocols isis metric-style 'wide' -set protocols isis net '49.0000.0000.0000.0001.00' -set protocols isis segment-routing maximum-label-depth '8' -set protocols isis segment-routing prefix 192.0.2.1/32 index value '1' -set protocols mpls interface 'eth1' -set protocols mpls interface 'eth3' -set system host-name 'P1-VyOS' -``` - -- XRv-P3: - -```none -hostname P3-VyOS -interface Loopback0 - ipv4 address 192.0.2.3 255.255.255.255 -! -interface GigabitEthernet0/0/0/1 - mtu 8014 - ipv4 address 192.0.2.6 255.255.255.252 -! -interface GigabitEthernet0/0/0/2 - mtu 8014 - ipv4 address 192.0.2.18 255.255.255.252 -! -router isis VyOS - is-type level-2-only - net 49.0000.0000.0000.0003.00 - log adjacency changes - address-family ipv4 unicast - metric-style wide - segment-routing mpls - ! - interface Loopback0 - passive - address-family ipv4 unicast - prefix-sid index 3 - ! - ! - interface GigabitEthernet0/0/0/1 - point-to-point - address-family ipv4 unicast - ! - ! - interface GigabitEthernet0/0/0/2 - point-to-point - address-family ipv4 unicast - ! - ! -! -``` - -- VyOS-P2: - -```none -set interfaces dummy dum0 address '192.0.2.2/32' -set interfaces ethernet eth2 address '192.0.2.17/30' -set interfaces ethernet eth2 mtu '8000' -set interfaces ethernet eth3 address '192.0.2.26/30' -set interfaces ethernet eth3 mtu '8000' -set protocols isis interface dum0 passive -set protocols isis interface eth2 network point-to-point -set protocols isis interface eth3 network point-to-point -set protocols isis level 'level-2' -set protocols isis log-adjacency-changes -set protocols isis metric-style 'wide' -set protocols isis net '49.0000.0000.0000.0002.00' -set protocols isis segment-routing maximum-label-depth '8' -set protocols isis segment-routing prefix 192.0.2.2/32 index value '2' -set protocols mpls interface 'eth2' -set protocols mpls interface 'eth3' -set system host-name 'P2-VyOS' -``` - -This gives us MPLS segment routing enabled and labels forwarding : - -```none -vyos@P1-VyOS:~$ show mpls table -Inbound Label Type Nexthop Outbound Label ------------------------------------------------------------------ -15000 SR (IS-IS) 192.0.2.6 implicit-null -15001 SR (IS-IS) 192.0.2.22 implicit-null -15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null -16002 SR (IS-IS) 192.0.2.6 16002 -16003 SR (IS-IS) 192.0.2.6 implicit-null -16011 SR (IS-IS) 192.0.2.22 implicit-null - -vyos@P2-VyOS:~$ show mpls table -Inbound Label Type Nexthop Outbound Label -------------------------------------------------------- -15000 SR (IS-IS) 192.0.2.18 implicit-null -16001 SR (IS-IS) 192.0.2.18 16001 -16003 SR (IS-IS) 192.0.2.18 implicit-null -16011 SR (IS-IS) 192.0.2.18 16011 - -RP/0/0/CPU0:P3-VyOS#show mpls forwarding -Tue Mar 28 17:47:18.928 UTC -Local Outgoing Prefix Outgoing Next Hop Bytes -Label Label or ID Interface Switched ------- ----------- ------------------ ------------ --------------- ------------ -16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0 -16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0 -16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0 -24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0 -24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0 -24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0 -24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0 -``` - -VyOS is able to check MSD per devices: - -```none -vyos@P1-VyOS:~$ show isis segment-routing node -Area VyOS: -IS-IS L1 SR-Nodes: - -IS-IS L2 SR-Nodes: - -System ID SRGB SRLB Algorithm MSD ---------------------------------------------------------------- -0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 -0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 -0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 -0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 - -vyos@P2-VyOS:~$ show isis segment-routing node -Area VyOS: - IS-IS L1 SR-Nodes: - - IS-IS L2 SR-Nodes: - - System ID SRGB SRLB Algorithm MSD - --------------------------------------------------------------- - 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 - 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 -``` - -Here is the routing tables showing the MPLS segment routing label operations: - -```none -vyos@P1-VyOS:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m -I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m -I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m -I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m -I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m -I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m -I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m - - -vyos@P2-VyOS:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m -I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m -I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m -I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m -I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m -I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m - -RP/0/0/CPU0:P3-VyOS#show route isis -Tue Mar 28 18:19:16.417 UTC - -i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 -i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 -i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1 -i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 -i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 -``` - -Information about prefix-sid and label-operation from VyOS - -```none -vyos@P1-VyOS:~$ show isis route prefix-sid -Area VyOS: -IS-IS L2 IPv4 routing table: - - Prefix Metric Interface Nexthop SID Label Op. - ---------------------------------------------------------------------- - 192.0.2.1/32 0 - - - - - 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002) - 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003) - 192.0.2.4/30 20 eth1 192.0.2.6 - - - 192.0.2.16/30 20 eth1 192.0.2.6 - - - 192.0.2.20/30 0 - - - - - 192.0.2.24/30 30 eth1 192.0.2.6 - - - - vyos@P2-VyOS:~$ show isis route prefix-sid - Area VyOS: - IS-IS L2 IPv4 routing table: - - Prefix Metric Interface Nexthop SID Label Op. - ----------------------------------------------------------------------- - 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001) - 192.0.2.2/32 0 - - - - - 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003) - 192.0.2.4/30 20 eth2 192.0.2.18 - - - 192.0.2.16/30 20 eth2 192.0.2.18 - - - 192.0.2.20/30 30 eth2 192.0.2.18 - - - 192.0.2.24/30 0 - - - - -``` - -Ping between VyOS-P1 / VyOS-P2 to confirm reachability: - -```none -vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1 -PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data. -64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms -64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms -64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms -64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms -^C ---- 192.0.2.2 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3004ms -rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms - -vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2 -PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data. -64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms -64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms -64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms -64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms -^C ---- 192.0.2.1 ping statistics --- -4 packets transmitted, 4 received, 0% packet loss, time 3005ms -rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms -``` diff --git a/docs/configexamples/md-site-2-site-cisco.md b/docs/configexamples/md-site-2-site-cisco.md deleted file mode 100644 index d8ca2c18..00000000 --- a/docs/configexamples/md-site-2-site-cisco.md +++ /dev/null @@ -1,170 +0,0 @@ -(examples-site-2-site-cisco)= - -# Site-to-Site IPSec VPN to Cisco using FlexVPN - -This guide shows a sample configuration for FlexVPN site-to-site Internet -Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel. - -FlexVPN is a newer "solution" for deployment of VPNs and it utilizes IKEv2 as -the key exchange protocol. The result is a flexible and scalable VPN solution -that can be easily adapted to fit various network needs. It can also support a -variety of encryption methods, including AES and 3DES. - -The lab was built using EVE-NG. - -## Configuration - -### VyOS - -- GRE: - -```none -set interfaces tunnel tun1 encapsulation 'gre' -set interfaces tunnel tun1 ip adjust-mss '1336' -set interfaces tunnel tun1 mtu '1376' -set interfaces tunnel tun1 remote '10.1.1.6' -set interfaces tunnel tun1 source-address '198.51.100.1' -``` - -- IPsec: - -```none -set vpn ipsec authentication psk vyos_cisco_l id 'vyos.net' -set vpn ipsec authentication psk vyos_cisco_l id 'cisco.hub.net' -set vpn ipsec authentication psk vyos_cisco_l secret 'secret' -set vpn ipsec esp-group e1 lifetime '3600' -set vpn ipsec esp-group e1 mode 'tunnel' -set vpn ipsec esp-group e1 pfs 'disable' -set vpn ipsec esp-group e1 proposal 1 encryption 'aes128' -set vpn ipsec esp-group e1 proposal 1 hash 'sha256' -set vpn ipsec ike-group i1 key-exchange 'ikev2' -set vpn ipsec ike-group i1 lifetime '28800' -set vpn ipsec ike-group i1 proposal 1 dh-group '5' -set vpn ipsec ike-group i1 proposal 1 encryption 'aes256' -set vpn ipsec ike-group i1 proposal 1 hash 'sha256' -set vpn ipsec interface 'eth2' -set vpn ipsec options disable-route-autoinstall -set vpn ipsec options flexvpn -set vpn ipsec options interface 'tun1' -set vpn ipsec options virtual-ip -set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net' -set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret' -set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net' -set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate' -set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1' -set vpn ipsec site-to-site peer cisco_hub ike-group 'i1' -set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1' -set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6' -set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32' -set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre' -set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32' -set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0' -``` - - -### Cisco - -```none -aaa new-model -! -! -aaa authorization network default local -! -crypto ikev2 name-mangler GET_DOMAIN - fqdn all - email all -! -! -crypto ikev2 authorization policy vyos - pool mypool - aaa attribute list mylist - route set interface - route accept any tag 100 distance 5 -! -crypto ikev2 keyring mykeys - peer peer1 - identity fqdn vyos.net - pre-shared-key local secret - pre-shared-key remote secret -crypto ikev2 profile my_profile - match identity remote fqdn vyos.net - identity local fqdn cisco.hub.net - authentication remote pre-share - authentication local pre-share - keyring local mykeys - dpd 10 3 periodic - aaa authorization group psk list local name-mangler GET_DOMAIN - aaa authorization user psk cached - virtual-template 1 -! -! -! -crypto ipsec transform-set TSET esp-aes esp-sha256-hmac - mode tunnel -! -! -crypto ipsec profile my-ipsec-profile - set transform-set TSET - set ikev2-profile my_profile -! -interface Virtual-Template1 type tunnel - no ip address - ip mtu 1376 - ip nhrp network-id 1 - ip nhrp shortcut virtual-template 1 - ip tcp adjust-mss 1336 - tunnel path-mtu-discovery - tunnel protection ipsec profile my-ipsec-profile - ! - ip local pool my_pool 172.16.122.1 172.16.122.254 -``` - -Since the tunnel is a point-to-point GRE tunnel, it behaves like any other -point-to-point interface (for example: serial, dialer), and it is possible to -run any Interior Gateway Protocol (IGP)/Exterior Gateway Protocol (EGP) over -the link in order to exchange routing information - -## Verification - -```none -vyos@vyos$ show interfaces -Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down -Interface IP Address S/L Description ---------- ---------- --- ----------- -eth0 - u/u -eth1 - u/u -eth2 198.51.100.1/24 u/u -eth3 172.16.1.2/24 u/u -lo 127.0.0.1/8 u/u - ::1/128 -tun1 172.16.122.2/32 u/u - -vyos@vyos:~$ show vpn ipsec sa -Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal ------------------- ------- -------- -------------- ---------------- ---------------- --------------------- ----------------------------- -cisco_hub-tunnel-1 up 44m17s 35K/31K 382/367 10.1.1.6 cisco.hub.net AES_CBC_128/HMAC_SHA2_256_128 - - -Hub#sh crypto ikev2 sa detailed - IPv4 Crypto IKEv2 SA - -Tunnel-id Local Remote fvrf/ivrf Status -5 10.1.1.6/4500 198.51.100.1/4500 none/none READY - Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK - Life/Active Time: 86400/2694 sec - CE id: 0, Session-id: 2 - Status Description: Negotiation done - Local spi: C94EE2DC92A60C47 Remote spi: 9AF0EF151BECF14C - Local id: cisco.hub.net - Remote id: vyos.net - Local req msg id: 269 Remote req msg id: 0 - Local next msg id: 269 Remote next msg id: 0 - Local req queued: 269 Remote req queued: 0 - Local window: 5 Remote window: 1 - DPD configured for 10 seconds, retry 3 - Fragmentation not configured. - Extended Authentication not configured. - NAT-T is not detected - Cisco Trust Security SGT is disabled - Assigned host addr: 172.16.122.2 -``` diff --git a/docs/configexamples/md-wan-load-balancing.md b/docs/configexamples/md-wan-load-balancing.md deleted file mode 100644 index b9357523..00000000 --- a/docs/configexamples/md-wan-load-balancing.md +++ /dev/null @@ -1,183 +0,0 @@ ---- -lastproofread: '2021-06-29' ---- - -(wan-load-balancing)= - - -# WAN Load Balancer examples - -% stop_vyoslinter - -## Example 1: Distributing load evenly - -The setup used in this example is shown in the following diagram: - -```{image} /_static/images/Wan_load_balancing1.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - - -### Overview - -> - All traffic coming in through eth2 is balanced between eth0 and eth1 -> on the router. -> - Pings will be sent to four targets for health testing (33.44.55.66, -> 44.55.66.77, 55.66.77.88 and 66.77.88.99). -> - All outgoing packets are assigned the source address of the assigned -> interface (SNAT). -> - eth0 is set to be removed from the load balancer's interface pool -> after 5 ping failures, eth1 will be removed after 4 ping failures. - -### Create static routes to ping targets - -Create static routes through the two ISPs towards the ping targets and -commit the changes: - -```none -set protocols static route 33.44.55.66/32 next-hop 11.22.33.1 -set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 -set protocols static route 55.66.77.88/32 next-hop 22.33.44.1 -set protocols static route 66.77.88.99/32 next-hop 22.33.44.1 -``` - - -### Configure the load balancer - -Configure the WAN load balancer with the parameters described above: - -```none -set load-balancing wan interface-health eth0 failure-count 5 -set load-balancing wan interface-health eth0 nexthop 11.22.33.1 -set load-balancing wan interface-health eth0 test 10 type ping -set load-balancing wan interface-health eth0 test 10 target 33.44.55.66 -set load-balancing wan interface-health eth0 test 20 type ping -set load-balancing wan interface-health eth0 test 20 target 44.55.66.77 -set load-balancing wan interface-health eth1 failure-count 4 -set load-balancing wan interface-health eth1 nexthop 22.33.44.1 -set load-balancing wan interface-health eth1 test 10 type ping -set load-balancing wan interface-health eth1 test 10 target 55.66.77.88 -set load-balancing wan interface-health eth1 test 20 type ping -set load-balancing wan interface-health eth1 test 20 target 66.77.88.99 -set load-balancing wan rule 10 inbound-interface eth2 -set load-balancing wan rule 10 interface eth0 -set load-balancing wan rule 10 interface eth1 -``` - - -## Example 2: Failover based on interface weights - -This example uses the failover mode. -(wan-example2-overview)= - -### Overview - -In this example, eth0 is the primary interface and eth1 is the secondary -interface. To provide simple failover functionality. If eth0 fails, eth1 -takes over. - -### Create interface weight based configuration - -The configuration steps are the same as in the previous example, except -rule 10. So we keep the configuration, remove rule 10 and add a new rule -for the failover mode: - -```none -delete load-balancing wan rule 10 -set load-balancing wan rule 10 failover -set load-balancing wan rule 10 inbound-interface eth2 -set load-balancing wan rule 10 interface eth0 weight 10 -set load-balancing wan rule 10 interface eth1 weight 1 -``` - - -## Example 3: Failover based on rule order - -The previous example used the failover command to send traffic through -eth1 if eth0 fails. In this example, failover functionality is provided -by rule order. -(wan-example3-overview)= - -### Overview - -Two rules will be created, the first rule directs traffic coming in -from eth2 to eth0 and the second rule directs the traffic to eth1. If -eth0 fails the first rule is bypassed and the second rule matches, -directing traffic to eth1. - -### Create rule order based configuration - -We keep the configuration from the previous example, delete rule 10 -and create the two new rules as described: - -```none -delete load-balancing wan rule 10 -set load-balancing wan rule 10 inbound-interface eth2 -set load-balancing wan rule 10 interface eth0 -set load-balancing wan rule 20 inbound-interface eth2 -set load-balancing wan rule 20 interface eth1 -``` - - -## Example 4: Failover based on rule order - priority traffic - -A rule order for prioritizing traffic is useful in scenarios where the -secondary link has a lower speed and should only carry high priority -traffic. It is assumed for this example that eth1 is connected to a -slower connection than eth0 and should prioritize VoIP traffic. -(wan-example4-overview)= - -### Overview - -A rule order for prioritizing traffic is useful in scenarios where the -secondary link has a lower speed and should only carry high priority -traffic. It is assumed for this example that eth1 is connected to a -slower connection than eth0 and should prioritize VoIP traffic. - -### Create rule order based configuration with low speed secondary link - -We keep the configuration from the previous example, delete rule 20 and -create a new rule as described: - -```none -delete load-balancing wan rule 20 -set load-balancing wan rule 20 inbound-interface eth2 -set load-balancing wan rule 20 interface eth1 -set load-balancing wan rule 20 destination port sip -set load-balancing wan rule 20 protocol tcp -set protocols static route 0.0.0.0/0 next-hop 11.22.33.1 -``` - - -## Example 5: Exclude traffic from load balancing - -In this example two LAN interfaces exist in different subnets instead -of one like in the previous examples: - -```{image} /_static/images/Wan_load_balancing_exclude1.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - - -### Adding a rule for the second interface - -Based on the previous example, another rule for traffic from the second -interface eth3 can be added to the load balancer. However, traffic meant -to flow between the LAN subnets will be sent to eth0 and eth1 as well. -To prevent this, another rule is required. This rule excludes traffic -between the local subnets from the load balancer. It also excludes -locally-sources packets (required for web caching with load balancing). -eth+ is used as an alias that refers to all ethernet interfaces: - -```none -set load-balancing wan rule 5 exclude -set load-balancing wan rule 5 inbound-interface eth+ -set load-balancing wan rule 5 destination address 10.0.0.0/8 -``` - -% start_vyoslinter - diff --git a/docs/configexamples/md-zone-policy.md b/docs/configexamples/md-zone-policy.md deleted file mode 100644 index 2cd773a9..00000000 --- a/docs/configexamples/md-zone-policy.md +++ /dev/null @@ -1,417 +0,0 @@ ---- -lastproofread: '2024-06-14' ---- - -(examples-zone-policy)= - -# Zone-Policy example - -:::{note} -In {vytask}`T2199` the syntax of the zone configuration was changed. -The zone configuration moved from `zone-policy zone ` to `firewall -zone `. -::: - -## Native IPv4 and IPv6 - -We have three networks. - -```none -WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64 -LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64 -DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64 -``` - -**This specific example is for a router on a stick, but is very easily -adapted for however many NICs you have**: - -- Internet - 192.168.200.100 - TCP/80 -- Internet - 192.168.200.100 - TCP/443 -- Internet - 192.168.200.100 - TCP/25 -- Internet - 192.168.200.100 - TCP/53 -- VyOS acts as DHCP, DNS forwarder, NAT, router and firewall. -- 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web - and mail (SMTP/IMAP) server. -- 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It - can SSH to VyOS. -- LAN and DMZ hosts have basic outbound access: Web, FTP, SSH. -- LAN can access DMZ resources. -- DMZ cannot access LAN resources. -- Inbound WAN connect to DMZ host. - -```{image} /_static/images/zone-policy-diagram.webp -:align: center -:alt: Network Topology Diagram -:width: 80% -``` - -The VyOS interface is assigned the .1/:1 address of their respective -networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30. - -It will look something like this: - -```none -interfaces { - ethernet eth0 { - duplex auto - hw-id 00:53:ed:6e:2a:92 - smp_affinity auto - speed auto - vif 10 { - address 172.16.10.1/24 - address 2001:db8:0:9999::1/64 - } - vif 20 { - address 192.168.100.1/24 - address 2001:db8:0:AAAA::1/64 - } - vif 30 { - address 192.168.200.1/24 - address 2001:db8:0:BBBB::1/64 - } - } - loopback lo { - } -} -``` - - -## Zones Basics - -Each interface is assigned to a zone. The interface can be physical or -virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly -the same. - -Traffic flows from zone A to zone B. That flow is what I refer to as a -zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations. - -Ruleset are created per zone-pair-direction. - -I name rule sets to indicate which zone-pair-direction they represent. -eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN. - -In VyOS, you have to have unique Ruleset names. In the event of overlap, -I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This -allows for each auto-completion and uniqueness. - -In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is -the firewall itself. - -If your computer is on the LAN and you need to SSH into your VyOS box, -you would need a rule to allow it in the LAN-Local ruleset. If you want -to access a webpage from your VyOS box, you need a rule to allow it in -the Local-LAN ruleset. - -In rules, it is good to keep them named consistently. As the number of -rules you have grows, the more consistency you have, the easier your -life will be. - -```none -Rule 1 - State Established, Related -Rule 2 - State Invalid -Rule 100 - ICMP -Rule 200 - Web -Rule 300 - FTP -Rule 400 - NTP -Rule 500 - SMTP -Rule 600 - DNS -Rule 700 - DHCP -Rule 800 - SSH -Rule 900 - IMAPS -``` - -The first two rules are to deal with the idiosyncrasies of VyOS and -iptables. - -Zones and Rulesets both have a default action statement. When using -Zone-Policies, the default action is set by the zone-policy statement -and is represented by rule 10000. - -It is good practice to log both accepted and denied traffic. It can save -you significant headaches when trying to troubleshoot a connectivity -issue. - -To add logging to the default rule, do: - -```none -set firewall name default-log -``` - -By default, iptables does not allow traffic for established sessions to -return, so you must explicitly allow this. I do this by adding two rules -to every ruleset. 1 allows established and related state packets through -and rule 2 drops and logs invalid state packets. We place the -established/related rule at the top because the vast majority of traffic -on a network is established and the invalid rule to prevent invalid -state packets from mistakenly being matched against other rules. Having -the most matched rule listed first reduces CPU load in high volume -environments. Note: I have filed a bug to have this added as a default -action as well. - -''It is important to note, that you do not want to add logging to the -established state rule as you will be logging both the inbound and -outbound packets for each session instead of just the initiation of the -session. Your logs will be massive in a very short period of time.'' - -In VyOS you must have the interfaces created before you can apply it to -the zone and the rulesets must be created prior to applying it to a -zone-policy. - -I create/configure the interfaces first. Build out the rulesets for each -zone-pair-direction which includes at least the three state rules. Then -I setup the zone-policies. - -Zones do not allow for a default action of accept; either drop or -reject. It is important to remember this because if you apply an -interface to a zone and commit, any active connections will be dropped. -Specifically, if you are SSH’d into VyOS and add local or the interface -you are connecting through to a zone and do not have rulesets in place -to allow SSH and established sessions, you will not be able to connect. - -The following are the rules that were created for this example (may not -be complete), both in IPv4 and IPv6. If there is no IP specified, then -the source/destination address is not explicit. - -```none -WAN - DMZ:192.168.200.200 - tcp/80 -WAN - DMZ:192.168.200.200 - tcp/443 -WAN - DMZ:192.168.200.200 - tcp/25 -WAN - DMZ:192.168.200.200 - tcp/53 -WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80 -WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443 -WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25 -WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53 - -DMZ - Local - tcp/53 -DMZ - Local - tcp/123 -DMZ - Local - tcp/67,68 - -LAN - Local - tcp/53 -LAN - Local - tcp/123 -LAN - Local - tcp/67,68 -LAN:192.168.100.10 - Local - tcp/22 -LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22 - -LAN - WAN - tcp/80 -LAN - WAN - tcp/443 -LAN - WAN - tcp/22 -LAN - WAN - tcp/20,21 - -DMZ - WAN - tcp/80 -DMZ - WAN - tcp/443 -DMZ - WAN - tcp/22 -DMZ - WAN - tcp/20,21 -DMZ - WAN - tcp/53 -DMZ - WAN - udp/53 - -Local - WAN - tcp/80 -Local - WAN - tcp/443 -Local - WAN - tcp/20,21 - -Local - DMZ - tcp/25 -Local - DMZ - tcp/67,68 -Local - DMZ - tcp/53 -Local - DMZ - udp/53 - -Local - LAN - tcp/67,68 - -LAN - DMZ - tcp/80 -LAN - DMZ - tcp/443 -LAN - DMZ - tcp/993 -LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22 -LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22 -``` - -Since we have 4 zones, we need to setup the following rulesets. - -```none -Lan-wan -Lan-local -Lan-dmz -Wan-lan -Wan-local -Wan-dmz -Local-lan -Local-wan -Local-dmz -Dmz-lan -Dmz-wan -Dmz-local -``` - -Even if the two zones will never communicate, it is a good idea to -create the zone-pair-direction rulesets and set default-log. This -will allow you to log attempts to access the networks. Without it, you -will never see the connection attempts. - -This is an example of the three base rules. - -```none -name wan-lan { - default-action drop - default-log - rule 1 { - action accept - state { - established enable - related enable - } - } - rule 2 { - action drop - log enable - state { - invalid enable - } - } -} -``` - -Here is an example of an IPv6 DMZ-WAN ruleset. - -```none -ipv6-name dmz-wan-6 { - default-action drop - default-log - rule 1 { - action accept - state { - established enable - related enable - } - } - rule 2 { - action drop - log enable - state { - invalid enable - } - } - rule 100 { - action accept - log enable - protocol ipv6-icmp - } - rule 200 { - action accept - destination { - port 80,443 - } - log enable - protocol tcp - } - rule 300 { - action accept - destination { - port 20,21 - } - log enable - protocol tcp - } - rule 500 { - action accept - destination { - port 25 - } - log enable - protocol tcp - source { - address 2001:db8:0:BBBB::200 - } - } - rule 600 { - action accept - destination { - port 53 - } - log enable - protocol tcp_udp - source { - address 2001:db8:0:BBBB::200 - } - } - rule 800 { - action accept - destination { - port 22 - } - log enable - protocol tcp - } -} -``` - -Once you have all of your rulesets built, then you need to create your -zone-policy. - -Start by setting the interface and default action for each zone. - -```none -set firewall zone dmz default-action drop -set firewall zone dmz interface eth0.30 -``` - -In this case, we are setting the v6 ruleset that represents traffic -sourced from the LAN, destined for the DMZ. Because the zone-policy -firewall syntax is a little awkward, I keep it straight by thinking of -it backwards. - -```none -set firewall zone dmz from lan firewall ipv6-name lan-dmz-6 -``` - -DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out -a bunch at one time. - -In the end, you will end up with something like this config. I took out -everything but the Firewall, Interfaces, and zone-policy sections. It is -long enough as is. - -## IPv6 Tunnel - -If you are using a IPv6 tunnel from HE.net or someone else, the basis is -the same except you have two WAN interfaces. One for v4 and one for v6. - -You would have 5 zones instead of just 4 and you would configure your v6 -ruleset between your tunnel interface and your LAN/DMZ zones instead of -to the WAN. - -LAN, WAN, DMZ, local and TUN (tunnel) - -v6 pairs would be: - -```none -lan-tun -lan-local -lan-dmz -tun-lan -tun-local -tun-dmz -local-lan -local-tun -local-dmz -dmz-lan -dmz-tun -dmz-local -``` - -Notice, none go to WAN since WAN wouldn't have a v6 address on it. - -You would have to add a couple of rules on your wan-local ruleset to -allow protocol 41 in. - -Something like: - -```none -rule 400 { - action accept - destination { - address 172.16.10.1 - } - log enable - protocol 41 - source { - address ip.of.tunnel.broker - } -} -``` diff --git a/docs/configexamples/nmp.md b/docs/configexamples/nmp.md new file mode 100644 index 00000000..63231a09 --- /dev/null +++ b/docs/configexamples/nmp.md @@ -0,0 +1,76 @@ +--- +lastproofread: '2023-03-26' +--- + +(examples-nmp)= + +# NMP example + +Consider how to quickly set up NMP and VyOS for monitoring. +NMP is multi-vendor network monitoring from 'SolarWinds' built to +scale and expand with the needs of your network. + +## Configuration 'VyOS' + +First prepare our VyOS router for connection to NMP. We have to set +up the SNMP protocol and connectivity between the router and NMP. + +% stop_vyoslinter + +```none +set interfaces ethernet eth0 address 'dhcp' +set system name-server '8.8.8.8' +set service snmp community router authorization 'test' +set service snmp community router network '0.0.0.0/0' +``` + +% start_vyoslinter + + +## Configuration 'NMP' + +Next, you should just follow the pictures: + +```{image} /_static/images/nmp1.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp2.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp3.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp4.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp5.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp6.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```{image} /_static/images/nmp7.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +In the end, you'll get a powerful instrument for monitoring the VyOS systems. diff --git a/docs/configexamples/nmp.rst b/docs/configexamples/nmp.rst deleted file mode 100644 index 8945a9f4..00000000 --- a/docs/configexamples/nmp.rst +++ /dev/null @@ -1,72 +0,0 @@ -:lastproofread: 2023-03-26 - -.. _examples-nmp: - -########### -NMP example -########### - -Consider how to quickly set up NMP and VyOS for monitoring. -NMP is multi-vendor network monitoring from 'SolarWinds' built to -scale and expand with the needs of your network. - -Configuration 'VyOS' -==================== - -First prepare our VyOS router for connection to NMP. We have to set -up the SNMP protocol and connectivity between the router and NMP. - -.. stop_vyoslinter - -.. code-block:: none - - set interfaces ethernet eth0 address 'dhcp' - set system name-server '8.8.8.8' - set service snmp community router authorization 'test' - set service snmp community router network '0.0.0.0/0' - -.. start_vyoslinter - - -Configuration 'NMP' -==================== - -Next, you just should follow the pictures: - -.. image:: /_static/images/nmp1.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp2.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp3.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp4.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp5.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp6.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. image:: /_static/images/nmp7.* - :width: 80% - :align: center - :alt: Network Topology Diagram - - -In the end, you'll get a powerful instrument for monitoring the VyOS systems. \ No newline at end of file diff --git a/docs/configexamples/ospf-unnumbered.md b/docs/configexamples/ospf-unnumbered.md new file mode 100644 index 00000000..9174d1b4 --- /dev/null +++ b/docs/configexamples/ospf-unnumbered.md @@ -0,0 +1,118 @@ +--- +lastproofread: '2021-06-29' +--- + +(examples-ospf-unnumbered)= + +# OSPF unnumbered with ECMP + +General information can be found in the {ref}`routing-ospf` chapter. + +## Configuration + +- Router A: + +```none +set interfaces ethernet eth0 address '10.0.0.1/24' +set interfaces ethernet eth1 address '192.168.0.1/32' +set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' +set interfaces ethernet eth1 ip ospf network 'point-to-point' +set interfaces ethernet eth2 address '192.168.0.1/32' +set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' +set interfaces ethernet eth2 ip ospf network 'point-to-point' +set interfaces loopback lo address '192.168.0.1/32' +set protocols ospf area 0.0.0.0 authentication 'md5' +set protocols ospf area 0.0.0.0 network '192.168.0.1/32' +set protocols ospf parameters router-id '192.168.0.1' +set protocols ospf redistribute connected +``` + +- Router B: + +```none +set interfaces ethernet eth0 address '10.0.0.2/24' +set interfaces ethernet eth1 address '192.168.0.2/32' +set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' +set interfaces ethernet eth1 ip ospf network 'point-to-point' +set interfaces ethernet eth2 address '192.168.0.2/32' +set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' +set interfaces ethernet eth2 ip ospf network 'point-to-point' +set interfaces loopback lo address '192.168.0.2/32' +set protocols ospf area 0.0.0.0 authentication 'md5' +set protocols ospf area 0.0.0.0 network '192.168.0.2/32' +set protocols ospf parameters router-id '192.168.0.2' +set protocols ospf redistribute connected +``` + + +## Results + +- Router A: + +```none +vyos@vyos:~$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 10.0.0.1/24 u/u +eth1 192.168.0.1/32 u/u +eth2 192.168.0.1/32 u/u +lo 127.0.0.1/8 u/u + 192.168.0.1/32 + ::1/128 +``` + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + +S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 +O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21 + via 192.168.0.2, eth2 onlink, 00:13:21 +C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 +O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53 +C * 192.168.0.1/32 is directly connected, eth2, 00:56:31 +C * 192.168.0.1/32 is directly connected, eth1, 00:56:31 +C>* 192.168.0.1/32 is directly connected, lo, 00:57:36 +O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03 + * via 192.168.0.2, eth2 onlink, 00:29:03 +``` + +- Router B: + +```none +vyos@vyos:~$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 10.0.0.2/24 u/u +eth1 192.168.0.2/32 u/u +eth2 192.168.0.2/32 u/u +lo 127.0.0.1/8 u/u + 192.168.0.2/32 + ::1/128 +``` + +```none +vyos@vyos:~$ show ip route +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + +S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 +O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21 + via 192.168.0.1, eth2 onlink, 00:13:21 +C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 +O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53 +C * 192.168.0.2/32 is directly connected, eth2, 00:56:31 +C * 192.168.0.2/32 is directly connected, eth1, 00:56:31 +C>* 192.168.0.2/32 is directly connected, lo, 00:57:36 +O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03 + * via 192.168.0.1, eth2 onlink, 00:29:03 +``` diff --git a/docs/configexamples/ospf-unnumbered.rst b/docs/configexamples/ospf-unnumbered.rst deleted file mode 100644 index 6a5a1bb4..00000000 --- a/docs/configexamples/ospf-unnumbered.rst +++ /dev/null @@ -1,120 +0,0 @@ -:lastproofread: 2021-06-29 - -.. _examples-ospf-unnumbered: - -######################### -OSPF unnumbered with ECMP -######################### - -General information can be found in the :ref:`routing-ospf` chapter. - -Configuration -============= - -- Router A: - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.0.1/24' - set interfaces ethernet eth1 address '192.168.0.1/32' - set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' - set interfaces ethernet eth1 ip ospf network 'point-to-point' - set interfaces ethernet eth2 address '192.168.0.1/32' - set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' - set interfaces ethernet eth2 ip ospf network 'point-to-point' - set interfaces loopback lo address '192.168.0.1/32' - set protocols ospf area 0.0.0.0 authentication 'md5' - set protocols ospf area 0.0.0.0 network '192.168.0.1/32' - set protocols ospf parameters router-id '192.168.0.1' - set protocols ospf redistribute connected - -- Router B: - -.. code-block:: none - - set interfaces ethernet eth0 address '10.0.0.2/24' - set interfaces ethernet eth1 address '192.168.0.2/32' - set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' - set interfaces ethernet eth1 ip ospf network 'point-to-point' - set interfaces ethernet eth2 address '192.168.0.2/32' - set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' - set interfaces ethernet eth2 ip ospf network 'point-to-point' - set interfaces loopback lo address '192.168.0.2/32' - set protocols ospf area 0.0.0.0 authentication 'md5' - set protocols ospf area 0.0.0.0 network '192.168.0.2/32' - set protocols ospf parameters router-id '192.168.0.2' - set protocols ospf redistribute connected - - -Results -======= - -- Router A: - -.. code-block:: none - - vyos@vyos:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 10.0.0.1/24 u/u - eth1 192.168.0.1/32 u/u - eth2 192.168.0.1/32 u/u - lo 127.0.0.1/8 u/u - 192.168.0.1/32 - ::1/128 - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - - S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 - O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21 - via 192.168.0.2, eth2 onlink, 00:13:21 - C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 - O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53 - C * 192.168.0.1/32 is directly connected, eth2, 00:56:31 - C * 192.168.0.1/32 is directly connected, eth1, 00:56:31 - C>* 192.168.0.1/32 is directly connected, lo, 00:57:36 - O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03 - * via 192.168.0.2, eth2 onlink, 00:29:03 - -- Router B: - -.. code-block:: none - - vyos@vyos:~$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 10.0.0.2/24 u/u - eth1 192.168.0.2/32 u/u - eth2 192.168.0.2/32 u/u - lo 127.0.0.1/8 u/u - 192.168.0.2/32 - ::1/128 - -.. code-block:: none - - vyos@vyos:~$ show ip route - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - - S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 - O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21 - via 192.168.0.1, eth2 onlink, 00:13:21 - C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 - O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53 - C * 192.168.0.2/32 is directly connected, eth2, 00:56:31 - C * 192.168.0.2/32 is directly connected, eth1, 00:56:31 - C>* 192.168.0.2/32 is directly connected, lo, 00:57:36 - O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03 - * via 192.168.0.1, eth2 onlink, 00:29:03 diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.md b/docs/configexamples/policy-based-ipsec-and-firewall.md new file mode 100644 index 00000000..86bc9318 --- /dev/null +++ b/docs/configexamples/policy-based-ipsec-and-firewall.md @@ -0,0 +1,269 @@ +(examples-policy-based-ipsec-and-firewall)= + +# Policy-Based Site-to-Site VPN and Firewall Configuration + +This guide shows an example policy-based IKEv2 site-to-site VPN between two +VyOS routers, and firewall configuration. + +For simplicity, configuration and tests are done only using IPv4, and firewall +configuration is done only on one router. + +## Network Topology and requirements + +This configuration example and the requirements consists of: + +- Two VyOS routers with public IP address. + +- 2 private subnets on each site. + +- Local subnets should be able to reach internet using source NAT. + +- Communication between private subnets should be done through IPSec tunnel + without NAT. + +- Configuration of basic firewall in one site, in order to: + + > - Protect the router on 'WAN' interface, allowing only IPSec connections + > and SSH access from trusted IPs. + > - Allow access to the router only from trusted networks. + > - Allow DNS requests only only for local networks. + > - Allow ICMP on all interfaces. + > - Allow all new connections from local subnets. + > - Allow connections from LANs to LANs through the tunnel. + +```{image} /_static/images/policy-based-ipsec-and-firewall.webp +``` + + +## Configuration + +Interface and routing configuration: + +```none +# LEFT router: +set interfaces ethernet eth0 address '198.51.100.14/30' +set interfaces ethernet eth1 vif 111 address '10.1.11.1/24' +set interfaces ethernet eth2 vif 112 address '10.1.12.1/24' +set protocols static route 0.0.0.0/0 next-hop 198.51.100.13 + +# RIGHT router: +set interfaces ethernet eth0 address '192.0.2.130/30' +set interfaces ethernet eth1 vif 221 address '10.2.21.1/24' +set interfaces ethernet eth2 vif 222 address '10.2.22.1/24' +``` + +IPSec configuration: + +```none +# LEFT router: +set vpn ipsec authentication psk RIGHT id '198.51.100.14' +set vpn ipsec authentication psk RIGHT id '192.0.2.130' +set vpn ipsec authentication psk RIGHT secret 'p4ssw0rd' +set vpn ipsec esp-group ESP-GROUP mode 'tunnel' +set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256' +set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256' +set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' +set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14' +set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256' +set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256' +set vpn ipsec interface 'eth0' +set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer RIGHT connection-type 'initiate' +set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14' +set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130' +set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24' +set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24' +set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24' +set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24' +set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24' +set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24' +set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24' +set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24' + +# RIGHT router: +set vpn ipsec authentication psk LEFT id '192.0.2.130' +set vpn ipsec authentication psk LEFT id '198.51.100.14' +set vpn ipsec authentication psk LEFT secret 'p4ssw0rd' +set vpn ipsec esp-group ESP-GROUP mode 'tunnel' +set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256' +set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256' +set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' +set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14' +set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256' +set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256' +set vpn ipsec interface 'eth0' +set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer LEFT connection-type 'none' +set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130' +set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14' +set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24' +set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24' +set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24' +set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24' +set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24' +set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24' +set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24' +set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24' +``` + +Firewall Configuration: + +```none +# Firewall Groups: +set firewall group network-group LOCAL-NETS network '10.1.11.0/24' +set firewall group network-group LOCAL-NETS network '10.1.12.0/24' +set firewall group network-group REMOTE-NETS network '10.2.21.0/24' +set firewall group network-group REMOTE-NETS network '10.2.22.0/24' +set firewall group network-group TRUSTED network '198.51.100.125/32' +set firewall group network-group TRUSTED network '203.0.113.0/24' +set firewall group network-group TRUSTED network '10.1.11.0/24' +set firewall group network-group TRUSTED network '192.168.70.0/24' + +# Forward traffic: default drop and only allow what is needed +set firewall ipv4 forward filter default-action 'drop' + +# Forward traffic: global state policies +set firewall ipv4 forward filter rule 1 action 'accept' +set firewall ipv4 forward filter rule 1 state established 'enable' +set firewall ipv4 forward filter rule 1 state related 'enable' +set firewall ipv4 forward filter rule 2 action 'drop' +set firewall ipv4 forward filter rule 2 state invalid 'enable' + +# Forward traffic: Accept all connections from local networks +set firewall ipv4 forward filter rule 10 action 'accept' +set firewall ipv4 forward filter rule 10 source group network-group 'LOCAL-NETS' + +# Forward traffic: accept connections from remote LANs to local LANs +set firewall ipv4 forward filter rule 20 action 'accept' +set firewall ipv4 forward filter rule 20 destination group network-group 'LOCAL-NETS' +set firewall ipv4 forward filter rule 20 source group network-group 'REMOTE-NETS' + +# Input traffic: default drop and only allow what is needed +set firewall ipv4 input filter default-action 'drop' + +# Input traffic: global state policies +set firewall ipv4 input filter rule 1 action 'accept' +set firewall ipv4 input filter rule 1 state established 'enable' +set firewall ipv4 input filter rule 1 state related 'enable' +set firewall ipv4 input filter rule 2 action 'drop' +set firewall ipv4 input filter rule 2 state invalid 'enable' + +# Input traffic: add rules needed for ipsec connection +set firewall ipv4 input filter rule 10 action 'accept' +set firewall ipv4 input filter rule 10 destination port '500,4500' +set firewall ipv4 input filter rule 10 inbound-interface name 'eth0' +set firewall ipv4 input filter rule 10 protocol 'udp' +set firewall ipv4 input filter rule 15 action 'accept' +set firewall ipv4 input filter rule 15 inbound-interface name 'eth0' +set firewall ipv4 input filter rule 15 protocol 'esp' + +# Input traffic: accept ssh connection from trusted ips +set firewall ipv4 input filter rule 20 action 'accept' +set firewall ipv4 input filter rule 20 destination port '22' +set firewall ipv4 input filter rule 20 protocol 'tcp' +set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED' + +# Input traffic: accept dns requests only from local networks. +set firewall ipv4 input filter rule 25 action 'accept' +set firewall ipv4 input filter rule 25 destination port '53' +set firewall ipv4 input filter rule 25 protocol 'udp' +set firewall ipv4 input filter rule 25 source group network-group 'LOCAL-NETS' + +# Input traffic: allow icmp +set firewall ipv4 input filter rule 30 action 'accept' +set firewall ipv4 input filter rule 30 protocol 'icmp' +``` + +And NAT Configuration: + +```none +set nat source rule 10 destination group network-group 'REMOTE-NETS' +set nat source rule 10 exclude +set nat source rule 10 outbound-interface name 'eth0' +set nat source rule 10 source group network-group 'LOCAL-NETS' +set nat source rule 20 outbound-interface name 'eth0' +set nat source rule 20 source group network-group 'LOCAL-NETS' +set nat source rule 20 translation address 'masquerade' +``` + +## Checking through op-mode commands + +After some testing, we can check IPSec status, and counter on every tunnel: + +```none +vyos@LEFT:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +-------------- ------- -------- -------------- ---------------- ---------------- ----------- --------------------------------------- +RIGHT-tunnel-0 up 36m24s 840B/840B 10/10 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 +RIGHT-tunnel-1 up 36m33s 588B/588B 7/7 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 +RIGHT-tunnel-2 up 35m50s 1K/1K 15/15 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 +RIGHT-tunnel-3 up 36m54s 2K/2K 32/32 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 +vyos@LEFT:~$ +``` + +Also, we can check firewall counters: + +```none +vyos@LEFT:~$ show firewall +Rulesets Information + +--------------------------------- +IPv4 Firewall "forward filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ------------------------------------------------------ +1 accept all 681 96545 ct state { established, related } accept +2 drop all 0 0 ct state invalid +10 accept all 360 27205 ip saddr @N_LOCAL-NETS accept +20 accept all 8 648 ip daddr @N_LOCAL-NETS ip saddr @N_REMOTE-NETS accept +default drop all + +--------------------------------- +IPv4 Firewall "input filter" + +Rule Action Protocol Packets Bytes Conditions +------- -------- ---------- --------- ------- ---------------------------------------------- +1 accept all 901 123709 ct state { established, related } accept +2 drop all 0 0 ct state invalid +10 accept udp 0 0 udp dport { 500, 4500 } iifname "eth0" accept +15 accept esp 0 0 meta l4proto esp iifname "eth0" accept +20 accept tcp 1 60 tcp dport 22 ip saddr @N_TRUSTED accept +25 accept udp 0 0 udp dport 53 ip saddr @N_LOCAL-NETS accept +30 accept icmp 0 0 meta l4proto icmp accept +default drop all + +vyos@LEFT:~$ +vyos@LEFT:~$ show firewall statistics +Rulesets Statistics + +--------------------------------- +IPv4 Firewall "forward filter" + +Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface +------- --------- ------- -------- ----------- ------------- ------------------- -------------------- +1 681 96545 accept any any any any +2 0 0 drop any any any any +10 360 27205 accept LOCAL-NETS any any any +20 8 648 accept REMOTE-NETS LOCAL-NETS any any +default N/A N/A drop any any any any + +--------------------------------- +IPv4 Firewall "input filter" + +Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface +------- --------- ------- -------- ---------- ------------- ------------------- -------------------- +1 905 124213 accept any any any any +2 0 0 drop any any any any +10 0 0 accept any any eth0 any +15 0 0 accept any any eth0 any +20 1 60 accept TRUSTED any any any +25 0 0 accept LOCAL-NETS any any any +30 0 0 accept any any any any +default N/A N/A drop any any any any + +vyos@LEFT:~$ +``` diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.rst b/docs/configexamples/policy-based-ipsec-and-firewall.rst deleted file mode 100644 index dcf59af9..00000000 --- a/docs/configexamples/policy-based-ipsec-and-firewall.rst +++ /dev/null @@ -1,282 +0,0 @@ -.. _examples-policy-based-ipsec-and-firewall: - - -######################################################## -Policy-Based Site-to-Site VPN and Firewall Configuration -######################################################## - -This guide shows an example policy-based IKEv2 site-to-site VPN between two -VyOS routers, and firewall configuration. - -For simplicity, configuration and tests are done only using IPv4, and firewall -configuration is done only on one router. - -Network Topology and requirements -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -This configuration example and the requirements consists of: - -- Two VyOS routers with public IP address. - -- 2 private subnets on each site. - -- Local subnets should be able to reach internet using source NAT. - -- Communication between private subnets should be done through IPSec tunnel - without NAT. - -- Configuration of basic firewall in one site, in order to: - - - Protect the router on 'WAN' interface, allowing only IPSec connections - and SSH access from trusted IPs. - - - Allow access to the router only from trusted networks. - - - Allow DNS requests only only for local networks. - - - Allow ICMP on all interfaces. - - - Allow all new connections from local subnets. - - - Allow connections from LANs to LANs through the tunnel. - - -.. image:: /_static/images/policy-based-ipsec-and-firewall.* - - -Configuration -^^^^^^^^^^^^^ - -Interface and routing configuration: - -.. code-block:: none - - # LEFT router: - set interfaces ethernet eth0 address '198.51.100.14/30' - set interfaces ethernet eth1 vif 111 address '10.1.11.1/24' - set interfaces ethernet eth2 vif 112 address '10.1.12.1/24' - set protocols static route 0.0.0.0/0 next-hop 198.51.100.13 - - # RIGHT router: - set interfaces ethernet eth0 address '192.0.2.130/30' - set interfaces ethernet eth1 vif 221 address '10.2.21.1/24' - set interfaces ethernet eth2 vif 222 address '10.2.22.1/24' - - -IPSec configuration: - -.. code-block:: none - - # LEFT router: - set vpn ipsec authentication psk RIGHT id '198.51.100.14' - set vpn ipsec authentication psk RIGHT id '192.0.2.130' - set vpn ipsec authentication psk RIGHT secret 'p4ssw0rd' - set vpn ipsec esp-group ESP-GROUP mode 'tunnel' - set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256' - set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256' - set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' - set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14' - set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256' - set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256' - set vpn ipsec interface 'eth0' - set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer RIGHT connection-type 'initiate' - set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP' - set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP' - set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14' - set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130' - set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24' - set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24' - set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24' - set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24' - set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24' - set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24' - set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24' - set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24' - - # RIGHT router: - set vpn ipsec authentication psk LEFT id '192.0.2.130' - set vpn ipsec authentication psk LEFT id '198.51.100.14' - set vpn ipsec authentication psk LEFT secret 'p4ssw0rd' - set vpn ipsec esp-group ESP-GROUP mode 'tunnel' - set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256' - set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256' - set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' - set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14' - set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256' - set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256' - set vpn ipsec interface 'eth0' - set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer LEFT connection-type 'none' - set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP' - set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP' - set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130' - set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14' - set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24' - set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24' - set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24' - set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24' - set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24' - set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24' - set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24' - set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24' - -Firewall Configuration: - -.. code-block:: none - - # Firewall Groups: - set firewall group network-group LOCAL-NETS network '10.1.11.0/24' - set firewall group network-group LOCAL-NETS network '10.1.12.0/24' - set firewall group network-group REMOTE-NETS network '10.2.21.0/24' - set firewall group network-group REMOTE-NETS network '10.2.22.0/24' - set firewall group network-group TRUSTED network '198.51.100.125/32' - set firewall group network-group TRUSTED network '203.0.113.0/24' - set firewall group network-group TRUSTED network '10.1.11.0/24' - set firewall group network-group TRUSTED network '192.168.70.0/24' - - # Forward traffic: default drop and only allow what is needed - set firewall ipv4 forward filter default-action 'drop' - - # Forward traffic: global state policies - set firewall ipv4 forward filter rule 1 action 'accept' - set firewall ipv4 forward filter rule 1 state established 'enable' - set firewall ipv4 forward filter rule 1 state related 'enable' - set firewall ipv4 forward filter rule 2 action 'drop' - set firewall ipv4 forward filter rule 2 state invalid 'enable' - - # Forward traffic: Accept all connections from local networks - set firewall ipv4 forward filter rule 10 action 'accept' - set firewall ipv4 forward filter rule 10 source group network-group 'LOCAL-NETS' - - # Forward traffic: accept connections from remote LANs to local LANs - set firewall ipv4 forward filter rule 20 action 'accept' - set firewall ipv4 forward filter rule 20 destination group network-group 'LOCAL-NETS' - set firewall ipv4 forward filter rule 20 source group network-group 'REMOTE-NETS' - - # Input traffic: default drop and only allow what is needed - set firewall ipv4 input filter default-action 'drop' - - # Input traffic: global state policies - set firewall ipv4 input filter rule 1 action 'accept' - set firewall ipv4 input filter rule 1 state established 'enable' - set firewall ipv4 input filter rule 1 state related 'enable' - set firewall ipv4 input filter rule 2 action 'drop' - set firewall ipv4 input filter rule 2 state invalid 'enable' - - # Input traffic: add rules needed for ipsec connection - set firewall ipv4 input filter rule 10 action 'accept' - set firewall ipv4 input filter rule 10 destination port '500,4500' - set firewall ipv4 input filter rule 10 inbound-interface name 'eth0' - set firewall ipv4 input filter rule 10 protocol 'udp' - set firewall ipv4 input filter rule 15 action 'accept' - set firewall ipv4 input filter rule 15 inbound-interface name 'eth0' - set firewall ipv4 input filter rule 15 protocol 'esp' - - # Input traffic: accept ssh connection from trusted ips - set firewall ipv4 input filter rule 20 action 'accept' - set firewall ipv4 input filter rule 20 destination port '22' - set firewall ipv4 input filter rule 20 protocol 'tcp' - set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED' - - # Input traffic: accepd dns requests only from local networks. - set firewall ipv4 input filter rule 25 action 'accept' - set firewall ipv4 input filter rule 25 destination port '53' - set firewall ipv4 input filter rule 25 protocol 'udp' - set firewall ipv4 input filter rule 25 source group network-group 'LOCAL-NETS' - - # Input traffic: allow icmp - set firewall ipv4 input filter rule 30 action 'accept' - set firewall ipv4 input filter rule 30 protocol 'icmp' - -And NAT Configuration: - -.. code-block:: none - - set nat source rule 10 destination group network-group 'REMOTE-NETS' - set nat source rule 10 exclude - set nat source rule 10 outbound-interface name 'eth0' - set nat source rule 10 source group network-group 'LOCAL-NETS' - set nat source rule 20 outbound-interface name 'eth0' - set nat source rule 20 source group network-group 'LOCAL-NETS' - set nat source rule 20 translation address 'masquerade' - -Checking through op-mode commands -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -After some testing, we can check IPSec status, and counter on every tunnel: - -.. code-block:: none - - vyos@LEFT:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - -------------- ------- -------- -------------- ---------------- ---------------- ----------- --------------------------------------- - RIGHT-tunnel-0 up 36m24s 840B/840B 10/10 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 - RIGHT-tunnel-1 up 36m33s 588B/588B 7/7 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 - RIGHT-tunnel-2 up 35m50s 1K/1K 15/15 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 - RIGHT-tunnel-3 up 36m54s 2K/2K 32/32 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 - vyos@LEFT:~$ - - -Also, we can check firewall counters: - -.. code-block:: none - - vyos@LEFT:~$ show firewall - Rulesets Information - - --------------------------------- - IPv4 Firewall "forward filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ------------------------------------------------------ - 1 accept all 681 96545 ct state { established, related } accept - 2 drop all 0 0 ct state invalid - 10 accept all 360 27205 ip saddr @N_LOCAL-NETS accept - 20 accept all 8 648 ip daddr @N_LOCAL-NETS ip saddr @N_REMOTE-NETS accept - default drop all - - --------------------------------- - IPv4 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------------------------------- - 1 accept all 901 123709 ct state { established, related } accept - 2 drop all 0 0 ct state invalid - 10 accept udp 0 0 udp dport { 500, 4500 } iifname "eth0" accept - 15 accept esp 0 0 meta l4proto esp iifname "eth0" accept - 20 accept tcp 1 60 tcp dport 22 ip saddr @N_TRUSTED accept - 25 accept udp 0 0 udp dport 53 ip saddr @N_LOCAL-NETS accept - 30 accept icmp 0 0 meta l4proto icmp accept - default drop all - - vyos@LEFT:~$ - vyos@LEFT:~$ show firewall statistics - Rulesets Statistics - - --------------------------------- - IPv4 Firewall "forward filter" - - Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface - ------- --------- ------- -------- ----------- ------------- ------------------- -------------------- - 1 681 96545 accept any any any any - 2 0 0 drop any any any any - 10 360 27205 accept LOCAL-NETS any any any - 20 8 648 accept REMOTE-NETS LOCAL-NETS any any - default N/A N/A drop any any any any - - --------------------------------- - IPv4 Firewall "input filter" - - Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface - ------- --------- ------- -------- ---------- ------------- ------------------- -------------------- - 1 905 124213 accept any any any any - 2 0 0 drop any any any any - 10 0 0 accept any any eth0 any - 15 0 0 accept any any eth0 any - 20 1 60 accept TRUSTED any any any - 25 0 0 accept LOCAL-NETS any any any - 30 0 0 accept any any any any - default N/A N/A drop any any any any - - vyos@LEFT:~$ diff --git a/docs/configexamples/pppoe-ipv6-basic.md b/docs/configexamples/pppoe-ipv6-basic.md new file mode 100644 index 00000000..76984f4b --- /dev/null +++ b/docs/configexamples/pppoe-ipv6-basic.md @@ -0,0 +1,114 @@ +--- +lastproofread: '2021-06-29' +--- + +(examples-pppoe-ipv6-basic)= + +# PPPoE IPv6 Basic Setup for Home Network + +This document is to describe a basic setup using PPPoE with DHCPv6-PD + +SLAAC to construct a typical home network. The user can follow the steps +described here to quickly setup a working network and use this as a starting +point to further configure or fine-tune other settings. + +To achieve this, your ISP is required to support DHCPv6-PD. If you're not sure, +please contact your ISP for more information. + +## Network Topology + +```{image} /_static/images/pppoe-ipv6-pd-diagram.webp +:align: center +:alt: Network Topology Diagram +:width: 60% +``` + + +## Configurations + +### PPPoE Setup + +```none +set interfaces pppoe pppoe0 authentication password +set interfaces pppoe pppoe0 authentication username +set interfaces pppoe pppoe0 service-name +set interfaces pppoe pppoe0 source-interface 'eth0' +``` + +- Fill `password` and `user` with the credential provided by your ISP. +- `service-name` can be an arbitrary string. + +### DHCPv6-PD Setup + +During address configuration, in addition to assigning an address to the WAN +interface, ISP also provides a prefix to allow the router to configure addresses +of LAN interface and other nodes connecting to LAN, which is called prefix +delegation (PD). + +```none +set interfaces pppoe pppoe0 ipv6 address autoconf +set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' +``` + +- Here we use the prefix to configure the address of eth1 (LAN) to form + `::64`, where `64` is hexadecimal of address 100. + + + +- For home network users, most of time ISP only provides /64 prefix, hence + there is no need to set SLA ID and prefix length. See {ref}`pppoe-interface` + for more information. + +### Router Advertisement + +We need to enable router advertisement for LAN network so that PC can receive +the prefix and use SLAAC to configure the address automatically. + +```none +set service router-advert interface eth1 link-mtu '1492' +set service router-advert interface eth1 name-server +set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800' +``` + +- Set MTU in advertisement to 1492 because of PPPoE header overhead. +- Set DNS server address in the advertisement so that clients can obtain it by + using RDNSS option. Most operating systems (Windows, Linux, Mac) should + already support it. +- Here we set the prefix to `::/64` to indicate advertising any /64 prefix + the LAN interface is assigned. +- Since some ISPs disconnects continuous connection for every 2~3 days, we set + `valid-lifetime` to 2 days to allow PC for phasing out old address. + +### Basic Firewall + +To have basic protection while keeping IPv6 network functional, we need to: +- Allow all established and related traffic for router and LAN +- Allow all icmpv6 packets for router and LAN +- Allow DHCPv6 packets for router + +```none +set firewall ipv6 name WAN_IN default-action 'drop' +set firewall ipv6 name WAN_IN rule 10 action 'accept' +set firewall ipv6 name WAN_IN rule 10 state established 'enable' +set firewall ipv6 name WAN_IN rule 10 state related 'enable' +set firewall ipv6 name WAN_IN rule 20 action 'accept' +set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6' +set firewall ipv6 name WAN_LOCAL default-action 'drop' +set firewall ipv6 name WAN_LOCAL rule 10 action 'accept' +set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable' +set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable' +set firewall ipv6 name WAN_LOCAL rule 20 action 'accept' +set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6' +set firewall ipv6 name WAN_LOCAL rule 30 action 'accept' +set firewall ipv6 name WAN_LOCAL rule 30 destination port '546' +set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp' +set firewall ipv6 name WAN_LOCAL rule 30 source port '547' +set firewall ipv6 forward filter rule 10 action jump +set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN' +set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0' +set firewall ipv6 input filter rule 10 action jump +set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL' +set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0' +``` + +Note to allow the router to receive DHCPv6 response from ISP. We need to allow +packets with source port 547 (server) and destination port 546 (client). diff --git a/docs/configexamples/pppoe-ipv6-basic.rst b/docs/configexamples/pppoe-ipv6-basic.rst deleted file mode 100644 index cc14451c..00000000 --- a/docs/configexamples/pppoe-ipv6-basic.rst +++ /dev/null @@ -1,121 +0,0 @@ -:lastproofread: 2021-06-29 - -.. _examples-pppoe-ipv6-basic: - -####################################### -PPPoE IPv6 Basic Setup for Home Network -####################################### - -This document is to describe a basic setup using PPPoE with DHCPv6-PD + -SLAAC to construct a typical home network. The user can follow the steps -described here to quickly setup a working network and use this as a starting -point to further configure or fine-tune other settings. - -To achieve this, your ISP is required to support DHCPv6-PD. If you're not sure, -please contact your ISP for more information. - -Network Topology -================ - -.. image:: /_static/images/pppoe-ipv6-pd-diagram.* - :width: 60% - :align: center - :alt: Network Topology Diagram - -Configurations -============== - -PPPoE Setup ------------ - -.. code-block:: none - - set interfaces pppoe pppoe0 authentication password - set interfaces pppoe pppoe0 authentication user - set interfaces pppoe pppoe0 service-name - set interfaces pppoe pppoe0 source-interface 'eth0' - -* Fill ``password`` and ``user`` with the credential provided by your ISP. -* ``service-name`` can be an arbitrary string. - -DHCPv6-PD Setup ---------------- - -During address configuration, in addition to assigning an address to the WAN -interface, ISP also provides a prefix to allow the router to configure addresses -of LAN interface and other nodes connecting to LAN, which is called prefix -delegation (PD). - -.. code-block:: none - - set interfaces pppoe pppoe0 ipv6 address autoconf - set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' - -.. stop_vyoslinter - -* Here we use the prefix to configure the address of eth1 (LAN) to form - ``::64``, where ``64`` is hexadecimal of address 100. - -.. start_vyoslinter - -* For home network users, most of time ISP only provides /64 prefix, hence - there is no need to set SLA ID and prefix length. See :ref:`pppoe-interface` - for more information. - -Router Advertisement --------------------- - -We need to enable router advertisement for LAN network so that PC can receive -the prefix and use SLAAC to configure the address automatically. - -.. code-block:: none - - set service router-advert interface eth1 link-mtu '1492' - set service router-advert interface eth1 name-server - set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800' - -* Set MTU in advertisement to 1492 because of PPPoE header overhead. -* Set DNS server address in the advertisement so that clients can obtain it by - using RDNSS option. Most operating systems (Windows, Linux, Mac) should - already support it. -* Here we set the prefix to ``::/64`` to indicate advertising any /64 prefix - the LAN interface is assigned. -* Since some ISPs disconnects continuous connection for every 2~3 days, we set - ``valid-lifetime`` to 2 days to allow PC for phasing out old address. - -Basic Firewall --------------- - -To have basic protection while keeping IPv6 network functional, we need to: - -* Allow all established and related traffic for router and LAN -* Allow all icmpv6 packets for router and LAN -* Allow DHCPv6 packets for router - -.. code-block:: none - - set firewall ipv6 name WAN_IN default-action 'drop' - set firewall ipv6 name WAN_IN rule 10 action 'accept' - set firewall ipv6 name WAN_IN rule 10 state established 'enable' - set firewall ipv6 name WAN_IN rule 10 state related 'enable' - set firewall ipv6 name WAN_IN rule 20 action 'accept' - set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6' - set firewall ipv6 name WAN_LOCAL default-action 'drop' - set firewall ipv6 name WAN_LOCAL rule 10 action 'accept' - set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable' - set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable' - set firewall ipv6 name WAN_LOCAL rule 20 action 'accept' - set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6' - set firewall ipv6 name WAN_LOCAL rule 30 action 'accept' - set firewall ipv6 name WAN_LOCAL rule 30 destination port '546' - set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp' - set firewall ipv6 name WAN_LOCAL rule 30 source port '547' - set firewall ipv6 forward filter rule 10 action jump - set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN' - set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0' - set firewall ipv6 input filter rule 10 action jump - set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL' - set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0' - -Note to allow the router to receive DHCPv6 response from ISP. We need to allow -packets with source port 547 (server) and destination port 546 (client). diff --git a/docs/configexamples/qos.md b/docs/configexamples/qos.md new file mode 100644 index 00000000..e8335584 --- /dev/null +++ b/docs/configexamples/qos.md @@ -0,0 +1,201 @@ +--- +lastproofread: '2023-02-18' +--- + +(examples-qos)= + +# QoS example + +## Configuration 'dcsp' and shaper using QoS + +In this case, we'll try to make a simple lab using QoS and the +general ability of the VyOS system. +We recommend you to go through the main article about +[QoS](https://docs.vyos.io/en/latest/configuration/trafficpolicy/index.html) +first. + +Using the general schema for example: + +```{image} /_static/images/qos1.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +We have four hosts on the local network 172.17.1.0/24. All hosts are +labeled CS0 by default. We need to replace labels on all hosts except +vpc8. +We will replace the labels on the nearest router “VyOS3” using the IP +addresses of the sources. + +- 172.17.1.2 CS0 -> CS4 +- 172.17.1.3 CS0 -> CS5 +- 172.17.1.4 CS0 -> CS6 +- 172.17.1.40 CS0 by default + +Next, we will replace only all CS4 labels on the “VyOS2” router. + +- CS4 -> CS5 + +In the end, we will configure the traffic shaper using QoS mechanisms +on the “VYOS2” router. + +## Configuration: + +Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll +use in this case only static routes. +On the VyOS3 router, we need to change the 'dscp' labels for the +VPCs. To do this, we use this configuration. + +```none +set interfaces ethernet eth0 address '10.1.1.100/24' +set interfaces ethernet eth1 address '172.17.1.1/24' +set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 +set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' +set qos policy shaper vyos3 class 10 set-dscp 'CS4' +set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' +set qos policy shaper vyos3 class 20 set-dscp 'CS5' +set qos policy shaper vyos3 class 30 match ADDRESS30 ip source address '172.17.1.4/32' +set qos policy shaper vyos3 class 30 set-dscp 'CS6' +set qos policy shaper vyos3 default bandwidth '10%' +set qos policy shaper vyos3 default ceiling '100%' +set qos policy shaper vyos3 default priority '7' +set qos policy shaper vyos3 default queue-type 'fair-queue' +set qos interface eth0 egress 'vyos3' +``` + +Main rules: + +- ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32 +- ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32 +- ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32 + +Check the result + +```{image} /_static/images/qos2.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +Before the interface eth0 on router VyOS3 + +```{image} /_static/images/qos3.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +After the interface eth0 on router VyOS3 + +```{image} /_static/images/qos4.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +On the router, VyOS4 set all traffic as CS4. We have to configure the +default class and class for changing all labels from CS0 to CS4 + +```none +set interfaces ethernet eth0 address '10.2.1.100/24' +set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 +set qos policy shaper vyos4 class 10 bandwidth '100%' +set qos policy shaper vyos4 class 10 burst '15k' +set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' +set qos policy shaper vyos4 class 10 queue-type 'fair-queue' +set qos policy shaper vyos4 class 10 set-dscp 'CS4' +set qos policy shaper vyos4 default bandwidth '10%' +set qos policy shaper vyos4 default burst '15k' +set qos policy shaper vyos4 default ceiling '100%' +set qos policy shaper vyos4 default priority '7' +set qos policy shaper vyos4 default queue-type 'fair-queue' + set qos interface eth0 egress 'vyos4' +``` + +Next on the router VyOS2 we will change labels on all incoming +traffic only from CS4-> CS6 + +```{image} /_static/images/qos5.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +```none +set interfaces ethernet eth0 address '10.1.1.1/24' +set interfaces ethernet eth1 address '10.2.1.1/24' +set interfaces ethernet eth2 address '10.9.9.1/24' +set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 +set qos policy shaper vyos2 class 10 bandwidth '100%' +set qos policy shaper vyos2 class 10 burst '15k' +set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' +set qos policy shaper vyos2 class 10 queue-type 'fair-queue' +set qos policy shaper vyos2 class 10 set-dscp 'CS5' +set qos policy shaper vyos2 default bandwidth '100%' +set qos policy shaper vyos2 default burst '15k' +set qos policy shaper vyos2 default ceiling '100%' +set qos policy shaper vyos2 default priority '7' +set qos policy shaper vyos2 default queue-type 'fair-queue' + set qos interface eth2 egress 'vyos2' +``` + +```{image} /_static/images/qos6.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +- 172.17.1.2/24 CS0 + +```{image} /_static/images/qos7.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +- 172.17.1.2/24 CS0 - > CS4 + +```{image} /_static/images/qos8.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +- 172.17.1.2/24 CS4 - > CS5 + +```{image} /_static/images/qos9.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +In the end, on the router “VyOS2” we will set outgoing bandwidth +limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for +IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work +with the help of the “iPerf” utility. + +Set up bandwidth limits on the eth2 interface of the router “VyOS2”. + +```none +vyos@vyos2# show qos policy shaper vyos2 class 20 +bandwidth 5mbit +description "for VyOS3 eth0" +match VyOS3 { + ip { + source { + address 10.1.1.100/32 + } + } +} +``` + +Check the result. + +```{image} /_static/images/qos10.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +As we see shaper is working and the traffic will not work over 5 Mbit/s. diff --git a/docs/configexamples/qos.rst b/docs/configexamples/qos.rst deleted file mode 100644 index 96448dd4..00000000 --- a/docs/configexamples/qos.rst +++ /dev/null @@ -1,200 +0,0 @@ -:lastproofread: 2023-02-18 - -.. _examples-qos: - -########### -QoS example -########### - -Configuration 'dcsp' and shaper using QoS -========================================= - -In this case, we'll try to make a simple lab using QoS and the -general ability of the VyOS system. -We recommend you to go through the main article about -`QoS `_ -first. - - -Using the general schema for example: - -.. image:: /_static/images/qos1.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -We have four hosts on the local network 172.17.1.0/24. All hosts are -labeled CS0 by default. We need to replace labels on all hosts except -vpc8. -We will replace the labels on the nearest router “VyOS3” using the IP -addresses of the sources. - -* 172.17.1.2 CS0 -> CS4 -* 172.17.1.3 CS0 -> CS5 -* 172.17.1.4 CS0 -> CS6 -* 172.17.1.40 CS0 by default - -Next, we will replace only all CS4 labels on the “VyOS2” router. - -* CS4 -> CS5 - -In the end, we will configure the traffic shaper using QoS mechanisms -on the “VYOS2” router. - -Configuration: -============== - -Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll -use in this case only static routes. -On the VyOS3 router, we need to change the 'dscp' labels for the -VPCs. To do this, we use this configuration. - -.. stop_vyoslinter - -.. code-block:: none - - set interfaces ethernet eth0 address '10.1.1.100/24' - set interfaces ethernet eth1 address '172.17.1.1/24' - set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 - set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' - set qos policy shaper vyos3 class 10 set-dscp 'CS4' - set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' - set qos policy shaper vyos3 class 20 set-dscp 'CS5' - set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' - set qos policy shaper vyos3 class 30 set-dscp 'CS6' - set qos policy shaper vyos3 default bandwidth '10%' - set qos policy shaper vyos3 default ceiling '100%' - set qos policy shaper vyos3 default priority '7' - set qos policy shaper vyos3 default queue-type 'fair-queue' - set qos interface eth0 egress 'vyos3' - -.. start_vyoslinter - -Main rules: - -* ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32 -* ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32 -* ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32 - - -Check the result - -.. image:: /_static/images/qos2.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -Before the interface eth0 on router VyOS3 - -.. image:: /_static/images/qos3.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -After the interface eth0 on router VyOS3 - -.. image:: /_static/images/qos4.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -On the router, VyOS4 set all traffic as CS4. We have to configure the -default class and class for changing all labels from CS0 to CS4 - -.. code-block:: none - - set interfaces ethernet eth0 address '10.2.1.100/24' - set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 - set qos policy shaper vyos4 class 10 bandwidth '100%' - set qos policy shaper vyos4 class 10 burst '15k' - set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' - set qos policy shaper vyos4 class 10 queue-type 'fair-queue' - set qos policy shaper vyos4 class 10 set-dscp 'CS4' - set qos policy shaper vyos4 default bandwidth '10%' - set qos policy shaper vyos4 default burst '15k' - set qos policy shaper vyos4 default ceiling '100%' - set qos policy shaper vyos4 default priority '7' - set qos policy shaper vyos4 default queue-type 'fair-queue' - set qos interface eth0 egress 'vyos4' - -Next on the router VyOS2 we will change labels on all incoming -traffic only from CS4-> CS6 - -.. image:: /_static/images/qos5.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -.. code-block:: none - - set interfaces ethernet eth0 address '10.1.1.1/24' - set interfaces ethernet eth1 address '10.2.1.1/24' - set interfaces ethernet eth2 address '10.9.9.1/24' - set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 - set qos policy shaper vyos2 class 10 bandwidth '100%' - set qos policy shaper vyos2 class 10 burst '15k' - set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' - set qos policy shaper vyos2 class 10 queue-type 'fair-queue' - set qos policy shaper vyos2 class 10 set-dscp 'CS5' - set qos policy shaper vyos2 default bandwidth '100%' - set qos policy shaper vyos2 default burst '15k' - set qos policy shaper vyos2 default ceiling '100%' - set qos policy shaper vyos2 default priority '7' - set qos policy shaper vyos2 default queue-type 'fair-queue' - set qos interface eth2 egress 'vyos2' - -.. image:: /_static/images/qos6.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -* 172.17.1.2/24 CS0 - -.. image:: /_static/images/qos7.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -* 172.17.1.2/24 CS0 - > CS4 - -.. image:: /_static/images/qos8.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -* 172.17.1.2/24 CS4 - > CS5 - -.. image:: /_static/images/qos9.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -In the end, on the router “VyOS2” we will set outgoing bandwidth -limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for -IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work -with the help of the “iPerf” utility. - -Set up bandwidth limits on the eth2 interface of the router “VyOS2”. - -.. code-block:: none - - - vyos@vyos2# show qos policy shaper vyos2 class 20 - bandwidth 5mbit - description "for VyOS3 eth0" - match VyOS3 { - ip { - source { - address 10.1.1.100/32 - } - } - } - -Check the result. - -.. image:: /_static/images/qos10.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -As we see shaper is working and the traffic will not work over 5 Mbit/s. diff --git a/docs/configexamples/rst-ansible.rst b/docs/configexamples/rst-ansible.rst new file mode 100644 index 00000000..ee865076 --- /dev/null +++ b/docs/configexamples/rst-ansible.rst @@ -0,0 +1,226 @@ +:lastproofread: 2024-04-09 + +.. _examples-ansible: + +############### +Ansible example +############### + +Setting up Ansible on a server running the Debian operating system. +=================================================================== + +In this example, we will set up a simple use of Ansible to configure +multiple VyOS routers. +We have four pre-configured routers with this configuration: + +Using the general schema for example: + +.. image:: /_static/images/ansible.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +We have four pre-configured routers with this configuration: + +.. code-block:: none + + set interfaces ethernet eth0 address dhcp + set service ssh + commit + save + +* vyos7 - 192.0.2.105 +* vyos8 - 192.0.2.106 +* vyos9 - 192.0.2.107 +* vyos10 - 192.0.2.108 + +Install Ansible: +==================== +.. code-block:: none + + # apt-get install ansible + Do you want to continue? [Y/n] y + +Install Paramiko: +===================== + +.. code-block:: none + + #apt-get install -y python3-paramiko + +Check the version: +================== + +.. stop_vyoslinter + +.. code-block:: none + + # ansible --version + ansible 2.10.8 + config file = None + configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] + ansible python module location = /usr/lib/python3/dist-packages/ansible + executable location = /usr/bin/ansible + python version = 3.9.2 (default, Feb 28 2021, 17:03:44) [GCC 10.2.1 20210110] + +.. start_vyoslinter + +Basic configuration of ansible.cfg: +======================================= + +.. code-block:: none + + # nano /root/ansible.cfg + [defaults] + host_key_checking = no + +Add all the VyOS hosts: +======================= + +.. code-block:: none + + # nano /root/hosts + [vyos_hosts] + vyos7 ansible_ssh_host=192.0.2.105 + vyos8 ansible_ssh_host=192.0.2.106 + vyos9 ansible_ssh_host=192.0.2.107 + vyos10 ansible_ssh_host=192.0.2.108 + +Add general variables: +====================== + +.. code-block:: none + + # mkdir /root/group_vars/ + # nano /root/group_vars/vyos_hosts + ansible_python_interpreter: /usr/bin/python3 + ansible_network_os: vyos + ansible_connection: network_cli + ansible_user: vyos + ansible_ssh_pass: vyos + + +Add a simple playbook with the tasks for each router: +===================================================== + +.. code-block:: none + + # nano /root/main.yml + + --- + - hosts: vyos_hosts + gather_facts: 'no' + tasks: + - name: Configure general settings for the vyos hosts group + vyos_config: + lines: + - set system name-server 192.0.2.1 + - set interfaces ethernet eth0 description '#WAN#' + - set interfaces ethernet eth1 description '#LAN#' + - set interfaces ethernet eth2 disable + - set interfaces ethernet eth3 disable + - set system host-name {{ inventory_hostname }} + save: true + +Start the playbook: +=================== + +.. stop_vyoslinter + +.. code-block:: none + + ansible-playbook -i hosts main.yml + PLAY [vyos_hosts] ************************************************************** + + TASK [Configure general settings for the vyos hosts group] ********************* + ok: [vyos9] + ok: [vyos10] + ok: [vyos7] + ok: [vyos8] + + PLAY RECAP ********************************************************************* + vyos10 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos7 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos8 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos9 : ok=2 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +.. start_vyoslinter + +Check the result on the vyos10 router: +====================================== + +.. code-block:: none + + vyos@vyos10:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 192.0.2.108/24 u/u WAN + eth1 - u/u LAN + eth2 - A/D + eth3 - A/D + lo 127.0.0.1/8 u/u + ::1/128 + + vyos@vyos10:~$ sh configuration commands | grep 192.0.2.1 + set system name-server '192.0.2.1' + +The simple way without configuration of the hostname (one task for all routers): +================================================================================ + +.. code-block:: none + + # nano /root/hosts_v2 + [vyos_hosts_group] + vyos7 ansible_ssh_host=192.0.2.105 + vyos8 ansible_ssh_host=192.0.2.106 + vyos9 ansible_ssh_host=192.0.2.107 + vyos10 ansible_ssh_host=192.0.2.108 + [vyos_hosts_group:vars] + ansible_python_interpreter=/usr/bin/python3 + ansible_user=vyos + ansible_ssh_pass=vyos + ansible_network_os=vyos + ansible_connection=network_cli + + # nano /root/main_v2.yml + --- + - hosts: vyos_hosts_group + connection: network_cli + gather_facts: 'no' + tasks: + - name: Configure remote vyos_hosts_group + vyos_config: + lines: + - set system name-server 192.0.2.1 + - set interfaces ethernet eth0 description WAN + - set interfaces ethernet eth1 description LAN + - set interfaces ethernet eth2 disable + - set interfaces ethernet eth3 disable + save: true + + +.. stop_vyoslinter + +.. code-block:: none + + # ansible-playbook -i hosts_v2 main_v2.yml + + PLAY [vyos_hosts_group] ******************************************************** + + TASK [Configure remote vyos_hosts_group] *************************************** + ok: [vyos8] + ok: [vyos7] + ok: [vyos9] + ok: [vyos10] + + PLAY RECAP ********************************************************************* + vyos10 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos7 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos8 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + vyos9 : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 + +.. start_vyoslinter + +In the next chapter of the example, we'll use Ansible with jinja2 +templates and variables. diff --git a/docs/configexamples/rst-azure-vpn-bgp.rst b/docs/configexamples/rst-azure-vpn-bgp.rst new file mode 100644 index 00000000..597a4d15 --- /dev/null +++ b/docs/configexamples/rst-azure-vpn-bgp.rst @@ -0,0 +1,138 @@ +:lastproofread: 2021-06-28 + +.. _examples-azure-vpn-bgp: + +############################################################ +Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) +############################################################ + +This guide shows an example of a route-based IKEv2 site-to-site VPN to +Azure using VTI and BGP for dynamic routing updates. + +For redundant / active-active configurations see +:ref:`examples-azure-vpn-dual-bgp` + + +Prerequisites +^^^^^^^^^^^^^ + +- A pair of Azure VNet Gateways deployed in active-passive + configuration with BGP enabled. + +- A local network gateway deployed in Azure representing + the Vyos device, matching the below Vyos settings except for + address space, which only requires the Vyos private IP, in + this example 10.10.0.5/32 + +- A connection resource deployed in Azure linking the + Azure VNet gateway and the local network gateway representing + the Vyos device. + +Example +^^^^^^^ + ++---------------------------------------+---------------------+ +| WAN Interface | eth0 | ++---------------------------------------+---------------------+ +| On-premises address space | 10.10.0.0/16 | ++---------------------------------------+---------------------+ +| Azure address space | 10.0.0.0/16 | ++---------------------------------------+---------------------+ +| Vyos public IP | 198.51.100.3 | ++---------------------------------------+---------------------+ +| Vyos private IP | 10.10.0.5 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway public IP | 203.0.113.2 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway BGP IP | 10.0.0.4 | ++---------------------------------------+---------------------+ +| Pre-shared key | ch00s3-4-s3cur3-psk | ++---------------------------------------+---------------------+ +| Vyos ASN | 64499 | ++---------------------------------------+---------------------+ +| Azure ASN | 65540 | ++---------------------------------------+---------------------+ + +Vyos configuration +^^^^^^^^^^^^^^^^^^ + +- Configure the IKE and ESP settings to match a subset + of those supported by Azure: + +.. code-block:: none + + set vpn ipsec esp-group AZURE lifetime '3600' + set vpn ipsec esp-group AZURE mode 'tunnel' + set vpn ipsec esp-group AZURE pfs 'dh-group2' + set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' + set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' + + set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' + set vpn ipsec ike-group AZURE dead-peer-detection interval '15' + set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' + set vpn ipsec ike-group AZURE ikev2-reauth + set vpn ipsec ike-group AZURE key-exchange 'ikev2' + set vpn ipsec ike-group AZURE lifetime '28800' + set vpn ipsec ike-group AZURE proposal 1 dh-group '2' + set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' + set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' + +- Enable IPsec on eth0 + +.. code-block:: none + + set vpn ipsec interface 'eth0' + +- Configure a VTI with a dummy IP address + +.. code-block:: none + + set interfaces vti vti1 address '10.10.1.5/32' + set interfaces vti vti1 description 'Azure Tunnel' + +- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. + +.. code-block:: none + + set interfaces vti vti1 ip adjust-mss 1350 + +- Configure the VPN tunnel + +.. code-block:: none + + set vpn ipsec authentication psk azure id '198.51.100.3' + set vpn ipsec authentication psk azure id '203.0.113.2' + set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' + set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3' + set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' + set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate' + set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' + set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' + set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' + set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' + set vpn ipsec site-to-site peer azure remote-address '203.0.113.2' + set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' + set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' + +- **Important**: Add an interface route to reach Azure's BGP listener + +.. code-block:: none + + set protocols static route 10.0.0.4/32 interface vti1 + +- Configure your BGP settings + +.. code-block:: none + + set protocols bgp system-as 64499 + set protocols bgp neighbor 10.0.0.4 remote-as '65540' + set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' + set protocols bgp neighbor 10.0.0.4 timers holdtime '30' + set protocols bgp neighbor 10.0.0.4 timers keepalive '10' + +- **Important**: Disable connected check \ + +.. code-block:: none + + set protocols bgp neighbor 10.0.0.4 disable-connected-check diff --git a/docs/configexamples/rst-azure-vpn-dual-bgp.rst b/docs/configexamples/rst-azure-vpn-dual-bgp.rst new file mode 100644 index 00000000..04a6a631 --- /dev/null +++ b/docs/configexamples/rst-azure-vpn-dual-bgp.rst @@ -0,0 +1,163 @@ +:lastproofread: 2021-06-28 + +.. _examples-azure-vpn-dual-bgp: + +###################################################################### +Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec) +###################################################################### + +This guide shows an example of a redundant (active-active) route-based IKEv2 +site-to-site VPN to Azure using VTI +and BGP for dynamic routing updates. + +Prerequisites +^^^^^^^^^^^^^ + +- A pair of Azure VNet Gateways deployed in active-active + configuration with BGP enabled. + +- A local network gateway deployed in Azure representing + the Vyos device, matching the below Vyos settings except for + address space, which only requires the Vyos private IP, in + this example 10.10.0.5/32 + +- A connection resource deployed in Azure linking the + Azure VNet gateway and the local network gateway representing + the Vyos device. + +Example +^^^^^^^ + ++---------------------------------------+---------------------+ +| WAN Interface | eth0 | ++---------------------------------------+---------------------+ +| On-premises address space | 10.10.0.0/16 | ++---------------------------------------+---------------------+ +| Azure address space | 10.0.0.0/16 | ++---------------------------------------+---------------------+ +| Vyos public IP | 198.51.100.3 | ++---------------------------------------+---------------------+ +| Vyos private IP | 10.10.0.5 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway 1 public IP | 203.0.113.2 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway 2 public IP | 203.0.113.3 | ++---------------------------------------+---------------------+ +| Azure VNet Gateway BGP IP | 10.0.0.4,10.0.0.5 | ++---------------------------------------+---------------------+ +| Pre-shared key | ch00s3-4-s3cur3-psk | ++---------------------------------------+---------------------+ +| Vyos ASN | 64499 | ++---------------------------------------+---------------------+ +| Azure ASN | 65540 | ++---------------------------------------+---------------------+ + +Vyos configuration +^^^^^^^^^^^^^^^^^^ + +- Configure the IKE and ESP settings to match a subset + of those supported by Azure: + +.. code-block:: none + + set vpn ipsec esp-group AZURE lifetime '3600' + set vpn ipsec esp-group AZURE mode 'tunnel' + set vpn ipsec esp-group AZURE pfs 'dh-group2' + set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256' + set vpn ipsec esp-group AZURE proposal 1 hash 'sha1' + + set vpn ipsec ike-group AZURE dead-peer-detection action 'restart' + set vpn ipsec ike-group AZURE dead-peer-detection interval '15' + set vpn ipsec ike-group AZURE dead-peer-detection timeout '30' + set vpn ipsec ike-group AZURE ikev2-reauth + set vpn ipsec ike-group AZURE key-exchange 'ikev2' + set vpn ipsec ike-group AZURE lifetime '28800' + set vpn ipsec ike-group AZURE proposal 1 dh-group '2' + set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256' + set vpn ipsec ike-group AZURE proposal 1 hash 'sha1' + +- Enable IPsec on eth0 + +.. code-block:: none + + set vpn ipsec interface 'eth0' + +- Configure two VTIs with a dummy IP address each + +.. code-block:: none + + set interfaces vti vti1 address '10.10.1.5/32' + set interfaces vti vti1 description 'Azure Primary Tunnel' + + set interfaces vti vti2 address '10.10.1.6/32' + set interfaces vti vti2 description 'Azure Secondary Tunnel' + +- Clamp the VTI's MSS to 1350 to avoid PMTU blackholes. + +.. code-block:: none + + set interfaces vti vti1 ip adjust-mss 1350 + set interfaces vti vti2 ip adjust-mss 1350 + +- Configure the VPN tunnels + +.. code-block:: none + + set vpn ipsec authentication psk azure id '198.51.100.3' + set vpn ipsec authentication psk azure id '203.0.113.2' + set vpn ipsec authentication psk azure id '203.0.113.3' + set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk' + + set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3' + set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2' + set vpn ipsec site-to-site peer azure-primary connection-type 'initiate' + set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL' + set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE' + set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit' + set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5' + set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2' + set vpn ipsec site-to-site peer azure-primary vti bind 'vti1' + set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE' + + set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3' + set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3' + set vpn ipsec site-to-site peer azure-secondary connection-type 'initiate' + set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL' + set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE' + set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit' + set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5' + set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3' + set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2' + set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE' + +- **Important**: Add an interface route to reach both Azure's BGP listeners + +.. code-block:: none + + set protocols static route 10.0.0.4/32 interface vti1 + set protocols static route 10.0.0.5/32 interface vti2 + +- Configure your BGP settings + +.. code-block:: none + + set protocols bgp system-as 64499 + set protocols bgp neighbor 10.0.0.4 remote-as '65540' + set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound' + set protocols bgp neighbor 10.0.0.4 timers holdtime '30' + set protocols bgp neighbor 10.0.0.4 timers keepalive '10' + + set protocols bgp neighbor 10.0.0.5 remote-as '65540' + set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration 'inbound' + set protocols bgp neighbor 10.0.0.5 timers holdtime '30' + set protocols bgp neighbor 10.0.0.5 timers keepalive '10' + +- **Important**: Disable connected check, otherwise the routes learned + from Azure will not be imported into the routing table. + +.. code-block:: none + + set protocols bgp neighbor 10.0.0.4 disable-connected-check + set protocols bgp neighbor 10.0.0.5 disable-connected-check diff --git a/docs/configexamples/rst-bgp-ipv6-unnumbered.rst b/docs/configexamples/rst-bgp-ipv6-unnumbered.rst new file mode 100644 index 00000000..f7a530d8 --- /dev/null +++ b/docs/configexamples/rst-bgp-ipv6-unnumbered.rst @@ -0,0 +1,176 @@ +:lastproofread: 2021-06-28 + +.. _examples-bgp-ipv6-unnumbered: + +######################################### +BGP IPv6 unnumbered with extended nexthop +######################################### + +General information can be found in the :ref:`routing-bgp` chapter. + +Configuration +============= + +- Router A: + +.. code-block:: none + + set protocols bgp system-as 64496 + set protocols bgp address-family ipv4-unicast redistribute connected + set protocols bgp address-family ipv6-unicast redistribute connected + set protocols bgp neighbor eth1 interface v6only + set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' + set protocols bgp neighbor eth2 interface v6only + set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' + set protocols bgp parameters bestpath as-path multipath-relax + set protocols bgp parameters bestpath compare-routerid + set protocols bgp parameters default no-ipv4-unicast + set protocols bgp parameters router-id '192.168.0.1' + set protocols bgp peer-group fabric address-family ipv4-unicast + set protocols bgp peer-group fabric address-family ipv6-unicast + set protocols bgp peer-group fabric capability extended-nexthop + set protocols bgp peer-group fabric remote-as 'external' + +- Router B: + +.. code-block:: none + + set protocols bgp system-as 64499 + set protocols bgp address-family ipv4-unicast redistribute connected + set protocols bgp address-family ipv6-unicast redistribute connected + set protocols bgp neighbor eth1 interface v6only + set protocols bgp neighbor eth1 interface v6only peer-group 'fabric' + set protocols bgp neighbor eth2 interface v6only + set protocols bgp neighbor eth2 interface v6only peer-group 'fabric' + set protocols bgp parameters bestpath as-path multipath-relax + set protocols bgp parameters bestpath compare-routerid + set protocols bgp parameters default no-ipv4-unicast + set protocols bgp parameters router-id '192.168.0.2' + set protocols bgp peer-group fabric address-family ipv4-unicast + set protocols bgp peer-group fabric address-family ipv6-unicast + set protocols bgp peer-group fabric capability extended-nexthop + set protocols bgp peer-group fabric remote-as 'external' + +Results +======= + +- Router A: + +.. code-block:: none + + vyos@vyos:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 198.51.100.34/24 u/u + eth1 - u/u + eth2 - u/u + lo 127.0.0.1/8 u/u + 192.168.0.1/32 + ::1/128 + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route + + S>* 0.0.0.0/0 [210/0] via 198.51.100.34, eth0, 03:21:53 + C>* 198.51.100.0/24 is directly connected, eth0, 03:21:53 + C>* 192.168.0.1/32 is directly connected, lo, 03:21:56 + B>* 192.168.0.2/32 [20/0] via fe80::a00:27ff:fe3b:7ed2, eth2, 00:05:07 + * via fe80::a00:27ff:fe7b:4000, eth1, 00:05:07 + +.. code-block:: none + + vyos@vyos:~$ ping 192.168.0.2 + PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data. + 64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.575 ms + 64 bytes from 192.168.0.2: icmp_seq=2 ttl=64 time=0.628 ms + 64 bytes from 192.168.0.2: icmp_seq=3 ttl=64 time=0.581 ms + 64 bytes from 192.168.0.2: icmp_seq=4 ttl=64 time=0.682 ms + 64 bytes from 192.168.0.2: icmp_seq=5 ttl=64 time=0.597 ms + + --- 192.168.0.2 ping statistics --- + 5 packets transmitted, 5 received, 0% packet loss, time 4086ms + rtt min/avg/max/mdev = 0.575/0.612/0.682/0.047 ms + +.. code-block:: none + + vyos@vyos:~$ show ip bgp summary + + IPv4 Unicast Summary: + BGP router identifier 192.168.0.1, local AS number 65020 vrf-id 0 + BGP table version 4 + RIB entries 5, using 800 bytes of memory + Peers 2, using 41 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd + eth1 4 64499 13 13 0 0 0 00:05:33 2 + eth2 4 64499 13 14 0 0 0 00:05:29 2 + + Total number of neighbors 2 + +- Router B: + +.. code-block:: none + + vyos@vyos:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 198.51.100.33/24 u/u + eth1 - u/u + eth2 - u/u + lo 127.0.0.1/8 u/u + 192.168.0.2/32 + ::1/128 + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route + + S>* 0.0.0.0/0 [210/0] via 198.51.100.33, eth0, 00:44:08 + C>* 198.51.100.0/24 is directly connected, eth0, 00:44:09 + B>* 192.168.0.1/32 [20/0] via fe80::a00:27ff:fe2d:205d, eth1, 00:06:18 + * via fe80::a00:27ff:fe93:e142, eth2, 00:06:18 + C>* 192.168.0.2/32 is directly connected, lo, 00:44:11 + +.. code-block:: none + + vyos@vyos:~$ ping 192.168.0.1 + PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data. + 64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.427 ms + 64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.471 ms + 64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.782 ms + 64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.715 ms + + --- 192.168.0.1 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3051ms + rtt min/avg/max/mdev = 0.427/0.598/0.782/0.155 ms + +.. code-block:: none + + vyos@vyos:~$ show ip bgp summary + IPv4 Unicast Summary: + BGP router identifier 192.168.0.2, local AS number 65021 vrf-id 0 + BGP table version 4 + RIB entries 5, using 800 bytes of memory + Peers 2, using 41 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd + eth1 4 64496 14 14 0 0 0 00:06:40 2 + eth2 4 64496 14 14 0 0 0 00:06:37 2 + + Total number of neighbors 2 + diff --git a/docs/configexamples/rst-dmvpn-dualhub-dualcloud.rst b/docs/configexamples/rst-dmvpn-dualhub-dualcloud.rst new file mode 100644 index 00000000..a3a4e619 --- /dev/null +++ b/docs/configexamples/rst-dmvpn-dualhub-dualcloud.rst @@ -0,0 +1,559 @@ +:lastproofread: 2024-02-21 + +.. _examples-dmvpn-dualhub-dualcloud: + +######################### +DMVPN Dual HUB Dual Cloud +######################### + +This document is to describe a basic setup to build DVMPN network with +two Hubs and two clouds using DMVPN Phase3. +OSPF is used as routing protocol inside DMVPN. + +In this example we use VyOS 1.5 as HUBs and Spokes (HUB-1, HUB-2, +SPOKE-2, SPOKE-3) and Cisco IOSv 15.5(3)M (SPOKE-1) as a Spoke. + +Network Topology +================ + +.. image:: /_static/images/dual-hub-DMVPN.* + :width: 80% + :align: center + :alt: DMVPN Network Topology + +Configurations +============== + +Underlay configuration +______________________ + +Networks 192.168.X.0/24 are used as LANs for every spoke. + +HUB-1 + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.0.2/30' + set protocols static route 0.0.0.0/0 next-hop 10.0.0.1 + +HUB-2 + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.1.2/30' + set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 + +Spoke-1 + +.. code-block:: none + + interface GigabitEthernet0/0 + ip address 10.0.11.2 255.255.255.252 + duplex auto + speed auto + media-type rj45 + ! + interface GigabitEthernet0/1 + ip address 192.168.11.1 255.255.255.0 + ip ospf 1 area 0 + duplex auto + speed auto + media-type rj45 + ! + ip route 0.0.0.0 0.0.0.0 10.0.11.1 + +Spoke-2 + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.12.2/30' + set interfaces ethernet eth1 address '192.168.12.1/24' + set protocols static route 0.0.0.0/0 next-hop 10.0.12.1 + +Spoke-3 + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.13.2/30' + set interfaces ethernet eth1 address '192.168.13.1/24' + set protocols static route 0.0.0.0/0 next-hop 10.0.13.1 + +NHRP configuration +__________________ + +The next step is to configure the NHRP protocol. In a Dual cloud +network, every HUB has to be configured with one GRE multipoint tunnel +interface and every spoke has to be configured with two tunnel +interfaces, one tunnel to each hub. +In this example tunnel networks are 10.100.100.0/24 for the first cloud +and 10.100.101.0/24 for the second cloud. +But VyOS uses FRR for NHRP, that is why the tunnel address mask must be /32. + +HUB-1 + +.. code-block:: none + + set interfaces tunnel tun100 address '10.100.100.1/32' + set interfaces tunnel tun100 enable-multicast + set interfaces tunnel tun100 encapsulation 'gre' + set interfaces tunnel tun100 ip adjust-mss '1360' + set interfaces tunnel tun100 mtu '1436' + set interfaces tunnel tun100 parameters ip key '42' + set interfaces tunnel tun100 source-interface 'eth0' + set protocols nhrp tunnel tun100 authentication 'vyos' + set protocols nhrp tunnel tun100 holdtime '300' + set protocols nhrp tunnel tun100 multicast 'dynamic' + set protocols nhrp tunnel tun100 network-id '1' + set protocols nhrp tunnel tun100 redirect + set protocols nhrp tunnel tun100 registration-no-unique + +HUB-2 + +.. code-block:: none + + set interfaces tunnel tun101 address '10.100.101.1/32' + set interfaces tunnel tun101 enable-multicast + set interfaces tunnel tun101 encapsulation 'gre' + set interfaces tunnel tun101 ip adjust-mss '1360' + set interfaces tunnel tun101 mtu '1436' + set interfaces tunnel tun101 parameters ip key '43' + set interfaces tunnel tun101 source-interface 'eth0' + set protocols nhrp tunnel tun101 authentication 'vyos' + set protocols nhrp tunnel tun101 holdtime '300' + set protocols nhrp tunnel tun101 multicast 'dynamic' + set protocols nhrp tunnel tun101 network-id '2' + set protocols nhrp tunnel tun101 redirect + set protocols nhrp tunnel tun101 registration-no-unique + +Spoke-1 + +.. code-block:: none + + interface Tunnel100 + ip address 10.100.100.11 255.255.255.0 + no ip redirects + ip mtu 1436 + ip nhrp authentication vyos + ip nhrp map multicast 10.0.0.2 + ip nhrp network-id 1 + ip nhrp holdtime 300 + ip nhrp nhs 10.100.100.1 nbma 10.0.0.2 + ip nhrp shortcut + ip tcp adjust-mss 1360 + tunnel source GigabitEthernet0/0 + tunnel mode gre multipoint + tunnel key 42 + ! + interface Tunnel101 + ip address 10.100.101.11 255.255.255.0 + no ip redirects + ip mtu 1436 + ip nhrp authentication vyos + ip nhrp map multicast 10.0.1.2 + ip nhrp network-id 2 + ip nhrp holdtime 300 + ip nhrp nhs 10.100.101.1 nbma 10.0.1.2 + ip nhrp shortcut + ip tcp adjust-mss 1360 + tunnel source GigabitEthernet0/0 + tunnel mode gre multipoint + tunnel key 43 + + +Spoke-2 + +.. code-block:: none + + set interfaces tunnel tun100 address '10.100.100.12/32' + set interfaces tunnel tun100 enable-multicast + set interfaces tunnel tun100 encapsulation 'gre' + set interfaces tunnel tun100 ip adjust-mss '1360' + set interfaces tunnel tun100 mtu '1436' + set interfaces tunnel tun100 parameters ip key '42' + set interfaces tunnel tun100 source-interface 'eth0' + set interfaces tunnel tun101 address '10.100.101.12/32' + set interfaces tunnel tun101 enable-multicast + set interfaces tunnel tun101 encapsulation 'gre' + set interfaces tunnel tun101 ip adjust-mss '1360' + set interfaces tunnel tun101 mtu '1436' + set interfaces tunnel tun101 parameters ip key '43' + set interfaces tunnel tun101 source-interface 'eth0' + set protocols nhrp tunnel tun100 authentication 'vyos' + set protocols nhrp tunnel tun100 holdtime '300' + set protocols nhrp tunnel tun100 multicast '10.0.0.2' + set protocols nhrp tunnel tun100 network-id '1' + set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' + set protocols nhrp tunnel tun100 registration-no-unique + set protocols nhrp tunnel tun100 shortcut + set protocols nhrp tunnel tun101 authentication 'vyos' + set protocols nhrp tunnel tun101 holdtime '300' + set protocols nhrp tunnel tun101 multicast '10.0.1.2' + set protocols nhrp tunnel tun101 network-id '2' + set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' + set protocols nhrp tunnel tun101 registration-no-unique + set protocols nhrp tunnel tun101 shortcut + +Spoke-3 + +.. code-block:: none + + set protocols nhrp tunnel tun100 authentication 'vyos' + set protocols nhrp tunnel tun100 holdtime '300' + set protocols nhrp tunnel tun100 multicast '10.0.0.2' + set protocols nhrp tunnel tun100 network-id '1' + set protocols nhrp tunnel tun100 nhs tunnel-ip dynamic nbma '10.0.0.2' + set protocols nhrp tunnel tun100 registration-no-unique + set protocols nhrp tunnel tun100 shortcut + set protocols nhrp tunnel tun101 authentication 'vyos' + set protocols nhrp tunnel tun101 holdtime '300' + set protocols nhrp tunnel tun101 multicast '10.0.1.2' + set protocols nhrp tunnel tun101 network-id '2' + set protocols nhrp tunnel tun101 nhs tunnel-ip dynamic nbma '10.0.1.2' + set protocols nhrp tunnel tun101 registration-no-unique + set protocols nhrp tunnel tun101 shortcut + +Overlay configuration +_____________________ + +The last step is to configure the routing protocol. In this scenario, +OSPF was chosen as the dynamic routing protocol. +But you can use iBGP or eBGP. To form fast convergence it is possible +to use BFD protocol. + + +HUB-1 + +.. code-block:: none + + set protocols ospf interface tun100 area '0' + set protocols ospf interface tun100 network 'point-to-multipoint' + set protocols ospf interface tun100 passive disable + set protocols ospf passive-interface 'default' + +HUB-2 + +.. code-block:: none + + set protocols ospf interface tun101 area '0' + set protocols ospf interface tun101 network 'point-to-multipoint' + set protocols ospf interface tun101 passive disable + set protocols ospf passive-interface 'default' + +Spoke-1 + +.. code-block:: none + + interface Tunnel100 + ip ospf network point-to-multipoint + ip ospf dead-interval 40 + ip ospf hello-interval 10 + ip ospf 1 area 0 + ! + interface Tunnel101 + ip ospf network point-to-multipoint + ip ospf dead-interval 40 + ip ospf hello-interval 10 + ip ospf 1 area 0 + ! + router ospf 1 + passive-interface default + no passive-interface Tunnel100 + no passive-interface Tunnel101 + +Spoke-2 + +.. code-block:: none + + set protocols ospf interface eth1 area '0' + set protocols ospf interface tun100 area '0' + set protocols ospf interface tun100 network 'point-to-multipoint' + set protocols ospf interface tun100 passive disable + set protocols ospf interface tun101 area '0' + set protocols ospf interface tun101 network 'point-to-multipoint' + set protocols ospf interface tun101 passive disable + set protocols ospf passive-interface 'default' + +Spoke-3 + +.. code-block:: none + + set protocols ospf interface eth1 area '0' + set protocols ospf interface tun100 area '0' + set protocols ospf interface tun100 network 'point-to-multipoint' + set protocols ospf interface tun100 passive disable + set protocols ospf interface tun101 area '0' + set protocols ospf interface tun101 network 'point-to-multipoint' + set protocols ospf interface tun101 passive disable + set protocols ospf passive-interface 'default' + +Security configuration +______________________ + +Tunnels can be encrypted by IPSEC for security. + +HUB-1 + + .. code-block:: none + + set vpn ipsec esp-group ESP-HUB lifetime '1800' + set vpn ipsec esp-group ESP-HUB mode 'transport' + set vpn ipsec esp-group ESP-HUB pfs 'disable' + set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' + set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' + set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' + set vpn ipsec ike-group IKE-HUB lifetime '3600' + set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' + set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' + set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' + set vpn ipsec interface 'eth0' + set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' + set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' + set vpn ipsec profile NHRPVPN bind tunnel 'tun100' + set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' + set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' + +HUB-2 + + .. code-block:: none + + set vpn ipsec esp-group ESP-HUB lifetime '1800' + set vpn ipsec esp-group ESP-HUB mode 'transport' + set vpn ipsec esp-group ESP-HUB pfs 'disable' + set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' + set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' + set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' + set vpn ipsec ike-group IKE-HUB lifetime '3600' + set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' + set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' + set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' + set vpn ipsec interface 'eth0' + set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' + set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' + set vpn ipsec profile NHRPVPN bind tunnel 'tun101' + set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' + set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' + +VyOS Spokes have the same configuration + + .. code-block:: none + + set vpn ipsec esp-group ESP-HUB lifetime '1800' + set vpn ipsec esp-group ESP-HUB mode 'transport' + set vpn ipsec esp-group ESP-HUB pfs 'disable' + set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256' + set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1' + set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1' + set vpn ipsec ike-group IKE-HUB lifetime '3600' + set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2' + set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256' + set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1' + set vpn ipsec interface 'eth0' + set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret' + set vpn ipsec profile NHRPVPN authentication pre-shared-secret 'secret' + set vpn ipsec profile NHRPVPN bind tunnel 'tun100' + set vpn ipsec profile NHRPVPN bind tunnel 'tun101' + set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB' + set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB' + +SPOKE-1 + + .. code-block:: none + + crypto isakmp policy 1 + encr aes 256 + authentication pre-share + group 2 + lifetime 3600 + crypto isakmp key secret address 0.0.0.0 + ! + ! + crypto ipsec transform-set ESP_TRANSFORMSET esp-aes 256 esp-sha-hmac + mode transport + ! + ! + crypto ipsec profile gre_protection + set security-association lifetime seconds 1800 + set transform-set ESP_TRANSFORMSET + ! + interface Tunnel100 + tunnel protection ipsec profile gre_protection shared + ! + interface Tunnel101 + tunnel protection ipsec profile gre_protection shared + +Monitoring +========== + +All spokes created IPSec tunnels to Hubs, are registered on Hubs using +NHRP protocol and formed adjacency in OSPF. + +.. code-block:: none + + vyos@HUB-1:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + -------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------ + dmvpn-NHRPVPN-tun100-child up 6m1s 4K/5K 51/56 10.0.13.2 10.0.13.2 AES_CBC_256/HMAC_SHA1_96 + dmvpn-NHRPVPN-tun100-child up 6m36s 4K/6K 56/65 10.0.12.2 10.0.12.2 AES_CBC_256/HMAC_SHA1_96 + dmvpn-NHRPVPN-tun100-child up 8m49s 6K/6K 73/77 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96 + + vyos@HUB-1:~$ show ip nhrp cache + Iface Type Protocol NBMA Claimed NBMA Flags Identity + tun100 dynamic 10.100.100.12 10.0.12.2 10.0.12.2 T 10.0.12.2 + tun100 dynamic 10.100.100.13 10.0.13.2 10.0.13.2 T 10.0.13.2 + tun100 dynamic 10.100.100.11 10.0.11.2 10.0.11.2 T 10.0.11.2 + tun100 local 10.100.100.1 10.0.0.2 10.0.0.2 - + + vyos@HUB-1:~$ show ip ospf neighbor + + Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL + 192.168.11.1 1 Full/DROther 17m01s 36.201s 10.100.100.11 tun100:10.100.100.1 0 0 0 + 192.168.12.1 1 Full/DROther 9m42s 37.443s 10.100.100.12 tun100:10.100.100.1 0 0 0 + 192.168.13.1 1 Full/DROther 9m15s 35.053s 10.100.100.13 tun100:10.100.100.1 0 0 0 + + +First, we see that LANs are accessible through hubs using OSPF routes. + +.. code-block:: none + + SPOKE-1#show ip route + Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP + D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area + N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 + E1 - OSPF external type 1, E2 - OSPF external type 2 + i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 + ia - IS-IS inter area, * - candidate default, U - per-user static route + o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + a - application route + + - replicated route, % - next hop override, p - overrides from PfR + + Gateway of last resort is 10.0.11.1 to network 0.0.0.0 + ..... + 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks + C 192.168.11.0/24 is directly connected, GigabitEthernet0/1 + L 192.168.11.1/32 is directly connected, GigabitEthernet0/1 + O 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101 + [110/1002] via 10.100.100.1, 00:16:13, Tunnel100 + O 192.168.13.0/24 [110/1002] via 10.100.101.1, 00:14:36, Tunnel101 + [110/1002] via 10.100.100.1, 00:15:45, Tunnel100 + + + vyos@SPOKE-2:~$ show ip route + Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + ...... + O>* 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36 + * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36 + O 192.168.12.0/24 [110/1] is directly connected, eth1, weight 1, 01:24:40 + C>* 192.168.12.0/24 is directly connected, eth1, weight 1, 01:24:43 + L>* 192.168.12.1/32 is directly connected, eth1, weight 1, 01:24:43 + O>* 192.168.13.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:12:36 + * via 10.100.101.1, tun101 onlink, weight 1, 00:12:36 + +After initiating traffic between SPOKES sites, Phase 3 of DMVPN will work. +For instance, traceroute was generated from PC-SPOKE-2 to PC-SPOKE-1 + +.. code-block:: none + + PC-SPOKE-2 : 192.168.12.2 255.255.255.0 gateway 192.168.12.1 + + PC-SPOKE-2> trace 192.168.11.2 + trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop + 1 192.168.12.1 0.558 ms 0.378 ms 0.561 ms + 2 10.100.101.1 1.768 ms 1.158 ms 1.744 ms + 3 10.100.101.11 7.196 ms 4.971 ms 4.793 ms + 4 *192.168.11.2 7.747 ms (ICMP type:3, code:3, Destination port unreachable) + + PC-SPOKE-2> trace 192.168.11.2 + trace to 192.168.11.2, 8 hops max, press Ctrl+C to stop + 1 192.168.12.1 0.562 ms 0.396 ms 0.364 ms + 2 10.100.100.11 4.401 ms 4.399 ms 4.174 ms + 3 *192.168.11.2 3.241 ms (ICMP type:3, code:3, Destination port unreachable) + +First trace goes via HUB but the second goes directly from SPOKE-1 to SPOKE-2. +Now routing tables are changed. LAN networks 192.168.12.0/24 and +192.168.11.0/24 available directly via SPOKES. + +.. code-block:: none + + vyos@SPOKE-2:~$ show ip route + Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + N>* 192.168.11.0/24 [10/0] via 10.100.100.11, tun100 onlink, weight 1, 00:00:14 + O 192.168.11.0/24 [110/3] via 10.100.100.1, tun100 onlink, weight 1, 00:00:54 + via 10.100.101.1, tun101 onlink, weight 1, 00:00:54 + + + SPOKE-1# show ip route next-hop-override + Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP + D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area + N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 + E1 - OSPF external type 1, E2 - OSPF external type 2 + i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 + ia - IS-IS inter area, * - candidate default, U - per-user static route + o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + a - application route + + - replicated route, % - next hop override, p - overrides from PfR + + Gateway of last resort is 10.0.11.1 to network 0.0.0.0 + + O % 192.168.12.0/24 [110/1002] via 10.100.101.1, 00:24:09, Tunnel101 + [110/1002] via 10.100.100.1, 00:25:46, Tunnel100 + [NHO][110/1] via 10.100.100.12, 00:00:03, Tunnel100 + +NHRP shows shortcuts on Spokes + +.. code-block:: none + + vyos@SPOKE-2:~$ show ip nhrp shortcut + Type Prefix Via Identity + dynamic 192.168.11.0/24 10.100.100.11 10.0.11.2 + + SPOKE-1# show ip nhrp shortcut + 10.100.100.12/32 via 10.100.100.12 + Tunnel100 created 00:09:59, expire 00:02:21 + Type: dynamic, Flags: router nhop rib nho + NBMA address: 10.0.12.2 + 192.168.12.0/24 via 10.100.100.12 + Tunnel100 created 00:02:38, expire 00:02:21 + Type: dynamic, Flags: router rib nho + NBMA address: 10.0.12.2 + +A new Spoke to Spoke IPSec tunnel is created + +.. code-block:: none + + SPOKE-1#show crypto isakmp sa + IPv4 Crypto ISAKMP SA + dst src state conn-id status + 10.0.0.2 10.0.11.2 QM_IDLE 1002 ACTIVE + 10.0.12.2 10.0.11.2 QM_IDLE 1004 ACTIVE + 10.0.1.2 10.0.11.2 QM_IDLE 1003 ACTIVE + + vyos@SPOKE-2:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + -------------------------- ------- -------- -------------- ---------------- ---------------- ----------- ------------------------ + dmvpn-NHRPVPN-tun100-child up 7m26s 4K/4K 57/53 10.0.0.2 10.0.0.2 AES_CBC_256/HMAC_SHA1_96 + dmvpn-NHRPVPN-tun100-child up 11m48s 316B/1K 3/15 10.0.11.2 10.0.11.2 AES_CBC_256/HMAC_SHA1_96 + dmvpn-NHRPVPN-tun101-child up 5m58s 5K/4K 62/51 10.0.1.2 10.0.1.2 AES_CBC_256/HMAC_SHA1_96 + +Summary +======= + +If one of the Hubs loses connectivity to the Internet, the other Hub +will be available and take the main role. +This is a simple example where only one internet connection is used. +But in the real world, there can be two connections to the Internet. +In this case, there is a recommendation to build each tunnel via each +Internet connection, choose the main cloud, and manipulate traffic via +a routing protocol. It allows the creation failover on link-level +connections too. \ No newline at end of file diff --git a/docs/configexamples/rst-firewall.rst b/docs/configexamples/rst-firewall.rst new file mode 100644 index 00000000..6968eb04 --- /dev/null +++ b/docs/configexamples/rst-firewall.rst @@ -0,0 +1,15 @@ +:lastproofread: 2024-09-11 + +################# +Firewall Examples +################# + +This section contains examples of firewall configurations for various +deployments. + +.. toctree:: + :maxdepth: 2 + + fwall-and-vrf + fwall-and-bridge + zone-policy diff --git a/docs/configexamples/rst-fwall-and-bridge.rst b/docs/configexamples/rst-fwall-and-bridge.rst new file mode 100644 index 00000000..134dd6c0 --- /dev/null +++ b/docs/configexamples/rst-fwall-and-bridge.rst @@ -0,0 +1,502 @@ +:lastproofread: 2024-09-11 + +########################### +Bridge and firewall example +########################### + +Scenario and requirements +^^^^^^^^^^^^^^^^^^^^^^^^^ + +This example shows how to configure a VyOS router with bridge interfaces and +firewall rules. + +Three non VLAN-aware bridges are going to be configured, and each one has its +own requirements. + +* Bridge br0: + * Isolated layer 2 bridge. + * Accept only IPv6 communication whithin the bridge. + +* Bridge br1: + * Drop all DHCP discover packets. + * Accept all ARP packets. + * Within the bridge, accept only new IPv4 connections from host 10.1.1.102 + * Drop all other IPv4 connections. + * Drop all IPv6 connections. + * Accept access to router itself. + * Allow connections to internet + * Drop connections to other LANs. + +* Bridge br2: + * Accept all DHCP discover packets. + * Accept only DHCP offers from valid server and|or trusted bridge port. + * Accept all ARP packets. + * Accept all IPv4 connections. + * Drop all IPv6 connections. + * Deny access to the router. + * Allow connections to internet. + * Allow connections to bridge br1. + +Configuration +^^^^^^^^^^^^^ + +Bridges and interfaces configuration +"""""""""""""""""""""""""""""""""""" + +First, we need to configure the interfaces and bridges: + +.. code-block:: none + + # Brige br0 + set interfaces bridge br0 description 'Isolated L2 bridge' + set interfaces bridge br0 member interface eth1 + set interfaces bridge br0 member interface eth2 + set interfaces ethernet eth1 description 'br0' + set interfaces ethernet eth2 description 'br0' + + # Bridge br1: + set interfaces bridge br1 address '10.1.1.1/24' + set interfaces bridge br1 description 'L3 bridge br1' + set interfaces bridge br1 member interface eth3 + set interfaces bridge br1 member interface eth4 + set interfaces ethernet eth3 description 'br1' + set interfaces ethernet eth4 description 'br1' + + # Bridge br2: + set interfaces bridge br2 address '10.2.2.1/24' + set interfaces bridge br2 description 'L3 bridge br2' + set interfaces bridge br2 member interface eth5 + set interfaces bridge br2 member interface eth6 + set interfaces bridge br2 member interface eth7 + set interfaces ethernet eth5 description 'br2 - Host' + set interfaces ethernet eth6 description 'br2 - Trusted DHCP Server' + set interfaces ethernet eth7 description 'br2' + +Bridge firewall configuration +""""""""""""""""""""""""""""" + +In this section, we are going to configure the firewall rules that will be used +in bridge firewall, and will control the traffic within each bridge. + +We are going to use custom firewall rulesets, one for each bridge that will +be used in ``prerouting``, and one for each bridge that will be used in the +``forward`` chain. + +Also, we are going to use firewall interface groups in order to simplify the +firewall configuration. + +So first, let's create the required firewall interface groups: + +.. code-block:: none + + # Bridge br0 interface-group: + set firewall group interface-group br0-ifaces interface 'br0' + set firewall group interface-group br0-ifaces interface 'eth1' + set firewall group interface-group br0-ifaces interface 'eth2' + + # Bridge br1 interface-group: + set firewall group interface-group br1-ifaces interface 'br1' + set firewall group interface-group br1-ifaces interface 'eth3' + set firewall group interface-group br1-ifaces interface 'eth4' + + # Bridge br2 interface-group: + set firewall group interface-group br2-ifaces interface 'br2' + set firewall group interface-group br2-ifaces interface 'eth5' + set firewall group interface-group br2-ifaces interface 'eth6' + set firewall group interface-group br2-ifaces interface 'eth7' + +As said before, we are going to create custom firewall rulesets for each +bridge, that will be used in the ``prerouting`` chain, in order to drop as much +unwanted traffic as early as possible. So, custom rulesets used in +``prerouting`` chain are going to be ``br0-pre``, ``br1-pre``, and ``br2-pre``: + +.. code-block:: none + + # Prerouting - Catch all traffic for br0 + set firewall bridge prerouting filter rule 10 action 'jump' + set firewall bridge prerouting filter rule 10 description 'br0 traffic' + set firewall bridge prerouting filter rule 10 inbound-interface group 'br0-ifaces' + set firewall bridge prerouting filter rule 10 jump-target 'br0-pre' + + # Prerouting - Catch all traffic for br1 + set firewall bridge prerouting filter rule 20 action 'jump' + set firewall bridge prerouting filter rule 20 description 'br1 traffic' + set firewall bridge prerouting filter rule 20 inbound-interface group 'br1-ifaces' + set firewall bridge prerouting filter rule 20 jump-target 'br1-pre' + + # Prerouting - Catch all traffic for br2 + set firewall bridge prerouting filter rule 30 action 'jump' + set firewall bridge prerouting filter rule 30 description 'br2 traffic' + set firewall bridge prerouting filter rule 30 inbound-interface group 'br2-ifaces' + set firewall bridge prerouting filter rule 30 jump-target 'br2-pre' + +And then create the custom rulesets: + +.. code-block:: none + + ### br0 - br0-pre + # Requirements: accept only IPv6 communication within the bridge + set firewall bridge name br0-pre rule 10 description 'Accept IPv6 traffic' + set firewall bridge name br0-pre rule 10 action 'accept' + set firewall bridge name br0-pre rule 10 ethernet-type 'ipv6' + # And drop everything else + set firewall bridge name br0-pre default-action 'drop' + + ### br1 - br1-pre + # Requirements: drop all DHCP discover packets + set firewall bridge name br1-pre rule 10 description 'Drop DHCP discover' + set firewall bridge name br1-pre rule 10 action 'drop' + set firewall bridge name br1-pre rule 10 protocol 'udp' + set firewall bridge name br1-pre rule 10 source port '68' + set firewall bridge name br1-pre rule 10 destination port '67' + set firewall bridge name br1-pre rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff' + set firewall bridge name br1-pre rule 10 log + # Requirement: drop all IPv6 connections + set firewall bridge name br1-pre rule 20 description 'Drop IPv6 traffic' + set firewall bridge name br1-pre rule 20 action 'drop' + set firewall bridge name br1-pre rule 20 ethernet-type 'ipv6' + # Accept everything else so it can be parsed later + set firewall bridge name br1-pre default-action 'accept' + + ### br2 - br2-pre + # Requirements: drop all IPv6 connections + set firewall bridge name br2-pre rule 10 description 'Drop IPv6 traffic' + set firewall bridge name br2-pre rule 10 action 'drop' + set firewall bridge name br2-pre rule 10 ethernet-type 'ipv6' + # Accept everything else so it can be parsed later + set firewall bridge name br2-pre default-action 'accept' + +Now, in the ``forward`` chain, we are going to define state policies, and +custom rulesets for each bridge that would be used in the ``forward`` chain. +These rulesets are ``br0-fwd``, ``br1-fwd``, and ``br2-fwd``: + +.. code-block:: none + + # Forward - State policies if not defined globally + set firewall bridge forward filter rule 5 action 'accept' + set firewall bridge forward filter rule 5 state 'established' + set firewall bridge forward filter rule 5 state 'related' + set firewall bridge forward filter rule 10 action 'drop' + set firewall bridge forward filter rule 10 state 'invalid' + + # Forward - Catch all traffic for br0 + set firewall bridge forward filter rule 110 description 'br0 traffic' + set firewall bridge forward filter rule 110 action 'jump' + set firewall bridge forward filter rule 110 inbound-interface group 'br0-ifaces' + set firewall bridge forward filter rule 110 jump-target 'br0-fwd' + + # Forward - Catch all traffic for br1 + set firewall bridge forward filter rule 120 description 'br1 traffic' + set firewall bridge forward filter rule 120 action 'jump' + set firewall bridge forward filter rule 120 inbound-interface group 'br1-ifaces' + set firewall bridge forward filter rule 120 jump-target 'br1-fwd' + + # Forward - Catch all traffic for br2 + set firewall bridge forward filter rule 130 description 'br2 traffic' + set firewall bridge forward filter rule 130 action 'jump' + set firewall bridge forward filter rule 130 inbound-interface group 'br2-ifaces' + set firewall bridge forward filter rule 130 jump-target 'br2-fwd' + + # Forward - Default action drop: + set firewall bridge forward filter default-action 'drop' + +And the content of the custom rulesets: + +.. code-block:: none + + ### br0 - br0-fwd + # Accept everything that wasn't dropped in prerouting + set firewall bridge name br0-fwd default-action 'accept' + + ### br1 - br1-fwd + # Requirement: Accept all ARP packets + set firewall bridge name br1-fwd rule 10 description 'Accept ARP' + set firewall bridge name br1-fwd rule 10 action 'accept' + set firewall bridge name br1-fwd rule 10 ethernet-type 'arp' + # Requirement: Accept only new IPv4 connections from host 10.1.1.102 + set firewall bridge name br1-fwd rule 20 description 'Accept ipv4 from host' + set firewall bridge name br1-fwd rule 20 action 'accept' + set firewall bridge name br1-fwd rule 20 source address '10.1.1.102' + set firewall bridge name br1-fwd rule 20 state 'new' + # Drop everythin else within the bridge: + set firewall bridge name br1-fwd default-action 'drop' + + ### br2 - br2-fwd + # Requirement: Accept all DHCP discover packets + set firewall bridge name br2-fwd rule 10 description 'Accept DHCP discover' + set firewall bridge name br2-fwd rule 10 action 'accept' + set firewall bridge name br2-fwd rule 10 protocol 'udp' + set firewall bridge name br2-fwd rule 10 source port '68' + set firewall bridge name br2-fwd rule 10 destination port '67' + set firewall bridge name br2-fwd rule 10 destination mac-address 'ff:ff:ff:ff:ff:ff' + # Requirement: Accept only DHCP offers from valid server on port eth6 + set firewall bridge name br2-fwd rule 20 description 'Accept DHCP offers from trusted interface' + set firewall bridge name br2-fwd rule 20 action 'accept' + set firewall bridge name br2-fwd rule 20 protocol 'udp' + set firewall bridge name br2-fwd rule 20 source port '67' + set firewall bridge name br2-fwd rule 20 destination port '68' + set firewall bridge name br2-fwd rule 20 inbound-interface name 'eth6' + set firewall bridge name br2-fwd rule 22 description 'Drop all other DHCP offers' + set firewall bridge name br2-fwd rule 22 action 'drop' + set firewall bridge name br2-fwd rule 22 protocol 'udp' + set firewall bridge name br2-fwd rule 22 source port '67' + set firewall bridge name br2-fwd rule 22 destination port '68' + set firewall bridge name br2-fwd rule 22 log + + # Accept all ARP packets + set firewall bridge name br2-fwd rule 30 description 'Accept ARP' + set firewall bridge name br2-fwd rule 30 action 'accept' + set firewall bridge name br2-fwd rule 30 ethernet-type 'arp' + # Accept all IPv4 connections + set firewall bridge name br2-fwd rule 40 description 'Accept ipv4' + set firewall bridge name br2-fwd rule 40 action 'accept' + set firewall bridge name br2-fwd rule 40 ethernet-type 'ipv4' + # Drop everything else + set firewall bridge name br2-fwd default-action 'drop' + + +IP firewall configuration +""""""""""""""""""""""""" + +Since some of the requirements listed above exceed the capabilities of the +bridge firewall, we need to use the IP firewall to implement them. +For bridge br1 and br2, we need to control the traffic that is going to the +router itself, to other local networks, and to the Internet. + +As a reminder, here's a link to the :doc:`firewall documentation +`, where you can find more information about +the packet flow for traffic that comes from bridge layer and should be analized +by the IP firewall. + +Access to the router itself is controlled by the base chain ``input``, and +rules to accomplish all the requirements are: + +.. code-block:: none + + # First of all, if not using global state policies, we need to define them: + set firewall ipv4 input filter rule 10 state 'established' + set firewall ipv4 input filter rule 10 state 'related' + set firewall ipv4 input filter rule 10 action 'accept' + set firewall ipv4 input filter rule 20 state 'invalid' + set firewall ipv4 input filter rule 20 action 'drop' + + # Input - br1 - Accept access to router itself + set firewall ipv4 input filter rule 110 description "Accept access from br1" + set firewall ipv4 input filter rule 110 action 'accept' + set firewall ipv4 input filter rule 110 inbound-interface group 'br1-ifaces' + + # Input - br2 - Deny access to the router + set firewall ipv4 input filter rule 120 description "Deny access from br2" + set firewall ipv4 input filter rule 120 action 'drop' + set firewall ipv4 input filter rule 120 inbound-interface group 'br2-ifaces' + +And for traffic that is going to other local networks, and to he Internet, we +need to use the base chain ``forward``. As in the bridge firewall, we are +going to use custom rulesets for each bridge, that would be used in the +``forward`` chain. Those rulesets are ``ip-br1-fwd`` and ``ip-br2-fwd``: + +.. code-block:: none + + # First of all, if not using global state policies, we need to define them: + set firewall ipv4 forward filter rule 5 action 'accept' + set firewall ipv4 forward filter rule 5 state 'established' + set firewall ipv4 forward filter rule 5 state 'related' + set firewall ipv4 forward filter rule 10 action 'drop' + set firewall ipv4 forward filter rule 10 state 'invalid' + + # Forward - Catch all traffic for br1 + set firewall ipv4 forward filter rule 110 description 'br1 traffic' + set firewall ipv4 forward filter rule 110 action 'jump' + set firewall ipv4 forward filter rule 110 inbound-interface group 'br1-ifaces' + set firewall ipv4 forward filter rule 110 jump-target 'ip-br1-fwd' + + # Forward - Catch all traffic for br2 + set firewall ipv4 forward filter rule 120 description 'br2 traffic' + set firewall ipv4 forward filter rule 120 action 'jump' + set firewall ipv4 forward filter rule 120 inbound-interface group 'br2-ifaces' + set firewall ipv4 forward filter rule 120 jump-target 'ip-br2-fwd' + + # Forward - Default action drop: + set firewall ipv4 forward filter default-action 'drop' + +And the content of the custom rulesets: + +.. code-block:: none + + ### br1 - ip-br1-fwd + # Requirement: Allow connections to internet + set firewall ipv4 name ip-br1-fwd rule 10 description 'br1 - allow internet access' + set firewall ipv4 name ip-br1-fwd rule 10 action 'accept' + set firewall ipv4 name ip-br1-fwd rule 10 outbound-interface name 'eth0' + # Requirement: Drop all other connections + set firewall ipv4 name ip-br1-fwd default-action 'drop' + + ### br2 - ip-br2-fwd + # Requirement: Allow connections to internet + set firewall ipv4 name ip-br2-fwd rule 10 description 'br2 - allow internet access' + set firewall ipv4 name ip-br2-fwd rule 10 action 'accept' + set firewall ipv4 name ip-br2-fwd rule 10 outbound-interface name 'eth0' + # Requirement: Allow connections to br1 + set firewall ipv4 name ip-br2-fwd rule 20 description 'br2 - allow access to br1' + set firewall ipv4 name ip-br2-fwd rule 20 action 'accept' + set firewall ipv4 name ip-br2-fwd rule 20 outbound-interface group 'br1-ifaces' + # Requirement: Drop all other connections + set firewall ipv4 name ip-br2-fwd default-action 'drop' + + +Validation +^^^^^^^^^^ + +While testing the configuration, we can check logs in order to ensure that +we are accepting and/or blocking the correct traffic. + +For example, while a host tries to get an IP address from a DHCP server in +br1 all DHCP discover are dropped, and in br2, we can see that DHCP offers from +untrusted servers are dropped: + +.. stop_vyoslinter + +.. code-block:: none + + vyos@bridge:~$ show log firewall bridge + Sep 17 14:22:35 kernel: [bri-NAM-br2-fwd-22-D]IN=eth7 OUT=eth5 MAC=50:00:00:09:00:00:50:00:00:04:00:00:08:00 SRC=10.2.2.199 DST=10.2.2.92 LEN=322 TOS=0x10 PREC=0x00 TTL=128 ID=0 DF PROTO=UDP SPT=67 DPT=68 LEN=302 + Sep 17 14:28:18 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 + Sep 17 14:28:19 kernel: [bri-NAM-br1-pre-10-D]IN=eth3 OUT= MAC=ff:ff:ff:ff:ff:ff:00:50:79:66:68:0c:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=392 TOS=0x10 PREC=0x00 TTL=16 ID=0 PROTO=UDP SPT=68 DPT=67 LEN=372 + +.. start_vyoslinter + + +And with operational mode commands, we can check rules matchers, actions, and +counters. + +Bridge firewall rulset: + +.. code-block:: none + + vyos@bri:~$ show firewall bridge + Rulesets bridge Information + + --------------------------------- + bridge Firewall "forward filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ----------------------------------------- + 5 accept all 19 1916 ct state { established, related } accept + 10 drop all 0 0 ct state invalid + 110 jump all 2 208 iifname @I_br0-ifaces jump NAME_br0-fwd + 120 jump all 10 670 iifname @I_br1-ifaces jump NAME_br1-fwd + 130 jump all 12 3086 iifname @I_br2-ifaces jump NAME_br2-fwd + default drop all 0 0 + + --------------------------------- + bridge Firewall "name br0-fwd" + + Rule Action Protocol Packets Bytes + ------- -------- ---------- --------- ------- + default accept all 2 208 + + --------------------------------- + bridge Firewall "name br0-pre" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ---------------------- + 10 accept all 18 1872 ether type ip6 accept + default drop all 9 1476 + + --------------------------------- + bridge Firewall "name br1-fwd" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ---------------------------------------- + 10 accept all 5 250 ether type arp accept + 20 accept all 3 252 ct state new ip saddr 10.1.1.102 accept + default drop all 2 168 + + --------------------------------- + bridge Firewall "name br1-pre" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ---------------------------------------------------------------------------------------- + 10 drop udp 3 1176 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 prefix "[bri-NAM-br1-pre-10-D]" + 20 drop all 0 0 ether type ip6 + default accept all 58 4430 + + --------------------------------- + bridge Firewall "name br2-fwd" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- --------------------------------------------------------------- + 10 accept udp 4 1312 ether daddr ff:ff:ff:ff:ff:ff udp sport 68 udp dport 67 accept + 20 accept udp 2 656 udp sport 67 udp dport 68 iifname "eth6" accept + 22 drop udp 1 322 udp sport 67 udp dport 68 prefix "[bri-NAM-br2-fwd-22-D]" + 30 accept all 2 92 ether type arp accept + 40 accept all 3 704 ether type ip accept + default drop all 0 0 + + --------------------------------- + bridge Firewall "name br2-pre" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- -------------- + 10 drop all 7 728 ether type ip6 + default accept all 77 7548 + + --------------------------------- + bridge Firewall "prerouting filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ---------------------------------------- + 10 jump all 27 3348 iifname @I_br0-ifaces jump NAME_br0-pre + 20 jump all 61 5606 iifname @I_br1-ifaces jump NAME_br1-pre + 30 jump all 84 8276 iifname @I_br2-ifaces jump NAME_br2-pre + default drop all 0 0 + + vyos@bridge:~$ + +IPv4 firewall rulset: + +.. code-block:: none + + vyos@bridge:~$ show firewall ipv4 + Rulesets ipv4 Information + + --------------------------------- + ipv4 Firewall "forward filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ------------------------------------------- + 5 accept all 76 6384 ct state { established, related } accept + 10 drop all 0 0 ct state invalid + 110 jump all 13 1092 iifname @I_br1-ifaces jump NAME_ip-br1-fwd + 120 jump all 3 252 iifname @I_br2-ifaces jump NAME_ip-br2-fwd + default drop all 0 0 + + --------------------------------- + ipv4 Firewall "input filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ----------------------------------------- + 10 accept all 0 0 ct state { established, related } accept + 20 drop all 0 0 ct state invalid + 110 accept all 10 720 iifname @I_br1-ifaces accept + 120 drop all 26 2672 iifname @I_br2-ifaces + default accept all 3037 991621 + + --------------------------------- + ipv4 Firewall "name ip-br1-fwd" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ---------------------- + 10 accept all 5 420 oifname "eth0" accept + default drop all 8 672 + + --------------------------------- + ipv4 Firewall "name ip-br2-fwd" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ----------------------------- + 10 accept all 1 84 oifname "eth0" accept + 20 accept all 2 168 oifname @I_br1-ifaces accept + default drop all 0 0 + + vyos@bridge:~$ diff --git a/docs/configexamples/rst-fwall-and-vrf.rst b/docs/configexamples/rst-fwall-and-vrf.rst new file mode 100644 index 00000000..bd97e1ad --- /dev/null +++ b/docs/configexamples/rst-fwall-and-vrf.rst @@ -0,0 +1,122 @@ +######################## +VRF and firewall example +######################## + +Scenario and requirements +^^^^^^^^^^^^^^^^^^^^^^^^^ + +This example shows how to configure a VyOS router with VRFs and firewall rules. + +Diagram used in this example: + +.. image:: /_static/images/firewall-and-vrf-blueprints.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +As exposed in the diagram, there are four VRFs. These VRFs are ``MGMT``, +``WAN``, ``LAN`` and ``PROD``, and their requirements are: + +* VRF MGMT: + * Allow connections to LAN and PROD. + * Deny connections to internet(WAN). + * Allow connections to the router. +* VRF LAN: + * Allow connections to PROD. + * Allow connections to internet(WAN). +* VRF PROD: + * Only accepts connections. +* VRF WAN: + * Allow connection to PROD. + +Configuration +^^^^^^^^^^^^^ + +First, we need to configure the interfaces and VRFs: + +.. code-block:: none + + set interfaces ethernet eth1 address '10.100.100.1/24' + set interfaces ethernet eth1 vrf 'MGMT' + set interfaces ethernet eth2 vif 150 address '10.150.150.1/24' + set interfaces ethernet eth2 vif 150 vrf 'LAN' + set interfaces ethernet eth2 vif 160 address '10.160.160.1/24' + set interfaces ethernet eth2 vif 160 vrf 'LAN' + set interfaces ethernet eth2 vif 3500 address '172.16.20.1/24' + set interfaces ethernet eth2 vif 3500 vrf 'PROD' + set interfaces loopback lo + set interfaces pppoe pppoe0 authentication password 'p4ssw0rd' + set interfaces pppoe pppoe0 authentication username 'vyos' + set interfaces pppoe pppoe0 source-interface 'eth0' + set interfaces pppoe pppoe0 vrf 'WAN' + set vrf bind-to-all + set vrf name LAN protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' + set vrf name LAN protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' + set vrf name LAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' + set vrf name LAN table '103' + set vrf name MGMT protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' + set vrf name MGMT protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' + set vrf name MGMT protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' + set vrf name MGMT table '102' + set vrf name PROD protocols static route 0.0.0.0/0 interface pppoe0 vrf 'WAN' + set vrf name PROD protocols static route 10.100.100.0/24 interface eth1 vrf 'MGMT' + set vrf name PROD protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' + set vrf name PROD protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' + set vrf name PROD table '104' + set vrf name WAN protocols static route 10.150.150.0/24 interface eth2.150 vrf 'LAN' + set vrf name WAN protocols static route 10.160.160.0/24 interface eth2.160 vrf 'LAN' + set vrf name WAN protocols static route 172.16.20.0/24 interface eth2.3500 vrf 'PROD' + set vrf name WAN table '101' + +And before firewall rules are shown, we need to pay attention how to configure +and match interfaces and VRFs. In case where an interface is assigned to a +non-default VRF, if we want to use inbound-interface or outbound-interface in +firewall rules, we need to: + +* For **inbound-interface**: use the interface name with the VRF name, like + ``MGMT`` or ``LAN``. +* For **outbound-interface**: use the interface name, like ``eth0``, ``vtun0``, + ``eth2*`` or similar. + +Next, we need to configure the firewall rules. First we will define all rules +for transit traffic between VRFs. + +.. code-block:: none + + set firewall ipv4 forward filter default-action 'drop' + set firewall ipv4 forward filter default-log + set firewall ipv4 forward filter rule 10 action 'accept' + set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD' + set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT' + set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*' + set firewall ipv4 forward filter rule 99 action 'drop' + set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt' + set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1' + set firewall ipv4 forward filter rule 120 action 'accept' + set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD' + set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN' + set firewall ipv4 forward filter rule 120 outbound-interface name 'eth2.3500' + set firewall ipv4 forward filter rule 130 action 'accept' + set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet' + set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN' + set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0' + +Also, we are adding global state policies, in order to allow established and +related traffic, in order not to drop valid responses: + +.. code-block:: none + + set firewall global-options state-policy established action 'accept' + set firewall global-options state-policy invalid action 'drop' + set firewall global-options state-policy related action 'accept' + +And finally, we need to allow input connections to the router itself only from +vrf MGMT: + +.. code-block:: none + + set firewall ipv4 input filter default-action 'drop' + set firewall ipv4 input filter default-log + set firewall ipv4 input filter rule 10 action 'accept' + set firewall ipv4 input filter rule 10 description 'MGMT - Allow input' + set firewall ipv4 input filter rule 10 inbound-interface name 'MGMT' \ No newline at end of file diff --git a/docs/configexamples/rst-ha.rst b/docs/configexamples/rst-ha.rst new file mode 100644 index 00000000..2f7bd4a4 --- /dev/null +++ b/docs/configexamples/rst-ha.rst @@ -0,0 +1,584 @@ +:lastproofread: 2021-06-28 + +.. _example-high-availability: + +############################# +High Availability Walkthrough +############################# + +This document walks you through a complete HA setup of two VyOS machines. This +design is based on a VM as the primary router and a physical machine as a +backup, using VRRP, BGP, OSPF, and conntrack sharing. + +This document aims to walk you through setting everything up, so +at a point where you can reboot any machine and not lose more than a few +seconds worth of connectivity. + +Design +====== + +This is based on a real-life production design. One of the complex issues +is ensuring you have redundant data INTO your network. We do this with a pair +of Cisco Nexus switches and using Virtual PortChannels that are spanned across +them. As a bonus, this also allows for complete switch failure without +an outage. How you achieve this yourself is left as an exercise to the reader. +But our setup is documented here. + +Walkthrough suggestion +---------------------- + +The ``commit`` command is implied after every section. If you make an error, +``commit`` will warn you and you can fix it before getting too far into things. +Please ensure you commit early and commit often. + +If you are following through this document, it is strongly suggested you +complete the entire document, ONLY doing the virtual router1 steps, and then +come back and walk through it AGAIN on the backup hardware router. + +This ensures you don't go too fast or miss a step. However, it will make your +life easier to configure the fixed IP address and default route now on the +hardware router. + +Example Network +--------------- + +In this document, we have been allocated 203.0.113.0/24 by our upstream +provider, which we are publishing on VLAN100. + +They want us to establish a BGP session to their routers on 192.0.2.11 and +192.0.2.12 from our routers 192.0.2.21 and 192.0.2.22. They are AS 65550 and +we are AS 65551. + +Our routers are going to have a floating IP address of 203.0.113.1, and use +.2 and .3 as their fixed IPs. + +We are going to use 10.200.201.0/24 for an 'internal' network on VLAN201. + +When traffic is originated from the 10.200.201.0/24 network, it will be +masqueraded to 203.0.113.1 + +For connection between sites, we are running a WireGuard link to two REMOTE +routers and using OSPF over those links to distribute routes. That remote +site is expected to send traffic from anything in 10.201.0.0/16 + +VLANs +----- + +These are the vlans we will be using: + +* 50: Upstream, using the 192.0.2.0/24 network allocated by them. +* 100: 'Public' network, using our 203.0.113.0/24 network. +* 201: 'Internal' network, using 10.200.201.0/24 + +Hardware +-------- + +* switch1 (Nexus 10gb Switch) +* switch2 (Nexus 10gb Switch) +* compute1 (VMware ESXi 6.5) +* compute2 (VMware ESXi 6.5) +* compute3 (VMware ESXi 6.5) +* router2 (Random 1RU machine with 4 NICs) + +Note that router1 is a VM that runs on one of the compute nodes. + +Network Cabling +--------------- + +* From Datacenter - This connects into port 1 on both switches, and is tagged + as VLAN 50 +* Cisco VPC Crossconnect - Ports 39 and 40 bonded between each switch +* Hardware Router - Port 8 of each switch +* compute1 - Port 9 of each switch +* compute2 - Port 10 of each switch +* compute3 - Port 11 of each switch + +This is ignoring the extra Out-of-band management networking, which should be +on totally different switches, and a different feed into the rack, and is out +of scope of this. + +.. note:: Our implementation uses VMware's Distributed Port Groups, which allows + VMware to use LACP. This is a part of the ENTERPRISE licence, and is not + available on a free licence. If you are implementing this and do not have + access to DPGs, you should not use VMware, and use some other virtualization + platform instead. + + +Basic Setup (via console) +========================= + +Create your router1 VM. So it can withstand a VM Host failing or a +network link failing. Using VMware, this is achieved by enabling vSphere DRS, +vSphere Availability, and creating a Distributed Port Group that uses LACP. + +Many other Hypervisors do this, and I'm hoping that this document will be +expanded to document how to do this for others. + +Create an 'All VLANs' network group, that passes all trunked traffic through +to the VM. Attach this network group to router1 as eth0. + +.. note:: VMware: You must DISABLE SECURITY on this Port group. Make sure that + ``Promiscuous Mode``\ , ``MAC address changes`` and ``Forged transmits`` are + enabled. All of these will be done as part of failover. + +Bonding on Hardware Router +-------------------------- + +Create a LACP bond on the hardware router. We are assuming that eth0 and eth1 +are connected to port 8 on both switches, and that those ports are configured +as a Port-Channel. + +.. code-block:: none + + set interfaces bonding bond0 description 'Switch Port-Channel' + set interfaces bonding bond0 hash-policy 'layer2' + set interfaces bonding bond0 member interface 'eth0' + set interfaces bonding bond0 member interface 'eth1' + set interfaces bonding bond0 mode '802.3ad' + + +Assign external IP addresses +---------------------------- + +VLAN 100 and 201 will have floating IP addresses, but VLAN50 does not, as this +is talking directly to upstream. Create our IP address on vlan50. + +For the hardware router, replace ``eth0`` with ``bond0``. As (almost) every +command is identical, this will not be specified unless different things need +to be performed on different hosts. + +.. code-block:: none + + set interfaces ethernet eth0 vif 50 address '192.0.2.21/24' + +In this case, the hardware router has a different IP, so it would be + +.. code-block:: none + + set interfaces ethernet bond0 vif 50 address '192.0.2.22/24' + +Add (temporary) default route +----------------------------- + +It is assumed that the routers provided by upstream are capable of acting as a +default router, add that as a static route. + +.. code-block:: none + + set protocols static route 0.0.0.0/0 next-hop 192.0.2.11 + commit + save + + +Enable SSH +---------- + +Enable SSH so you can now SSH into the routers, rather than using the console. + +.. code-block:: none + + set service ssh + commit + save + +At this point, you should be able to SSH into both of them, and will no longer +need access to the console (unless you break something!) + + +VRRP Configuration +================== + +We are setting up VRRP so that it does NOT fail back when a machine returns into +service, and it prioritizes router1 over router2. + +Internal Network +---------------- + +This has a floating IP address of 10.200.201.1/24, using virtual router ID 201. +The difference between them is the interface name, hello-source-address, and +peer-address. + +**router1** + +.. code-block:: none + + set interfaces ethernet eth0 vif 201 address 10.200.201.2/24 + set high-availability vrrp group int hello-source-address '10.200.201.2' + set high-availability vrrp group int interface 'eth0.201' + set high-availability vrrp group int peer-address '10.200.201.3' + set high-availability vrrp group int no-preempt + set high-availability vrrp group int priority '200' + set high-availability vrrp group int address '10.200.201.1/24' + set high-availability vrrp group int vrid '201' + + +**router2** + +.. code-block:: none + + set interfaces ethernet bond0 vif 201 address 10.200.201.3/24 + set high-availability vrrp group int hello-source-address '10.200.201.3' + set high-availability vrrp group int interface 'bond0.201' + set high-availability vrrp group int peer-address '10.200.201.2' + set high-availability vrrp group int no-preempt + set high-availability vrrp group int priority '100' + set high-availability vrrp group int address '10.200.201.1/24' + set high-availability vrrp group int vrid '201' + + +Public Network +-------------- + +This has a floating IP address of 203.0.113.1/24, using virtual router ID 113. +The virtual router ID is just a random number between 1 and 254, and can be set +to whatever you want. Best practices suggest you try to keep them unique +enterprise-wide. + +**router1** + +.. code-block:: none + + set interfaces ethernet eth0 vif 100 address 203.0.113.2/24 + set high-availability vrrp group public hello-source-address '203.0.113.2' + set high-availability vrrp group public interface 'eth0.100' + set high-availability vrrp group public peer-address '203.0.113.3' + set high-availability vrrp group public no-preempt + set high-availability vrrp group public priority '200' + set high-availability vrrp group public address '203.0.113.1/24' + set high-availability vrrp group public vrid '113' + +**router2** + +.. code-block:: none + + set interfaces ethernet bond0 vif 100 address 203.0.113.3/24 + set high-availability vrrp group public hello-source-address '203.0.113.3' + set high-availability vrrp group public interface 'bond0.100' + set high-availability vrrp group public peer-address '203.0.113.2' + set high-availability vrrp group public no-preempt + set high-availability vrrp group public priority '100' + set high-availability vrrp group public address '203.0.113.1/24' + set high-availability vrrp group public vrid '113' + + +Create VRRP sync-group +---------------------- + +The sync group is used to replicate connection tracking. It needs to be assigned +to a random VRRP group, and we are creating a sync group called ``sync`` using +the vrrp group ``int``. + +.. code-block:: none + + set high-availability vrrp sync-group sync member 'int' + +Testing +------- + +At this point, you should be able to see both IP addresses when you run +``show interfaces``\ , and ``show vrrp`` should show both interfaces in MASTER +state (and SLAVE state on router2). + +.. code-block:: none + + vyos@router1:~$ show vrrp + Name Interface VRID State Last Transition + -------- ----------- ------ ------- ----------------- + int eth0.201 201 MASTER 100s + public eth0.100 113 MASTER 200s + vyos@router1:~$ + + +You should be able to ping to and from all the IPs you have allocated. + +NAT and conntrack-sync +====================== + +Masquerade Traffic originating from 10.200.201.0/24 that is heading out the +public interface. + +.. note:: We explicitly exclude the primary upstream network so that BGP or + OSPF traffic doesn't accidentally get NAT'ed. + +.. code-block:: none + + set nat source rule 10 destination address '!192.0.2.0/24' + set nat source rule 10 outbound-interface name 'eth0.50' + set nat source rule 10 source address '10.200.201.0/24' + set nat source rule 10 translation address '203.0.113.1' + + +Configure conntrack-sync and enable helpers +-------------------------------------------- + +Conntrack helper modules are enabled by default, but they tend to cause more +problems than they're worth in complex networks. You can disable all of them +at one go. + +.. code-block:: none + + delete system conntrack modules + +Now enable replication between nodes. Replace eth0.201 with bond0.201 on the +hardware router. + +.. code-block:: none + + set service conntrack-sync accept-protocol 'tcp,udp,icmp' + set service conntrack-sync event-listen-queue-size '8' + set service conntrack-sync failover-mechanism vrrp sync-group 'sync' + set service conntrack-sync interface eth0.201 + set service conntrack-sync mcast-group '224.0.0.50' + set service conntrack-sync sync-queue-size '8' + +.. _ha:contracktesting: + +Testing +------- + +The simplest way to test is to look at the connection tracking stats on the +standby hardware router with the command ``show conntrack-sync statistics``. +The numbers should be very close to the numbers on the primary router. + +When you have both routers up, you should be able to establish a connection +from a NAT'ed machine out to the internet, reboot the active machine, and that +connection should be preserved, and will not drop out. + +OSPF Over WireGuard +=================== + +Wireguard doesn't have the concept of an up or down link, due to its design. +This complicates AND simplifies using it for network transport, as for reliable +state detection you need to use SOMETHING to detect when the link is down. + +If you use a routing protocol itself, you solve two problems at once. This is +only a basic example, and is provided as a starting point. + +Configure Wireguard +------------------- + +There is plenty of instructions and documentation on setting up Wireguard. The +only important thing you need to remember is to only use one WireGuard +interface per OSPF connection. + +We use small /30's from 10.254.60/24 for the point-to-point links. + +**router1** + +Replace the 203.0.113.3 with whatever the other router's IP address is. + +.. code-block:: none + + set interfaces wireguard wg01 address '10.254.60.1/30' + set interfaces wireguard wg01 description 'router1-to-offsite1' + set interfaces wireguard wg01 peer OFFSITE1 allowed-ips '0.0.0.0/0' + set interfaces wireguard wg01 peer OFFSITE1 endpoint '203.0.113.3:50001' + set interfaces wireguard wg01 peer OFFSITE1 persistent-keepalive '15' + set interfaces wireguard wg01 peer OFFSITE1 pubkey 'GEFMOWzAyau42/HwdwfXnrfHdIISQF8YHj35rOgSZ0o=' + set interfaces wireguard wg01 port '50001' + set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' + set protocols ospf interface wg01 cost '11' + set protocols ospf interface wg01 dead-interval '5' + set protocols ospf interface wg01 hello-interval '1' + set protocols ospf interface wg01 network 'point-to-point' + set protocols ospf interface wg01 priority '1' + set protocols ospf interface wg01 retransmit-interval '5' + set protocols ospf interface wg01 transmit-delay '1' + + +**offsite1** + +This is connecting back to the STATIC IP of router1, not the floating. + +.. code-block:: none + + set interfaces wireguard wg01 address '10.254.60.2/30' + set interfaces wireguard wg01 description 'offsite1-to-router1' + set interfaces wireguard wg01 peer ROUTER1 allowed-ips '0.0.0.0/0' + set interfaces wireguard wg01 peer ROUTER1 endpoint '192.0.2.21:50001' + set interfaces wireguard wg01 peer ROUTER1 persistent-keepalive '15' + set interfaces wireguard wg01 peer ROUTER1 pubkey 'CKwMV3ZaLntMule2Kd3G7UyVBR7zE8/qoZgLb82EE2Q=' + set interfaces wireguard wg01 port '50001' + set protocols ospf interface wg01 authentication md5 key-id 1 md5-key 'i360KoCwUGZvPq7e' + set protocols ospf interface wg01 cost '11' + set protocols ospf interface wg01 dead-interval '5' + set protocols ospf interface wg01 hello-interval '1' + set protocols ospf interface wg01 network 'point-to-point' + set protocols ospf interface wg01 priority '1' + set protocols ospf interface wg01 retransmit-interval '5' + set protocols ospf interface wg01 transmit-delay '1' + +Test WireGuard +-------------- + +Make sure you can ping 10.254.60.1 and .2 from both routers. + +Create Export Filter +-------------------- + +We only want to export the networks we know. Always do a whitelist on your route +filters, both importing and exporting. A good rule of thumb is +**'If you are not the default router for a network, don't advertise +it'**. This means we explicitly do not want to advertise the 192.0.2.0/24 +network (but do want to advertise 10.200.201.0 and 203.0.113.0, which we ARE +the default route for). This filter is applied to ``redistribute connected``. +If we WERE to advertise it, the remote machines would see 192.0.2.21 available +via their default route, establish the connection, and then OSPF would say +'192.0.2.0/24 is available via this tunnel', at which point the tunnel would +break, OSPF would drop the routes, and then 192.0.2.0/24 would be reachable via +default again. This is called 'flapping'. + +.. code-block:: none + + set policy access-list 150 description 'Outbound OSPF Redistribution' + set policy access-list 150 rule 10 action 'permit' + set policy access-list 150 rule 10 destination any + set policy access-list 150 rule 10 source inverse-mask '0.0.0.255' + set policy access-list 150 rule 10 source network '10.200.201.0' + set policy access-list 150 rule 20 action 'permit' + set policy access-list 150 rule 20 destination any + set policy access-list 150 rule 20 source inverse-mask '0.0.0.255' + set policy access-list 150 rule 20 source network '203.0.113.0' + set policy access-list 150 rule 100 action 'deny' + set policy access-list 150 rule 100 destination any + set policy access-list 150 rule 100 source any + + +Create Import Filter +-------------------- + +We only want to import networks we know. Our OSPF peer should only be +advertising networks in the 10.201.0.0/16 range. Note that this is an INVERSE +MATCH. You deny in access-list 100 to accept the route. + +.. code-block:: none + + set policy access-list 100 description 'Inbound OSPF Routes from Peers' + set policy access-list 100 rule 10 action 'deny' + set policy access-list 100 rule 10 destination any + set policy access-list 100 rule 10 source inverse-mask '0.0.255.255' + set policy access-list 100 rule 10 source network '10.201.0.0' + set policy access-list 100 rule 100 action 'permit' + set policy access-list 100 rule 100 destination any + set policy access-list 100 rule 100 source any + set policy route-map PUBOSPF rule 100 action 'deny' + set policy route-map PUBOSPF rule 100 match ip address access-list '100' + set policy route-map PUBOSPF rule 500 action 'permit' + + +Enable OSPF +----------- + +Every router **must** have a unique router-id. +The 'reference-bandwidth' is used because when OSPF was originally designed, +the idea of a link faster than 1gbit was unheard of, and it does not scale +correctly. + +.. code-block:: none + + set protocols ospf area 0.0.0.0 authentication 'md5' + set protocols ospf area 0.0.0.0 network '10.254.60.0/24' + set protocols ospf auto-cost reference-bandwidth '10000' + set protocols ospf log-adjacency-changes + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.254.60.2' + set system ip protocol ospf route-map PUBOSPF + + +Test OSPF +--------- + +When you have enabled OSPF on both routers, you should be able to see each +other with the command ``show ip ospf neighbour``. The state must be 'Full' +or '2-Way'. If it is not, then there is a network connectivity issue between the +hosts. This is often caused by NAT or MTU issues. You should not see any new +routes (unless this is the second pass) in the output of ``show ip route`` + +Advertise connected routes +========================== + +As a reminder, only advertise routes that you are the default router for. This +is why we are NOT announcing the 192.0.2.0/24 network, because if that was +announced into OSPF, the other routers would try to connect to that network +over a tunnel that connects to that network! + +.. code-block:: none + + set protocols ospf access-list 150 export 'connected' + set protocols ospf redistribute connected + + +You should now be able to see the advertised network on the other host. + +Duplicate configuration +----------------------- + +At this point, you now need to create the X link between all four routers. +Use amdifferent /30 for each link. + +Priorities +---------- + +Set the cost on the secondary links to be 200. This means that they will not +be used unless the primary links are down. + +.. code-block:: none + + set protocols ospf interface wg01 cost '10' + set protocols ospf interface wg01 cost '200' + + +This will be visible in 'show ip route'. + +BGP +=== + +BGP is an extremely complex network protocol. An example is provided here. + +.. note:: Router id's must be unique. + +**router1** + + +The ``redistribute ospf`` command is there purely as an example of how this can +be expanded. In this walkthrough, it will be filtered by BGPOUT rule 10000, as +it is not 203.0.113.0/24. + +.. code-block:: none + + set policy prefix-list BGPOUT description 'BGP Export List' + set policy prefix-list BGPOUT rule 10 action 'deny' + set policy prefix-list BGPOUT rule 10 description 'Do not advertise short masks' + set policy prefix-list BGPOUT rule 10 ge '25' + set policy prefix-list BGPOUT rule 10 prefix '0.0.0.0/0' + set policy prefix-list BGPOUT rule 100 action 'permit' + set policy prefix-list BGPOUT rule 100 description 'Our network' + set policy prefix-list BGPOUT rule 100 prefix '203.0.113.0/24' + set policy prefix-list BGPOUT rule 10000 action 'deny' + set policy prefix-list BGPOUT rule 10000 prefix '0.0.0.0/0' + + set policy route-map BGPOUT description 'BGP Export Filter' + set policy route-map BGPOUT rule 10 action 'permit' + set policy route-map BGPOUT rule 10 match ip address prefix-list 'BGPOUT' + set policy route-map BGPOUT rule 10000 action 'deny' + set policy route-map BGPPREPENDOUT description 'BGP Export Filter' + set policy route-map BGPPREPENDOUT rule 10 action 'permit' + set policy route-map BGPPREPENDOUT rule 10 set as-path prepend '65551 65551 65551' + set policy route-map BGPPREPENDOUT rule 10 match ip address prefix-list 'BGPOUT' + set policy route-map BGPPREPENDOUT rule 10000 action 'deny' + + set protocols bgp system-as 65551 + set protocols bgp address-family ipv4-unicast network 192.0.2.0/24 + set protocols bgp address-family ipv4-unicast redistribute connected metric '50' + set protocols bgp address-family ipv4-unicast redistribute ospf metric '50' + set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast route-map export 'BGPOUT' + set protocols bgp neighbor 192.0.2.11 address-family ipv4-unicast soft-reconfiguration inbound + set protocols bgp neighbor 192.0.2.11 remote-as '65550' + set protocols bgp neighbor 192.0.2.11 update-source '192.0.2.21' + set protocols bgp parameters router-id '192.0.2.21' + + +**router2** + +This is identical, but you use the BGPPREPENDOUT route-map to advertise the +route with a longer path. diff --git a/docs/configexamples/rst-index.rst b/docs/configexamples/rst-index.rst new file mode 100644 index 00000000..b5985d7f --- /dev/null +++ b/docs/configexamples/rst-index.rst @@ -0,0 +1,63 @@ +.. _examples: + +######################## +Configuration Blueprints +######################## + +This chapter contains various configuration examples: + +.. toctree:: + :maxdepth: 2 + + firewall + bgp-ipv6-unnumbered + ospf-unnumbered + azure-vpn-bgp + azure-vpn-dual-bgp + ha + wan-load-balancing + pppoe-ipv6-basic + l3vpn-hub-and-spoke + lac-lns + inter-vrf-routing-vrf-lite + dmvpn-dualhub-dualcloud + qos + segment-routing-isis + nmp + ansible + ipsec-cisco-policy-based + ipsec-cisco-route-based + ipsec-pa-route-based + policy-based-ipsec-and-firewall + site-2-site-cisco + + +Configuration Blueprints (autotest) +=================================== + +The next pages contains automatic full tested configuration examples. + +Each lab will build an test from an external script. +The page content will generate, so changes will not take an effect. + +A host ``vyos-oobm`` will use as a ssh proxy. This host is just +necessary for the Lab test. + +The process will do the following steps: + +1. create the lab on a eve-ng server +2. configure each host in the lab +3. do some defined tests +4. optional do an upgrade to a higher version and do step 3 again. +5. generate the documentation and include files +6. shutdown and destroy the lab, if there is no error + + +.. toctree:: + :maxdepth: 1 + + autotest/DHCPRelay_through_GRE/DHCPRelay_through_GRE + autotest/tunnelbroker/tunnelbroker + autotest/L3VPN_EVPN/L3VPN_EVPN + autotest/Wireguard/Wireguard + autotest/OpenVPN_with_LDAP/OpenVPN_with_LDAP diff --git a/docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst b/docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst new file mode 100644 index 00000000..1f02da8e --- /dev/null +++ b/docs/configexamples/rst-inter-vrf-routing-vrf-lite.rst @@ -0,0 +1,856 @@ +################################ +Inter-VRF Routing over VRF Lite +################################ + +**Virtual Routing and Forwarding** is a technology that allow multiple instance +of a routing table to exist within a single device. One of the key aspect of +**VRFs** is that do not share the same routes or interfaces, therefore packets +are forwarded between interfaces that belong to the same VRF only. + +Any information related to a VRF is not exchanged between devices -or in the +same device- by default, this is a technique called **VRF-Lite**. + +Keep networks isolated is -in general- a good principle, but there are cases +where you might need that some network can access other in a different VRF. + +The scope of this document is to cover such cases in a dynamic way without the +use of MPLS-LDP. + +General information about L3VPNs can be found in the +:ref:`configuration/vrf/index:L3VPN VRFs` chapter. + +******** +Overview +******** + +Let’s say we have a requirement to have multiple networks. + +* LAN 1 +* LAN 2 +* Management +* Internet + +Both LANs have to be able to route between each other, both will have managed +devices through a dedicated management network and both will need Internet +access yet the LAN2 will need access to some set of outside networks, not all. +The management network will need access to both LANs but cannot have access +to/from the outside. + +This scenario could be a nightmare applying regular routing and might need +filtering in multiple interfaces. + +A simple solution could be using different routing tables, or VRFs +for all the networks so we can keep the routing restrictions. +But for us to route between the different VRFs we would need a cable or a +logical connection between each other: + +* One cable/logical connection between LAN1 and LAN2 +* One cable/logical connection between LAN1 and Internet +* One cable/logical connection between LAN2 and Internet +* One cable/logical connection between LAN1 and Management +* One cable/logical connection between LAN2 and Management + +As we can see this is unpractical. + +To address this scenario we will use to our advantage an extension of the BGP +routing protocol that will help us in the “Export” between VRFs without the +need for MPLS. + +MP-BGP or MultiProtocol BGP introduces two main concepts to solve this +limitation: +- Route Distinguisher (RD): Is used to distinguish between different VRFs +–called VPNs- inside the BGP Process. The RD is appended to each IPv4 Network +that is advertised into BGP for that VPN making it a unique VPNv4 route. +- Route Target (RT): This is an extended BGP community append to the VPNv4 route +in the Import/Export process. When a route passes from the VRF routing table +into the BGP process it will add the configured export extended community(ies) +for that VPN. When that route needs to go from BGP into the VRF routing table +will only pass if that given VPN import policy matches any of the appended +community(ies) into that prefix. + +******** +Topology +******** +.. image:: /_static/images/inter-vrf-routing-vrf-lite.* + :width: 70% + :align: center + :alt: Network Topology Diagram + + + + +IP Schema +========= + ++----------+------------+----------------+------------------+ +| Device-A | Device-B | IPv4 Network | IPv6 Network | ++----------+------------+----------------+------------------+ +| Core | LAN1 | 10.1.1.0/30 | 2001:db8::/127 | ++----------+------------+----------------+------------------+ +| Core | LAN2 | 172.16.2.0/30 | 2001:db8::2/127 | ++----------+------------+----------------+------------------+ +| Core | Management | 192.168.3.0/30 | 2001:db8::4/127 | ++----------+------------+----------------+------------------+ +| Core | ISP | 10.2.2.0/30 | 2001:db8::6/127 | ++----------+------------+----------------+------------------+ + +RD & RT Schema +============== + ++------------+-----------+-----------+ +| VRF | RD | RT | ++------------+-----------+-----------+ +| LAN1 | 64496:1 | 64496:1 | ++------------+-----------+-----------+ +| LAN2 | 64496:2 | 64496:2 | ++------------+-----------+-----------+ +| Management | 64496:50 | 64496:50 | ++------------+-----------+-----------+ +| Internet | 64496:100 | 64496:100 | ++------------+-----------+-----------+ + +************** +Configurations +************** + +.. note:: We use a static route configuration in between the Core and each + LAN and Management router, and BGP between the Core router and the ISP router + but any dynamic routing protocol can be used. + +Remote Networks +=============== + +The following template configuration can be used in each remote router based +in our topology. + +.. code-block:: none + + # Interface Configuration + set interface eth eth address + + # Static default route back to Core + set procotols static route 0.0.0.0/0 next-hop + +Core Router +=========== + +Step 1: VRF and Configurations to remote networks +------------------------------------------------- + +- Configuration + + + +Set the VRF name and Table ID, set interface address and bind it to the VRF. +Last add the static route to the remote network. + +.. code-block:: none + + # VRF name and table ID (MANDATORY) + set vrf name table + + # Interface Configuration + set interface eth eth address + + # Assign interface to VRF + set interface eth eth vrf + + # Static route to remote Network + set vrf name protocols static route next-hop + +- Verification + + + +Checking the routing table of the VRF should reveal both static and connected +entries active. A PING test between the Core and remote router is a way to +validate connectivity within the VRF. + +.. code-block:: none + + # show ip route vrf + # show ipv6 route vrf + + vyos@Core:~$ show ip route vrf LAN1 + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF LAN1: + S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:05:41 + C>* 10.1.1.0/30 is directly connected, eth0, 00:05:44 + + vyos@Core:~$ show ipv6 route vrf LAN1 + Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF LAN1: + C>* 2001:db8::/127 is directly connected, eth0, 00:18:43 + S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 00:16:03 + C>* fe80::/64 is directly connected, eth0, 00:18:43 + + # ping vrf + + vyos@Core:~$ ping 10.1.1.2 vrf LAN1 + PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data. + 64 bytes from 10.1.1.2: icmp_seq=1 ttl=64 time=1.52 ms + 64 bytes from 10.1.1.2: icmp_seq=2 ttl=64 time=0.830 ms + ^C + --- 10.1.1.2 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1002ms + rtt min/avg/max/mdev = 0.830/1.174/1.518/0.344 ms + vyos@Core:~$ ping 10.0.0.1 vrf LAN1 + PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. + 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.785 ms + 64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.948 ms + ^C + --- 10.0.0.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1002ms + rtt min/avg/max/mdev = 0.785/0.866/0.948/0.081 ms + + vyos@Core:~$ ping 2001:db8:0:1::1 vrf LAN1 + PING 2001:db8:0:1::1(2001:db8:0:1::1) 56 data bytes + 64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=64 time=3.04 ms + 64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=64 time=1.04 ms + 64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=64 time=0.925 ms + ^C + --- 2001:db8:0:1::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2004ms + rtt min/avg/max/mdev = 0.925/1.665/3.035/0.969 ms + +Step 2: BGP Configuration for VRF-Lite +-------------------------------------- + + +- Configuration + + + +Setting BGP global local-as as well inside the VRF. Redistribute static routes +to inject configured networks into the BGP process but still inside the VRF. + + +.. code-block:: none + + # set BGP global local-as + set protocols bgp system-as + + # set BGP VRF local-as and redistribution + set vrf name protocols bgp address-family redistribute static + +- Verification + + + +Check the BGP VRF table and verify if the static routes are injected showing +the correct next-hop information. + +.. code-block:: none + + # show ip bgp vrf + # show bgp vrf ipv6 + + vyos@Core:~$ show ip bgp vrf LAN1 + BGP table version is 3, local router ID is 10.1.1.1, vrf id 8 + Default local pref 100, local AS 64496 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path + *> 10.0.0.0/24 10.1.1.2 0 32768 ? + + vyos@Core# run show bgp vrf LAN1 ipv6 + BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 + Default local pref 100, local AS 64496 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path + *> 2001:db8:0:1::/64 + 2001:db8::1 0 32768 ? + + +Step 3: VPN Configuration +------------------------- + + +- Configuration + + +Within the VRF we set the Route-Distinguisher (RD) and Route-Targets (RT), then +we enable the export/import VPN. + + +.. code-block:: none + + # set Route-distinguisher + set vrf name protocols bgp address-family rd vpn export '' + + # set route-target for import/export + # Note: RT are a list that can be more than one community between apostrophe + # and separated by blank space. Ex: ' ' + set vrf name protocols bgp address-family route-target vpn export '' + set vrf name protocols bgp address-family route-target vpn import '' + + # Enable VPN export/import under this VRF + set vrf name protocols bgp address-family export vpn + set vrf name protocols bgp address-family import vpn + +A key point to understand is that if we need two VRFs to communicate between +each other EXPORT rt from VRF1 has to be in the IMPORT rt list from VRF2. But +this is only in ONE direction, to complete the communication the EXPORT rt from +VRF2 has to be in the IMPORT rt list from VRF1. + +There are some cases where this is not needed -for example, in some +DDoS appliance- but most inter-vrf routing designs use the above configurations. + +- Verification + + + +After configured all the VRFs involved in this topology we take a deeper look +at both BGP and Routing table for the VRF LAN1 + +.. code-block:: none + + # show ip bgp vrf + # show bgp vrf ipv6 + + vyos@Core# run show ip bgp vrf LAN1 + BGP table version is 53, local router ID is 10.1.1.1, vrf id 8 + Default local pref 100, local AS 64496 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path + *> 0.0.0.0/0 10.2.2.2@7< 0 64497 i + *> 10.0.0.0/24 10.1.1.2 0 32768 ? + *> 10.2.2.0/30 10.2.2.2@7< 0 0 64497 ? + *> 192.0.2.0/24 10.2.2.2@7< 0 0 64497 ? + *> 192.168.0.0/24 192.168.3.2@11< 0 32768 ? + *> 198.51.100.0/24 10.2.2.2@7< 0 0 64497 ? + *> 203.0.113.0/24 10.2.2.2@7< 0 0 64497 ? + + vyos@Core# run show bgp vrf LAN1 ipv6 + BGP table version is 13, local router ID is 10.1.1.1, vrf id 8 + Default local pref 100, local AS 64496 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + RPKI validation codes: V valid, I invalid, N Not found + + Network Next Hop Metric LocPrf Weight Path + *> ::/0 fe80::5200:ff:fe02:3@7< + 0 64497 i + *> 2001:db8::6/127 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + *> 2001:db8:0:1::/64 + 2001:db8::1 0 32768 ? + *> 2001:db8:0:3::/64 + 2001:db8::5@11< 0 32768 ? + *> 2001:db8:1::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + *> 2001:db8:2::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + *> 2001:db8:3::/48 fe80::5200:ff:fe02:3@7< + 0 0 64497 ? + + + # show ip route vrf + # show ipv6 route vrf + + vyos@Core:~$ show ip route vrf LAN1 + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF LAN1: + B>* 0.0.0.0/0 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + S>* 10.0.0.0/24 [1/0] via 10.1.1.2, eth0, weight 1, 00:29:57 + C>* 10.1.1.0/30 is directly connected, eth0, 00:29:59 + B 10.2.2.0/30 [20/0] via 10.2.2.2 (vrf Internet) inactive, weight 1, 00:00:38 + B>* 172.16.0.0/24 [20/0] via 172.16.2.2, eth1 (vrf LAN2), weight 1, 00:00:38 + B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + B>* 203.0.113.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:00:38 + + vyos@Core# run show ipv6 route vrf LAN1 + Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + VRF LAN1: + B>* ::/0 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + C>* 2001:db8::/127 is directly connected, eth0, 05:33:43 + B>* 2001:db8::6/127 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + S>* 2001:db8:0:1::/64 [1/0] via 2001:db8::1, eth0, weight 1, 05:31:03 + B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Management), weight 1, 00:07:50 + B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + B>* 2001:db8:3::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:07:50 + C>* fe80::/64 is directly connected, eth0, 05:33:43 + + +As we can see in the BGP table any imported route has been injected with a "@" +followed by the VPN id; In the routing table of the VRF, if the route was +installed, we can see -between round brackets- the exported VRF table. + +Step 4: End to End verification +------------------------------- + + +Now we perform some end-to-end testing + +- From Management to LAN1/LAN2 + + +.. code-block:: none + + vyos@Management:~$ ping 10.0.0.1 source-address 192.168.0.1 + PING 10.0.0.1 (10.0.0.1) from 192.168.0.1 : 56(84) bytes of data. + 64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=1.93 ms + 64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=2.12 ms + 64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=2.12 ms + ^C + --- 10.0.0.1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2005ms + rtt min/avg/max/mdev = 1.931/2.056/2.123/0.088 ms + vyos@Management:~$ ping 172.16.0.1 source-address 192.168.0.1 + PING 172.16.0.1 (172.16.0.1) from 192.168.0.1 : 56(84) bytes of data. + 64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=1.62 ms + 64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=1.75 ms + ^C + --- 172.16.0.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1001ms + rtt min/avg/max/mdev = 1.621/1.686/1.752/0.065 ms + vyos@Management:~$ ping 2001:db8:0:1::1 source-address 2001:db8:0:3::1 + PING 2001:db8:0:1::1(2001:db8:0:1::1) from 2001:db8:0:3::1 : 56 data bytes + 64 bytes from 2001:db8:0:1::1: icmp_seq=1 ttl=63 time=2.44 ms + 64 bytes from 2001:db8:0:1::1: icmp_seq=2 ttl=63 time=2.40 ms + 64 bytes from 2001:db8:0:1::1: icmp_seq=3 ttl=63 time=2.41 ms + ^C + --- 2001:db8:0:1::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2003ms + rtt min/avg/max/mdev = 2.399/2.418/2.442/0.017 ms + vyos@Management:~$ ping 2001:db8:0:2::1 source-address 2001:db8:0:3::1 + PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:3::1 : 56 data bytes + 64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=1.66 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.99 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.88 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=4 ttl=63 time=2.32 ms + ^C + --- 2001:db8:0:2::1 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3005ms + rtt min/avg/max/mdev = 1.660/1.960/2.315/0.236 ms + +- From Management to Outside (fails as intended) + +.. stop_vyoslinter + +.. code-block:: none + + vyos@Management:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + S>* 0.0.0.0/0 [1/0] via 192.168.3.1, eth2, weight 1, 00:01:58 + C>* 192.168.0.0/24 is directly connected, dum0, 00:02:05 + C>* 192.168.3.0/30 is directly connected, eth2, 00:02:03 + vyos@Management:~$ ping 192.0.2.1 + PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data. + From 192.168.3.1 icmp_seq=1 Destination Net Unreachable + From 192.168.3.1 icmp_seq=2 Destination Net Unreachable + ^C + --- 192.0.2.1 ping statistics --- + 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + + vyos@Management:~$ ping 195.51.100.1 + PING 195.51.100.1 (195.51.100.1) 56(84) bytes of data. + From 192.168.3.1 icmp_seq=1 Destination Net Unreachable + From 192.168.3.1 icmp_seq=2 Destination Net Unreachable + From 192.168.3.1 icmp_seq=3 Destination Net Unreachable + ^C + --- 195.51.100.1 ping statistics --- + 3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2003ms + + vyos@Management:~$ ping 2001:db8:1::1 + PING 2001:db8:1::1(2001:db8:1::1) 56 data bytes + From 2001:db8::4 icmp_seq=1 Destination unreachable: No route + From 2001:db8::4 icmp_seq=2 Destination unreachable: No route + ^C + --- 2001:db8:1::1 ping statistics --- + 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + + vyos@Management:~$ ping 2001:db8:2::1 + PING 2001:db8:2::1(2001:db8:2::1) 56 data bytes + From 2001:db8::4 icmp_seq=1 Destination unreachable: No route + From 2001:db8::4 icmp_seq=2 Destination unreachable: No route + ^C + --- 2001:db8:2::1 ping statistics --- + 2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms + +.. start_vyoslinter + +- LAN1 to Outside + + + +.. code-block:: none + + vyos@LAN1:~$ ping 192.0.2.1 source-address 10.0.0.1 + PING 192.0.2.1 (192.0.2.1) from 10.0.0.1 : 56(84) bytes of data. + 64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=1.47 ms + 64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=1.41 ms + 64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=1.80 ms + ^C + --- 192.0.2.1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2004ms + rtt min/avg/max/mdev = 1.414/1.563/1.803/0.171 ms + vyos@LAN1:~$ ping 198.51.100.1 source-address 10.0.0.1 + PING 198.51.100.1 (198.51.100.1) from 10.0.0.1 : 56(84) bytes of data. + 64 bytes from 198.51.100.1: icmp_seq=1 ttl=63 time=1.71 ms + 64 bytes from 198.51.100.1: icmp_seq=2 ttl=63 time=1.83 ms + ^C + --- 198.51.100.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1002ms + rtt min/avg/max/mdev = 1.705/1.766/1.828/0.061 ms + vyos@LAN1:~$ ping 203.0.113.1 source-address 10.0.0.1 + PING 203.0.113.1 (203.0.113.1) from 10.0.0.1 : 56(84) bytes of data. + 64 bytes from 203.0.113.1: icmp_seq=1 ttl=63 time=1.25 ms + 64 bytes from 203.0.113.1: icmp_seq=2 ttl=63 time=1.88 ms + ^C + --- 203.0.113.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1003ms + rtt min/avg/max/mdev = 1.249/1.566/1.884/0.317 ms + vyos@LAN1:~$ ping 2001:db8:1::1 source-address 2001:db8:0:1::1 + PING 2001:db8:1::1(2001:db8:1::1) from 2001:db8:0:1::1 : 56 data bytes + 64 bytes from 2001:db8:1::1: icmp_seq=1 ttl=63 time=2.35 ms + 64 bytes from 2001:db8:1::1: icmp_seq=2 ttl=63 time=2.29 ms + 64 bytes from 2001:db8:1::1: icmp_seq=3 ttl=63 time=2.22 ms + ^C + --- 2001:db8:1::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2004ms + rtt min/avg/max/mdev = 2.215/2.285/2.352/0.055 ms + vyos@LAN1:~$ ping 2001:db8:2::1 source-address 2001:db8:0:1::1 + PING 2001:db8:2::1(2001:db8:2::1) from 2001:db8:0:1::1 : 56 data bytes + 64 bytes from 2001:db8:2::1: icmp_seq=1 ttl=63 time=1.37 ms + 64 bytes from 2001:db8:2::1: icmp_seq=2 ttl=63 time=2.68 ms + 64 bytes from 2001:db8:2::1: icmp_seq=3 ttl=63 time=2.00 ms + ^C + --- 2001:db8:2::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2003ms + rtt min/avg/max/mdev = 1.367/2.015/2.679/0.535 ms + + +.. note:: we are using "source-address" option cause we are not redistributing + connected interfaces into BGP on the Core router hence there is no comeback + route and ping will fail. + +- LAN1 to LAN2 + + + +.. code-block:: none + + vyos@LAN1:~$ ping 172.16.0.1 source-address 10.0.0.1 + PING 172.16.0.1 (172.16.0.1) from 10.0.0.1 : 56(84) bytes of data. + 64 bytes from 172.16.0.1: icmp_seq=1 ttl=63 time=3.00 ms + 64 bytes from 172.16.0.1: icmp_seq=2 ttl=63 time=2.20 ms + ^C + --- 172.16.0.1 ping statistics --- + 2 packets transmitted, 2 received, 0% packet loss, time 1002ms + rtt min/avg/max/mdev = 2.199/2.600/3.001/0.401 ms + vyos@LAN1:~$ ping 2001:db8:0:2::1 source 2001:db8:0:1::1 + PING 2001:db8:0:2::1(2001:db8:0:2::1) from 2001:db8:0:1::1 : 56 data bytes + 64 bytes from 2001:db8:0:2::1: icmp_seq=1 ttl=63 time=4.82 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=2 ttl=63 time=1.95 ms + 64 bytes from 2001:db8:0:2::1: icmp_seq=3 ttl=63 time=1.98 ms + ^C + --- 2001:db8:0:2::1 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 2003ms + rtt min/avg/max/mdev = 1.949/2.915/4.815/1.343 ms + +*********** +Conclusions +*********** + +Inter-VRF routing is a well-known solution to address complex routing scenarios +that enable -in a dynamic way- to leak routes between VRFs. Is recommended to +take special consideration while designing route-targets and its application as +it can minimize future interventions while creating a new VRF will automatically +take the desired effect in its propagation. + +********** +Appendix-A +********** + +Full configuration from all devices +=================================== + +- Core + + +.. code-block:: none + + set interfaces ethernet eth0 address '10.1.1.1/30' + set interfaces ethernet eth0 address '2001:db8::/127' + set interfaces ethernet eth0 vrf 'LAN1' + set interfaces ethernet eth1 address '172.16.2.1/30' + set interfaces ethernet eth1 address '2001:db8::2/127' + set interfaces ethernet eth1 vrf 'LAN2' + set interfaces ethernet eth2 address '192.168.3.1/30' + set interfaces ethernet eth2 address '2001:db8::4/127' + set interfaces ethernet eth2 vrf 'Management' + set interfaces ethernet eth3 address '10.2.2.1/30' + set interfaces ethernet eth3 address '2001:db8::6/127' + set interfaces ethernet eth3 vrf 'Internet' + set protocols bgp address-family ipv4-unicast + set protocols bgp system-as '64496' + set vrf name Internet protocols bgp address-family ipv4-unicast export vpn + set vrf name Internet protocols bgp address-family ipv4-unicast import vpn + set vrf name Internet protocols bgp address-family ipv4-unicast rd vpn export '64496:100' + set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn export '64496:100' + set vrf name Internet protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' + set vrf name Internet protocols bgp address-family ipv6-unicast export vpn + set vrf name Internet protocols bgp address-family ipv6-unicast import vpn + set vrf name Internet protocols bgp address-family ipv6-unicast rd vpn export '64496:100' + set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn export '64496:100' + set vrf name Internet protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' + set vrf name Internet protocols bgp neighbor 10.2.2.2 address-family ipv4-unicast + set vrf name Internet protocols bgp neighbor 10.2.2.2 remote-as '64497' + set vrf name Internet protocols bgp neighbor 2001:db8::7 address-family ipv6-unicast + set vrf name Internet protocols bgp neighbor 2001:db8::7 remote-as '64497' + set vrf name Internet table '104' + set vrf name LAN1 protocols bgp address-family ipv4-unicast export vpn + set vrf name LAN1 protocols bgp address-family ipv4-unicast import vpn + set vrf name LAN1 protocols bgp address-family ipv4-unicast rd vpn export '64496:1' + set vrf name LAN1 protocols bgp address-family ipv4-unicast redistribute static + set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn export '64496:1' + set vrf name LAN1 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:2' + set vrf name LAN1 protocols bgp address-family ipv6-unicast export vpn + set vrf name LAN1 protocols bgp address-family ipv6-unicast import vpn + set vrf name LAN1 protocols bgp address-family ipv6-unicast rd vpn export '64496:1' + set vrf name LAN1 protocols bgp address-family ipv6-unicast redistribute static + set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn export '64496:1' + set vrf name LAN1 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:2' + set vrf name LAN1 protocols static route 10.0.0.0/24 next-hop 10.1.1.2 + set vrf name LAN1 protocols static route6 2001:db8:0:1::/64 next-hop 2001:db8::1 + set vrf name LAN1 table '101' + set vrf name LAN2 protocols bgp address-family ipv4-unicast export vpn + set vrf name LAN2 protocols bgp address-family ipv4-unicast import vpn + set vrf name LAN2 protocols bgp address-family ipv4-unicast rd vpn export '64496:2' + set vrf name LAN2 protocols bgp address-family ipv4-unicast redistribute static + set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn export '64496:2' + set vrf name LAN2 protocols bgp address-family ipv4-unicast route-target vpn import '64496:100 64496:50 64496:1' + set vrf name LAN2 protocols bgp address-family ipv6-unicast export vpn + set vrf name LAN2 protocols bgp address-family ipv6-unicast import vpn + set vrf name LAN2 protocols bgp address-family ipv6-unicast rd vpn export '64496:2' + set vrf name LAN2 protocols bgp address-family ipv6-unicast redistribute static + set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn export '64496:2' + set vrf name LAN2 protocols bgp address-family ipv6-unicast route-target vpn import '64496:100 64496:50 64496:1' + set vrf name LAN2 protocols static route 172.16.0.0/24 next-hop 172.16.2.2 + set vrf name LAN2 protocols static route6 2001:db8:0:2::/64 next-hop 2001:db8::3 + set vrf name LAN2 table '102' + set vrf name Management protocols bgp address-family ipv4-unicast export vpn + set vrf name Management protocols bgp address-family ipv4-unicast import vpn + set vrf name Management protocols bgp address-family ipv4-unicast rd vpn export '64496:50' + set vrf name Management protocols bgp address-family ipv4-unicast redistribute static + set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn export '64496:50' + set vrf name Management protocols bgp address-family ipv4-unicast route-target vpn import '64496:1 64496:2' + set vrf name Management protocols bgp address-family ipv6-unicast export vpn + set vrf name Management protocols bgp address-family ipv6-unicast import vpn + set vrf name Management protocols bgp address-family ipv6-unicast rd vpn export '64496:50' + set vrf name Management protocols bgp address-family ipv6-unicast redistribute static + set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn export '64496:50' + set vrf name Management protocols bgp address-family ipv6-unicast route-target vpn import '64496:1 64496:2' + set vrf name Management protocols static route 192.168.0.0/24 next-hop 192.168.3.2 + set vrf name Management protocols static route6 2001:db8:0:3::/64 next-hop 2001:db8::5 + set vrf name Management table '103' + + +- LAN1 + + +.. code-block:: none + + set interfaces dummy dum0 address '10.0.0.1/24' + set interfaces dummy dum0 address '2001:db8:0:1::1/64' + set interfaces ethernet eth0 address '10.1.1.2/30' + set interfaces ethernet eth0 address '2001:db8::1/127' + set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 + set protocols static route6 ::/0 next-hop 2001:db8::* + +- LAN2 + + + +.. code-block:: none + + set interfaces dummy dum0 address '172.16.0.1/24' + set interfaces dummy dum0 address '2001:db8:0:2::1/64' + set interfaces ethernet eth0 hw-id '50:00:00:03:00:00' + set interfaces ethernet eth1 address '172.16.2.2/30' + set interfaces ethernet eth1 address '2001:db8::3/127' + set protocols static route 0.0.0.0/0 next-hop 172.16.2.1 + set protocols static route6 ::/0 next-hop 2001:db8::2 + +- Management + + +.. code-block:: none + + set interfaces dummy dum0 address '192.168.0.1/24' + set interfaces dummy dum0 address '2001:db8:0:3::1/64' + set interfaces ethernet eth2 address '192.168.3.2/30' + set interfaces ethernet eth2 address '2001:db8::5/127' + set protocols static route 0.0.0.0/0 next-hop 192.168.3.1 + set protocols static route6 ::/0 next-hop 2001:db8::4 + +- ISP + + +.. code-block:: none + + set interfaces dummy dum0 address '192.0.2.1/24' + set interfaces dummy dum0 address '2001:db8:1::1/48' + set interfaces dummy dum1 address '198.51.100.1/24' + set interfaces dummy dum1 address '2001:db8:2::1/48' + set interfaces dummy dum2 address '203.0.113.1/24' + set interfaces dummy dum2 address '2001:db8:3::1/48' + set interfaces ethernet eth3 address '10.2.2.2/30' + set interfaces ethernet eth3 address '2001:db8::7/127' + set protocols bgp address-family ipv4-unicast redistribute connected + set protocols bgp address-family ipv6-unicast redistribute connected + set protocols bgp system-as '64497' + set protocols bgp neighbor 10.2.2.1 address-family ipv4-unicast default-originate + set protocols bgp neighbor 10.2.2.1 remote-as '64496' + set protocols bgp neighbor 2001:db8::6 address-family ipv6-unicast default-originate + set protocols bgp neighbor 2001:db8::6 remote-as '64496' + set protocols static route 0.0.0.0/0 next-hop 10.2.2.1 + set protocols static route6 ::/0 next-hop 2001:db8::6 + +********** +Appendix-B +********** + +Route-Filtering +=============== + + +When importing routes using MP-BGP it is possible to filter a subset of them +before are injected in the BGP table. One of the most common case is to use a +route-map with an prefix-list. + +- Configuration + + + +We create a prefix-list first and add all the routes we need to. + +.. stop_vyoslinter + +.. code-block:: none + + # set both ipv4 and ipv6 policies + + set policy prefix-list LAN2-Internet rule 1 action 'permit' + set policy prefix-list LAN2-Internet rule 1 le '24' + set policy prefix-list LAN2-Internet rule 1 prefix '198.51.0.0/16' + set policy prefix-list LAN2-Internet rule 2 action 'permit' + set policy prefix-list LAN2-Internet rule 2 prefix '192.0.2.0/24' + set policy prefix-list LAN2-Internet rule 3 action 'permit' + set policy prefix-list LAN2-Internet rule 3 prefix '192.168.0.0/24' + set policy prefix-list LAN2-Internet rule 4 action 'permit' + set policy prefix-list LAN2-Internet rule 4 prefix '10.0.0.0/24' + + set policy prefix-list6 LAN2-Internet-v6 rule 1 action 'permit' + set policy prefix-list6 LAN2-Internet-v6 rule 1 prefix '2001:db8:1::/48' + set policy prefix-list6 LAN2-Internet-v6 rule 2 action 'permit' + set policy prefix-list6 LAN2-Internet-v6 rule 2 prefix '2001:db8:2::/48' + set policy prefix-list6 LAN2-Internet-v6 rule 3 action 'permit' + set policy prefix-list6 LAN2-Internet-v6 rule 3 prefix '2001:db8:0:3::/64' + set policy prefix-list6 LAN2-Internet-v6 rule 4 action 'permit' + set policy prefix-list6 LAN2-Internet-v6 rule 4 prefix '2001:db8:0:1::/64' + +.. start_vyoslinter + +Then add a route-map and reference to above prefix. Consider that the actions +taken inside the prefix will MATCH the routes that will be affected by the +actions inside the rules of the route-map. + +.. code-block:: none + + set policy route-map LAN2-Internet rule 1 action 'permit' + set policy route-map LAN2-Internet rule 1 match ip address prefix-list 'LAN2-Internet' + + set policy route-map LAN2-Internet-v6 rule 1 action 'permit' + set policy route-map LAN2-Internet-v6 rule 1 match ipv6 address prefix-list 'LAN2-Internet-v6' + +We are using a "white list" approach by allowing only what is necessary. In case +that need to implement a "black list" approach then you will need to change the +action in the route-map for a deny BUT you need to add a rule that permits the +rest due to the implicit deny in the route-map. + +Then we need to attach the policy to the BGP process. This needs to be under +the import statement in the vrf we need to filter. + +.. code-block:: none + + set vrf name LAN2 protocols bgp address-family ipv4-unicast route-map vpn import 'LAN2-Internet' + set vrf name LAN2 protocols bgp address-family ipv6-unicast route-map vpn import 'LAN2-Internet-v6' + + +- Verification + + +.. code-block:: none + + # show ip route vrf LAN2 + + B>* 10.0.0.0/24 [20/0] via 10.1.1.2, eth0 (vrf LAN1), weight 1, 00:45:28 + S>* 172.16.0.0/24 [1/0] via 172.16.2.2, eth1, weight 1, 00:45:32 + C>* 172.16.2.0/30 is directly connected, eth1, 00:45:39 + B>* 192.0.2.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 + B>* 192.168.0.0/24 [20/0] via 192.168.3.2, eth2 (vrf Managment), weight 1, 00:45:27 + B>* 198.51.100.0/24 [20/0] via 10.2.2.2, eth3 (vrf Internet), weight 1, 00:45:24 + + # show ipv6 route vrf LAN2 + + C>* 2001:db8::2/127 is directly connected, eth1, 00:46:26 + B>* 2001:db8:0:1::/64 [20/0] via 2001:db8::1, eth0 (vrf LAN1), weight 1, 00:46:17 + S>* 2001:db8:0:2::/64 [1/0] via 2001:db8::3, eth1, weight 1, 00:46:21 + B>* 2001:db8:0:3::/64 [20/0] via 2001:db8::5, eth2 (vrf Managment), weight 1, 00:46:16 + B>* 2001:db8:1::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 + B>* 2001:db8:2::/48 [20/0] via fe80::5200:ff:fe02:3, eth3 (vrf Internet), weight 1, 00:46:13 + C>* fe80::/64 is directly connected, eth1, 00:46:27 + +As we can see even if both VRF LAN1 and LAN2 has the same import RTs we are able +to select which routes are effectively imported and installed. + diff --git a/docs/configexamples/rst-ipsec-cisco-policy-based.rst b/docs/configexamples/rst-ipsec-cisco-policy-based.rst new file mode 100644 index 00000000..257d98a1 --- /dev/null +++ b/docs/configexamples/rst-ipsec-cisco-policy-based.rst @@ -0,0 +1,355 @@ +:lastproofread: 2025-06-26 + +.. _examples-ipsec-cisco-policy-based: + +########################################################## +Policy-based Site-to-Site VPN IPsec between VyOS and Cisco +########################################################## + +This document is to describe a basic setup using policy-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +Cisco IOS. Cisco initiates IPsec connection only if interesting +traffic present. For stable work we recommend configuring an +initiator role on VyOS side. + +Network Topology +================ + +.. image:: /_static/images/cisco-vpn-ipsec.* + :align: center + :alt: Network Topology Diagram + +Prerequirements +=============== + +**VyOS:** + ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ + +**Cisco:** + ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ + +**IKE parameters:** + ++-------------------+---------+ +| Encryption | AES-256 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 2 | ++-------------------+---------+ + +**IPsec parameters:** + ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ + +**Traffic Selectors** + 192.168.0.0/24 <==> 192.168.10.0/24 + + 192.168.1.0/24 <==> 192.168.11.0/24 + +**Hosts configuration** + ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ + +Configuration +============= + +.. note:: Pfs is disabled in Cisco by default. + +VyOS +---- + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.1.2/30' + set interfaces ethernet eth1 address '192.168.0.1/24' + set interfaces ethernet eth2 address '192.168.1.1/24' + set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 + set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' + set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' + set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' + set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' + set vpn ipsec esp-group ESP-GROUP lifetime '3600' + set vpn ipsec esp-group ESP-GROUP pfs 'disable' + set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' + set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' + set vpn ipsec ike-group IKE-GROUP close-action 'start' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' + set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' + set vpn ipsec ike-group IKE-GROUP lifetime '28800' + set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' + set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes256' + set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' + set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' + set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' + set vpn ipsec site-to-site peer CISCO connection-type 'initiate' + set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' + set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' + set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' + set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' + set vpn ipsec site-to-site peer CISCO tunnel 1 local prefix '192.168.0.0/24' + set vpn ipsec site-to-site peer CISCO tunnel 1 remote prefix '192.168.10.0/24' + set vpn ipsec site-to-site peer CISCO tunnel 2 local prefix '192.168.1.0/24' + set vpn ipsec site-to-site peer CISCO tunnel 2 remote prefix '192.168.11.0/24' + +Cisco +----- + +.. code-block:: none + + crypto ikev2 proposal aes-cbc-256-proposal + encryption aes-cbc-256 + integrity sha1 + group 14 + ! + crypto ikev2 policy policy1 + match address local 10.0.2.2 + proposal aes-cbc-256-proposal + ! + crypto ikev2 keyring keys + peer VyOS + address 10.0.1.2 + pre-shared-key local test + pre-shared-key remote test + ! + crypto ikev2 profile IKEv2-profile + match identity remote address 10.0.1.2 255.255.255.255 + authentication remote pre-share + authentication local pre-share + keyring local keys + lifetime 28800 + ! + crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac + mode tunnel + ! + crypto map IPSEC-map 10 ipsec-isakmp + set peer 10.0.1.2 + set security-association lifetime seconds 3600 + set transform-set TS + set ikev2-profile IKEv2-profile + match address cryptoacl + ! + interface GigabitEthernet0/0 + ip address 10.0.2.2 255.255.255.252 + crypto map IPSEC-map + ! + interface GigabitEthernet0/1 + ip address 192.168.10.1 255.255.255.0 + ! + interface GigabitEthernet0/2 + ip address 192.168.11.1 255.255.255.0 + ! + ip route 0.0.0.0 0.0.0.0 10.0.2.1 + ! + ip access-list extended cryptoacl + permit ip 192.168.10.0 0.0.0.255 192.168.0.0 0.0.0.255 + permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255 + + + +Monitoring +========== + +Monitoring on VyOS side +----------------------- + +IKE SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ike sa + Peer ID / IP Local ID / IP + ------------ ------------- + 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv2 AES_CBC_256 HMAC_SHA1_96 MODP_2048 no 304 26528 + +IPsec SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + -------------- ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- + CISCO-tunnel-1 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 + CISCO-tunnel-2 up 6m6s 0B/0B 0/0 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 + +Monitoring on Cisco side +------------------------ + +IKE SAs: + +.. code-block:: none + + Cisco#show crypto ikev2 sa + IPv4 Crypto IKEv2 SA + + Tunnel-id Local Remote fvrf/ivrf Status + 1 10.0.2.2/4500 10.0.1.2/4500 none/none READY + Encr: AES-CBC, keysize: 256, PRF: SHA1, Hash: SHA96, DH Grp:14, Auth sign: PSK, Auth verify: PSK + Life/Active Time: 28800/471 sec + + IPv6 Crypto IKEv2 SA + + +IPsec SAs: + +.. code-block:: none + + Cisco#show crypto ipsec sa + + interface: GigabitEthernet0/0 + Crypto map tag: IPSEC-map, local addr 10.0.2.2 + + protected vrf: (none) + local ident (addr/mask/prot/port): (192.168.11.0/255.255.255.0/0/0) + remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) + current_peer 10.0.1.2 port 4500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 + #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC81F83DA(3357508570) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x8C63C51E(2355348766) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 23, flow_id: SW:23, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4231729/3585) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC81F83DA(3357508570) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 24, flow_id: SW:24, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4231729/3585) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: + + protected vrf: (none) + local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0) + remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0) + current_peer 10.0.1.2 port 4500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 + #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC40C7A20(3289152032) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x2948B6CB(692631243) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 21, flow_id: SW:21, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4194891/3581) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC40C7A20(3289152032) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 22, flow_id: SW:22, sibling_flags 80000040, crypto map: IPSEC-map + sa timing: remaining key lifetime (k/sec): (4194891/3581) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: + +Checking Connectivity +--------------------- + +ICMP packets from PC1 to PC3. + +.. code-block:: none + + PC1> ping 192.168.10.2 + + 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms + 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms + 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms + 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms + 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms + +ICMP packets from PC2 to PC4. + +.. code-block:: none + + PC2> ping 192.168.11.2 + + 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms + 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms + 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/rst-ipsec-cisco-route-based.rst b/docs/configexamples/rst-ipsec-cisco-route-based.rst new file mode 100644 index 00000000..553c5e2a --- /dev/null +++ b/docs/configexamples/rst-ipsec-cisco-route-based.rst @@ -0,0 +1,420 @@ +:lastproofread: 2025-06-26 + +.. _examples-ipsec-cisco-route-based: + +######################################################### +Route-based Site-to-Site VPN IPsec between VyOS and Cisco +######################################################### + +This document is to describe a basic setup using route-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +Cisco IOS. Cisco initiates IPsec connection only if interesting +traffic present. For stable work we recommend configuring an +initiator role on VyOS side. OSPF is selected as routing protocol +inside the tunnel. + +Network Topology +================ + +.. image:: /_static/images/cisco-vpn-ipsec.* + :align: center + :alt: Network Topology Diagram + +Prerequirements +=============== + +**VyOS:** + ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ + +**Cisco:** + ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ + +**IKE parameters:** + ++-------------------+---------+ +| Encryption | AES-128 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 1 | ++-------------------+---------+ + +**IPsec parameters:** + ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ + +**Hosts configuration** + ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ + +Configuration +============= + +.. note:: Pfs is disabled in Cisco by default. + +VyOS +---- + +.. stop_vyoslinter + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.1.2/30' + set interfaces ethernet eth1 address '192.168.0.1/24' + set interfaces ethernet eth2 address '192.168.1.1/24' + set interfaces vti vti1 address '10.100.100.1/30' + set interfaces vti vti1 mtu '1438' + set protocols ospf area 0 network '10.100.100.0/30' + set protocols ospf area 0 network '192.168.0.0/24' + set protocols ospf area 0 network '192.168.1.0/24' + set protocols ospf interface eth1 passive + set protocols ospf interface eth2 passive + set protocols ospf interface vti1 network 'point-to-point' + set protocols ospf parameters router-id '2.2.2.2' + set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 + set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' + set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' + set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' + set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' + set vpn ipsec esp-group ESP-GROUP lifetime '3600' + set vpn ipsec esp-group ESP-GROUP pfs 'disable' + set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' + set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' + set vpn ipsec ike-group IKE-GROUP close-action 'start' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' + set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' + set vpn ipsec ike-group IKE-GROUP lifetime '28800' + set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' + set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' + set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' + set vpn ipsec options disable-route-autoinstall + set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' + set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' + set vpn ipsec site-to-site peer CISCO connection-type 'initiate' + set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' + set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' + set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' + set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' + set vpn ipsec site-to-site peer CISCO vti bind 'vti1' + +.. start_vyoslinter + +Cisco +----- + +.. stop_vyoslinter + +.. code-block:: none + + crypto isakmp policy 10 + encr aes + authentication pre-share + group 14 + lifetime 28800 + crypto isakmp key test address 10.0.1.2 + ! + ! + crypto ipsec transform-set TS esp-aes 256 esp-sha256-hmac + mode transport + ! + crypto ipsec profile IPsec-profile + set transform-set TS + ! + ! + ! + ! + ! + ! + ! + interface Loopback0 + ip address 1.1.1.1 255.255.255.255 + ! + interface Tunnel10 + ip address 10.100.100.2 255.255.255.252 + ip ospf network point-to-point + tunnel source GigabitEthernet0/0 + tunnel mode ipsec ipv4 + tunnel destination 10.0.1.2 + tunnel protection ipsec profile IPsec-profile + ! + interface GigabitEthernet0/0 + ip address 10.0.2.2 255.255.255.252 + duplex auto + speed auto + media-type rj45 + ! + interface GigabitEthernet0/1 + ip address 192.168.10.1 255.255.255.0 + duplex auto + speed auto + media-type rj45 + ! + interface GigabitEthernet0/2 + ip address 192.168.11.1 255.255.255.0 + duplex auto + speed auto + media-type rj45 + ! + router ospf 1 + router-id 1.1.1.1 + passive-interface GigabitEthernet0/1 + passive-interface GigabitEthernet0/2 + network 10.100.100.0 0.0.0.3 area 0 + network 192.168.10.0 0.0.0.255 area 0 + network 192.168.11.0 0.0.0.255 area 0 + ! + ip route 0.0.0.0 0.0.0.0 10.0.2.1 + +.. start_vyoslinter + + +Monitoring +========== + +Monitoring on VyOS side +----------------------- + +IKE SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ike sa + Peer ID / IP Local ID / IP + ------------ ------------- + 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 8175 18439 + + + +IPsec SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + ------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- + CISCO-vti up 34m59s 17K/14K 224/213 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 + +OSPF Neighbor Status: + +.. stop_vyoslinter + +.. code-block:: none + + vyos@vyos:~$ show ip ospf neighbor + + Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL + 1.1.1.1 1 Full/- 1h29m37s 39.317s 10.100.100.2 vti1:10.100.100.1 0 0 0 + +.. start_vyoslinter + +Routing Table: + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + + S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:07:54 + C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:07:59 + L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:07:59 + O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:07:50 + C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:07:50 + L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:07:50 + O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:07:54 + C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:07:59 + L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:07:59 + O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:07:54 + C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:07:59 + L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:07:59 + O>* 192.168.10.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 + O>* 192.168.11.0/24 [110/2] via 10.100.100.2, vti1, weight 1, 00:07:34 + +Monitoring on Cisco side +------------------------ + +.. stop_vyoslinter + +IKE SAs: + +.. code-block:: none + + Cisco#show crypto isakmp sa + IPv4 Crypto ISAKMP SA + dst src state conn-id status + 10.0.1.2 10.0.2.2 QM_IDLE 1002 ACTIVE + + IPv6 Crypto ISAKMP SA + + + +IPsec SAs: + +.. code-block:: none + + Cisco#show crypto ipsec sa + + interface: Tunnel10 + Crypto map tag: Tunnel10-head-0, local addr 10.0.2.2 + + protected vrf: (none) + local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) + remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0) + current_peer 10.0.1.2 port 500 + PERMIT, flags={origin_is_acl,} + #pkts encaps: 1295, #pkts encrypt: 1295, #pkts digest: 1295 + #pkts decaps: 1238, #pkts decrypt: 1238, #pkts verify: 1238 + #pkts compressed: 0, #pkts decompressed: 0 + #pkts not compressed: 0, #pkts compr. failed: 0 + #pkts not decompressed: 0, #pkts decompress failed: 0 + #send errors 0, #recv errors 0 + + local crypto endpt.: 10.0.2.2, remote crypto endpt.: 10.0.1.2 + plaintext mtu 1438, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0 + current outbound spi: 0xC3E9B307(3286872839) + PFS (Y/N): N, DH group: none + + inbound esp sas: + spi: 0x2740C328(658555688) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 7, flow_id: SW:7, sibling_flags 80000040, crypto map: Tunnel10-head-0 + sa timing: remaining key lifetime (k/sec): (4173824/1401) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + inbound ah sas: + + inbound pcp sas: + + outbound esp sas: + spi: 0xC3E9B307(3286872839) + transform: esp-256-aes esp-sha256-hmac , + in use settings ={Tunnel, } + conn id: 8, flow_id: SW:8, sibling_flags 80000040, crypto map: Tunnel10-head-0 + sa timing: remaining key lifetime (k/sec): (4173819/1401) + IV size: 16 bytes + replay detection support: Y + Status: ACTIVE(ACTIVE) + + outbound ah sas: + + outbound pcp sas: + +OSPF Neighbor Status: + +.. code-block:: none + + Cisco# show ip ospf neighbor + + Neighbor ID Pri State Dead Time Address Interface + 2.2.2.2 0 FULL/ - 00:00:35 10.100.100.1 Tunnel10 + +Routing Table: + +.. code-block:: none + + Cisco#show ip route + Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP + D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area + N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 + E1 - OSPF external type 1, E2 - OSPF external type 2 + i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 + ia - IS-IS inter area, * - candidate default, U - per-user static route + o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + a - application route + + - replicated route, % - next hop override, p - overrides from PfR + + Gateway of last resort is 10.0.2.1 to network 0.0.0.0 + + S* 0.0.0.0/0 [1/0] via 10.0.2.1 + 1.0.0.0/32 is subnetted, 1 subnets + C 1.1.1.1 is directly connected, Loopback0 + 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks + C 10.0.2.0/30 is directly connected, GigabitEthernet0/0 + L 10.0.2.2/32 is directly connected, GigabitEthernet0/0 + C 10.100.100.0/30 is directly connected, Tunnel10 + L 10.100.100.2/32 is directly connected, Tunnel10 + O 192.168.0.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 + O 192.168.1.0/24 [110/1001] via 10.100.100.1, 00:09:36, Tunnel10 + 192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks + C 192.168.10.0/24 is directly connected, GigabitEthernet0/1 + L 192.168.10.1/32 is directly connected, GigabitEthernet0/1 + 192.168.11.0/24 is variably subnetted, 2 subnets, 2 masks + C 192.168.11.0/24 is directly connected, GigabitEthernet0/2 + L 192.168.11.1/32 is directly connected, GigabitEthernet0/2 + +.. start_vyoslinter + + +Checking Connectivity +--------------------- + +ICMP packets from PC1 to PC3. + +.. code-block:: none + + PC1> ping 192.168.10.2 + + 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms + 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms + 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms + 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms + 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms + +ICMP packets from PC2 to PC4. + +.. code-block:: none + + PC2> ping 192.168.11.2 + + 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms + 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms + 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/rst-ipsec-pa-route-based.rst b/docs/configexamples/rst-ipsec-pa-route-based.rst new file mode 100644 index 00000000..96349d98 --- /dev/null +++ b/docs/configexamples/rst-ipsec-pa-route-based.rst @@ -0,0 +1,436 @@ +:lastproofread: 2025-06-26 + +.. _examples-ipsec-pa-route-based: + +############################################################# +Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto +############################################################# + +This document is to describe a basic setup using route-based +site-to-site VPN IPsec. In this example we use VyOS 1.5 and +PA 11.0.0. OSPF is selected as routing protocol inside the +tunnel. + +Since this example focuses on IPsec configuration it does not +include firewall configuration. + +Network Topology +================ + +.. image:: /_static/images/ipsec-vyos-pa.* + :align: center + :alt: Network Topology Diagram + +Prerequirements +=============== + +**VyOS:** + ++---------+----------------+ +| WAN IP | 10.0.1.2/30 | ++---------+----------------+ +| LAN1 IP | 192.168.0.1/24 | ++---------+----------------+ +| LAN2 IP | 192.168.1.1/24 | ++---------+----------------+ + +**Cisco:** + ++---------+-----------------+ +| WAN IP | 10.0.2.2/30 | ++---------+-----------------+ +| LAN1 IP | 192.168.10.1/24 | ++---------+-----------------+ +| LAN2 IP | 192.168.11.1/24 | ++---------+-----------------+ + +**IKE parameters:** + ++-------------------+---------+ +| Encryption | AES-128 | ++-------------------+---------+ +| HASH | SHA-1 | ++-------------------+---------+ +| Diff-Helman Group | 14 | ++-------------------+---------+ +| Life-Time | 28800 | ++-------------------+---------+ +| IKE Version | 1 | ++-------------------+---------+ + +**IPsec parameters:** + ++------------+---------+ +| Encryption | AES-256 | ++------------+---------+ +| HASH | SHA-256 | ++------------+---------+ +| Life-Time | 3600 | ++------------+---------+ +| PFS | disable | ++------------+---------+ + +**Hosts configuration** + ++--------+--------------+ +| PC1 IP | 192.168.0.2 | ++--------+--------------+ +| PC2 IP | 192.168.1.2 | ++--------+--------------+ +| PC3 IP | 192.168.10.2 | ++--------+--------------+ +| PC4 IP | 192.168.11.2 | ++--------+--------------+ + +Configuration +============= + +VyOS +---- + +.. stop_vyoslinter + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.1.2/30' + set interfaces ethernet eth1 address '192.168.0.1/24' + set interfaces ethernet eth2 address '192.168.1.1/24' + set interfaces vti vti1 address '10.100.100.1/30' + set interfaces vti vti1 mtu '1438' + set protocols ospf area 0 network '10.100.100.0/30' + set protocols ospf area 0 network '192.168.0.0/24' + set protocols ospf area 0 network '192.168.1.0/24' + set protocols ospf interface eth1 passive + set protocols ospf interface eth2 passive + set protocols ospf interface vti1 network 'point-to-point' + set protocols ospf parameters router-id '2.2.2.2' + set protocols static route 0.0.0.0/0 next-hop 10.0.1.1 + set vpn ipsec authentication psk AUTH-PSK id '10.0.1.2' + set vpn ipsec authentication psk AUTH-PSK id '10.0.2.2' + set vpn ipsec authentication psk AUTH-PSK secret 'dGVzdA==' + set vpn ipsec authentication psk AUTH-PSK secret-type 'base64' + set vpn ipsec esp-group ESP-GROUP lifetime '3600' + set vpn ipsec esp-group ESP-GROUP pfs 'disable' + set vpn ipsec esp-group ESP-GROUP proposal 10 encryption 'aes256' + set vpn ipsec esp-group ESP-GROUP proposal 10 hash 'sha256' + set vpn ipsec ike-group IKE-GROUP close-action 'start' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection action 'restart' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval '10' + set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout '30' + set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev1' + set vpn ipsec ike-group IKE-GROUP lifetime '28800' + set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group '14' + set vpn ipsec ike-group IKE-GROUP proposal 10 encryption 'aes128' + set vpn ipsec ike-group IKE-GROUP proposal 10 hash 'sha1' + set vpn ipsec options disable-route-autoinstall + set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' + set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' + set vpn ipsec site-to-site peer CISCO connection-type 'initiate' + set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' + set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' + set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' + set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' + set vpn ipsec site-to-site peer CISCO vti bind 'vti1' + +.. start_vyoslinter + +Palo Alto +--------- + +.. stop_vyoslinter + +GUI Configuration: + Network -> Network Profiles -> IKE Crypto + + .. image:: /_static/images/PA-IKE-group.* + :align: center + + Network -> Network Profiles -> IKE Gateways + + .. image:: /_static/images/PA-IKE-GW-1.* + :align: center + + .. image:: /_static/images/PA-IKE-GW-2.* + :align: center + + Network -> Network Profiles -> IPSec Crypto + + .. image:: /_static/images/PA-ESP-group.* + :align: center + + Network -> Interfaces + + .. image:: /_static/images/PA-tunnel-1.* + :align: center + + .. image:: /_static/images/PA-tunnel-2.* + :align: center + + .. image:: /_static/images/PA-tunnel-3.* + :align: center + + Network -> IPSec Tunnels + + .. image:: /_static/images/PA-IPsec-tunnel.* + :align: center + +CLI configuration with OSPF: + +.. code-block:: none + + set network interface ethernet ethernet1/1 layer3 ip 10.0.2.2/30 + set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow + set network interface ethernet ethernet1/2 layer3 ip 192.168.10.1/24 + set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow + set network interface ethernet ethernet1/3 layer3 ip 192.168.11.1/24 + set network interface ethernet ethernet1/1 layer3 interface-management-profile Allow + set network interface tunnel units tunnel.1 ip 10.100.100.2/30 + set network interface tunnel units tunnel.1 interface-management-profile Allow + set network interface tunnel units tunnel.1 mtu 1438 + set network profiles interface-management-profile Allow ping yes + set network ike crypto-profiles ike-crypto-profiles IKE-GROUP hash sha1 + set network ike crypto-profiles ike-crypto-profiles IKE-GROUP dh-group group14 + set network ike crypto-profiles ike-crypto-profiles IKE-GROUP encryption aes-128-cbc + set network ike crypto-profiles ike-crypto-profiles IKE-GROUP lifetime seconds 28800 + set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp authentication sha256 + set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP esp encryption aes-256-cbc + set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP lifetime seconds 3600 + set network ike crypto-profiles ipsec-crypto-profiles ESP-GROUP dh-group no-pfs + set network ike gateway VyOS authentication pre-shared-key key test + set network ike gateway VyOS protocol ikev1 dpd enable yes + set network ike gateway VyOS protocol ikev1 exchange-mode main + set network ike gateway VyOS protocol ikev1 ike-crypto-profile IKE-GROUP + set network ike gateway VyOS protocol ikev2 dpd enable yes + set network ike gateway VyOS protocol version ikev1 + set network ike gateway VyOS protocol-common nat-traversal enable yes + set network ike gateway VyOS protocol-common fragmentation enable no + set network ike gateway VyOS protocol-common passive-mode yes + set network ike gateway VyOS local-address interface ethernet1/1 + set network ike gateway VyOS peer-address ip 10.0.1.2 + set network ike gateway VyOS local-id id 10.0.2.2 + set network ike gateway VyOS local-id type ipaddr + set network ike gateway VyOS peer-id id 10.0.1.2 + set network ike gateway VyOS peer-id type ipaddr + set network tunnel ipsec VyOS-tunnel auto-key ike-gateway VyOS + set network tunnel ipsec VyOS-tunnel auto-key ipsec-crypto-profile ESP-GROUP + set network tunnel ipsec VyOS-tunnel tunnel-monitor enable no + set network tunnel ipsec VyOS-tunnel tunnel-interface tunnel.1 + set network tunnel ipsec VyOS-tunnel anti-replay no + set network virtual-router default protocol ospf enable yes + set network virtual-router default protocol ospf area 0.0.0.0 type normal + set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 enable yes + set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 passive no + set network virtual-router default protocol ospf area 0.0.0.0 interface tunnel.1 link-type p2p + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 enable yes + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 passive yes + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/2 link-type broadcast + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 enable yes + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 passive yes + set network virtual-router default protocol ospf area 0.0.0.0 interface ethernet1/3 link-type broadcast + set network virtual-router default protocol ospf router-id 1.1.1.1 + set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 tunnel.1 ] + +.. start_vyoslinter + + +Monitoring +========== + +Monitoring on VyOS side +----------------------- + +IKE SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ike sa + Peer ID / IP Local ID / IP + ------------ ------------- + 10.0.2.2 10.0.2.2 10.0.1.2 10.0.1.2 + + State IKEVer Encrypt Hash D-H Group NAT-T A-Time L-Time + ----- ------ ------- ---- --------- ----- ------ ------ + up IKEv1 AES_CBC_128 HMAC_SHA1_96 MODP_2048 no 1372 25802 + + + + +IPsec SAs: + +.. code-block:: none + + vyos@vyos:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + ------------ ------- -------- -------------- ---------------- ---------------- ----------- ----------------------------- + PA-vti up 23m27s 9K/10K 149/151 10.0.2.2 10.0.2.2 AES_CBC_256/HMAC_SHA2_256_128 + + +OSPF Neighbor Status: + +.. stop_vyoslinter + +.. code-block:: none + + vyos@vyos:~$ show ip ospf neighbor + + Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL + 1.1.1.1 1 Full/- 23m56s 37.948s 10.100.100.2 vti1:10.100.100.1 0 0 0 + +.. start_vyoslinter + + +Routing Table: + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, L - local, S - static, + R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, t - Table-Direct, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + S>* 0.0.0.0/0 [1/0] via 10.0.1.1, eth0, weight 1, 00:27:30 + C>* 10.0.1.0/30 is directly connected, eth0, weight 1, 00:27:34 + L>* 10.0.1.2/32 is directly connected, eth0, weight 1, 00:27:34 + O 10.100.100.0/30 [110/1] is directly connected, vti1, weight 1, 00:24:34 + C>* 10.100.100.0/30 is directly connected, vti1, weight 1, 00:24:34 + L>* 10.100.100.1/32 is directly connected, vti1, weight 1, 00:24:34 + O 192.168.0.0/24 [110/1] is directly connected, eth1, weight 1, 00:27:29 + C>* 192.168.0.0/24 is directly connected, eth1, weight 1, 00:27:34 + L>* 192.168.0.1/32 is directly connected, eth1, weight 1, 00:27:34 + O 192.168.1.0/24 [110/1] is directly connected, eth2, weight 1, 00:27:29 + C>* 192.168.1.0/24 is directly connected, eth2, weight 1, 00:27:34 + L>* 192.168.1.1/32 is directly connected, eth2, weight 1, 00:27:34 + O>* 192.168.10.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 + O>* 192.168.11.0/24 [110/11] via 10.100.100.2, vti1, weight 1, 00:24:19 + + +Monitoring on Cisco side +------------------------ + +IKE SAs: + +.. code-block:: none + + admin@PA-VM> show vpn ike-sa + + IKEv1 phase-1 SAs + GwID/client IP Peer-Address Gateway Name Role Mode Algorithm Established Expiration V ST Xt Phase2 + -------------- ------------ ------------ ---- ---- --------- ----------- ---------- - -- -- ------ + 1 10.0.1.2 VyOS Resp Main PSK/DH14/A128/SHA1 Jul.31 01:35:00 Jul.31 09:35:00 v1 13 1 1 + + Show IKEv1 IKE SA: Total 1 gateways found. 1 ike sa found. + + + IKEv1 phase-2 SAs + Gateway Name TnID Tunnel GwID/IP Role Algorithm SPI(in) SPI(out) MsgID ST Xt + ------------ ---- ------ ------- ---- --------- ------- -------- ----- -- -- + VyOS 1 VyOS-tunnel 1 Resp ESP/ /tunl/SHA2 8827A3D9 C204F4FA BD202829 9 1 + + Show IKEv1 phase2 SA: Total 1 gateways found. 1 ike sa found. + + + There is no IKEv2 SA found. + +IPsec SAs: + +.. code-block:: none + + admin@PA-VM> show vpn ipsec-sa + + GwID/client IP TnID Peer-Address Tunnel(Gateway) Algorithm SPI(in) SPI(out) life(Sec/KB) remain-time(Sec) + -------------- ---- ------------ --------------- --------- ------- -------- ------------ ---------------- + 1 1 10.0.1.2 VyOS-tunnel(VyOS) ESP/A256/SHA256 8827A3D9 C204F4FA 3600/Unlimited 2733 + + Show IPSec SA: Total 1 tunnels found. 1 ipsec sa found. + +OSPF Neighbor Status: + +.. stop_vyoslinter + +.. code-block:: none + + admin@PA-VM> show routing protocol ospf neighbor + + Options: 0x80:reserved, O:Opaq-LSA capability, DC:demand circuits, EA:Ext-Attr LSA capability, + N/P:NSSA option, MC:multicase, E:AS external LSA capability, T:TOS capability + ========== + virtual router: default + neighbor address: 10.100.100.1 + local address binding: 0.0.0.0 + type: dynamic + status: full + neighbor router ID: 2.2.2.2 + area id: 0.0.0.0 + neighbor priority: 1 + lifetime remain: 32 + messages pending: 0 + LSA request pending: 0 + options: 0x02: E + hello suppressed: no + restart helper status: not helping + restart helper time remaining: 0 + restart helper exit reason: none + +.. start_vyoslinter + + + +Routing Table: + +.. code-block:: none + + admin@PA-VM> show routing route + + flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp, + Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast + + + VIRTUAL ROUTER: default (id 1) + ========== + destination nexthop metric flags age interface next-AS + 0.0.0.0/0 10.0.2.1 10 A S ethernet1/1 + 10.0.2.0/30 10.0.2.2 0 A C ethernet1/1 + 10.0.2.2/32 0.0.0.0 0 A H + 10.100.100.0/30 0.0.0.0 10 Oi 1273 tunnel.1 + 10.100.100.0/30 10.100.100.2 0 A C tunnel.1 + 10.100.100.2/32 0.0.0.0 0 A H + 192.168.0.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 + 192.168.1.0/24 10.100.100.1 11 A Oi 1253 tunnel.1 + 192.168.10.0/24 0.0.0.0 10 Oi 1273 ethernet1/2 + 192.168.10.0/24 192.168.10.1 0 A C ethernet1/2 + 192.168.10.1/32 0.0.0.0 0 A H + 192.168.11.0/24 0.0.0.0 10 Oi 1273 ethernet1/3 + 192.168.11.0/24 192.168.11.1 0 A C ethernet1/3 + 192.168.11.1/32 0.0.0.0 0 A H + total routes shown: 14 + + + +Checking Connectivity +--------------------- + +ICMP packets from PC1 to PC3. + +.. code-block:: none + + PC1> ping 192.168.10.2 + + 84 bytes from 192.168.10.2 icmp_seq=1 ttl=62 time=8.479 ms + 84 bytes from 192.168.10.2 icmp_seq=2 ttl=62 time=3.344 ms + 84 bytes from 192.168.10.2 icmp_seq=3 ttl=62 time=3.139 ms + 84 bytes from 192.168.10.2 icmp_seq=4 ttl=62 time=3.176 ms + 84 bytes from 192.168.10.2 icmp_seq=5 ttl=62 time=3.978 ms + +ICMP packets from PC2 to PC4. + +.. code-block:: none + + PC2> ping 192.168.11.2 + + 84 bytes from 192.168.11.2 icmp_seq=1 ttl=62 time=9.687 ms + 84 bytes from 192.168.11.2 icmp_seq=2 ttl=62 time=3.286 ms + 84 bytes from 192.168.11.2 icmp_seq=3 ttl=62 time=2.972 ms diff --git a/docs/configexamples/rst-l3vpn-hub-and-spoke.rst b/docs/configexamples/rst-l3vpn-hub-and-spoke.rst new file mode 100644 index 00000000..90a036d8 --- /dev/null +++ b/docs/configexamples/rst-l3vpn-hub-and-spoke.rst @@ -0,0 +1,1127 @@ + +############################################## +L3VPN for Hub-and-Spoke connectivity with VyOS +############################################## + +IP/MPLS technology is widely used by various service providers and large +enterprises in order to achieve better network scalability, manageability +and flexibility. It also provides the possibility to deliver different +services for the customers in a seamless manner. +Layer 3 VPN (L3VPN) is a type of VPN mode that is built and delivered +through OSI layer 3 networking technologies. Often the border gateway +protocol (BGP) is used to send and receive VPN-related data that is +responsible for the control plane. L3VPN utilizes virtual routing and +forwarding (VRF) techniques to receive and deliver user data as well as +separate data planes of the end-users. It is built using a combination of +IP- and MPLS-based information. Generally, L3VPNs are used to send data +on back-end VPN infrastructures, such as for VPN connections between data +centres, HQs and branches. + +An L3VPN consists of multiple access links, multiple VPN routing and +forwarding (VRF) tables, and multiple MPLS paths or multiple P2MP LSPs. +An L3VPN can be configured to connect two or more customer sites. +In hub-and-spoke MPLS L3VPN environments, the spoke routers need to have +unique Route Distinguishers (RDs). In order to use the hub site as a +transit point for connectivity in such an environment, the spoke sites +export their routes to the hub. Spokes can talk to hubs, but never have +direct paths to other spokes. All traffic between spokes is controlled +and delivered over the hub site. + + +To deploy a Layer3 VPN with MPLS on VyOS, we should meet a couple +requirements in order to properly implement the solution. +We'll use the following nodes in our LAB environment: + +* 2 x Route reflectors (VyOS-RRx) +* 4 x Provider routers (VyOS-Px) +* 3 x Provider Edge (VyOs-PEx) +* 3 x Customer Edge (VyOS-CEx) + +The following software was used in the creation of this document: + +* Operating system: VyOS +* Version: 1.4-rolling-202110310317 +* Image name: vyos-1.4-rolling-202110310317-amd64.iso + +**NOTE:** VyOS Router (tested with VyOS 1.4-rolling-202110310317) +– The configurations below are specifically for VyOS 1.4.x. + +General information can be found in the +:ref:`configuration/vrf/index:L3VPN VRFs` chapter. + + + +******** +Topology +******** +.. image:: /_static/images/L3VPN_hub_and_spoke.* + :width: 80% + :align: center + :alt: Network Topology Diagram + + + +***************** +How does it work? +***************** + +As we know the main assumption of L3VPN “Hub and Spoke” is, that the +traffic between spokes have to pass via hub, in our scenario VyOS-PE2 +is the Hub PE +and the VyOS-CE1-HUB is the central customer office device that is responsible +for controlling access between all spokes and announcing its network prefixes +(10.0.0.100/32). VyOS-PE2 has the main VRF (its name is BLUE_HUB), its +own Route-Distinguisher(RD) and route-target import/export lists. +Multiprotocol-BGP(MP-BGP) delivers L3VPN related control-plane information to +the nodes across network where PEs Spokes import the route-target 60535:1030 +(this is export route-target of vrf BLUE_HUB) and export its own route-target +60535:1011(this is vrf BLUE_SPOKE export route-target). Therefore, the +Customer edge nodes can only learn the network prefixes of the HUB site +[10.0.0.100/32]. For this example VyOS-CE1 has network prefixes +[10.0.0.80/32] / VyOS-CE2 has network prefixes [10.0.0.90/32]. +Route-Reflector devices VyOS-RR1 and VyOS-RR2 are used to simplify network +routes exchange and minimize iBGP peerings between devices. + +L3VPN configuration parameters table: + ++----------+-------+------------+-----------------+-------------+-------------+ +| Node | Role | VRF | RD | RT import | RT export | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE2 | Hub | BLUE_HUB | 10.80.80.1:1011 | 65035:1011 | 65035:1030 | +| | | | | 65035:1030 | | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE1 | Spoke | BLUE_SPOKE | 10.50.50.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ +| VyOS-PE3 | Spoke | BLUE_SPOKE | 10.60.60.1:1011 | 65035:1030 | 65035:1011 | ++----------+-------+------------+-----------------+-------------+-------------+ + + + +************* +Configuration +************* + + + +Step-1: Configuring IGP and enabling MPLS LDP +============================================= + +At the first step we need to configure the IP/MPLS backbone network using OSPF +as IGP protocol and LDP as label-switching protocol for the base connectivity +between **P** (rovider), **P** (rovider) **E** (dge) and **R** (oute) **R** +(eflector) nodes: + +- VyOS-P1: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.3/32' + set interfaces ethernet eth0 address '172.16.30.1/24' + set interfaces ethernet eth1 address '172.16.40.1/24' + set interfaces ethernet eth2 address '172.16.90.1/24' + set interfaces ethernet eth3 address '172.16.10.1/24' + set interfaces ethernet eth5 address '172.16.100.1/24' + + # protocols ospf+ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth5' + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.3' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp interface 'eth5' + set protocols mpls ldp router-id '10.0.0.3' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.3 + + +- VyOS-P2: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.4/32' + set interfaces ethernet eth0 address '172.16.30.2/24' + set interfaces ethernet eth1 address '172.16.20.1/24' + set interfaces ethernet eth2 address '172.16.120.1/24' + set interfaces ethernet eth3 address '172.16.60.1/24' + + # protocols ospf+ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.4' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp router-id '10.0.0.4' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.4' + +- VyOS-P3: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.5/32' + set interfaces ethernet eth0 address '172.16.110.1/24' + set interfaces ethernet eth1 address '172.16.40.2/24' + set interfaces ethernet eth2 address '172.16.50.1/24' + set interfaces ethernet eth3 address '172.16.70.1/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.5' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp router-id '10.0.0.5' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.5' + +- VyOS-P4: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.6/32' + set interfaces ethernet eth0 address '172.16.80.2/24' + set interfaces ethernet eth1 address '172.16.130.1/24' + set interfaces ethernet eth2 address '172.16.50.2/24' + set interfaces ethernet eth3 address '172.16.60.2/24' + set interfaces ethernet eth5 address '172.16.140.1/24' + + + # protocols ospf + ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set protocols mpls interface 'eth0' + set protocols mpls interface 'eth5' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.6' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp interface 'eth3' + set protocols mpls ldp interface 'eth5' + set protocols mpls ldp router-id '10.0.0.6' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.6' + +- VyOS-PE1: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.7/32' + set interfaces ethernet eth0 address '172.16.90.2/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.7' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp router-id '10.0.0.7' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.7' + +- VyOS-PE2: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.8/32' + set interfaces ethernet eth0 address '172.16.110.2/24' + set interfaces ethernet eth1 address '172.16.100.2/24' + set interfaces ethernet eth2 address '172.16.80.1/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls interface 'eth1' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.8' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp router-id '10.0.0.8' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.8' + +- VyOS-PE3: + +.. code-block:: none + + # interfaces + set interfaces dummy dum10 address '10.0.0.10/32' + set interfaces ethernet eth0 address '172.16.140.2/24' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.10' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp router-id '10.0.0.10' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.10' + +- VyOS-RR1: + +.. code-block:: none + + # interfaces + set interfaces ethernet eth1 address '172.16.20.2/24' + set interfaces ethernet eth2 address '172.16.10.2/24' + set interfaces dummy dum10 address '10.0.0.1/32' + + # protocols ospf + ldp + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth2' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.1' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth2' + set protocols mpls ldp router-id '10.0.0.1' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.1' + +- VyOS-RR2: + +.. code-block:: none + + # interfaces + set interfaces ethernet eth0 address '172.16.80.1/24' + set interfaces ethernet eth1 address '172.16.70.2/24' + set interfaces dummy dum10 address '10.0.0.2/32' + + # protocols ospf + ldp + set protocols mpls interface 'eth0' + set protocols mpls interface 'eth1' + set protocols mpls ldp discovery transport-ipv4-address '10.0.0.2' + set protocols mpls ldp interface 'eth1' + set protocols mpls ldp interface 'eth0' + set protocols mpls ldp router-id '10.0.0.2' + set protocols ospf area 0 network '0.0.0.0/0' + set protocols ospf parameters abr-type 'cisco' + set protocols ospf parameters router-id '10.0.0.2' + + + +Step-2: Configuring iBGP for L3VPN control-plane +================================================ + +At this step we are going to enable iBGP protocol on MPLS nodes and +Route Reflectors (two routers for redundancy) that will deliver IPv4 +VPN (L3VPN) routes between them: + +.. stop_vyoslinter + +- VyOS-RR1: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' + set protocols bgp parameters cluster-id '10.0.0.1' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.1' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-RR2: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.7 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.7 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.8 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.8 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.10 address-family ipv4-vpn route-reflector-client + set protocols bgp neighbor 10.0.0.10 peer-group 'RR_VPNv4' + set protocols bgp parameters cluster-id '10.0.0.1' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.2' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-PE1: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.7' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-PE2: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.8' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + +- VyOS-PE3: + +.. code-block:: none + + set protocols bgp system-as '65001' + set protocols bgp neighbor 10.0.0.1 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.1 peer-group 'RR_VPNv4' + set protocols bgp neighbor 10.0.0.2 address-family ipv4-vpn nexthop-self + set protocols bgp neighbor 10.0.0.2 peer-group 'RR_VPNv4' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.0.0.10' + set protocols bgp peer-group RR_VPNv4 remote-as '65001' + set protocols bgp peer-group RR_VPNv4 update-source 'dum10' + + + +Step-3: Configuring L3VPN VRFs on PE nodes +========================================== + +This section provides configuration steps for setting up VRFs on our +PE nodes including CE facing interfaces, BGP, rd and route-target +import/export based on the pre-defined parameters. + +- VyOS-PE1: + +.. code-block:: none + + # VRF settings + set vrf name BLUE_SPOKE table '200' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.50.50.0/24 + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.50.50.1:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' + set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 address-family ipv4-unicast as-override + set vrf name BLUE_SPOKE protocols bgp neighbor 10.50.50.2 remote-as '65035' + + # interfaces + set interfaces ethernet eth3 address '10.50.50.1/24' + set interfaces ethernet eth3 vrf 'BLUE_SPOKE' + +- VyOS-PE2: + +.. code-block:: none + + # VRF settings + set vrf name BLUE_HUB table '400' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast export vpn + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast import vpn + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast label vpn export 'auto' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast network 10.80.80.0/24 + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast rd vpn export '10.80.80.1:1011' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast redistribute connected + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn export '65035:1030' + set vrf name BLUE_HUB protocols bgp address-family ipv4-unicast route-target vpn import '65035:1011 65050:2011 65035:1030' + set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 address-family ipv4-unicast as-override + set vrf name BLUE_HUB protocols bgp neighbor 10.80.80.2 remote-as '65035' + + # interfaces + set interfaces ethernet eth3 address '10.80.80.1/24' + set interfaces ethernet eth3 vrf 'BLUE_HUB' + +- VyOS-PE3: + +.. code-block:: none + + # VRF settings + set vrf name BLUE_SPOKE table '200' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast export vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast import vpn + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast label vpn export 'auto' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast network 10.60.60.0/24 + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast rd vpn export '10.60.60.1:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast redistribute connected + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn export '65035:1011' + set vrf name BLUE_SPOKE protocols bgp address-family ipv4-unicast route-target vpn import '65035:1030' + set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 address-family ipv4-unicast as-override + set vrf name BLUE_SPOKE protocols bgp neighbor 10.60.60.2 remote-as '65035' + + # interfaces + set interfaces ethernet eth3 address '10.60.60.1/24' + set interfaces ethernet eth3 vrf 'BLUE_SPOKE' + + + +Step-4: Configuring CE nodes +============================ + +Dynamic routing used between CE and PE nodes and eBGP peering +established for the route exchanging between them. All routes +received by PEs are then exported to L3VPN and delivered from +Spoke sites to Hub and vise-versa based on previously +configured L3VPN parameters. + +- VyOS-CE1-SPOKE: + +.. code-block:: none + + # interfaces + set interfaces dummy dum20 address '10.0.0.80/32' + set interfaces ethernet eth0 address '10.50.50.2/24' + + # BGP for peering with PE + set protocols bgp system-as 65035 + set protocols bgp address-family ipv4-unicast network 10.0.0.80/32 + set protocols bgp neighbor 10.50.50.1 ebgp-multihop '2' + set protocols bgp neighbor 10.50.50.1 remote-as '65001' + set protocols bgp neighbor 10.50.50.1 update-source 'eth0' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.50.50.2' + +- VyOS-CE1-HUB: + +.. code-block:: none + + # interfaces + set interfaces dummy dum20 address '10.0.0.100/32' + set interfaces ethernet eth0 address '10.80.80.2/24' + + # BGP for peering with PE + set protocols bgp system-as 65035 + set protocols bgp address-family ipv4-unicast network 10.0.0.100/32 + set protocols bgp address-family ipv4-unicast redistribute connected + set protocols bgp neighbor 10.80.80.1 ebgp-multihop '2' + set protocols bgp neighbor 10.80.80.1 remote-as '65001' + set protocols bgp neighbor 10.80.80.1 update-source 'eth0' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.80.80.2' + +- VyOS-CE2-SPOKE: + +.. code-block:: none + + # interfaces + set interfaces dummy dum20 address '10.0.0.90/32' + set interfaces ethernet eth0 address '10.60.60.2/24' + + # BGP for peering with PE + set protocols bgp system-as 65035 + set protocols bgp address-family ipv4-unicast network 10.0.0.90/32 + set protocols bgp neighbor 10.60.60.1 ebgp-multihop '2' + set protocols bgp neighbor 10.60.60.1 remote-as '65001' + set protocols bgp neighbor 10.60.60.1 update-source 'eth0' + set protocols bgp parameters log-neighbor-changes + set protocols bgp parameters router-id '10.60.60.2' + + + +Step-5: Verification +==================== + +This section describes verification commands for MPLS/BGP/LDP +protocols and L3VPN related routes as well as diagnosis and +reachability checks between CE nodes. + +Let’s check IPv4 routing and MPLS information on provider nodes +(same procedure for all P nodes): + +- “show ip ospf neighbor” for checking ospf relationship + +.. code-block:: none + + vyos@VyOS-P1:~$ show ip ospf neighbor + + Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL + 10.0.0.4 1 Full/Backup 34.718s 172.16.30.2 eth0:172.16.30.1 0 0 0 + 10.0.0.5 1 Full/Backup 35.132s 172.16.40.2 eth1:172.16.40.1 0 0 0 + 10.0.0.7 1 Full/Backup 34.764s 172.16.90.2 eth2:172.16.90.1 0 0 0 + 10.0.0.1 1 Full/Backup 35.642s 172.16.10.2 eth3:172.16.10.1 0 0 0 + 10.0.0.8 1 Full/Backup 35.484s 172.16.100.2 eth5:172.16.100.1 0 0 0 + +- “show mpls ldp neighbor “ for checking ldp neighbors + +.. code-block:: none + + vyos@VyOS-P1:~$ show mpls ldp neighbor + AF ID State Remote Address Uptime + ipv4 10.0.0.1 OPERATIONAL 10.0.0.1 07w5d06h + ipv4 10.0.0.4 OPERATIONAL 10.0.0.4 09w3d00h + ipv4 10.0.0.5 OPERATIONAL 10.0.0.5 09w2d23h + ipv4 10.0.0.7 OPERATIONAL 10.0.0.7 03w0d01h + ipv4 10.0.0.8 OPERATIONAL 10.0.0.8 01w3d02h + +- “show mpls ldp binding” for checking mpls label assignment + +.. code-block:: none + + vyos@VyOS-P1:~$ show mpls ldp discovery + AF Destination Nexthop Local Label Remote Label In Use + ipv4 10.0.0.1/32 10.0.0.1 23 imp-null yes + ipv4 10.0.0.1/32 10.0.0.4 23 20 no + ipv4 10.0.0.1/32 10.0.0.5 23 17 no + ipv4 10.0.0.1/32 10.0.0.7 23 16 no + ipv4 10.0.0.1/32 10.0.0.8 23 16 no + ipv4 10.0.0.2/32 10.0.0.1 20 16 no + ipv4 10.0.0.2/32 10.0.0.4 20 22 no + ipv4 10.0.0.2/32 10.0.0.5 20 24 yes + ipv4 10.0.0.2/32 10.0.0.7 20 17 no + ipv4 10.0.0.2/32 10.0.0.8 20 17 no + ipv4 10.0.0.3/32 10.0.0.1 imp-null 17 no + ipv4 10.0.0.3/32 10.0.0.4 imp-null 16 no + ipv4 10.0.0.3/32 10.0.0.5 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.7 imp-null 18 no + ipv4 10.0.0.3/32 10.0.0.8 imp-null 18 no + ipv4 10.0.0.4/32 10.0.0.1 16 18 no + ipv4 10.0.0.4/32 10.0.0.4 16 imp-null yes + ipv4 10.0.0.4/32 10.0.0.5 16 19 no + ipv4 10.0.0.4/32 10.0.0.7 16 19 no + ipv4 10.0.0.4/32 10.0.0.8 16 19 no + ipv4 10.0.0.5/32 10.0.0.1 21 19 no + ipv4 10.0.0.5/32 10.0.0.4 21 17 no + ipv4 10.0.0.5/32 10.0.0.5 21 imp-null yes + ipv4 10.0.0.5/32 10.0.0.7 21 20 no + ipv4 10.0.0.5/32 10.0.0.8 21 20 no + ipv4 10.0.0.6/32 10.0.0.1 17 20 no + ipv4 10.0.0.6/32 10.0.0.4 17 23 yes + ipv4 10.0.0.6/32 10.0.0.5 17 21 yes + ipv4 10.0.0.6/32 10.0.0.7 17 21 no + ipv4 10.0.0.6/32 10.0.0.8 17 21 no + ipv4 10.0.0.7/32 10.0.0.1 22 21 no + ipv4 10.0.0.7/32 10.0.0.4 22 18 no + ipv4 10.0.0.7/32 10.0.0.5 22 20 no + ipv4 10.0.0.7/32 10.0.0.7 22 imp-null yes + ipv4 10.0.0.7/32 10.0.0.8 22 22 no + ipv4 10.0.0.8/32 10.0.0.1 24 22 no + ipv4 10.0.0.8/32 10.0.0.4 24 19 no + ipv4 10.0.0.8/32 10.0.0.5 24 16 no + ipv4 10.0.0.8/32 10.0.0.7 24 22 no + ipv4 10.0.0.8/32 10.0.0.8 24 imp-null yes + ipv4 10.0.0.9/32 10.0.0.1 18 23 no + ipv4 10.0.0.9/32 10.0.0.4 18 21 yes + ipv4 10.0.0.9/32 10.0.0.5 18 22 no + ipv4 10.0.0.9/32 10.0.0.7 18 23 no + ipv4 10.0.0.9/32 10.0.0.8 18 23 no + ipv4 10.0.0.10/32 10.0.0.1 19 24 no + ipv4 10.0.0.10/32 10.0.0.4 19 24 yes + ipv4 10.0.0.10/32 10.0.0.5 19 23 yes + ipv4 10.0.0.10/32 10.0.0.7 19 24 no + ipv4 10.0.0.10/32 10.0.0.8 19 24 no + +Now we’re checking iBGP status and routes from route-reflector +nodes to other devices: + +- “show bgp ipv4 vpn summary” for checking BGP VPNv4 neighbors: + +.. code-block:: none + + vyos@VyOS-RR1:~$ show bgp ipv4 vpn summary + BGP router identifier 10.0.0.1, local AS number 65001 vrf-id 0 + BGP table version 0 + RIB entries 9, using 1728 bytes of memory + Peers 4, using 85 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.7 4 65001 7719 7733 0 0 0 5d07h56m 2 10 + 10.0.0.8 4 65001 7715 7724 0 0 0 5d08h28m 4 10 + 10.0.0.9 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + 10.0.0.10 4 65001 7713 7724 0 0 0 5d08h28m 2 10 + + Total number of neighbors 4 + +- “show bgp ipv4 vpn” for checking all VPNv4 prefixes information: + +.. code-block:: none + + vyos@VyOS-RR1:~$ show bgp ipv4 vpn + BGP table version is 2, local router ID is 10.0.0.1, vrf id 0 + Default local pref 100, local AS 65001 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + Route Distinguisher: 10.50.50.1:1011 + *>i10.50.50.0/24 10.0.0.7 0 100 0 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i80.80.80.80/32 10.0.0.7 0 100 0 65035 i + UN=10.0.0.7 EC{65035:1011} label=80 type=bgp, subtype=0 + Route Distinguisher: 10.60.60.1:1011 + *>i10.60.60.0/24 10.0.0.10 0 100 0 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 + *>i90.90.90.90/32 10.0.0.10 0 100 0 65035 i + UN=10.0.0.10 EC{65035:1011} label=80 type=bgp, subtype=0 + Route Distinguisher: 10.80.80.1:1011 + *>i10.80.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 + *>i100.100.100.100/32 + 10.0.0.8 0 100 0 65035 i + UN=10.0.0.8 EC{65035:1030} label=80 type=bgp, subtype=0 + Route Distinguisher: 172.16.80.1:2011 + *>i10.110.110.0/24 10.0.0.8 0 100 0 65050 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 + *>i172.16.80.0/24 10.0.0.8 0 100 0 i + UN=10.0.0.8 EC{65050:2011} label=81 type=bgp, subtype=0 + Route Distinguisher: 172.16.100.1:2011 + *>i10.210.210.0/24 10.0.0.9 0 100 0 65050 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 + *>i172.16.100.0/24 10.0.0.9 0 100 0 i + UN=10.0.0.9 EC{65050:2011} label=80 type=bgp, subtype=0 + +- “show bgp ipv4 vpn x.x.x.x/x” for checking best path selected + for specific VPNv4 destination + +.. code-block:: none + + vyos@VyOS-RR1:~$ show bgp ipv4 vpn 10.0.0.100/32 + BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 + not allocated + Paths: (1 available, best #1) + Advertised to non peer-group peers: + 10.0.0.7 10.0.0.8 10.0.0.9 10.0.0.10 + 65035, (Received from a RR-client) + 10.0.0.8 from 10.0.0.8 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (First path received) + Extended Community: RT:65035:1030 + Remote label: 80 + Last update: Tue Oct 19 13:45:32 202 + +Also we can verify how PE devices receives VPNv4 networks from the RRs +and installing them to the specific customer VRFs: + +- “show bgp ipv4 vpn summary” for checking iBGP neighbors against + route-reflector devices: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp ipv4 vpn summary + BGP router identifier 10.0.0.7, local AS number 65001 vrf-id 0 + BGP table version 0 + RIB entries 9, using 1728 bytes of memory + Peers 2, using 43 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.1 4 65001 8812 8794 0 0 0 01:18:42 8 2 + 10.0.0.2 4 65001 8800 8792 0 0 0 6d02h27m 8 2 + +- “show bgp vrf all” for checking all the prefix learning on BGP + within VRFs: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp vrf all + + Instance default: + No BGP prefixes displayed, 0 exist + + Instance BLUE_SPOKE: + BGP table version is 8, local router ID is 10.50.50.1, vrf id 6 + Default local pref 100, local AS 65001 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + * 10.50.50.0/24 0.0.0.0 0 32768 ? + *> 0.0.0.0 0 32768 i + *> 10.80.80.0/24 10.0.0.8@0< 0 100 0 i + * 10.0.0.8@0< 0 100 0 i + *> 10.0.0.80/32 10.50.50.2 0 0 65035 i + *> 10.0.0.100/32 + 10.0.0.8@0< 0 100 0 65035 ? + * 10.0.0.8@0< 0 100 0 65035 ? + +- “show bgp vrf BLUE_SPOKE summary” for checking EBGP neighbor + information between PE and CE: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp vrf BLUE_SPOKE summary + + + IPv4 Unicast Summary: + BGP router identifier 10.50.50.1, local AS number 65001 vrf-id 6 + BGP table version 8 + RIB entries 7, using 1344 bytes of memory + Peers 1, using 21 KiB of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.50.50.2 4 65035 9019 9023 0 0 0 6d06h12m 1 4 + + Total number of neighbors 1 + +- “show ip route vrf BLUE_SPOKE” for viewing the RIB in our Spoke PE. + Using this command we are also able to check the transport and + customer label (inner/outer) for Hub network prefix (10.0.0.100/32): + +.. code-block:: none + + vyos@VyOS-PE1:~$ show ip route vrf BLUE_SPOKE + + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + VRF BLUE_SPOKE: + K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 03w0d23h + C>* 10.50.50.0/24 is directly connected, eth3, 03w0d23h + B> 10.80.80.0/24 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + B>* 10.0.0.80/32 [20/0] via 10.50.50.2, eth3, weight 1, 6d05h30m + B> 10.0.0.100/32 [200/0] via 10.0.0.8 (vrf default) (recursive), label 80, weight 1, 04:22:00 + * via 172.16.90.1, eth0 (vrf default), label 24/80, weight 1, 04:22:00 + +- “show bgp ipv4 vpn x.x.x.x/32” for checking the best-path to the + specific VPNv4 destination including extended community and + remotelabel information. This procedure is the same on all Spoke nodes: + +.. code-block:: none + + vyos@VyOS-PE1:~$ show bgp ipv4 vpn 10.0.0.100/32 + BGP routing table entry for 10.80.80.1:1011:10.0.0.100/32 + not allocated + Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.8 from 10.0.0.1 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Tue Oct 19 13:45:26 2021 + 65035 + 10.0.0.8 from 10.0.0.2 (10.0.0.8) + Origin incomplete, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1030 + Originator: 10.0.0.8, Cluster list: 10.0.0.1 + Remote label: 80 + Last update: Wed Oct 13 12:39:34 202 + +Now, let’s check routing information on out Hub PE: + +- “show bgp ipv4 vpn summary” for checking iBGP neighbors again + VyOS-RR1/RR2 + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp ipv4 vpn summary + BGP router identifier 10.0.0.8, local AS number 65001 vrf-id 0 + BGP table version 0 + RIB entries 9, using 1728 bytes of memory + Peers 2, using 43 KiB of memory + Peer groups 1, using 64 bytes of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.0.0.1 4 65001 15982 15949 0 0 0 05:41:28 6 4 + 10.0.0.2 4 65001 9060 9054 0 0 0 6d06h47m 6 4 + + Total number of neighbors + +- “show bgp vrf all” for checking all the prefixes learning on BGP + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp vrf all + + Instance default: + No BGP prefixes displayed, 0 exist + + Instance BLUE_HUB: + BGP table version is 50, local router ID is 10.80.80.1, vrf id 8 + Default local pref 100, local AS 65001 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + *> 10.50.50.0/24 10.0.0.7@0< 0 100 0 i + * 10.0.0.7@0< 0 100 0 i + *> 10.60.60.0/24 10.0.0.10@0< 0 100 0 i + * 10.0.0.10@0< 0 100 0 i + * 10.80.80.0/24 10.80.80.2 0 0 65035 ? + * 0.0.0.0 0 32768 i + *> 0.0.0.0 0 32768 ? + *> 10.110.110.0/24 172.16.80.2@9< 0 0 65050 i + *> 10.210.210.0/24 10.0.0.9@0< 0 100 0 65050 i + * 10.0.0.9@0< 0 100 0 65050 i + *> 10.0.0.80/32 10.0.0.7@0< 0 100 0 65035 i + * 10.0.0.7@0< 0 100 0 65035 i + *> 10.0.0.90/32 10.0.0.10@0< 0 100 0 65035 i + * 10.0.0.10@0< 0 100 0 65035 i + *> 10.0.0.100/32 + 10.80.80.2 0 0 65035 ? + *> 172.16.80.0/24 0.0.0.0@9< 0 32768 ? + 0.0.0.0@9< 0 32768 i + *> 172.16.100.0/24 10.0.0.9@0< 0 100 0 i + * 10.0.0.9@0< 0 100 0 i + +- “show bgp vrf BLUE_HUB summary” for checking EBGP neighbor + CE Hub device + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp vrf BLUE_HUB summary + + IPv4 Unicast Summary: + BGP router identifier 10.80.80.1, local AS number 65001 vrf-id 8 + BGP table version 50 + RIB entries 19, using 3648 bytes of memory + Peers 1, using 21 KiB of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt + 10.80.80.2 4 65035 15954 15972 0 0 0 01w4d01h 2 10 + +- “show ip route vrf BLUE_HUB” to view the RIB in our Hub PE. + With this command we are able to check the transport and + customer label (inner/outer) for network spokes prefixes + 10.0.0.80/32 - 10.0.0.90/32 + +.. code-block:: none + + vyos@VyOS-PE2:~$ show ip route vrf BLUE_HUB + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + VRF BLUE_HUB: + K>* 0.0.0.0/0 [255/8192] unreachable (ICMP unreachable), 01w4d01h + B> 10.50.50.0/24 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + B> 10.60.60.0/24 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + C>* 10.80.80.0/24 is directly connected, eth3, 01w4d01h + B>* 10.110.110.0/24 [200/0] via 172.16.80.2, eth2 (vrf GREEN), weight 1, 01w4d01h + B> 10.210.210.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + B> 10.0.0.80/32 [200/0] via 10.0.0.7 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 22/144, weight 1, 05:53:15 + B> 10.0.0.90/32 [200/0] via 10.0.0.10 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 23/144, weight 1, 05:53:15 + B>* 10.0.0.100/32 [20/0] via 10.80.80.2, eth3, weight 1, 01w4d01h + B>* 172.16.80.0/24 [200/0] is directly connected, eth2 (vrf GREEN), weight 1, 01w4d01h + B> 172.16.100.0/24 [200/0] via 10.0.0.9 (vrf default) (recursive), label 144, weight 1, 05:53:15 + * via 172.16.100.1, eth1 (vrf default), label 18/144, weight 1, 05:53:15 + * via 172.16.110.1, eth0 (vrf default), label 22/144, weight 1, 05:53:15 + +- “show bgp ipv4 vpn x.x.x.x/32” for checking best-path, + extended community and remote label of specific destination + +.. code-block:: none + + vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.80/32 + BGP routing table entry for 10.50.50.1:1011:10.0.0.80/32 + not allocated + Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.7 from 10.0.0.1 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 10.0.0.7 from 10.0.0.2 (10.0.0.7) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.7, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:39:37 2021 + + vyos@VyOS-PE2:~$ show bgp ipv4 vpn 10.0.0.90/32 + BGP routing table entry for 10.60.60.1:1011:10.0.0.90/32 + not allocated + Paths: (2 available, best #1) + Not advertised to any peer + 65035 + 10.0.0.10 from 10.0.0.1 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal, best (Neighbor IP) + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Tue Oct 19 13:45:30 2021 + 65035 + 10.0.0.10 from 10.0.0.2 (10.0.0.10) + Origin IGP, metric 0, localpref 100, valid, internal + Extended Community: RT:65035:1011 + Originator: 10.0.0.10, Cluster list: 10.0.0.1 + Remote label: 144 + Last update: Wed Oct 13 12:45:44 2021 + +Finally, let’s check the reachability between CEs: + +- VyOS-CE1-SPOKE -----> VyOS-CE-HUB + + +.. code-block:: none + + # check rib + vyos@VyOS-CE1-SPOKE:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + B 10.50.50.0/24 [20/0] via 10.50.50.1 inactive, weight 1, 6d07h53m + C>* 10.50.50.0/24 is directly connected, eth0, 09w0d00h + B>* 10.80.80.0/24 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m + C>* 10.0.0.80/32 is directly connected, dum20, 09w0d00h + B>* 10.0.0.100/32 [20/0] via 10.50.50.1, eth0, weight 1, 6d07h53m + + # check icmp + vyos@VyOS-CE1-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.80 + PING 10.0.0.100 (10.0.0.100) from 10.0.0.80 : 56(84) bytes of data. + 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=6.52 ms + 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.13 ms + 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.04 ms + 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.03 ms + ^C + --- 10.0.0.100 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 8ms + rtt min/avg/max/mdev = 4.030/4.680/6.518/1.064 ms + + # check network path + vyos@VyOS-CE1-SPOKE:~$ traceroute 10.0.0.100 + traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets + 1 10.50.50.1 (10.50.50.1) 1.041 ms 1.252 ms 1.835 ms + 2 * * * + 3 10.0.0.100 (10.0.0.100) 9.225 ms 9.159 ms 9.121 m + +- VyOS-CE-HUB -------> VyOS-CE1-SPOKE +- VyOS-CE-HUB -------> VyOS-CE2-SPOKE + +.. code-block:: none + + # check rib + vyos@VyOS-CE-HUB:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + B>* 10.50.50.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m + B>* 10.60.60.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + C>* 10.80.80.0/24 is directly connected, eth0, 01w6d07h + B>* 10.110.110.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h + B>* 10.210.210.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + B>* 10.0.0.80/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h04m + B>* 10.0.0.90/32 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + C>* 10.0.0.100/32 is directly connected, dum20, 01w6d07h + B>* 172.16.80.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 01w4d02h + B>* 172.16.100.0/24 [20/0] via 10.80.80.1, eth0, weight 1, 6d08h35m + + # check icmp + vyos@VyOS-CE-HUB:~$ ping 10.0.0.80 interface 10.0.0.100 c 4 + PING 10.0.0.80 (10.0.0.80) from 10.0.0.100 : 56(84) bytes of data. + 64 bytes from 10.0.0.80: icmp_seq=1 ttl=62 time=3.31 ms + 64 bytes from 10.0.0.80: icmp_seq=2 ttl=62 time=4.23 ms + 64 bytes from 10.0.0.80: icmp_seq=3 ttl=62 time=3.89 ms + 64 bytes from 10.0.0.80: icmp_seq=4 ttl=62 time=3.22 ms + + --- 10.0.0.80 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 9ms + rtt min/avg/max/mdev = 3.218/3.661/4.226/0.421 ms + + vyos@VyOS-CE-HUB:~$ ping 10.0.0.90 interface 10.0.0.100 c 4 + PING 10.0.0.90 (10.0.0.90) from 10.0.0.100 : 56(84) bytes of data. + 64 bytes from 10.0.0.90: icmp_seq=1 ttl=62 time=7.46 ms + 64 bytes from 10.0.0.90: icmp_seq=2 ttl=62 time=4.43 ms + 64 bytes from 10.0.0.90: icmp_seq=3 ttl=62 time=4.60 ms + ^C + --- 10.0.0.90 ping statistics --- + 3 packets transmitted, 3 received, 0% packet loss, time 6ms + rtt min/avg/max/mdev = 4.430/5.498/7.463/1.391 ms + + # check network path + vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.80 + traceroute to 10.0.0.80 (10.0.0.80), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.563 ms 1.341 ms 1.075 ms + 2 * * * + 3 10.0.0.80 (10.0.0.80) 8.125 ms 8.019 ms 7.781 ms + + vyos@VyOS-CE-HUB:~$ traceroute 10.0.0.90 + traceroute to 10.0.0.90 (10.0.0.90), 30 hops max, 60 byte packets + 1 10.80.80.1 (10.80.80.1) 1.305 ms 1.137 ms 1.097 ms + 2 * * * + 3 * * * + 4 10.0.0.90 (10.0.0.90) 9.358 ms 9.325 ms 9.292 ms + +- VyOS-CE2-SPOKE -------> VyOS-CE-HUB + +.. code-block:: none + + # check rib + vyos@rt-ce2-SPOKE:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + + B 10.60.60.0/24 [20/0] via 10.60.60.1 inactive, weight 1, 02w6d00h + C>* 10.60.60.0/24 is directly connected, eth0, 02w6d00h + B>* 10.80.80.0/24 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m + C>* 10.0.0.90/32 is directly connected, dum20, 02w6d00h + B>* 10.0.0.100/32 [20/0] via 10.60.60.1, eth0, weight 1, 6d08h46m + + # check icmp + vyos@rt-ce2-SPOKE:~$ ping 10.0.0.100 interface 10.0.0.90 c 4 + PING 10.0.0.100 (10.0.0.100) from 10.0.0.90 : 56(84) bytes of data. + 64 bytes from 10.0.0.100: icmp_seq=1 ttl=62 time=4.97 ms + 64 bytes from 10.0.0.100: icmp_seq=2 ttl=62 time=4.45 ms + 64 bytes from 10.0.0.100: icmp_seq=3 ttl=62 time=4.20 ms + 64 bytes from 10.0.0.100: icmp_seq=4 ttl=62 time=4.29 ms + + --- 10.0.0.100 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 9ms + rtt min/avg/max/mdev = 4.201/4.476/4.971/0.309 ms + + # check network path + vyos@rt-ce2-SPOKE:~$ traceroute 10.0.0.100 + traceroute to 10.0.0.100 (10.0.0.100), 30 hops max, 60 byte packets + 1 10.60.60.1 (10.60.60.1) 1.343 ms 1.190 ms 1.152 ms + 2 * * * + 3 * * * + 4 10.0.0.100 (10.0.0.100) 7.504 ms 7.480 ms 7.488 ms + +.. start_vyoslinter + +**Note:** At the moment, trace mpls doesn’t show labels/paths. So we’ll +see ``* * *`` for the transit routers of the mpls backbone. diff --git a/docs/configexamples/rst-lac-lns.rst b/docs/configexamples/rst-lac-lns.rst new file mode 100644 index 00000000..5f344d54 --- /dev/null +++ b/docs/configexamples/rst-lac-lns.rst @@ -0,0 +1,182 @@ +:lastproofread: 2024-02-21 + +.. _examples-lac-lns: + +############### +PPPoE over L2TP +############### + +This document is to describe a basic setup using PPPoE over L2TP. +LAC and LNS are components of the broadband topology. +LAC - L2TP access concentrator +LNS - L2TP Network Server +LAC and LNS forms L2TP tunnel. LAC receives packets from PPPoE clients and +forward them to LNS. LNS is the termination point that comes from PPP packets +from the remote client. + +In this example we use VyOS 1.5 as LNS and Cisco IOS as LAC. +All users with domain **vyos.io** will be tunneled to LNS via L2TP. + +Network Topology +================ + +.. image:: /_static/images/lac-lns-diagram.* + :width: 60% + :align: center + :alt: Network Topology Diagram + +Configurations +============== + +LAC +--- + +.. code-block:: none + + aaa new-model + ! + aaa authentication ppp default local + ! + vpdn enable + vpdn aaa attribute nas-ip-address vpdn-nas + ! + vpdn-group LAC + request-dialin + protocol l2tp + domain vyos.io + initiate-to ip 192.168.139.100 + source-ip 192.168.139.101 + local name LAC + l2tp tunnel password 0 test123 + ! + bba-group pppoe MAIN-BBA + virtual-template 1 + ! + interface GigabitEthernet0/0 + description To LNS + ip address 192.168.139.101 255.255.255.0 + duplex auto + speed auto + media-type rj45 + ! + interface GigabitEthernet0/1 + description To PPPoE clients + no ip address + duplex auto + speed auto + media-type rj45 + pppoe enable group MAIN-BBA + ! + interface Virtual-Template1 + description pppoe MAIN-BBA + no ip address + no peer default ip address + ppp mtu adaptive + ppp authentication chap + ! + + +LNS +--- + +.. stop_vyoslinter + +.. code-block:: none + + set interfaces ethernet eth0 address '192.168.139.100/24' + set nat source rule 100 outbound-interface name 'eth0' + set nat source rule 100 source address '10.0.0.0/24' + set nat source rule 100 translation address 'masquerade' + set protocols static route 0.0.0.0/0 next-hop 192.168.139.2 + set vpn l2tp remote-access authentication mode 'radius' + set vpn l2tp remote-access authentication radius server 192.168.139.110 key 'radiustest' + set vpn l2tp remote-access client-ip-pool TEST-POOL range '10.0.0.2-10.0.0.100' + set vpn l2tp remote-access default-pool 'TEST-POOL' + set vpn l2tp remote-access gateway-address '10.0.0.1' + set vpn l2tp remote-access lns host-name 'LAC' + set vpn l2tp remote-access lns shared-secret 'test123' + set vpn l2tp remote-access name-server '8.8.8.8' + set vpn l2tp remote-access ppp-options disable-ccp + +.. start_vyoslinter + +.. note:: This setup requires the Compression Control Protocol (CCP) + being disabled, the command + ``set vpn l2tp remote-access ppp-options disable-ccp`` + accomplishes that. + +Client +------ + +In this lab we use Windows PPPoE client. + +.. image:: /_static/images/lac-lns-winclient.* + :width: 100% + :align: center + :alt: Window PPPoE Client Configuration + +Monitoring +---------- + +Monitoring on LNS side + +.. code-block:: none + + vyos@vyos:~$ show l2tp-server sessions + ifname | username | ip | ip6 | ip6-dp | calling-sid | rate-limit | state | uptime | rx-bytes | tx-bytes + --------+--------------+----------+-----+--------+-----------------+------------+--------+----------+-----------+---------- + l2tp0 | test@vyos.io | 10.0.0.2 | | | 192.168.139.101 | | active | 00:00:35 | 188.4 KiB | 9.3 MiB + +Monitoring on LAC side + +.. code-block:: none + + Router#show pppoe session + 1 session in FORWARDED (FWDED) State + 1 session total + Uniq ID PPPoE RemMAC Port VT VA State + SID LocMAC VA-st Type + 1 1 000c.290b.20a6 Gi0/1 1 N/A FWDED + 0c58.88ac.0001 + + Router#show l2tp + L2TP Tunnel and Session Information Total tunnels 1 sessions 1 + + LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ + Count VPDN Group + 23238 2640 LAC est 192.168.139.100 1 LAC + + LocID RemID TunID Username, Intf/ State Last Chg Uniq ID + Vcid, Circuit + 25641 25822 23238 test@vyos.io, Gi0/1 est 00:05:36 1 + +Monitoring on RADIUS Server side + +.. code-block:: none + + root@Radius:~# cat /var/log/freeradius/radacct/192.168.139.100/detail-20240221 + Wed Feb 21 13:37:17 2024 + User-Name = "test@vyos.io" + NAS-Port = 0 + NAS-Port-Id = "l2tp0" + NAS-Port-Type = Virtual + Service-Type = Framed-User + Framed-Protocol = PPP + Calling-Station-Id = "192.168.139.101" + Called-Station-Id = "192.168.139.100" + Acct-Status-Type = Start + Acct-Authentic = RADIUS + Acct-Session-Id = "45c731e169d9a4f1" + Acct-Session-Time = 0 + Acct-Input-Octets = 0 + Acct-Output-Octets = 0 + Acct-Input-Packets = 0 + Acct-Output-Packets = 0 + Acct-Input-Gigawords = 0 + Acct-Output-Gigawords = 0 + Framed-IP-Address = 10.0.0.2 + NAS-IP-Address = 192.168.139.100 + Event-Timestamp = "Feb 21 2024 13:37:17 UTC" + Tmp-String-9 = "ai:" + Acct-Unique-Session-Id = "ea6a1089816f19c0d0f1819bc61c3318" + Timestamp = 1708522637 diff --git a/docs/configexamples/rst-nmp.rst b/docs/configexamples/rst-nmp.rst new file mode 100644 index 00000000..8945a9f4 --- /dev/null +++ b/docs/configexamples/rst-nmp.rst @@ -0,0 +1,72 @@ +:lastproofread: 2023-03-26 + +.. _examples-nmp: + +########### +NMP example +########### + +Consider how to quickly set up NMP and VyOS for monitoring. +NMP is multi-vendor network monitoring from 'SolarWinds' built to +scale and expand with the needs of your network. + +Configuration 'VyOS' +==================== + +First prepare our VyOS router for connection to NMP. We have to set +up the SNMP protocol and connectivity between the router and NMP. + +.. stop_vyoslinter + +.. code-block:: none + + set interfaces ethernet eth0 address 'dhcp' + set system name-server '8.8.8.8' + set service snmp community router authorization 'test' + set service snmp community router network '0.0.0.0/0' + +.. start_vyoslinter + + +Configuration 'NMP' +==================== + +Next, you just should follow the pictures: + +.. image:: /_static/images/nmp1.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp2.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp3.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp4.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp5.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp6.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. image:: /_static/images/nmp7.* + :width: 80% + :align: center + :alt: Network Topology Diagram + + +In the end, you'll get a powerful instrument for monitoring the VyOS systems. \ No newline at end of file diff --git a/docs/configexamples/rst-ospf-unnumbered.rst b/docs/configexamples/rst-ospf-unnumbered.rst new file mode 100644 index 00000000..6a5a1bb4 --- /dev/null +++ b/docs/configexamples/rst-ospf-unnumbered.rst @@ -0,0 +1,120 @@ +:lastproofread: 2021-06-29 + +.. _examples-ospf-unnumbered: + +######################### +OSPF unnumbered with ECMP +######################### + +General information can be found in the :ref:`routing-ospf` chapter. + +Configuration +============= + +- Router A: + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.0.1/24' + set interfaces ethernet eth1 address '192.168.0.1/32' + set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' + set interfaces ethernet eth1 ip ospf network 'point-to-point' + set interfaces ethernet eth2 address '192.168.0.1/32' + set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' + set interfaces ethernet eth2 ip ospf network 'point-to-point' + set interfaces loopback lo address '192.168.0.1/32' + set protocols ospf area 0.0.0.0 authentication 'md5' + set protocols ospf area 0.0.0.0 network '192.168.0.1/32' + set protocols ospf parameters router-id '192.168.0.1' + set protocols ospf redistribute connected + +- Router B: + +.. code-block:: none + + set interfaces ethernet eth0 address '10.0.0.2/24' + set interfaces ethernet eth1 address '192.168.0.2/32' + set interfaces ethernet eth1 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' + set interfaces ethernet eth1 ip ospf network 'point-to-point' + set interfaces ethernet eth2 address '192.168.0.2/32' + set interfaces ethernet eth2 ip ospf authentication md5 key-id 1 md5-key 'yourpassword' + set interfaces ethernet eth2 ip ospf network 'point-to-point' + set interfaces loopback lo address '192.168.0.2/32' + set protocols ospf area 0.0.0.0 authentication 'md5' + set protocols ospf area 0.0.0.0 network '192.168.0.2/32' + set protocols ospf parameters router-id '192.168.0.2' + set protocols ospf redistribute connected + + +Results +======= + +- Router A: + +.. code-block:: none + + vyos@vyos:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 10.0.0.1/24 u/u + eth1 192.168.0.1/32 u/u + eth2 192.168.0.1/32 u/u + lo 127.0.0.1/8 u/u + 192.168.0.1/32 + ::1/128 + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + + S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 + O 10.0.0.0/24 [110/20] via 192.168.0.2, eth1 onlink, 00:13:21 + via 192.168.0.2, eth2 onlink, 00:13:21 + C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 + O 192.168.0.1/32 [110/0] is directly connected, lo, 00:48:53 + C * 192.168.0.1/32 is directly connected, eth2, 00:56:31 + C * 192.168.0.1/32 is directly connected, eth1, 00:56:31 + C>* 192.168.0.1/32 is directly connected, lo, 00:57:36 + O>* 192.168.0.2/32 [110/1] via 192.168.0.2, eth1 onlink, 00:29:03 + * via 192.168.0.2, eth2 onlink, 00:29:03 + +- Router B: + +.. code-block:: none + + vyos@vyos:~$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 10.0.0.2/24 u/u + eth1 192.168.0.2/32 u/u + eth2 192.168.0.2/32 u/u + lo 127.0.0.1/8 u/u + 192.168.0.2/32 + ::1/128 + +.. code-block:: none + + vyos@vyos:~$ show ip route + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + + S>* 0.0.0.0/0 [210/0] via 10.0.0.254, eth0, 00:57:34 + O 10.0.0.0/24 [110/20] via 192.168.0.1, eth1 onlink, 00:13:21 + via 192.168.0.1, eth2 onlink, 00:13:21 + C>* 10.0.0.0/24 is directly connected, eth0, 00:57:35 + O 192.168.0.2/32 [110/0] is directly connected, lo, 00:48:53 + C * 192.168.0.2/32 is directly connected, eth2, 00:56:31 + C * 192.168.0.2/32 is directly connected, eth1, 00:56:31 + C>* 192.168.0.2/32 is directly connected, lo, 00:57:36 + O>* 192.168.0.1/32 [110/1] via 192.168.0.1, eth1 onlink, 00:29:03 + * via 192.168.0.1, eth2 onlink, 00:29:03 diff --git a/docs/configexamples/rst-policy-based-ipsec-and-firewall.rst b/docs/configexamples/rst-policy-based-ipsec-and-firewall.rst new file mode 100644 index 00000000..dcf59af9 --- /dev/null +++ b/docs/configexamples/rst-policy-based-ipsec-and-firewall.rst @@ -0,0 +1,282 @@ +.. _examples-policy-based-ipsec-and-firewall: + + +######################################################## +Policy-Based Site-to-Site VPN and Firewall Configuration +######################################################## + +This guide shows an example policy-based IKEv2 site-to-site VPN between two +VyOS routers, and firewall configuration. + +For simplicity, configuration and tests are done only using IPv4, and firewall +configuration is done only on one router. + +Network Topology and requirements +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +This configuration example and the requirements consists of: + +- Two VyOS routers with public IP address. + +- 2 private subnets on each site. + +- Local subnets should be able to reach internet using source NAT. + +- Communication between private subnets should be done through IPSec tunnel + without NAT. + +- Configuration of basic firewall in one site, in order to: + + - Protect the router on 'WAN' interface, allowing only IPSec connections + and SSH access from trusted IPs. + + - Allow access to the router only from trusted networks. + + - Allow DNS requests only only for local networks. + + - Allow ICMP on all interfaces. + + - Allow all new connections from local subnets. + + - Allow connections from LANs to LANs through the tunnel. + + +.. image:: /_static/images/policy-based-ipsec-and-firewall.* + + +Configuration +^^^^^^^^^^^^^ + +Interface and routing configuration: + +.. code-block:: none + + # LEFT router: + set interfaces ethernet eth0 address '198.51.100.14/30' + set interfaces ethernet eth1 vif 111 address '10.1.11.1/24' + set interfaces ethernet eth2 vif 112 address '10.1.12.1/24' + set protocols static route 0.0.0.0/0 next-hop 198.51.100.13 + + # RIGHT router: + set interfaces ethernet eth0 address '192.0.2.130/30' + set interfaces ethernet eth1 vif 221 address '10.2.21.1/24' + set interfaces ethernet eth2 vif 222 address '10.2.22.1/24' + + +IPSec configuration: + +.. code-block:: none + + # LEFT router: + set vpn ipsec authentication psk RIGHT id '198.51.100.14' + set vpn ipsec authentication psk RIGHT id '192.0.2.130' + set vpn ipsec authentication psk RIGHT secret 'p4ssw0rd' + set vpn ipsec esp-group ESP-GROUP mode 'tunnel' + set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256' + set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256' + set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' + set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14' + set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256' + set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256' + set vpn ipsec interface 'eth0' + set vpn ipsec site-to-site peer RIGHT authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer RIGHT connection-type 'initiate' + set vpn ipsec site-to-site peer RIGHT default-esp-group 'ESP-GROUP' + set vpn ipsec site-to-site peer RIGHT ike-group 'IKE-GROUP' + set vpn ipsec site-to-site peer RIGHT local-address '198.51.100.14' + set vpn ipsec site-to-site peer RIGHT remote-address '192.0.2.130' + set vpn ipsec site-to-site peer RIGHT tunnel 0 local prefix '10.1.11.0/24' + set vpn ipsec site-to-site peer RIGHT tunnel 0 remote prefix '10.2.21.0/24' + set vpn ipsec site-to-site peer RIGHT tunnel 1 local prefix '10.1.11.0/24' + set vpn ipsec site-to-site peer RIGHT tunnel 1 remote prefix '10.2.22.0/24' + set vpn ipsec site-to-site peer RIGHT tunnel 2 local prefix '10.1.12.0/24' + set vpn ipsec site-to-site peer RIGHT tunnel 2 remote prefix '10.2.21.0/24' + set vpn ipsec site-to-site peer RIGHT tunnel 3 local prefix '10.1.12.0/24' + set vpn ipsec site-to-site peer RIGHT tunnel 3 remote prefix '10.2.22.0/24' + + # RIGHT router: + set vpn ipsec authentication psk LEFT id '192.0.2.130' + set vpn ipsec authentication psk LEFT id '198.51.100.14' + set vpn ipsec authentication psk LEFT secret 'p4ssw0rd' + set vpn ipsec esp-group ESP-GROUP mode 'tunnel' + set vpn ipsec esp-group ESP-GROUP proposal 1 encryption 'aes256' + set vpn ipsec esp-group ESP-GROUP proposal 1 hash 'sha256' + set vpn ipsec ike-group IKE-GROUP key-exchange 'ikev2' + set vpn ipsec ike-group IKE-GROUP proposal 1 dh-group '14' + set vpn ipsec ike-group IKE-GROUP proposal 1 encryption 'aes256' + set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256' + set vpn ipsec interface 'eth0' + set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer LEFT connection-type 'none' + set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP' + set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP' + set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130' + set vpn ipsec site-to-site peer LEFT remote-address '198.51.100.14' + set vpn ipsec site-to-site peer LEFT tunnel 0 local prefix '10.2.21.0/24' + set vpn ipsec site-to-site peer LEFT tunnel 0 remote prefix '10.1.11.0/24' + set vpn ipsec site-to-site peer LEFT tunnel 1 local prefix '10.2.22.0/24' + set vpn ipsec site-to-site peer LEFT tunnel 1 remote prefix '10.1.11.0/24' + set vpn ipsec site-to-site peer LEFT tunnel 2 local prefix '10.2.21.0/24' + set vpn ipsec site-to-site peer LEFT tunnel 2 remote prefix '10.1.12.0/24' + set vpn ipsec site-to-site peer LEFT tunnel 3 local prefix '10.2.22.0/24' + set vpn ipsec site-to-site peer LEFT tunnel 3 remote prefix '10.1.12.0/24' + +Firewall Configuration: + +.. code-block:: none + + # Firewall Groups: + set firewall group network-group LOCAL-NETS network '10.1.11.0/24' + set firewall group network-group LOCAL-NETS network '10.1.12.0/24' + set firewall group network-group REMOTE-NETS network '10.2.21.0/24' + set firewall group network-group REMOTE-NETS network '10.2.22.0/24' + set firewall group network-group TRUSTED network '198.51.100.125/32' + set firewall group network-group TRUSTED network '203.0.113.0/24' + set firewall group network-group TRUSTED network '10.1.11.0/24' + set firewall group network-group TRUSTED network '192.168.70.0/24' + + # Forward traffic: default drop and only allow what is needed + set firewall ipv4 forward filter default-action 'drop' + + # Forward traffic: global state policies + set firewall ipv4 forward filter rule 1 action 'accept' + set firewall ipv4 forward filter rule 1 state established 'enable' + set firewall ipv4 forward filter rule 1 state related 'enable' + set firewall ipv4 forward filter rule 2 action 'drop' + set firewall ipv4 forward filter rule 2 state invalid 'enable' + + # Forward traffic: Accept all connections from local networks + set firewall ipv4 forward filter rule 10 action 'accept' + set firewall ipv4 forward filter rule 10 source group network-group 'LOCAL-NETS' + + # Forward traffic: accept connections from remote LANs to local LANs + set firewall ipv4 forward filter rule 20 action 'accept' + set firewall ipv4 forward filter rule 20 destination group network-group 'LOCAL-NETS' + set firewall ipv4 forward filter rule 20 source group network-group 'REMOTE-NETS' + + # Input traffic: default drop and only allow what is needed + set firewall ipv4 input filter default-action 'drop' + + # Input traffic: global state policies + set firewall ipv4 input filter rule 1 action 'accept' + set firewall ipv4 input filter rule 1 state established 'enable' + set firewall ipv4 input filter rule 1 state related 'enable' + set firewall ipv4 input filter rule 2 action 'drop' + set firewall ipv4 input filter rule 2 state invalid 'enable' + + # Input traffic: add rules needed for ipsec connection + set firewall ipv4 input filter rule 10 action 'accept' + set firewall ipv4 input filter rule 10 destination port '500,4500' + set firewall ipv4 input filter rule 10 inbound-interface name 'eth0' + set firewall ipv4 input filter rule 10 protocol 'udp' + set firewall ipv4 input filter rule 15 action 'accept' + set firewall ipv4 input filter rule 15 inbound-interface name 'eth0' + set firewall ipv4 input filter rule 15 protocol 'esp' + + # Input traffic: accept ssh connection from trusted ips + set firewall ipv4 input filter rule 20 action 'accept' + set firewall ipv4 input filter rule 20 destination port '22' + set firewall ipv4 input filter rule 20 protocol 'tcp' + set firewall ipv4 input filter rule 20 source group network-group 'TRUSTED' + + # Input traffic: accepd dns requests only from local networks. + set firewall ipv4 input filter rule 25 action 'accept' + set firewall ipv4 input filter rule 25 destination port '53' + set firewall ipv4 input filter rule 25 protocol 'udp' + set firewall ipv4 input filter rule 25 source group network-group 'LOCAL-NETS' + + # Input traffic: allow icmp + set firewall ipv4 input filter rule 30 action 'accept' + set firewall ipv4 input filter rule 30 protocol 'icmp' + +And NAT Configuration: + +.. code-block:: none + + set nat source rule 10 destination group network-group 'REMOTE-NETS' + set nat source rule 10 exclude + set nat source rule 10 outbound-interface name 'eth0' + set nat source rule 10 source group network-group 'LOCAL-NETS' + set nat source rule 20 outbound-interface name 'eth0' + set nat source rule 20 source group network-group 'LOCAL-NETS' + set nat source rule 20 translation address 'masquerade' + +Checking through op-mode commands +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +After some testing, we can check IPSec status, and counter on every tunnel: + +.. code-block:: none + + vyos@LEFT:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + -------------- ------- -------- -------------- ---------------- ---------------- ----------- --------------------------------------- + RIGHT-tunnel-0 up 36m24s 840B/840B 10/10 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 + RIGHT-tunnel-1 up 36m33s 588B/588B 7/7 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 + RIGHT-tunnel-2 up 35m50s 1K/1K 15/15 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 + RIGHT-tunnel-3 up 36m54s 2K/2K 32/32 192.0.2.130 192.0.2.130 AES_CBC_256/HMAC_SHA2_256_128/MODP_2048 + vyos@LEFT:~$ + + +Also, we can check firewall counters: + +.. code-block:: none + + vyos@LEFT:~$ show firewall + Rulesets Information + + --------------------------------- + IPv4 Firewall "forward filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ------------------------------------------------------ + 1 accept all 681 96545 ct state { established, related } accept + 2 drop all 0 0 ct state invalid + 10 accept all 360 27205 ip saddr @N_LOCAL-NETS accept + 20 accept all 8 648 ip daddr @N_LOCAL-NETS ip saddr @N_REMOTE-NETS accept + default drop all + + --------------------------------- + IPv4 Firewall "input filter" + + Rule Action Protocol Packets Bytes Conditions + ------- -------- ---------- --------- ------- ---------------------------------------------- + 1 accept all 901 123709 ct state { established, related } accept + 2 drop all 0 0 ct state invalid + 10 accept udp 0 0 udp dport { 500, 4500 } iifname "eth0" accept + 15 accept esp 0 0 meta l4proto esp iifname "eth0" accept + 20 accept tcp 1 60 tcp dport 22 ip saddr @N_TRUSTED accept + 25 accept udp 0 0 udp dport 53 ip saddr @N_LOCAL-NETS accept + 30 accept icmp 0 0 meta l4proto icmp accept + default drop all + + vyos@LEFT:~$ + vyos@LEFT:~$ show firewall statistics + Rulesets Statistics + + --------------------------------- + IPv4 Firewall "forward filter" + + Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface + ------- --------- ------- -------- ----------- ------------- ------------------- -------------------- + 1 681 96545 accept any any any any + 2 0 0 drop any any any any + 10 360 27205 accept LOCAL-NETS any any any + 20 8 648 accept REMOTE-NETS LOCAL-NETS any any + default N/A N/A drop any any any any + + --------------------------------- + IPv4 Firewall "input filter" + + Rule Packets Bytes Action Source Destination Inbound-Interface Outbound-interface + ------- --------- ------- -------- ---------- ------------- ------------------- -------------------- + 1 905 124213 accept any any any any + 2 0 0 drop any any any any + 10 0 0 accept any any eth0 any + 15 0 0 accept any any eth0 any + 20 1 60 accept TRUSTED any any any + 25 0 0 accept LOCAL-NETS any any any + 30 0 0 accept any any any any + default N/A N/A drop any any any any + + vyos@LEFT:~$ diff --git a/docs/configexamples/rst-pppoe-ipv6-basic.rst b/docs/configexamples/rst-pppoe-ipv6-basic.rst new file mode 100644 index 00000000..cc14451c --- /dev/null +++ b/docs/configexamples/rst-pppoe-ipv6-basic.rst @@ -0,0 +1,121 @@ +:lastproofread: 2021-06-29 + +.. _examples-pppoe-ipv6-basic: + +####################################### +PPPoE IPv6 Basic Setup for Home Network +####################################### + +This document is to describe a basic setup using PPPoE with DHCPv6-PD + +SLAAC to construct a typical home network. The user can follow the steps +described here to quickly setup a working network and use this as a starting +point to further configure or fine-tune other settings. + +To achieve this, your ISP is required to support DHCPv6-PD. If you're not sure, +please contact your ISP for more information. + +Network Topology +================ + +.. image:: /_static/images/pppoe-ipv6-pd-diagram.* + :width: 60% + :align: center + :alt: Network Topology Diagram + +Configurations +============== + +PPPoE Setup +----------- + +.. code-block:: none + + set interfaces pppoe pppoe0 authentication password + set interfaces pppoe pppoe0 authentication user + set interfaces pppoe pppoe0 service-name + set interfaces pppoe pppoe0 source-interface 'eth0' + +* Fill ``password`` and ``user`` with the credential provided by your ISP. +* ``service-name`` can be an arbitrary string. + +DHCPv6-PD Setup +--------------- + +During address configuration, in addition to assigning an address to the WAN +interface, ISP also provides a prefix to allow the router to configure addresses +of LAN interface and other nodes connecting to LAN, which is called prefix +delegation (PD). + +.. code-block:: none + + set interfaces pppoe pppoe0 ipv6 address autoconf + set interfaces pppoe pppoe0 dhcpv6-options pd 0 interface eth1 address '100' + +.. stop_vyoslinter + +* Here we use the prefix to configure the address of eth1 (LAN) to form + ``::64``, where ``64`` is hexadecimal of address 100. + +.. start_vyoslinter + +* For home network users, most of time ISP only provides /64 prefix, hence + there is no need to set SLA ID and prefix length. See :ref:`pppoe-interface` + for more information. + +Router Advertisement +-------------------- + +We need to enable router advertisement for LAN network so that PC can receive +the prefix and use SLAAC to configure the address automatically. + +.. code-block:: none + + set service router-advert interface eth1 link-mtu '1492' + set service router-advert interface eth1 name-server + set service router-advert interface eth1 prefix ::/64 valid-lifetime '172800' + +* Set MTU in advertisement to 1492 because of PPPoE header overhead. +* Set DNS server address in the advertisement so that clients can obtain it by + using RDNSS option. Most operating systems (Windows, Linux, Mac) should + already support it. +* Here we set the prefix to ``::/64`` to indicate advertising any /64 prefix + the LAN interface is assigned. +* Since some ISPs disconnects continuous connection for every 2~3 days, we set + ``valid-lifetime`` to 2 days to allow PC for phasing out old address. + +Basic Firewall +-------------- + +To have basic protection while keeping IPv6 network functional, we need to: + +* Allow all established and related traffic for router and LAN +* Allow all icmpv6 packets for router and LAN +* Allow DHCPv6 packets for router + +.. code-block:: none + + set firewall ipv6 name WAN_IN default-action 'drop' + set firewall ipv6 name WAN_IN rule 10 action 'accept' + set firewall ipv6 name WAN_IN rule 10 state established 'enable' + set firewall ipv6 name WAN_IN rule 10 state related 'enable' + set firewall ipv6 name WAN_IN rule 20 action 'accept' + set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6' + set firewall ipv6 name WAN_LOCAL default-action 'drop' + set firewall ipv6 name WAN_LOCAL rule 10 action 'accept' + set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable' + set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable' + set firewall ipv6 name WAN_LOCAL rule 20 action 'accept' + set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6' + set firewall ipv6 name WAN_LOCAL rule 30 action 'accept' + set firewall ipv6 name WAN_LOCAL rule 30 destination port '546' + set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp' + set firewall ipv6 name WAN_LOCAL rule 30 source port '547' + set firewall ipv6 forward filter rule 10 action jump + set firewall ipv6 forward filter rule 10 jump-target 'WAN_IN' + set firewall ipv6 forward filter rule 10 inbound-interface name 'pppoe0' + set firewall ipv6 input filter rule 10 action jump + set firewall ipv6 input filter rule 10 jump-target 'WAN_LOCAL' + set firewall ipv6 input filter rule 10 inbound-interface name 'pppoe0' + +Note to allow the router to receive DHCPv6 response from ISP. We need to allow +packets with source port 547 (server) and destination port 546 (client). diff --git a/docs/configexamples/rst-qos.rst b/docs/configexamples/rst-qos.rst new file mode 100644 index 00000000..96448dd4 --- /dev/null +++ b/docs/configexamples/rst-qos.rst @@ -0,0 +1,200 @@ +:lastproofread: 2023-02-18 + +.. _examples-qos: + +########### +QoS example +########### + +Configuration 'dcsp' and shaper using QoS +========================================= + +In this case, we'll try to make a simple lab using QoS and the +general ability of the VyOS system. +We recommend you to go through the main article about +`QoS `_ +first. + + +Using the general schema for example: + +.. image:: /_static/images/qos1.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +We have four hosts on the local network 172.17.1.0/24. All hosts are +labeled CS0 by default. We need to replace labels on all hosts except +vpc8. +We will replace the labels on the nearest router “VyOS3” using the IP +addresses of the sources. + +* 172.17.1.2 CS0 -> CS4 +* 172.17.1.3 CS0 -> CS5 +* 172.17.1.4 CS0 -> CS6 +* 172.17.1.40 CS0 by default + +Next, we will replace only all CS4 labels on the “VyOS2” router. + +* CS4 -> CS5 + +In the end, we will configure the traffic shaper using QoS mechanisms +on the “VYOS2” router. + +Configuration: +============== + +Set IP addresses on all VPCs and a default gateway 172.17.1.1. We'll +use in this case only static routes. +On the VyOS3 router, we need to change the 'dscp' labels for the +VPCs. To do this, we use this configuration. + +.. stop_vyoslinter + +.. code-block:: none + + set interfaces ethernet eth0 address '10.1.1.100/24' + set interfaces ethernet eth1 address '172.17.1.1/24' + set protocols static route 0.0.0.0/0 next-hop 10.1.1.1 + set qos policy shaper vyos3 class 10 match ADDRESS10 ip source address '172.17.1.2/32' + set qos policy shaper vyos3 class 10 set-dscp 'CS4' + set qos policy shaper vyos3 class 20 match ADDRESS20 ip source address '172.17.1.3/32' + set qos policy shaper vyos3 class 20 set-dscp 'CS5' + set qos policy shaper vyos3 class 30 match ADDRESS20 ip source address '172.17.1.4/32' + set qos policy shaper vyos3 class 30 set-dscp 'CS6' + set qos policy shaper vyos3 default bandwidth '10%' + set qos policy shaper vyos3 default ceiling '100%' + set qos policy shaper vyos3 default priority '7' + set qos policy shaper vyos3 default queue-type 'fair-queue' + set qos interface eth0 egress 'vyos3' + +.. start_vyoslinter + +Main rules: + +* ADDRESS10 change CS0 -> CS4 source 172.17.1.2/32 +* ADDRESS20 change CS0 -> CS5 source 172.17.1.3/32 +* ADDRESS30 change CS0 -> CS6 source 172.17.1.4/32 + + +Check the result + +.. image:: /_static/images/qos2.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +Before the interface eth0 on router VyOS3 + +.. image:: /_static/images/qos3.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +After the interface eth0 on router VyOS3 + +.. image:: /_static/images/qos4.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +On the router, VyOS4 set all traffic as CS4. We have to configure the +default class and class for changing all labels from CS0 to CS4 + +.. code-block:: none + + set interfaces ethernet eth0 address '10.2.1.100/24' + set protocols static route 0.0.0.0/0 next-hop 10.2.1.1 + set qos policy shaper vyos4 class 10 bandwidth '100%' + set qos policy shaper vyos4 class 10 burst '15k' + set qos policy shaper vyos4 class 10 match ALL ether protocol 'all' + set qos policy shaper vyos4 class 10 queue-type 'fair-queue' + set qos policy shaper vyos4 class 10 set-dscp 'CS4' + set qos policy shaper vyos4 default bandwidth '10%' + set qos policy shaper vyos4 default burst '15k' + set qos policy shaper vyos4 default ceiling '100%' + set qos policy shaper vyos4 default priority '7' + set qos policy shaper vyos4 default queue-type 'fair-queue' + set qos interface eth0 egress 'vyos4' + +Next on the router VyOS2 we will change labels on all incoming +traffic only from CS4-> CS6 + +.. image:: /_static/images/qos5.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +.. code-block:: none + + set interfaces ethernet eth0 address '10.1.1.1/24' + set interfaces ethernet eth1 address '10.2.1.1/24' + set interfaces ethernet eth2 address '10.9.9.1/24' + set protocols static route 172.17.1.0/24 next-hop 10.1.1.100 + set qos policy shaper vyos2 class 10 bandwidth '100%' + set qos policy shaper vyos2 class 10 burst '15k' + set qos policy shaper vyos2 class 10 match VYOS2 ip dscp 'CS4' + set qos policy shaper vyos2 class 10 queue-type 'fair-queue' + set qos policy shaper vyos2 class 10 set-dscp 'CS5' + set qos policy shaper vyos2 default bandwidth '100%' + set qos policy shaper vyos2 default burst '15k' + set qos policy shaper vyos2 default ceiling '100%' + set qos policy shaper vyos2 default priority '7' + set qos policy shaper vyos2 default queue-type 'fair-queue' + set qos interface eth2 egress 'vyos2' + +.. image:: /_static/images/qos6.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +* 172.17.1.2/24 CS0 + +.. image:: /_static/images/qos7.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +* 172.17.1.2/24 CS0 - > CS4 + +.. image:: /_static/images/qos8.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +* 172.17.1.2/24 CS4 - > CS5 + +.. image:: /_static/images/qos9.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +In the end, on the router “VyOS2” we will set outgoing bandwidth +limits between the “VyOS3” and “VyOS1” routers. Let's set a limit for +IP 10.1.1.100 = 5 Mbps(Tx). We will check the result of the work +with the help of the “iPerf” utility. + +Set up bandwidth limits on the eth2 interface of the router “VyOS2”. + +.. code-block:: none + + + vyos@vyos2# show qos policy shaper vyos2 class 20 + bandwidth 5mbit + description "for VyOS3 eth0" + match VyOS3 { + ip { + source { + address 10.1.1.100/32 + } + } + } + +Check the result. + +.. image:: /_static/images/qos10.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +As we see shaper is working and the traffic will not work over 5 Mbit/s. diff --git a/docs/configexamples/rst-segment-routing-isis.rst b/docs/configexamples/rst-segment-routing-isis.rst new file mode 100644 index 00000000..86cbec26 --- /dev/null +++ b/docs/configexamples/rst-segment-routing-isis.rst @@ -0,0 +1,279 @@ +:lastproofread: 2023-04-10 + +.. _examples-segment-routing-isis: + +############################# +Segment-routing IS-IS example +############################# + +When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this +blue print as an initial setup to get MPLS ISIS-SR working between those two +devices.The lab was build using :abbr:`EVE-NG (Emulated Virtual +Environment NG)`. + +.. figure:: /_static/images/vyos-sr-isis.* + :alt: ISIS-SR network + + ISIS-SR example network + +The below configuration is used as example where we keep focus on +VyOS-P1/VyOS-P2/XRv-P3 which we share the settings. + + +Configuration +============= + +- VyOS-P1: + +.. code-block:: none + + set interfaces dummy dum0 address '192.0.2.1/32' + set interfaces ethernet eth1 address '192.0.2.5/30' + set interfaces ethernet eth1 mtu '8000' + set interfaces ethernet eth3 address '192.0.2.21/30' + set interfaces ethernet eth3 mtu '8000' + set protocols isis interface dum0 passive + set protocols isis interface eth1 network point-to-point + set protocols isis interface eth3 network point-to-point + set protocols isis level 'level-2' + set protocols isis log-adjacency-changes + set protocols isis metric-style 'wide' + set protocols isis net '49.0000.0000.0000.0001.00' + set protocols isis segment-routing maximum-label-depth '8' + set protocols isis segment-routing prefix 192.0.2.1/32 index value '1' + set protocols mpls interface 'eth1' + set protocols mpls interface 'eth3' + set system host-name 'P1-VyOS' + +- XRv-P3: + +.. code-block:: none + + hostname P3-VyOS + interface Loopback0 + ipv4 address 192.0.2.3 255.255.255.255 + ! + interface GigabitEthernet0/0/0/1 + mtu 8014 + ipv4 address 192.0.2.6 255.255.255.252 + ! + interface GigabitEthernet0/0/0/2 + mtu 8014 + ipv4 address 192.0.2.18 255.255.255.252 + ! + router isis VyOS + is-type level-2-only + net 49.0000.0000.0000.0003.00 + log adjacency changes + address-family ipv4 unicast + metric-style wide + segment-routing mpls + ! + interface Loopback0 + passive + address-family ipv4 unicast + prefix-sid index 3 + ! + ! + interface GigabitEthernet0/0/0/1 + point-to-point + address-family ipv4 unicast + ! + ! + interface GigabitEthernet0/0/0/2 + point-to-point + address-family ipv4 unicast + ! + ! + ! + +- VyOS-P2: + +.. code-block:: none + + set interfaces dummy dum0 address '192.0.2.2/32' + set interfaces ethernet eth2 address '192.0.2.17/30' + set interfaces ethernet eth2 mtu '8000' + set interfaces ethernet eth3 address '192.0.2.26/30' + set interfaces ethernet eth3 mtu '8000' + set protocols isis interface dum0 passive + set protocols isis interface eth2 network point-to-point + set protocols isis interface eth3 network point-to-point + set protocols isis level 'level-2' + set protocols isis log-adjacency-changes + set protocols isis metric-style 'wide' + set protocols isis net '49.0000.0000.0000.0002.00' + set protocols isis segment-routing maximum-label-depth '8' + set protocols isis segment-routing prefix 192.0.2.2/32 index value '2' + set protocols mpls interface 'eth2' + set protocols mpls interface 'eth3' + set system host-name 'P2-VyOS' + +This gives us MPLS segment routing enabled and labels forwarding : + +.. code-block:: none + + vyos@P1-VyOS:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------------- + 15000 SR (IS-IS) 192.0.2.6 implicit-null + 15001 SR (IS-IS) 192.0.2.22 implicit-null + 15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null + 16002 SR (IS-IS) 192.0.2.6 16002 + 16003 SR (IS-IS) 192.0.2.6 implicit-null + 16011 SR (IS-IS) 192.0.2.22 implicit-null + + vyos@P2-VyOS:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ------------------------------------------------------- + 15000 SR (IS-IS) 192.0.2.18 implicit-null + 16001 SR (IS-IS) 192.0.2.18 16001 + 16003 SR (IS-IS) 192.0.2.18 implicit-null + 16011 SR (IS-IS) 192.0.2.18 16011 + + RP/0/0/CPU0:P3-VyOS#show mpls forwarding + Tue Mar 28 17:47:18.928 UTC + Local Outgoing Prefix Outgoing Next Hop Bytes + Label Label or ID Interface Switched + ------ ----------- ------------------ ------------ --------------- ------------ + 16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0 + 16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0 + 16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0 + 24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0 + 24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0 + 24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0 + 24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0 + + +VyOS is able to check MSD per devices: + +.. code-block:: none + + vyos@P1-VyOS:~$ show isis segment-routing node + Area VyOS: + IS-IS L1 SR-Nodes: + + IS-IS L2 SR-Nodes: + + System ID SRGB SRLB Algorithm MSD + --------------------------------------------------------------- + 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 + 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 + + vyos@P2-VyOS:~$ show isis segment-routing node + Area VyOS: + IS-IS L1 SR-Nodes: + + IS-IS L2 SR-Nodes: + + System ID SRGB SRLB Algorithm MSD + --------------------------------------------------------------- + 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 + 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 + +Here is the routing tables showing the MPLS segment routing label operations: + +.. code-block:: none + + vyos@P1-VyOS:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m + I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m + I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m + I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m + I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m + I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m + I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m + + + vyos@P2-VyOS:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m + I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m + I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m + I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m + I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m + I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m + + RP/0/0/CPU0:P3-VyOS#show route isis + Tue Mar 28 18:19:16.417 UTC + + i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 + i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 + i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1 + i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 + i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 + +Information about prefix-sid and label-operation from VyOS + +.. code-block:: none + + vyos@P1-VyOS:~$ show isis route prefix-sid + Area VyOS: + IS-IS L2 IPv4 routing table: + + Prefix Metric Interface Nexthop SID Label Op. + ---------------------------------------------------------------------- + 192.0.2.1/32 0 - - - - + 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002) + 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003) + 192.0.2.4/30 20 eth1 192.0.2.6 - - + 192.0.2.16/30 20 eth1 192.0.2.6 - - + 192.0.2.20/30 0 - - - - + 192.0.2.24/30 30 eth1 192.0.2.6 - - + + vyos@P2-VyOS:~$ show isis route prefix-sid + Area VyOS: + IS-IS L2 IPv4 routing table: + + Prefix Metric Interface Nexthop SID Label Op. + ----------------------------------------------------------------------- + 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001) + 192.0.2.2/32 0 - - - - + 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003) + 192.0.2.4/30 20 eth2 192.0.2.18 - - + 192.0.2.16/30 20 eth2 192.0.2.18 - - + 192.0.2.20/30 30 eth2 192.0.2.18 - - + 192.0.2.24/30 0 - - - - + +Ping between VyOS-P1 / VyOS-P2 to confirm reachability: + +.. code-block:: none + + vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1 + PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data. + 64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms + 64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms + 64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms + 64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms + ^C + --- 192.0.2.2 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3004ms + rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms + + vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2 + PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data. + 64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms + 64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms + 64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms + 64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms + ^C + --- 192.0.2.1 ping statistics --- + 4 packets transmitted, 4 received, 0% packet loss, time 3005ms + rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms \ No newline at end of file diff --git a/docs/configexamples/rst-site-2-site-cisco.rst b/docs/configexamples/rst-site-2-site-cisco.rst new file mode 100644 index 00000000..e8322002 --- /dev/null +++ b/docs/configexamples/rst-site-2-site-cisco.rst @@ -0,0 +1,178 @@ +.. _examples-site-2-site-cisco: + +############################################# +Site-to-Site IPSec VPN to Cisco using FlexVPN +############################################# + +This guide shows a sample configuration for FlexVPN site-to-site Internet +Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel. + +FlexVPN is a newer "solution" for deployment of VPNs and it utilizes IKEv2 as +the key exchange protocol. The result is a flexible and scalable VPN solution +that can be easily adapted to fit various network needs. It can also support a +variety of encryption methods, including AES and 3DES. + +The lab was built using EVE-NG. + + +Configuration +^^^^^^^^^^^^^^ + +VyOS +===== + +- GRE: + +.. code-block:: none + + set interfaces tunnel tun1 encapsulation 'gre' + set interfaces tunnel tun1 ip adjust-mss '1336' + set interfaces tunnel tun1 mtu '1376' + set interfaces tunnel tun1 remote '10.1.1.6' + set interfaces tunnel tun1 source-address '198.51.100.1' + + +- IPsec: + +.. code-block:: none + + set vpn ipsec authentication psk vyos_cisco_l id 'vyos.net’ + set vpn ipsec authentication psk vyos_cisco_l id 'cisco.hub.net' + set vpn ipsec authentication psk vyos_cisco_l secret 'secret' + set vpn ipsec esp-group e1 lifetime '3600' + set vpn ipsec esp-group e1 mode 'tunnel' + set vpn ipsec esp-group e1 pfs 'disable' + set vpn ipsec esp-group e1 proposal 1 encryption 'aes128' + set vpn ipsec esp-group e1 proposal 1 hash 'sha256' + set vpn ipsec ike-group i1 key-exchange 'ikev2' + set vpn ipsec ike-group i1 lifetime '28800' + set vpn ipsec ike-group i1 proposal 1 dh-group '5' + set vpn ipsec ike-group i1 proposal 1 encryption 'aes256' + set vpn ipsec ike-group i1 proposal 1 hash 'sha256' + set vpn ipsec interface 'eth2' + set vpn ipsec options disable-route-autoinstall + set vpn ipsec options flexvpn + set vpn ipsec options interface 'tun1' + set vpn ipsec options virtual-ip + set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net' + set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret' + set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net' + set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate' + set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1' + set vpn ipsec site-to-site peer cisco_hub ike-group 'i1' + set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1' + set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6' + set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32' + set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre' + set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32' + set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0' + + +Cisco +===== +.. code-block:: none + + aaa new-model + ! + ! + aaa authorization network default local + ! + crypto ikev2 name-mangler GET_DOMAIN + fqdn all + email all + ! + ! + crypto ikev2 authorization policy vyos + pool mypool + aaa attribute list mylist + route set interface + route accept any tag 100 distance 5 + ! + crypto ikev2 keyring mykeys + peer peer1 + identity fqdn vyos.net + pre-shared-key local secret + pre-shared-key remote secret + crypto ikev2 profile my_profile + match identity remote fqdn vyos.net + identity local fqdn cisco.hub.net + authentication remote pre-share + authentication local pre-share + keyring local mykeys + dpd 10 3 periodic + aaa authorization group psk list local name-mangler GET_DOMAIN + aaa authorization user psk cached + virtual-template 1 + ! + ! + ! + crypto ipsec transform-set TSET esp-aes esp-sha256-hmac + mode tunnel + ! + ! + crypto ipsec profile my-ipsec-profile + set transform-set TSET + set ikev2-profile my_profile + ! + interface Virtual-Template1 type tunnel + no ip address + ip mtu 1376 + ip nhrp network-id 1 + ip nhrp shortcut virtual-template 1 + ip tcp adjust-mss 1336 + tunnel path-mtu-discovery + tunnel protection ipsec profile my-ipsec-profile + ! + ip local pool my_pool 172.16.122.1 172.16.122.254 + + +Since the tunnel is a point-to-point GRE tunnel, it behaves like any other +point-to-point interface (for example: serial, dialer), and it is possible to +run any Interior Gateway Protocol (IGP)/Exterior Gateway Protocol (EGP) over +the link in order to exchange routing information + +Verification +^^^^^^^^^^^^ + +.. code-block:: none + + vyos@vyos$ show interfaces + Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down + Interface IP Address S/L Description + --------- ---------- --- ----------- + eth0 - u/u + eth1 - u/u + eth2 198.51.100.1/24 u/u + eth3 172.16.1.2/24 u/u + lo 127.0.0.1/8 u/u + ::1/128 + tun1 172.16.122.2/32 u/u + + vyos@vyos:~$ show vpn ipsec sa + Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal + ------------------ ------- -------- -------------- ---------------- ---------------- --------------------- ----------------------------- + cisco_hub-tunnel-1 up 44m17s 35K/31K 382/367 10.1.1.6 cisco.hub.net AES_CBC_128/HMAC_SHA2_256_128 + + + Hub#sh crypto ikev2 sa detailed + IPv4 Crypto IKEv2 SA + + Tunnel-id Local Remote fvrf/ivrf Status + 5 10.1.1.6/4500 198.51.100.1/4500 none/none READY + Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK + Life/Active Time: 86400/2694 sec + CE id: 0, Session-id: 2 + Status Description: Negotiation done + Local spi: C94EE2DC92A60C47 Remote spi: 9AF0EF151BECF14C + Local id: cisco.hub.net + Remote id: vyos.net + Local req msg id: 269 Remote req msg id: 0 + Local next msg id: 269 Remote next msg id: 0 + Local req queued: 269 Remote req queued: 0 + Local window: 5 Remote window: 1 + DPD configured for 10 seconds, retry 3 + Fragmentation not configured. + Extended Authentication not configured. + NAT-T is not detected + Cisco Trust Security SGT is disabled + Assigned host addr: 172.16.122.2 diff --git a/docs/configexamples/rst-wan-load-balancing.rst b/docs/configexamples/rst-wan-load-balancing.rst new file mode 100644 index 00000000..d03d4ed9 --- /dev/null +++ b/docs/configexamples/rst-wan-load-balancing.rst @@ -0,0 +1,184 @@ +:lastproofread: 2021-06-29 + +.. _wan-load-balancing: + +.. stop_vyoslinter # pictures and text have to change + +########################## +WAN Load Balancer examples +########################## + + +Example 1: Distributing load evenly +----------------------------------- + +The setup used in this example is shown in the following diagram: + +.. image:: /_static/images/Wan_load_balancing1.* + :width: 80% + :align: center + :alt: Network Topology Diagram + + +Overview +^^^^^^^^ + * All traffic coming in through eth2 is balanced between eth0 and eth1 + on the router. + * Pings will be sent to four targets for health testing (33.44.55.66, + 44.55.66.77, 55.66.77.88 and 66.77.88.99). + * All outgoing packets are assigned the source address of the assigned + interface (SNAT). + * eth0 is set to be removed from the load balancer's interface pool + after 5 ping failures, eth1 will be removed after 4 ping failures. + +Create static routes to ping targets +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Create static routes through the two ISPs towards the ping targets and +commit the changes: + +.. code-block:: none + + set protocols static route 33.44.55.66/32 next-hop 11.22.33.1 + set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 + set protocols static route 55.66.77.88/32 next-hop 22.33.44.1 + set protocols static route 66.77.88.99/32 next-hop 22.33.44.1 + +Configure the load balancer +^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Configure the WAN load balancer with the parameters described above: + +.. code-block:: none + + set load-balancing wan interface-health eth0 failure-count 5 + set load-balancing wan interface-health eth0 nexthop 11.22.33.1 + set load-balancing wan interface-health eth0 test 10 type ping + set load-balancing wan interface-health eth0 test 10 target 33.44.55.66 + set load-balancing wan interface-health eth0 test 20 type ping + set load-balancing wan interface-health eth0 test 20 target 44.55.66.77 + set load-balancing wan interface-health eth1 failure-count 4 + set load-balancing wan interface-health eth1 nexthop 22.33.44.1 + set load-balancing wan interface-health eth1 test 10 type ping + set load-balancing wan interface-health eth1 test 10 target 55.66.77.88 + set load-balancing wan interface-health eth1 test 20 type ping + set load-balancing wan interface-health eth1 test 20 target 66.77.88.99 + set load-balancing wan rule 10 inbound-interface eth2 + set load-balancing wan rule 10 interface eth0 + set load-balancing wan rule 10 interface eth1 + +Example 2: Failover based on interface weights +---------------------------------------------- + +This example uses the failover mode. + +.. _wan:example2_overview: + +Overview +^^^^^^^^ +In this example, eth0 is the primary interface and eth1 is the secondary +interface. To provide simple failover functionality. If eth0 fails, eth1 +takes over. + +Create interface weight based configuration +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +The configuration steps are the same as in the previous example, except +rule 10. So we keep the configuration, remove rule 10 and add a new rule +for the failover mode: + +.. code-block:: none + + delete load-balancing wan rule 10 + set load-balancing wan rule 10 failover + set load-balancing wan rule 10 inbound-interface eth2 + set load-balancing wan rule 10 interface eth0 weight 10 + set load-balancing wan rule 10 interface eth1 weight 1 + +Example 3: Failover based on rule order +--------------------------------------- + +The previous example used the failover command to send traffic through +eth1 if eth0 fails. In this example, failover functionality is provided +by rule order. + +.. _wan:example3_overview: + +Overview +^^^^^^^^ +Two rules will be created, the first rule directs traffic coming in +from eth2 to eth0 and the second rule directs the traffic to eth1. If +eth0 fails the first rule is bypassed and the second rule matches, +directing traffic to eth1. + +Create rule order based configuration +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +We keep the configuration from the previous example, delete rule 10 +and create the two new rules as described: + +.. code-block:: none + + delete load-balancing wan rule 10 + set load-balancing wan rule 10 inbound-interface eth2 + set load-balancing wan rule 10 interface eth0 + set load-balancing wan rule 20 inbound-interface eth2 + set load-balancing wan rule 20 interface eth1 + +Example 4: Failover based on rule order - priority traffic +---------------------------------------------------------- + +A rule order for prioritizing traffic is useful in scenarios where the +secondary link has a lower speed and should only carry high priority +traffic. It is assumed for this example that eth1 is connected to a +slower connection than eth0 and should prioritize VoIP traffic. + + +.. _wan:example4_overview: + +Overview +^^^^^^^^ +A rule order for prioritizing traffic is useful in scenarios where the +secondary link has a lower speed and should only carry high priority +traffic. It is assumed for this example that eth1 is connected to a +slower connection than eth0 and should prioritize VoIP traffic. + +Create rule order based configuration with low speed secondary link +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +We keep the configuration from the previous example, delete rule 20 and +create a new rule as described: + +.. code-block:: none + + delete load-balancing wan rule 20 + set load-balancing wan rule 20 inbound-interface eth2 + set load-balancing wan rule 20 interface eth1 + set load-balancing wan rule 20 destination port sip + set load-balancing wan rule 20 protocol tcp + set protocols static route 0.0.0.0/0 next-hop 11.22.33.1 + +Example 5: Exclude traffic from load balancing +---------------------------------------------- + +In this example two LAN interfaces exist in different subnets instead +of one like in the previous examples: + +.. image:: /_static/images/Wan_load_balancing_exclude1.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +Adding a rule for the second interface +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Based on the previous example, another rule for traffic from the second +interface eth3 can be added to the load balancer. However, traffic meant +to flow between the LAN subnets will be sent to eth0 and eth1 as well. +To prevent this, another rule is required. This rule excludes traffic +between the local subnets from the load balancer. It also excludes +locally-sources packets (required for web caching with load balancing). +eth+ is used as an alias that refers to all ethernet interfaces: + +.. code-block:: none + + set load-balancing wan rule 5 exclude + set load-balancing wan rule 5 inbound-interface eth+ + set load-balancing wan rule 5 destination address 10.0.0.0/8 + +.. start_vyoslinter diff --git a/docs/configexamples/rst-zone-policy.rst b/docs/configexamples/rst-zone-policy.rst new file mode 100644 index 00000000..7ea33b95 --- /dev/null +++ b/docs/configexamples/rst-zone-policy.rst @@ -0,0 +1,421 @@ +:lastproofread: 2024-06-14 + +.. _examples-zone-policy: + +################### +Zone-Policy example +################### + +.. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. + The zone configuration moved from ``zone-policy zone `` to ``firewall + zone ``. + +Native IPv4 and IPv6 +^^^^^^^^^^^^^^^^^^^^ + +We have three networks. + +.. code-block:: none + + WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64 + LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64 + DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64 + + +**This specific example is for a router on a stick, but is very easily +adapted for however many NICs you have**: + + +* Internet - 192.168.200.100 - TCP/80 +* Internet - 192.168.200.100 - TCP/443 +* Internet - 192.168.200.100 - TCP/25 +* Internet - 192.168.200.100 - TCP/53 +* VyOS acts as DHCP, DNS forwarder, NAT, router and firewall. +* 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web + and mail (SMTP/IMAP) server. +* 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It + can SSH to VyOS. +* LAN and DMZ hosts have basic outbound access: Web, FTP, SSH. +* LAN can access DMZ resources. +* DMZ cannot access LAN resources. +* Inbound WAN connect to DMZ host. + +.. image:: /_static/images/zone-policy-diagram.* + :width: 80% + :align: center + :alt: Network Topology Diagram + +The VyOS interface is assigned the .1/:1 address of their respective +networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30. + +It will look something like this: + +.. code-block:: none + + interfaces { + ethernet eth0 { + duplex auto + hw-id 00:53:ed:6e:2a:92 + smp_affinity auto + speed auto + vif 10 { + address 172.16.10.1/24 + address 2001:db8:0:9999::1/64 + } + vif 20 { + address 192.168.100.1/24 + address 2001:db8:0:AAAA::1/64 + } + vif 30 { + address 192.168.200.1/24 + address 2001:db8:0:BBBB::1/64 + } + } + loopback lo { + } + } + + +Zones Basics +^^^^^^^^^^^^ + +Each interface is assigned to a zone. The interface can be physical or +virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly +the same. + +Traffic flows from zone A to zone B. That flow is what I refer to as a +zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations. + +Ruleset are created per zone-pair-direction. + +I name rule sets to indicate which zone-pair-direction they represent. +eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN. + +In VyOS, you have to have unique Ruleset names. In the event of overlap, +I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This +allows for each auto-completion and uniqueness. + +In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is +the firewall itself. + +If your computer is on the LAN and you need to SSH into your VyOS box, +you would need a rule to allow it in the LAN-Local ruleset. If you want +to access a webpage from your VyOS box, you need a rule to allow it in +the Local-LAN ruleset. + +In rules, it is good to keep them named consistently. As the number of +rules you have grows, the more consistency you have, the easier your +life will be. + +.. code-block:: none + + Rule 1 - State Established, Related + Rule 2 - State Invalid + Rule 100 - ICMP + Rule 200 - Web + Rule 300 - FTP + Rule 400 - NTP + Rule 500 - SMTP + Rule 600 - DNS + Rule 700 - DHCP + Rule 800 - SSH + Rule 900 - IMAPS + +The first two rules are to deal with the idiosyncrasies of VyOS and +iptables. + +Zones and Rulesets both have a default action statement. When using +Zone-Policies, the default action is set by the zone-policy statement +and is represented by rule 10000. + +It is good practice to log both accepted and denied traffic. It can save +you significant headaches when trying to troubleshoot a connectivity +issue. + +To add logging to the default rule, do: + +.. code-block:: none + + set firewall name default-log + + +By default, iptables does not allow traffic for established sessions to +return, so you must explicitly allow this. I do this by adding two rules +to every ruleset. 1 allows established and related state packets through +and rule 2 drops and logs invalid state packets. We place the +established/related rule at the top because the vast majority of traffic +on a network is established and the invalid rule to prevent invalid +state packets from mistakenly being matched against other rules. Having +the most matched rule listed first reduces CPU load in high volume +environments. Note: I have filed a bug to have this added as a default +action as well. + +''It is important to note, that you do not want to add logging to the +established state rule as you will be logging both the inbound and +outbound packets for each session instead of just the initiation of the +session. Your logs will be massive in a very short period of time.'' + +In VyOS you must have the interfaces created before you can apply it to +the zone and the rulesets must be created prior to applying it to a +zone-policy. + +I create/configure the interfaces first. Build out the rulesets for each +zone-pair-direction which includes at least the three state rules. Then +I setup the zone-policies. + +Zones do not allow for a default action of accept; either drop or +reject. It is important to remember this because if you apply an +interface to a zone and commit, any active connections will be dropped. +Specifically, if you are SSH’d into VyOS and add local or the interface +you are connecting through to a zone and do not have rulesets in place +to allow SSH and established sessions, you will not be able to connect. + +The following are the rules that were created for this example (may not +be complete), both in IPv4 and IPv6. If there is no IP specified, then +the source/destination address is not explicit. + +.. code-block:: none + + WAN - DMZ:192.168.200.200 - tcp/80 + WAN - DMZ:192.168.200.200 - tcp/443 + WAN - DMZ:192.168.200.200 - tcp/25 + WAN - DMZ:192.168.200.200 - tcp/53 + WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80 + WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443 + WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25 + WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53 + + DMZ - Local - tcp/53 + DMZ - Local - tcp/123 + DMZ - Local - tcp/67,68 + + LAN - Local - tcp/53 + LAN - Local - tcp/123 + LAN - Local - tcp/67,68 + LAN:192.168.100.10 - Local - tcp/22 + LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22 + + LAN - WAN - tcp/80 + LAN - WAN - tcp/443 + LAN - WAN - tcp/22 + LAN - WAN - tcp/20,21 + + DMZ - WAN - tcp/80 + DMZ - WAN - tcp/443 + DMZ - WAN - tcp/22 + DMZ - WAN - tcp/20,21 + DMZ - WAN - tcp/53 + DMZ - WAN - udp/53 + + Local - WAN - tcp/80 + Local - WAN - tcp/443 + Local - WAN - tcp/20,21 + + Local - DMZ - tcp/25 + Local - DMZ - tcp/67,68 + Local - DMZ - tcp/53 + Local - DMZ - udp/53 + + Local - LAN - tcp/67,68 + + LAN - DMZ - tcp/80 + LAN - DMZ - tcp/443 + LAN - DMZ - tcp/993 + LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22 + LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22 + +Since we have 4 zones, we need to setup the following rulesets. + +.. code-block:: none + + Lan-wan + Lan-local + Lan-dmz + Wan-lan + Wan-local + Wan-dmz + Local-lan + Local-wan + Local-dmz + Dmz-lan + Dmz-wan + Dmz-local + +Even if the two zones will never communicate, it is a good idea to +create the zone-pair-direction rulesets and set default-log. This +will allow you to log attempts to access the networks. Without it, you +will never see the connection attempts. + +This is an example of the three base rules. + +.. code-block:: none + + name wan-lan { + default-action drop + default-log + rule 1 { + action accept + state { + established enable + related enable + } + } + rule 2 { + action drop + log enable + state { + invalid enable + } + } + } + + +Here is an example of an IPv6 DMZ-WAN ruleset. + +.. code-block:: none + + ipv6-name dmz-wan-6 { + default-action drop + default-log + rule 1 { + action accept + state { + established enable + related enable + } + } + rule 2 { + action drop + log enable + state { + invalid enable + } + rule 100 { + action accept + log enable + protocol ipv6-icmp + } + rule 200 { + action accept + destination { + port 80,443 + } + log enable + protocol tcp + } + rule 300 { + action accept + destination { + port 20,21 + } + log enable + protocol tcp + } + rule 500 { + action accept + destination { + port 25 + } + log enable + protocol tcp + source { + address 2001:db8:0:BBBB::200 + } + } + rule 600 { + action accept + destination { + port 53 + } + log enable + protocol tcp_udp + source { + address 2001:db8:0:BBBB::200 + } + } + rule 800 { + action accept + destination { + port 22 + } + log enable + protocol tcp + } + } + +Once you have all of your rulesets built, then you need to create your +zone-policy. + +Start by setting the interface and default action for each zone. + +.. code-block:: none + + set firewall zone dmz default-action drop + set firewall zone dmz interface eth0.30 + +In this case, we are setting the v6 ruleset that represents traffic +sourced from the LAN, destined for the DMZ. Because the zone-policy +firewall syntax is a little awkward, I keep it straight by thinking of +it backwards. + +.. code-block:: none + + set firewall zone dmz from lan firewall ipv6-name lan-dmz-6 + +DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out +a bunch at one time. + +In the end, you will end up with something like this config. I took out +everything but the Firewall, Interfaces, and zone-policy sections. It is +long enough as is. + + +IPv6 Tunnel +^^^^^^^^^^^ + +If you are using a IPv6 tunnel from HE.net or someone else, the basis is +the same except you have two WAN interfaces. One for v4 and one for v6. + +You would have 5 zones instead of just 4 and you would configure your v6 +ruleset between your tunnel interface and your LAN/DMZ zones instead of +to the WAN. + +LAN, WAN, DMZ, local and TUN (tunnel) + +v6 pairs would be: + +.. code-block:: none + + lan-tun + lan-local + lan-dmz + tun-lan + tun-local + tun-dmz + local-lan + local-tun + local-dmz + dmz-lan + dmz-tun + dmz-local + +Notice, none go to WAN since WAN wouldn't have a v6 address on it. + +You would have to add a couple of rules on your wan-local ruleset to +allow protocol 41 in. + +Something like: + +.. code-block:: none + + rule 400 { + action accept + destination { + address 172.16.10.1 + } + log enable + protocol 41 + source { + address ip.of.tunnel.broker + } + } diff --git a/docs/configexamples/segment-routing-isis.md b/docs/configexamples/segment-routing-isis.md new file mode 100644 index 00000000..41ba2389 --- /dev/null +++ b/docs/configexamples/segment-routing-isis.md @@ -0,0 +1,277 @@ +--- +lastproofread: '2023-04-10' +--- + +(examples-segment-routing-isis)= + +# Segment-routing IS-IS example + +When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this +blue print as an initial setup to get MPLS ISIS-SR working between those two +devices.The lab was build using {abbr}`EVE-NG (Emulated Virtual +Environment NG)`. + +:::{figure} /_static/images/vyos-sr-isis.webp +:alt: ISIS-SR network + +ISIS-SR example network +::: + +The below configuration is used as example where we keep focus on +VyOS-P1/VyOS-P2/XRv-P3 which we share the settings. + +## Configuration + +- VyOS-P1: + +```none +set interfaces dummy dum0 address '192.0.2.1/32' +set interfaces ethernet eth1 address '192.0.2.5/30' +set interfaces ethernet eth1 mtu '8000' +set interfaces ethernet eth3 address '192.0.2.21/30' +set interfaces ethernet eth3 mtu '8000' +set protocols isis interface dum0 passive +set protocols isis interface eth1 network point-to-point +set protocols isis interface eth3 network point-to-point +set protocols isis level 'level-2' +set protocols isis log-adjacency-changes +set protocols isis metric-style 'wide' +set protocols isis net '49.0000.0000.0000.0001.00' +set protocols isis segment-routing maximum-label-depth '8' +set protocols isis segment-routing prefix 192.0.2.1/32 index value '1' +set protocols mpls interface 'eth1' +set protocols mpls interface 'eth3' +set system host-name 'P1-VyOS' +``` + +- XRv-P3: + +```none +hostname P3-VyOS +interface Loopback0 + ipv4 address 192.0.2.3 255.255.255.255 +! +interface GigabitEthernet0/0/0/1 + mtu 8014 + ipv4 address 192.0.2.6 255.255.255.252 +! +interface GigabitEthernet0/0/0/2 + mtu 8014 + ipv4 address 192.0.2.18 255.255.255.252 +! +router isis VyOS + is-type level-2-only + net 49.0000.0000.0000.0003.00 + log adjacency changes + address-family ipv4 unicast + metric-style wide + segment-routing mpls + ! + interface Loopback0 + passive + address-family ipv4 unicast + prefix-sid index 3 + ! + ! + interface GigabitEthernet0/0/0/1 + point-to-point + address-family ipv4 unicast + ! + ! + interface GigabitEthernet0/0/0/2 + point-to-point + address-family ipv4 unicast + ! + ! +! +``` + +- VyOS-P2: + +```none +set interfaces dummy dum0 address '192.0.2.2/32' +set interfaces ethernet eth2 address '192.0.2.17/30' +set interfaces ethernet eth2 mtu '8000' +set interfaces ethernet eth3 address '192.0.2.26/30' +set interfaces ethernet eth3 mtu '8000' +set protocols isis interface dum0 passive +set protocols isis interface eth2 network point-to-point +set protocols isis interface eth3 network point-to-point +set protocols isis level 'level-2' +set protocols isis log-adjacency-changes +set protocols isis metric-style 'wide' +set protocols isis net '49.0000.0000.0000.0002.00' +set protocols isis segment-routing maximum-label-depth '8' +set protocols isis segment-routing prefix 192.0.2.2/32 index value '2' +set protocols mpls interface 'eth2' +set protocols mpls interface 'eth3' +set system host-name 'P2-VyOS' +``` + +This gives us MPLS segment routing enabled and labels forwarding : + +```none +vyos@P1-VyOS:~$ show mpls table +Inbound Label Type Nexthop Outbound Label +----------------------------------------------------------------- +15000 SR (IS-IS) 192.0.2.6 implicit-null +15001 SR (IS-IS) 192.0.2.22 implicit-null +15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null +16002 SR (IS-IS) 192.0.2.6 16002 +16003 SR (IS-IS) 192.0.2.6 implicit-null +16011 SR (IS-IS) 192.0.2.22 implicit-null + +vyos@P2-VyOS:~$ show mpls table +Inbound Label Type Nexthop Outbound Label +------------------------------------------------------- +15000 SR (IS-IS) 192.0.2.18 implicit-null +16001 SR (IS-IS) 192.0.2.18 16001 +16003 SR (IS-IS) 192.0.2.18 implicit-null +16011 SR (IS-IS) 192.0.2.18 16011 + +RP/0/0/CPU0:P3-VyOS#show mpls forwarding +Tue Mar 28 17:47:18.928 UTC +Local Outgoing Prefix Outgoing Next Hop Bytes +Label Label or ID Interface Switched +------ ----------- ------------------ ------------ --------------- ------------ +16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0 +16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0 +16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0 +24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0 +24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0 +24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0 +24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0 +``` + +VyOS is able to check MSD per devices: + +```none +vyos@P1-VyOS:~$ show isis segment-routing node +Area VyOS: +IS-IS L1 SR-Nodes: + +IS-IS L2 SR-Nodes: + +System ID SRGB SRLB Algorithm MSD +--------------------------------------------------------------- +0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 +0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 +0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 +0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 + +vyos@P2-VyOS:~$ show isis segment-routing node +Area VyOS: + IS-IS L1 SR-Nodes: + + IS-IS L2 SR-Nodes: + + System ID SRGB SRLB Algorithm MSD + --------------------------------------------------------------- + 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 + 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 + 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +```none +vyos@P1-VyOS:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m +I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m +I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m +I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m +I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m +I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m +I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m + + +vyos@P2-VyOS:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m +I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m +I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m +I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m +I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m +I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m + +RP/0/0/CPU0:P3-VyOS#show route isis +Tue Mar 28 18:19:16.417 UTC + +i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 +i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 +i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1 +i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 +i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 +``` + +Information about prefix-sid and label-operation from VyOS + +```none +vyos@P1-VyOS:~$ show isis route prefix-sid +Area VyOS: +IS-IS L2 IPv4 routing table: + + Prefix Metric Interface Nexthop SID Label Op. + ---------------------------------------------------------------------- + 192.0.2.1/32 0 - - - - + 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002) + 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003) + 192.0.2.4/30 20 eth1 192.0.2.6 - - + 192.0.2.16/30 20 eth1 192.0.2.6 - - + 192.0.2.20/30 0 - - - - + 192.0.2.24/30 30 eth1 192.0.2.6 - - + + vyos@P2-VyOS:~$ show isis route prefix-sid + Area VyOS: + IS-IS L2 IPv4 routing table: + + Prefix Metric Interface Nexthop SID Label Op. + ----------------------------------------------------------------------- + 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001) + 192.0.2.2/32 0 - - - - + 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003) + 192.0.2.4/30 20 eth2 192.0.2.18 - - + 192.0.2.16/30 20 eth2 192.0.2.18 - - + 192.0.2.20/30 30 eth2 192.0.2.18 - - + 192.0.2.24/30 0 - - - - +``` + +Ping between VyOS-P1 / VyOS-P2 to confirm reachability: + +```none +vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1 +PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data. +64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms +64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms +64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms +64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms +^C +--- 192.0.2.2 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3004ms +rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms + +vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2 +PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data. +64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms +64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms +64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms +64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms +^C +--- 192.0.2.1 ping statistics --- +4 packets transmitted, 4 received, 0% packet loss, time 3005ms +rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms +``` diff --git a/docs/configexamples/segment-routing-isis.rst b/docs/configexamples/segment-routing-isis.rst deleted file mode 100644 index 86cbec26..00000000 --- a/docs/configexamples/segment-routing-isis.rst +++ /dev/null @@ -1,279 +0,0 @@ -:lastproofread: 2023-04-10 - -.. _examples-segment-routing-isis: - -############################# -Segment-routing IS-IS example -############################# - -When utilizing VyOS in an environment with Cisco IOS-XR gear you can use this -blue print as an initial setup to get MPLS ISIS-SR working between those two -devices.The lab was build using :abbr:`EVE-NG (Emulated Virtual -Environment NG)`. - -.. figure:: /_static/images/vyos-sr-isis.* - :alt: ISIS-SR network - - ISIS-SR example network - -The below configuration is used as example where we keep focus on -VyOS-P1/VyOS-P2/XRv-P3 which we share the settings. - - -Configuration -============= - -- VyOS-P1: - -.. code-block:: none - - set interfaces dummy dum0 address '192.0.2.1/32' - set interfaces ethernet eth1 address '192.0.2.5/30' - set interfaces ethernet eth1 mtu '8000' - set interfaces ethernet eth3 address '192.0.2.21/30' - set interfaces ethernet eth3 mtu '8000' - set protocols isis interface dum0 passive - set protocols isis interface eth1 network point-to-point - set protocols isis interface eth3 network point-to-point - set protocols isis level 'level-2' - set protocols isis log-adjacency-changes - set protocols isis metric-style 'wide' - set protocols isis net '49.0000.0000.0000.0001.00' - set protocols isis segment-routing maximum-label-depth '8' - set protocols isis segment-routing prefix 192.0.2.1/32 index value '1' - set protocols mpls interface 'eth1' - set protocols mpls interface 'eth3' - set system host-name 'P1-VyOS' - -- XRv-P3: - -.. code-block:: none - - hostname P3-VyOS - interface Loopback0 - ipv4 address 192.0.2.3 255.255.255.255 - ! - interface GigabitEthernet0/0/0/1 - mtu 8014 - ipv4 address 192.0.2.6 255.255.255.252 - ! - interface GigabitEthernet0/0/0/2 - mtu 8014 - ipv4 address 192.0.2.18 255.255.255.252 - ! - router isis VyOS - is-type level-2-only - net 49.0000.0000.0000.0003.00 - log adjacency changes - address-family ipv4 unicast - metric-style wide - segment-routing mpls - ! - interface Loopback0 - passive - address-family ipv4 unicast - prefix-sid index 3 - ! - ! - interface GigabitEthernet0/0/0/1 - point-to-point - address-family ipv4 unicast - ! - ! - interface GigabitEthernet0/0/0/2 - point-to-point - address-family ipv4 unicast - ! - ! - ! - -- VyOS-P2: - -.. code-block:: none - - set interfaces dummy dum0 address '192.0.2.2/32' - set interfaces ethernet eth2 address '192.0.2.17/30' - set interfaces ethernet eth2 mtu '8000' - set interfaces ethernet eth3 address '192.0.2.26/30' - set interfaces ethernet eth3 mtu '8000' - set protocols isis interface dum0 passive - set protocols isis interface eth2 network point-to-point - set protocols isis interface eth3 network point-to-point - set protocols isis level 'level-2' - set protocols isis log-adjacency-changes - set protocols isis metric-style 'wide' - set protocols isis net '49.0000.0000.0000.0002.00' - set protocols isis segment-routing maximum-label-depth '8' - set protocols isis segment-routing prefix 192.0.2.2/32 index value '2' - set protocols mpls interface 'eth2' - set protocols mpls interface 'eth3' - set system host-name 'P2-VyOS' - -This gives us MPLS segment routing enabled and labels forwarding : - -.. code-block:: none - - vyos@P1-VyOS:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------------- - 15000 SR (IS-IS) 192.0.2.6 implicit-null - 15001 SR (IS-IS) 192.0.2.22 implicit-null - 15002 SR (IS-IS) fe80::5200:ff:fe04:3 implicit-null - 16002 SR (IS-IS) 192.0.2.6 16002 - 16003 SR (IS-IS) 192.0.2.6 implicit-null - 16011 SR (IS-IS) 192.0.2.22 implicit-null - - vyos@P2-VyOS:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ------------------------------------------------------- - 15000 SR (IS-IS) 192.0.2.18 implicit-null - 16001 SR (IS-IS) 192.0.2.18 16001 - 16003 SR (IS-IS) 192.0.2.18 implicit-null - 16011 SR (IS-IS) 192.0.2.18 16011 - - RP/0/0/CPU0:P3-VyOS#show mpls forwarding - Tue Mar 28 17:47:18.928 UTC - Local Outgoing Prefix Outgoing Next Hop Bytes - Label Label or ID Interface Switched - ------ ----------- ------------------ ------------ --------------- ------------ - 16001 Pop SR Pfx (idx 1) Gi0/0/0/1 192.0.2.5 0 - 16002 Pop SR Pfx (idx 2) Gi0/0/0/2 192.0.2.17 0 - 16011 16011 SR Pfx (idx 11) Gi0/0/0/1 192.0.2.5 0 - 24000 Pop SR Adj (idx 1) Gi0/0/0/1 192.0.2.5 0 - 24001 Pop SR Adj (idx 3) Gi0/0/0/1 192.0.2.5 0 - 24002 Pop SR Adj (idx 1) Gi0/0/0/2 192.0.2.17 0 - 24003 Pop SR Adj (idx 3) Gi0/0/0/2 192.0.2.17 0 - - -VyOS is able to check MSD per devices: - -.. code-block:: none - - vyos@P1-VyOS:~$ show isis segment-routing node - Area VyOS: - IS-IS L1 SR-Nodes: - - IS-IS L2 SR-Nodes: - - System ID SRGB SRLB Algorithm MSD - --------------------------------------------------------------- - 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 - 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 - - vyos@P2-VyOS:~$ show isis segment-routing node - Area VyOS: - IS-IS L1 SR-Nodes: - - IS-IS L2 SR-Nodes: - - System ID SRGB SRLB Algorithm MSD - --------------------------------------------------------------- - 0000.0000.0001 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0002 16000 - 23999 15000 - 15999 SPF 8 - 0000.0000.0003 16000 - 23999 0 - 4294967295 SPF 10 - 0000.0000.0011 16000 - 23999 15000 - 15999 SPF 8 - -Here is the routing tables showing the MPLS segment routing label operations: - -.. code-block:: none - - vyos@P1-VyOS:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I>* 192.0.2.2/32 [115/30] via 192.0.2.6, eth1, label 16002, weight 1, 1d03h18m - I>* 192.0.2.3/32 [115/10] via 192.0.2.6, eth1, label implicit-null, weight 1, 1d03h18m - I 192.0.2.4/30 [115/20] via 192.0.2.6, eth1 inactive, weight 1, 1d03h18m - I>* 192.0.2.11/32 [115/20] via 192.0.2.22, eth3, label implicit-null, weight 1, 1d02h47m - I>* 192.0.2.16/30 [115/20] via 192.0.2.6, eth1, weight 1, 1d03h18m - I 192.0.2.20/30 [115/20] via 192.0.2.22, eth3 inactive, weight 1, 1d02h48m - I>* 192.0.2.24/30 [115/30] via 192.0.2.6, eth1, weight 1, 1d03h18m - - - vyos@P2-VyOS:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I>* 192.0.2.1/32 [115/30] via 192.0.2.18, eth2, label 16001, weight 1, 1d03h17m - I>* 192.0.2.3/32 [115/10] via 192.0.2.18, eth2, label implicit-null, weight 1, 1d03h17m - I>* 192.0.2.4/30 [115/20] via 192.0.2.18, eth2, weight 1, 1d03h17m - I>* 192.0.2.11/32 [115/40] via 192.0.2.18, eth2, label 16011, weight 1, 1d02h47m - I 192.0.2.16/30 [115/20] via 192.0.2.18, eth2 inactive, weight 1, 1d03h17m - I>* 192.0.2.20/30 [115/30] via 192.0.2.18, eth2, weight 1, 1d03h17m - - RP/0/0/CPU0:P3-VyOS#show route isis - Tue Mar 28 18:19:16.417 UTC - - i L2 192.0.2.1/32 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 - i L2 192.0.2.2/32 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 - i L2 192.0.2.11/32 [115/30] via 192.0.2.5, 1d02h, GigabitEthernet0/0/0/1 - i L2 192.0.2.20/30 [115/20] via 192.0.2.5, 1d03h, GigabitEthernet0/0/0/1 - i L2 192.0.2.24/30 [115/20] via 192.0.2.17, 1d03h, GigabitEthernet0/0/0/2 - -Information about prefix-sid and label-operation from VyOS - -.. code-block:: none - - vyos@P1-VyOS:~$ show isis route prefix-sid - Area VyOS: - IS-IS L2 IPv4 routing table: - - Prefix Metric Interface Nexthop SID Label Op. - ---------------------------------------------------------------------- - 192.0.2.1/32 0 - - - - - 192.0.2.2/32 30 eth1 192.0.2.6 2 Swap(16002, 16002) - 192.0.2.3/32 10 eth1 192.0.2.6 3 Pop(16003) - 192.0.2.4/30 20 eth1 192.0.2.6 - - - 192.0.2.16/30 20 eth1 192.0.2.6 - - - 192.0.2.20/30 0 - - - - - 192.0.2.24/30 30 eth1 192.0.2.6 - - - - vyos@P2-VyOS:~$ show isis route prefix-sid - Area VyOS: - IS-IS L2 IPv4 routing table: - - Prefix Metric Interface Nexthop SID Label Op. - ----------------------------------------------------------------------- - 192.0.2.1/32 30 eth2 192.0.2.18 1 Swap(16001, 16001) - 192.0.2.2/32 0 - - - - - 192.0.2.3/32 10 eth2 192.0.2.18 3 Pop(16003) - 192.0.2.4/30 20 eth2 192.0.2.18 - - - 192.0.2.16/30 20 eth2 192.0.2.18 - - - 192.0.2.20/30 30 eth2 192.0.2.18 - - - 192.0.2.24/30 0 - - - - - -Ping between VyOS-P1 / VyOS-P2 to confirm reachability: - -.. code-block:: none - - vyos@P1-VyOS:~$ ping 192.0.2.2 source-address 192.0.2.1 - PING 192.0.2.2 (192.0.2.2) from 192.0.2.1 : 56(84) bytes of data. - 64 bytes from 192.0.2.2: icmp_seq=1 ttl=63 time=3.47 ms - 64 bytes from 192.0.2.2: icmp_seq=2 ttl=63 time=2.06 ms - 64 bytes from 192.0.2.2: icmp_seq=3 ttl=63 time=3.90 ms - 64 bytes from 192.0.2.2: icmp_seq=4 ttl=63 time=3.87 ms - ^C - --- 192.0.2.2 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3004ms - rtt min/avg/max/mdev = 2.064/3.326/3.903/0.748 ms - - vyos@P2-VyOS:~$ ping 192.0.2.1 source-address 192.0.2.2 - PING 192.0.2.1 (192.0.2.1) from 192.0.2.2 : 56(84) bytes of data. - 64 bytes from 192.0.2.1: icmp_seq=1 ttl=63 time=2.91 ms - 64 bytes from 192.0.2.1: icmp_seq=2 ttl=63 time=3.23 ms - 64 bytes from 192.0.2.1: icmp_seq=3 ttl=63 time=2.91 ms - 64 bytes from 192.0.2.1: icmp_seq=4 ttl=63 time=2.85 ms - ^C - --- 192.0.2.1 ping statistics --- - 4 packets transmitted, 4 received, 0% packet loss, time 3005ms - rtt min/avg/max/mdev = 2.846/2.972/3.231/0.151 ms \ No newline at end of file diff --git a/docs/configexamples/site-2-site-cisco.md b/docs/configexamples/site-2-site-cisco.md new file mode 100644 index 00000000..d8ca2c18 --- /dev/null +++ b/docs/configexamples/site-2-site-cisco.md @@ -0,0 +1,170 @@ +(examples-site-2-site-cisco)= + +# Site-to-Site IPSec VPN to Cisco using FlexVPN + +This guide shows a sample configuration for FlexVPN site-to-site Internet +Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel. + +FlexVPN is a newer "solution" for deployment of VPNs and it utilizes IKEv2 as +the key exchange protocol. The result is a flexible and scalable VPN solution +that can be easily adapted to fit various network needs. It can also support a +variety of encryption methods, including AES and 3DES. + +The lab was built using EVE-NG. + +## Configuration + +### VyOS + +- GRE: + +```none +set interfaces tunnel tun1 encapsulation 'gre' +set interfaces tunnel tun1 ip adjust-mss '1336' +set interfaces tunnel tun1 mtu '1376' +set interfaces tunnel tun1 remote '10.1.1.6' +set interfaces tunnel tun1 source-address '198.51.100.1' +``` + +- IPsec: + +```none +set vpn ipsec authentication psk vyos_cisco_l id 'vyos.net' +set vpn ipsec authentication psk vyos_cisco_l id 'cisco.hub.net' +set vpn ipsec authentication psk vyos_cisco_l secret 'secret' +set vpn ipsec esp-group e1 lifetime '3600' +set vpn ipsec esp-group e1 mode 'tunnel' +set vpn ipsec esp-group e1 pfs 'disable' +set vpn ipsec esp-group e1 proposal 1 encryption 'aes128' +set vpn ipsec esp-group e1 proposal 1 hash 'sha256' +set vpn ipsec ike-group i1 key-exchange 'ikev2' +set vpn ipsec ike-group i1 lifetime '28800' +set vpn ipsec ike-group i1 proposal 1 dh-group '5' +set vpn ipsec ike-group i1 proposal 1 encryption 'aes256' +set vpn ipsec ike-group i1 proposal 1 hash 'sha256' +set vpn ipsec interface 'eth2' +set vpn ipsec options disable-route-autoinstall +set vpn ipsec options flexvpn +set vpn ipsec options interface 'tun1' +set vpn ipsec options virtual-ip +set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net' +set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net' +set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate' +set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1' +set vpn ipsec site-to-site peer cisco_hub ike-group 'i1' +set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1' +set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6' +set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32' +set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre' +set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32' +set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0' +``` + + +### Cisco + +```none +aaa new-model +! +! +aaa authorization network default local +! +crypto ikev2 name-mangler GET_DOMAIN + fqdn all + email all +! +! +crypto ikev2 authorization policy vyos + pool mypool + aaa attribute list mylist + route set interface + route accept any tag 100 distance 5 +! +crypto ikev2 keyring mykeys + peer peer1 + identity fqdn vyos.net + pre-shared-key local secret + pre-shared-key remote secret +crypto ikev2 profile my_profile + match identity remote fqdn vyos.net + identity local fqdn cisco.hub.net + authentication remote pre-share + authentication local pre-share + keyring local mykeys + dpd 10 3 periodic + aaa authorization group psk list local name-mangler GET_DOMAIN + aaa authorization user psk cached + virtual-template 1 +! +! +! +crypto ipsec transform-set TSET esp-aes esp-sha256-hmac + mode tunnel +! +! +crypto ipsec profile my-ipsec-profile + set transform-set TSET + set ikev2-profile my_profile +! +interface Virtual-Template1 type tunnel + no ip address + ip mtu 1376 + ip nhrp network-id 1 + ip nhrp shortcut virtual-template 1 + ip tcp adjust-mss 1336 + tunnel path-mtu-discovery + tunnel protection ipsec profile my-ipsec-profile + ! + ip local pool my_pool 172.16.122.1 172.16.122.254 +``` + +Since the tunnel is a point-to-point GRE tunnel, it behaves like any other +point-to-point interface (for example: serial, dialer), and it is possible to +run any Interior Gateway Protocol (IGP)/Exterior Gateway Protocol (EGP) over +the link in order to exchange routing information + +## Verification + +```none +vyos@vyos$ show interfaces +Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down +Interface IP Address S/L Description +--------- ---------- --- ----------- +eth0 - u/u +eth1 - u/u +eth2 198.51.100.1/24 u/u +eth3 172.16.1.2/24 u/u +lo 127.0.0.1/8 u/u + ::1/128 +tun1 172.16.122.2/32 u/u + +vyos@vyos:~$ show vpn ipsec sa +Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal +------------------ ------- -------- -------------- ---------------- ---------------- --------------------- ----------------------------- +cisco_hub-tunnel-1 up 44m17s 35K/31K 382/367 10.1.1.6 cisco.hub.net AES_CBC_128/HMAC_SHA2_256_128 + + +Hub#sh crypto ikev2 sa detailed + IPv4 Crypto IKEv2 SA + +Tunnel-id Local Remote fvrf/ivrf Status +5 10.1.1.6/4500 198.51.100.1/4500 none/none READY + Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK + Life/Active Time: 86400/2694 sec + CE id: 0, Session-id: 2 + Status Description: Negotiation done + Local spi: C94EE2DC92A60C47 Remote spi: 9AF0EF151BECF14C + Local id: cisco.hub.net + Remote id: vyos.net + Local req msg id: 269 Remote req msg id: 0 + Local next msg id: 269 Remote next msg id: 0 + Local req queued: 269 Remote req queued: 0 + Local window: 5 Remote window: 1 + DPD configured for 10 seconds, retry 3 + Fragmentation not configured. + Extended Authentication not configured. + NAT-T is not detected + Cisco Trust Security SGT is disabled + Assigned host addr: 172.16.122.2 +``` diff --git a/docs/configexamples/site-2-site-cisco.rst b/docs/configexamples/site-2-site-cisco.rst deleted file mode 100644 index e8322002..00000000 --- a/docs/configexamples/site-2-site-cisco.rst +++ /dev/null @@ -1,178 +0,0 @@ -.. _examples-site-2-site-cisco: - -############################################# -Site-to-Site IPSec VPN to Cisco using FlexVPN -############################################# - -This guide shows a sample configuration for FlexVPN site-to-site Internet -Protocol Security (IPsec)/Generic Routing Encapsulation (GRE) tunnel. - -FlexVPN is a newer "solution" for deployment of VPNs and it utilizes IKEv2 as -the key exchange protocol. The result is a flexible and scalable VPN solution -that can be easily adapted to fit various network needs. It can also support a -variety of encryption methods, including AES and 3DES. - -The lab was built using EVE-NG. - - -Configuration -^^^^^^^^^^^^^^ - -VyOS -===== - -- GRE: - -.. code-block:: none - - set interfaces tunnel tun1 encapsulation 'gre' - set interfaces tunnel tun1 ip adjust-mss '1336' - set interfaces tunnel tun1 mtu '1376' - set interfaces tunnel tun1 remote '10.1.1.6' - set interfaces tunnel tun1 source-address '198.51.100.1' - - -- IPsec: - -.. code-block:: none - - set vpn ipsec authentication psk vyos_cisco_l id 'vyos.net’ - set vpn ipsec authentication psk vyos_cisco_l id 'cisco.hub.net' - set vpn ipsec authentication psk vyos_cisco_l secret 'secret' - set vpn ipsec esp-group e1 lifetime '3600' - set vpn ipsec esp-group e1 mode 'tunnel' - set vpn ipsec esp-group e1 pfs 'disable' - set vpn ipsec esp-group e1 proposal 1 encryption 'aes128' - set vpn ipsec esp-group e1 proposal 1 hash 'sha256' - set vpn ipsec ike-group i1 key-exchange 'ikev2' - set vpn ipsec ike-group i1 lifetime '28800' - set vpn ipsec ike-group i1 proposal 1 dh-group '5' - set vpn ipsec ike-group i1 proposal 1 encryption 'aes256' - set vpn ipsec ike-group i1 proposal 1 hash 'sha256' - set vpn ipsec interface 'eth2' - set vpn ipsec options disable-route-autoinstall - set vpn ipsec options flexvpn - set vpn ipsec options interface 'tun1' - set vpn ipsec options virtual-ip - set vpn ipsec site-to-site peer cisco_hub authentication local-id 'vyos.net' - set vpn ipsec site-to-site peer cisco_hub authentication mode 'pre-shared-secret' - set vpn ipsec site-to-site peer cisco_hub authentication remote-id 'cisco.hub.net' - set vpn ipsec site-to-site peer cisco_hub connection-type 'initiate' - set vpn ipsec site-to-site peer cisco_hub default-esp-group 'e1' - set vpn ipsec site-to-site peer cisco_hub ike-group 'i1' - set vpn ipsec site-to-site peer cisco_hub local-address '198.51.100.1' - set vpn ipsec site-to-site peer cisco_hub remote-address '10.1.1.6' - set vpn ipsec site-to-site peer cisco_hub tunnel 1 local prefix '198.51.100.1/32' - set vpn ipsec site-to-site peer cisco_hub tunnel 1 protocol 'gre' - set vpn ipsec site-to-site peer cisco_hub tunnel 1 remote prefix '10.1.1.6/32' - set vpn ipsec site-to-site peer cisco_hub virtual-address '0.0.0.0' - - -Cisco -===== -.. code-block:: none - - aaa new-model - ! - ! - aaa authorization network default local - ! - crypto ikev2 name-mangler GET_DOMAIN - fqdn all - email all - ! - ! - crypto ikev2 authorization policy vyos - pool mypool - aaa attribute list mylist - route set interface - route accept any tag 100 distance 5 - ! - crypto ikev2 keyring mykeys - peer peer1 - identity fqdn vyos.net - pre-shared-key local secret - pre-shared-key remote secret - crypto ikev2 profile my_profile - match identity remote fqdn vyos.net - identity local fqdn cisco.hub.net - authentication remote pre-share - authentication local pre-share - keyring local mykeys - dpd 10 3 periodic - aaa authorization group psk list local name-mangler GET_DOMAIN - aaa authorization user psk cached - virtual-template 1 - ! - ! - ! - crypto ipsec transform-set TSET esp-aes esp-sha256-hmac - mode tunnel - ! - ! - crypto ipsec profile my-ipsec-profile - set transform-set TSET - set ikev2-profile my_profile - ! - interface Virtual-Template1 type tunnel - no ip address - ip mtu 1376 - ip nhrp network-id 1 - ip nhrp shortcut virtual-template 1 - ip tcp adjust-mss 1336 - tunnel path-mtu-discovery - tunnel protection ipsec profile my-ipsec-profile - ! - ip local pool my_pool 172.16.122.1 172.16.122.254 - - -Since the tunnel is a point-to-point GRE tunnel, it behaves like any other -point-to-point interface (for example: serial, dialer), and it is possible to -run any Interior Gateway Protocol (IGP)/Exterior Gateway Protocol (EGP) over -the link in order to exchange routing information - -Verification -^^^^^^^^^^^^ - -.. code-block:: none - - vyos@vyos$ show interfaces - Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down - Interface IP Address S/L Description - --------- ---------- --- ----------- - eth0 - u/u - eth1 - u/u - eth2 198.51.100.1/24 u/u - eth3 172.16.1.2/24 u/u - lo 127.0.0.1/8 u/u - ::1/128 - tun1 172.16.122.2/32 u/u - - vyos@vyos:~$ show vpn ipsec sa - Connection State Uptime Bytes In/Out Packets In/Out Remote address Remote ID Proposal - ------------------ ------- -------- -------------- ---------------- ---------------- --------------------- ----------------------------- - cisco_hub-tunnel-1 up 44m17s 35K/31K 382/367 10.1.1.6 cisco.hub.net AES_CBC_128/HMAC_SHA2_256_128 - - - Hub#sh crypto ikev2 sa detailed - IPv4 Crypto IKEv2 SA - - Tunnel-id Local Remote fvrf/ivrf Status - 5 10.1.1.6/4500 198.51.100.1/4500 none/none READY - Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:5, Auth sign: PSK, Auth verify: PSK - Life/Active Time: 86400/2694 sec - CE id: 0, Session-id: 2 - Status Description: Negotiation done - Local spi: C94EE2DC92A60C47 Remote spi: 9AF0EF151BECF14C - Local id: cisco.hub.net - Remote id: vyos.net - Local req msg id: 269 Remote req msg id: 0 - Local next msg id: 269 Remote next msg id: 0 - Local req queued: 269 Remote req queued: 0 - Local window: 5 Remote window: 1 - DPD configured for 10 seconds, retry 3 - Fragmentation not configured. - Extended Authentication not configured. - NAT-T is not detected - Cisco Trust Security SGT is disabled - Assigned host addr: 172.16.122.2 diff --git a/docs/configexamples/wan-load-balancing.md b/docs/configexamples/wan-load-balancing.md new file mode 100644 index 00000000..b9357523 --- /dev/null +++ b/docs/configexamples/wan-load-balancing.md @@ -0,0 +1,183 @@ +--- +lastproofread: '2021-06-29' +--- + +(wan-load-balancing)= + + +# WAN Load Balancer examples + +% stop_vyoslinter + +## Example 1: Distributing load evenly + +The setup used in this example is shown in the following diagram: + +```{image} /_static/images/Wan_load_balancing1.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + + +### Overview + +> - All traffic coming in through eth2 is balanced between eth0 and eth1 +> on the router. +> - Pings will be sent to four targets for health testing (33.44.55.66, +> 44.55.66.77, 55.66.77.88 and 66.77.88.99). +> - All outgoing packets are assigned the source address of the assigned +> interface (SNAT). +> - eth0 is set to be removed from the load balancer's interface pool +> after 5 ping failures, eth1 will be removed after 4 ping failures. + +### Create static routes to ping targets + +Create static routes through the two ISPs towards the ping targets and +commit the changes: + +```none +set protocols static route 33.44.55.66/32 next-hop 11.22.33.1 +set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 +set protocols static route 55.66.77.88/32 next-hop 22.33.44.1 +set protocols static route 66.77.88.99/32 next-hop 22.33.44.1 +``` + + +### Configure the load balancer + +Configure the WAN load balancer with the parameters described above: + +```none +set load-balancing wan interface-health eth0 failure-count 5 +set load-balancing wan interface-health eth0 nexthop 11.22.33.1 +set load-balancing wan interface-health eth0 test 10 type ping +set load-balancing wan interface-health eth0 test 10 target 33.44.55.66 +set load-balancing wan interface-health eth0 test 20 type ping +set load-balancing wan interface-health eth0 test 20 target 44.55.66.77 +set load-balancing wan interface-health eth1 failure-count 4 +set load-balancing wan interface-health eth1 nexthop 22.33.44.1 +set load-balancing wan interface-health eth1 test 10 type ping +set load-balancing wan interface-health eth1 test 10 target 55.66.77.88 +set load-balancing wan interface-health eth1 test 20 type ping +set load-balancing wan interface-health eth1 test 20 target 66.77.88.99 +set load-balancing wan rule 10 inbound-interface eth2 +set load-balancing wan rule 10 interface eth0 +set load-balancing wan rule 10 interface eth1 +``` + + +## Example 2: Failover based on interface weights + +This example uses the failover mode. +(wan-example2-overview)= + +### Overview + +In this example, eth0 is the primary interface and eth1 is the secondary +interface. To provide simple failover functionality. If eth0 fails, eth1 +takes over. + +### Create interface weight based configuration + +The configuration steps are the same as in the previous example, except +rule 10. So we keep the configuration, remove rule 10 and add a new rule +for the failover mode: + +```none +delete load-balancing wan rule 10 +set load-balancing wan rule 10 failover +set load-balancing wan rule 10 inbound-interface eth2 +set load-balancing wan rule 10 interface eth0 weight 10 +set load-balancing wan rule 10 interface eth1 weight 1 +``` + + +## Example 3: Failover based on rule order + +The previous example used the failover command to send traffic through +eth1 if eth0 fails. In this example, failover functionality is provided +by rule order. +(wan-example3-overview)= + +### Overview + +Two rules will be created, the first rule directs traffic coming in +from eth2 to eth0 and the second rule directs the traffic to eth1. If +eth0 fails the first rule is bypassed and the second rule matches, +directing traffic to eth1. + +### Create rule order based configuration + +We keep the configuration from the previous example, delete rule 10 +and create the two new rules as described: + +```none +delete load-balancing wan rule 10 +set load-balancing wan rule 10 inbound-interface eth2 +set load-balancing wan rule 10 interface eth0 +set load-balancing wan rule 20 inbound-interface eth2 +set load-balancing wan rule 20 interface eth1 +``` + + +## Example 4: Failover based on rule order - priority traffic + +A rule order for prioritizing traffic is useful in scenarios where the +secondary link has a lower speed and should only carry high priority +traffic. It is assumed for this example that eth1 is connected to a +slower connection than eth0 and should prioritize VoIP traffic. +(wan-example4-overview)= + +### Overview + +A rule order for prioritizing traffic is useful in scenarios where the +secondary link has a lower speed and should only carry high priority +traffic. It is assumed for this example that eth1 is connected to a +slower connection than eth0 and should prioritize VoIP traffic. + +### Create rule order based configuration with low speed secondary link + +We keep the configuration from the previous example, delete rule 20 and +create a new rule as described: + +```none +delete load-balancing wan rule 20 +set load-balancing wan rule 20 inbound-interface eth2 +set load-balancing wan rule 20 interface eth1 +set load-balancing wan rule 20 destination port sip +set load-balancing wan rule 20 protocol tcp +set protocols static route 0.0.0.0/0 next-hop 11.22.33.1 +``` + + +## Example 5: Exclude traffic from load balancing + +In this example two LAN interfaces exist in different subnets instead +of one like in the previous examples: + +```{image} /_static/images/Wan_load_balancing_exclude1.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + + +### Adding a rule for the second interface + +Based on the previous example, another rule for traffic from the second +interface eth3 can be added to the load balancer. However, traffic meant +to flow between the LAN subnets will be sent to eth0 and eth1 as well. +To prevent this, another rule is required. This rule excludes traffic +between the local subnets from the load balancer. It also excludes +locally-sources packets (required for web caching with load balancing). +eth+ is used as an alias that refers to all ethernet interfaces: + +```none +set load-balancing wan rule 5 exclude +set load-balancing wan rule 5 inbound-interface eth+ +set load-balancing wan rule 5 destination address 10.0.0.0/8 +``` + +% start_vyoslinter + diff --git a/docs/configexamples/wan-load-balancing.rst b/docs/configexamples/wan-load-balancing.rst deleted file mode 100644 index d03d4ed9..00000000 --- a/docs/configexamples/wan-load-balancing.rst +++ /dev/null @@ -1,184 +0,0 @@ -:lastproofread: 2021-06-29 - -.. _wan-load-balancing: - -.. stop_vyoslinter # pictures and text have to change - -########################## -WAN Load Balancer examples -########################## - - -Example 1: Distributing load evenly ------------------------------------ - -The setup used in this example is shown in the following diagram: - -.. image:: /_static/images/Wan_load_balancing1.* - :width: 80% - :align: center - :alt: Network Topology Diagram - - -Overview -^^^^^^^^ - * All traffic coming in through eth2 is balanced between eth0 and eth1 - on the router. - * Pings will be sent to four targets for health testing (33.44.55.66, - 44.55.66.77, 55.66.77.88 and 66.77.88.99). - * All outgoing packets are assigned the source address of the assigned - interface (SNAT). - * eth0 is set to be removed from the load balancer's interface pool - after 5 ping failures, eth1 will be removed after 4 ping failures. - -Create static routes to ping targets -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Create static routes through the two ISPs towards the ping targets and -commit the changes: - -.. code-block:: none - - set protocols static route 33.44.55.66/32 next-hop 11.22.33.1 - set protocols static route 44.55.66.77/32 next-hop 11.22.33.1 - set protocols static route 55.66.77.88/32 next-hop 22.33.44.1 - set protocols static route 66.77.88.99/32 next-hop 22.33.44.1 - -Configure the load balancer -^^^^^^^^^^^^^^^^^^^^^^^^^^^ -Configure the WAN load balancer with the parameters described above: - -.. code-block:: none - - set load-balancing wan interface-health eth0 failure-count 5 - set load-balancing wan interface-health eth0 nexthop 11.22.33.1 - set load-balancing wan interface-health eth0 test 10 type ping - set load-balancing wan interface-health eth0 test 10 target 33.44.55.66 - set load-balancing wan interface-health eth0 test 20 type ping - set load-balancing wan interface-health eth0 test 20 target 44.55.66.77 - set load-balancing wan interface-health eth1 failure-count 4 - set load-balancing wan interface-health eth1 nexthop 22.33.44.1 - set load-balancing wan interface-health eth1 test 10 type ping - set load-balancing wan interface-health eth1 test 10 target 55.66.77.88 - set load-balancing wan interface-health eth1 test 20 type ping - set load-balancing wan interface-health eth1 test 20 target 66.77.88.99 - set load-balancing wan rule 10 inbound-interface eth2 - set load-balancing wan rule 10 interface eth0 - set load-balancing wan rule 10 interface eth1 - -Example 2: Failover based on interface weights ----------------------------------------------- - -This example uses the failover mode. - -.. _wan:example2_overview: - -Overview -^^^^^^^^ -In this example, eth0 is the primary interface and eth1 is the secondary -interface. To provide simple failover functionality. If eth0 fails, eth1 -takes over. - -Create interface weight based configuration -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -The configuration steps are the same as in the previous example, except -rule 10. So we keep the configuration, remove rule 10 and add a new rule -for the failover mode: - -.. code-block:: none - - delete load-balancing wan rule 10 - set load-balancing wan rule 10 failover - set load-balancing wan rule 10 inbound-interface eth2 - set load-balancing wan rule 10 interface eth0 weight 10 - set load-balancing wan rule 10 interface eth1 weight 1 - -Example 3: Failover based on rule order ---------------------------------------- - -The previous example used the failover command to send traffic through -eth1 if eth0 fails. In this example, failover functionality is provided -by rule order. - -.. _wan:example3_overview: - -Overview -^^^^^^^^ -Two rules will be created, the first rule directs traffic coming in -from eth2 to eth0 and the second rule directs the traffic to eth1. If -eth0 fails the first rule is bypassed and the second rule matches, -directing traffic to eth1. - -Create rule order based configuration -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -We keep the configuration from the previous example, delete rule 10 -and create the two new rules as described: - -.. code-block:: none - - delete load-balancing wan rule 10 - set load-balancing wan rule 10 inbound-interface eth2 - set load-balancing wan rule 10 interface eth0 - set load-balancing wan rule 20 inbound-interface eth2 - set load-balancing wan rule 20 interface eth1 - -Example 4: Failover based on rule order - priority traffic ----------------------------------------------------------- - -A rule order for prioritizing traffic is useful in scenarios where the -secondary link has a lower speed and should only carry high priority -traffic. It is assumed for this example that eth1 is connected to a -slower connection than eth0 and should prioritize VoIP traffic. - - -.. _wan:example4_overview: - -Overview -^^^^^^^^ -A rule order for prioritizing traffic is useful in scenarios where the -secondary link has a lower speed and should only carry high priority -traffic. It is assumed for this example that eth1 is connected to a -slower connection than eth0 and should prioritize VoIP traffic. - -Create rule order based configuration with low speed secondary link -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -We keep the configuration from the previous example, delete rule 20 and -create a new rule as described: - -.. code-block:: none - - delete load-balancing wan rule 20 - set load-balancing wan rule 20 inbound-interface eth2 - set load-balancing wan rule 20 interface eth1 - set load-balancing wan rule 20 destination port sip - set load-balancing wan rule 20 protocol tcp - set protocols static route 0.0.0.0/0 next-hop 11.22.33.1 - -Example 5: Exclude traffic from load balancing ----------------------------------------------- - -In this example two LAN interfaces exist in different subnets instead -of one like in the previous examples: - -.. image:: /_static/images/Wan_load_balancing_exclude1.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -Adding a rule for the second interface -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Based on the previous example, another rule for traffic from the second -interface eth3 can be added to the load balancer. However, traffic meant -to flow between the LAN subnets will be sent to eth0 and eth1 as well. -To prevent this, another rule is required. This rule excludes traffic -between the local subnets from the load balancer. It also excludes -locally-sources packets (required for web caching with load balancing). -eth+ is used as an alias that refers to all ethernet interfaces: - -.. code-block:: none - - set load-balancing wan rule 5 exclude - set load-balancing wan rule 5 inbound-interface eth+ - set load-balancing wan rule 5 destination address 10.0.0.0/8 - -.. start_vyoslinter diff --git a/docs/configexamples/zone-policy.md b/docs/configexamples/zone-policy.md new file mode 100644 index 00000000..2cd773a9 --- /dev/null +++ b/docs/configexamples/zone-policy.md @@ -0,0 +1,417 @@ +--- +lastproofread: '2024-06-14' +--- + +(examples-zone-policy)= + +# Zone-Policy example + +:::{note} +In {vytask}`T2199` the syntax of the zone configuration was changed. +The zone configuration moved from `zone-policy zone ` to `firewall +zone `. +::: + +## Native IPv4 and IPv6 + +We have three networks. + +```none +WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64 +LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64 +DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64 +``` + +**This specific example is for a router on a stick, but is very easily +adapted for however many NICs you have**: + +- Internet - 192.168.200.100 - TCP/80 +- Internet - 192.168.200.100 - TCP/443 +- Internet - 192.168.200.100 - TCP/25 +- Internet - 192.168.200.100 - TCP/53 +- VyOS acts as DHCP, DNS forwarder, NAT, router and firewall. +- 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web + and mail (SMTP/IMAP) server. +- 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It + can SSH to VyOS. +- LAN and DMZ hosts have basic outbound access: Web, FTP, SSH. +- LAN can access DMZ resources. +- DMZ cannot access LAN resources. +- Inbound WAN connect to DMZ host. + +```{image} /_static/images/zone-policy-diagram.webp +:align: center +:alt: Network Topology Diagram +:width: 80% +``` + +The VyOS interface is assigned the .1/:1 address of their respective +networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30. + +It will look something like this: + +```none +interfaces { + ethernet eth0 { + duplex auto + hw-id 00:53:ed:6e:2a:92 + smp_affinity auto + speed auto + vif 10 { + address 172.16.10.1/24 + address 2001:db8:0:9999::1/64 + } + vif 20 { + address 192.168.100.1/24 + address 2001:db8:0:AAAA::1/64 + } + vif 30 { + address 192.168.200.1/24 + address 2001:db8:0:BBBB::1/64 + } + } + loopback lo { + } +} +``` + + +## Zones Basics + +Each interface is assigned to a zone. The interface can be physical or +virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly +the same. + +Traffic flows from zone A to zone B. That flow is what I refer to as a +zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations. + +Ruleset are created per zone-pair-direction. + +I name rule sets to indicate which zone-pair-direction they represent. +eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN. + +In VyOS, you have to have unique Ruleset names. In the event of overlap, +I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This +allows for each auto-completion and uniqueness. + +In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is +the firewall itself. + +If your computer is on the LAN and you need to SSH into your VyOS box, +you would need a rule to allow it in the LAN-Local ruleset. If you want +to access a webpage from your VyOS box, you need a rule to allow it in +the Local-LAN ruleset. + +In rules, it is good to keep them named consistently. As the number of +rules you have grows, the more consistency you have, the easier your +life will be. + +```none +Rule 1 - State Established, Related +Rule 2 - State Invalid +Rule 100 - ICMP +Rule 200 - Web +Rule 300 - FTP +Rule 400 - NTP +Rule 500 - SMTP +Rule 600 - DNS +Rule 700 - DHCP +Rule 800 - SSH +Rule 900 - IMAPS +``` + +The first two rules are to deal with the idiosyncrasies of VyOS and +iptables. + +Zones and Rulesets both have a default action statement. When using +Zone-Policies, the default action is set by the zone-policy statement +and is represented by rule 10000. + +It is good practice to log both accepted and denied traffic. It can save +you significant headaches when trying to troubleshoot a connectivity +issue. + +To add logging to the default rule, do: + +```none +set firewall name default-log +``` + +By default, iptables does not allow traffic for established sessions to +return, so you must explicitly allow this. I do this by adding two rules +to every ruleset. 1 allows established and related state packets through +and rule 2 drops and logs invalid state packets. We place the +established/related rule at the top because the vast majority of traffic +on a network is established and the invalid rule to prevent invalid +state packets from mistakenly being matched against other rules. Having +the most matched rule listed first reduces CPU load in high volume +environments. Note: I have filed a bug to have this added as a default +action as well. + +''It is important to note, that you do not want to add logging to the +established state rule as you will be logging both the inbound and +outbound packets for each session instead of just the initiation of the +session. Your logs will be massive in a very short period of time.'' + +In VyOS you must have the interfaces created before you can apply it to +the zone and the rulesets must be created prior to applying it to a +zone-policy. + +I create/configure the interfaces first. Build out the rulesets for each +zone-pair-direction which includes at least the three state rules. Then +I setup the zone-policies. + +Zones do not allow for a default action of accept; either drop or +reject. It is important to remember this because if you apply an +interface to a zone and commit, any active connections will be dropped. +Specifically, if you are SSH’d into VyOS and add local or the interface +you are connecting through to a zone and do not have rulesets in place +to allow SSH and established sessions, you will not be able to connect. + +The following are the rules that were created for this example (may not +be complete), both in IPv4 and IPv6. If there is no IP specified, then +the source/destination address is not explicit. + +```none +WAN - DMZ:192.168.200.200 - tcp/80 +WAN - DMZ:192.168.200.200 - tcp/443 +WAN - DMZ:192.168.200.200 - tcp/25 +WAN - DMZ:192.168.200.200 - tcp/53 +WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80 +WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443 +WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25 +WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53 + +DMZ - Local - tcp/53 +DMZ - Local - tcp/123 +DMZ - Local - tcp/67,68 + +LAN - Local - tcp/53 +LAN - Local - tcp/123 +LAN - Local - tcp/67,68 +LAN:192.168.100.10 - Local - tcp/22 +LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22 + +LAN - WAN - tcp/80 +LAN - WAN - tcp/443 +LAN - WAN - tcp/22 +LAN - WAN - tcp/20,21 + +DMZ - WAN - tcp/80 +DMZ - WAN - tcp/443 +DMZ - WAN - tcp/22 +DMZ - WAN - tcp/20,21 +DMZ - WAN - tcp/53 +DMZ - WAN - udp/53 + +Local - WAN - tcp/80 +Local - WAN - tcp/443 +Local - WAN - tcp/20,21 + +Local - DMZ - tcp/25 +Local - DMZ - tcp/67,68 +Local - DMZ - tcp/53 +Local - DMZ - udp/53 + +Local - LAN - tcp/67,68 + +LAN - DMZ - tcp/80 +LAN - DMZ - tcp/443 +LAN - DMZ - tcp/993 +LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22 +LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22 +``` + +Since we have 4 zones, we need to setup the following rulesets. + +```none +Lan-wan +Lan-local +Lan-dmz +Wan-lan +Wan-local +Wan-dmz +Local-lan +Local-wan +Local-dmz +Dmz-lan +Dmz-wan +Dmz-local +``` + +Even if the two zones will never communicate, it is a good idea to +create the zone-pair-direction rulesets and set default-log. This +will allow you to log attempts to access the networks. Without it, you +will never see the connection attempts. + +This is an example of the three base rules. + +```none +name wan-lan { + default-action drop + default-log + rule 1 { + action accept + state { + established enable + related enable + } + } + rule 2 { + action drop + log enable + state { + invalid enable + } + } +} +``` + +Here is an example of an IPv6 DMZ-WAN ruleset. + +```none +ipv6-name dmz-wan-6 { + default-action drop + default-log + rule 1 { + action accept + state { + established enable + related enable + } + } + rule 2 { + action drop + log enable + state { + invalid enable + } + } + rule 100 { + action accept + log enable + protocol ipv6-icmp + } + rule 200 { + action accept + destination { + port 80,443 + } + log enable + protocol tcp + } + rule 300 { + action accept + destination { + port 20,21 + } + log enable + protocol tcp + } + rule 500 { + action accept + destination { + port 25 + } + log enable + protocol tcp + source { + address 2001:db8:0:BBBB::200 + } + } + rule 600 { + action accept + destination { + port 53 + } + log enable + protocol tcp_udp + source { + address 2001:db8:0:BBBB::200 + } + } + rule 800 { + action accept + destination { + port 22 + } + log enable + protocol tcp + } +} +``` + +Once you have all of your rulesets built, then you need to create your +zone-policy. + +Start by setting the interface and default action for each zone. + +```none +set firewall zone dmz default-action drop +set firewall zone dmz interface eth0.30 +``` + +In this case, we are setting the v6 ruleset that represents traffic +sourced from the LAN, destined for the DMZ. Because the zone-policy +firewall syntax is a little awkward, I keep it straight by thinking of +it backwards. + +```none +set firewall zone dmz from lan firewall ipv6-name lan-dmz-6 +``` + +DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out +a bunch at one time. + +In the end, you will end up with something like this config. I took out +everything but the Firewall, Interfaces, and zone-policy sections. It is +long enough as is. + +## IPv6 Tunnel + +If you are using a IPv6 tunnel from HE.net or someone else, the basis is +the same except you have two WAN interfaces. One for v4 and one for v6. + +You would have 5 zones instead of just 4 and you would configure your v6 +ruleset between your tunnel interface and your LAN/DMZ zones instead of +to the WAN. + +LAN, WAN, DMZ, local and TUN (tunnel) + +v6 pairs would be: + +```none +lan-tun +lan-local +lan-dmz +tun-lan +tun-local +tun-dmz +local-lan +local-tun +local-dmz +dmz-lan +dmz-tun +dmz-local +``` + +Notice, none go to WAN since WAN wouldn't have a v6 address on it. + +You would have to add a couple of rules on your wan-local ruleset to +allow protocol 41 in. + +Something like: + +```none +rule 400 { + action accept + destination { + address 172.16.10.1 + } + log enable + protocol 41 + source { + address ip.of.tunnel.broker + } +} +``` diff --git a/docs/configexamples/zone-policy.rst b/docs/configexamples/zone-policy.rst deleted file mode 100644 index 7ea33b95..00000000 --- a/docs/configexamples/zone-policy.rst +++ /dev/null @@ -1,421 +0,0 @@ -:lastproofread: 2024-06-14 - -.. _examples-zone-policy: - -################### -Zone-Policy example -################### - -.. note:: In :vytask:`T2199` the syntax of the zone configuration was changed. - The zone configuration moved from ``zone-policy zone `` to ``firewall - zone ``. - -Native IPv4 and IPv6 -^^^^^^^^^^^^^^^^^^^^ - -We have three networks. - -.. code-block:: none - - WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64 - LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64 - DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64 - - -**This specific example is for a router on a stick, but is very easily -adapted for however many NICs you have**: - - -* Internet - 192.168.200.100 - TCP/80 -* Internet - 192.168.200.100 - TCP/443 -* Internet - 192.168.200.100 - TCP/25 -* Internet - 192.168.200.100 - TCP/53 -* VyOS acts as DHCP, DNS forwarder, NAT, router and firewall. -* 192.168.200.200/2001:0DB8:0:BBBB::200 is an internal/external DNS, web - and mail (SMTP/IMAP) server. -* 192.168.100.10/2001:0DB8:0:AAAA::10 is the administrator's console. It - can SSH to VyOS. -* LAN and DMZ hosts have basic outbound access: Web, FTP, SSH. -* LAN can access DMZ resources. -* DMZ cannot access LAN resources. -* Inbound WAN connect to DMZ host. - -.. image:: /_static/images/zone-policy-diagram.* - :width: 80% - :align: center - :alt: Network Topology Diagram - -The VyOS interface is assigned the .1/:1 address of their respective -networks. WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30. - -It will look something like this: - -.. code-block:: none - - interfaces { - ethernet eth0 { - duplex auto - hw-id 00:53:ed:6e:2a:92 - smp_affinity auto - speed auto - vif 10 { - address 172.16.10.1/24 - address 2001:db8:0:9999::1/64 - } - vif 20 { - address 192.168.100.1/24 - address 2001:db8:0:AAAA::1/64 - } - vif 30 { - address 192.168.200.1/24 - address 2001:db8:0:BBBB::1/64 - } - } - loopback lo { - } - } - - -Zones Basics -^^^^^^^^^^^^ - -Each interface is assigned to a zone. The interface can be physical or -virtual such as tunnels (VPN, PPTP, GRE, etc) and are treated exactly -the same. - -Traffic flows from zone A to zone B. That flow is what I refer to as a -zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations. - -Ruleset are created per zone-pair-direction. - -I name rule sets to indicate which zone-pair-direction they represent. -eg. ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN. - -In VyOS, you have to have unique Ruleset names. In the event of overlap, -I add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This -allows for each auto-completion and uniqueness. - -In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is -the firewall itself. - -If your computer is on the LAN and you need to SSH into your VyOS box, -you would need a rule to allow it in the LAN-Local ruleset. If you want -to access a webpage from your VyOS box, you need a rule to allow it in -the Local-LAN ruleset. - -In rules, it is good to keep them named consistently. As the number of -rules you have grows, the more consistency you have, the easier your -life will be. - -.. code-block:: none - - Rule 1 - State Established, Related - Rule 2 - State Invalid - Rule 100 - ICMP - Rule 200 - Web - Rule 300 - FTP - Rule 400 - NTP - Rule 500 - SMTP - Rule 600 - DNS - Rule 700 - DHCP - Rule 800 - SSH - Rule 900 - IMAPS - -The first two rules are to deal with the idiosyncrasies of VyOS and -iptables. - -Zones and Rulesets both have a default action statement. When using -Zone-Policies, the default action is set by the zone-policy statement -and is represented by rule 10000. - -It is good practice to log both accepted and denied traffic. It can save -you significant headaches when trying to troubleshoot a connectivity -issue. - -To add logging to the default rule, do: - -.. code-block:: none - - set firewall name default-log - - -By default, iptables does not allow traffic for established sessions to -return, so you must explicitly allow this. I do this by adding two rules -to every ruleset. 1 allows established and related state packets through -and rule 2 drops and logs invalid state packets. We place the -established/related rule at the top because the vast majority of traffic -on a network is established and the invalid rule to prevent invalid -state packets from mistakenly being matched against other rules. Having -the most matched rule listed first reduces CPU load in high volume -environments. Note: I have filed a bug to have this added as a default -action as well. - -''It is important to note, that you do not want to add logging to the -established state rule as you will be logging both the inbound and -outbound packets for each session instead of just the initiation of the -session. Your logs will be massive in a very short period of time.'' - -In VyOS you must have the interfaces created before you can apply it to -the zone and the rulesets must be created prior to applying it to a -zone-policy. - -I create/configure the interfaces first. Build out the rulesets for each -zone-pair-direction which includes at least the three state rules. Then -I setup the zone-policies. - -Zones do not allow for a default action of accept; either drop or -reject. It is important to remember this because if you apply an -interface to a zone and commit, any active connections will be dropped. -Specifically, if you are SSH’d into VyOS and add local or the interface -you are connecting through to a zone and do not have rulesets in place -to allow SSH and established sessions, you will not be able to connect. - -The following are the rules that were created for this example (may not -be complete), both in IPv4 and IPv6. If there is no IP specified, then -the source/destination address is not explicit. - -.. code-block:: none - - WAN - DMZ:192.168.200.200 - tcp/80 - WAN - DMZ:192.168.200.200 - tcp/443 - WAN - DMZ:192.168.200.200 - tcp/25 - WAN - DMZ:192.168.200.200 - tcp/53 - WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/80 - WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/443 - WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/25 - WAN - DMZ:2001:0DB8:0:BBBB::200 - tcp/53 - - DMZ - Local - tcp/53 - DMZ - Local - tcp/123 - DMZ - Local - tcp/67,68 - - LAN - Local - tcp/53 - LAN - Local - tcp/123 - LAN - Local - tcp/67,68 - LAN:192.168.100.10 - Local - tcp/22 - LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22 - - LAN - WAN - tcp/80 - LAN - WAN - tcp/443 - LAN - WAN - tcp/22 - LAN - WAN - tcp/20,21 - - DMZ - WAN - tcp/80 - DMZ - WAN - tcp/443 - DMZ - WAN - tcp/22 - DMZ - WAN - tcp/20,21 - DMZ - WAN - tcp/53 - DMZ - WAN - udp/53 - - Local - WAN - tcp/80 - Local - WAN - tcp/443 - Local - WAN - tcp/20,21 - - Local - DMZ - tcp/25 - Local - DMZ - tcp/67,68 - Local - DMZ - tcp/53 - Local - DMZ - udp/53 - - Local - LAN - tcp/67,68 - - LAN - DMZ - tcp/80 - LAN - DMZ - tcp/443 - LAN - DMZ - tcp/993 - LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22 - LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22 - -Since we have 4 zones, we need to setup the following rulesets. - -.. code-block:: none - - Lan-wan - Lan-local - Lan-dmz - Wan-lan - Wan-local - Wan-dmz - Local-lan - Local-wan - Local-dmz - Dmz-lan - Dmz-wan - Dmz-local - -Even if the two zones will never communicate, it is a good idea to -create the zone-pair-direction rulesets and set default-log. This -will allow you to log attempts to access the networks. Without it, you -will never see the connection attempts. - -This is an example of the three base rules. - -.. code-block:: none - - name wan-lan { - default-action drop - default-log - rule 1 { - action accept - state { - established enable - related enable - } - } - rule 2 { - action drop - log enable - state { - invalid enable - } - } - } - - -Here is an example of an IPv6 DMZ-WAN ruleset. - -.. code-block:: none - - ipv6-name dmz-wan-6 { - default-action drop - default-log - rule 1 { - action accept - state { - established enable - related enable - } - } - rule 2 { - action drop - log enable - state { - invalid enable - } - rule 100 { - action accept - log enable - protocol ipv6-icmp - } - rule 200 { - action accept - destination { - port 80,443 - } - log enable - protocol tcp - } - rule 300 { - action accept - destination { - port 20,21 - } - log enable - protocol tcp - } - rule 500 { - action accept - destination { - port 25 - } - log enable - protocol tcp - source { - address 2001:db8:0:BBBB::200 - } - } - rule 600 { - action accept - destination { - port 53 - } - log enable - protocol tcp_udp - source { - address 2001:db8:0:BBBB::200 - } - } - rule 800 { - action accept - destination { - port 22 - } - log enable - protocol tcp - } - } - -Once you have all of your rulesets built, then you need to create your -zone-policy. - -Start by setting the interface and default action for each zone. - -.. code-block:: none - - set firewall zone dmz default-action drop - set firewall zone dmz interface eth0.30 - -In this case, we are setting the v6 ruleset that represents traffic -sourced from the LAN, destined for the DMZ. Because the zone-policy -firewall syntax is a little awkward, I keep it straight by thinking of -it backwards. - -.. code-block:: none - - set firewall zone dmz from lan firewall ipv6-name lan-dmz-6 - -DMZ-LAN policy is LAN-DMZ. You can get a rhythm to it when you build out -a bunch at one time. - -In the end, you will end up with something like this config. I took out -everything but the Firewall, Interfaces, and zone-policy sections. It is -long enough as is. - - -IPv6 Tunnel -^^^^^^^^^^^ - -If you are using a IPv6 tunnel from HE.net or someone else, the basis is -the same except you have two WAN interfaces. One for v4 and one for v6. - -You would have 5 zones instead of just 4 and you would configure your v6 -ruleset between your tunnel interface and your LAN/DMZ zones instead of -to the WAN. - -LAN, WAN, DMZ, local and TUN (tunnel) - -v6 pairs would be: - -.. code-block:: none - - lan-tun - lan-local - lan-dmz - tun-lan - tun-local - tun-dmz - local-lan - local-tun - local-dmz - dmz-lan - dmz-tun - dmz-local - -Notice, none go to WAN since WAN wouldn't have a v6 address on it. - -You would have to add a couple of rules on your wan-local ruleset to -allow protocol 41 in. - -Something like: - -.. code-block:: none - - rule 400 { - action accept - destination { - address 172.16.10.1 - } - log enable - protocol 41 - source { - address ip.of.tunnel.broker - } - } diff --git a/docs/configuration/container/index.md b/docs/configuration/container/index.md new file mode 100644 index 00000000..db46db38 --- /dev/null +++ b/docs/configuration/container/index.md @@ -0,0 +1,479 @@ +--- +lastproofread: '2024-07-03' +--- + +# Container + +The VyOS container implementation is based on [Podman](https://podman.io/) as +a daemonless container engine. + +## Configuration + +```{cfgcmd} set container name \ image + +Sets the image name in the hub registry + +:::{code-block} none +set container name mysql-server image mysql:8.0 +::: + +If a registry is not specified, Docker.io will be used as the container +registry unless an alternative registry is specified using +`set container registry ` or the registry is included +in the image name + +:::{code-block} none +set container name mysql-server image quay.io/mysql:8.0 +::: +``` + + +```{cfgcmd} set container name \ entrypoint \ + +Override the default entrypoint from the image for a container. +``` + + +```{cfgcmd} set container name \ command \ + +Override the default command from the image for a container. +``` + + +```{cfgcmd} set container name \ arguments \ + +Set the command arguments for a container. +``` + + +```{cfgcmd} set container name \ host-name \ + +Set the host name for a container. +``` + + +```{cfgcmd} set container name \ allow-host-pid + +The container and the host share the same process namespace. +This means that processes running on the host are visible inside the +container, and processes inside the container are visible on the host. + +The command translates to "--pid host" when the container is created. +``` + + +```{cfgcmd} set container name \ allow-host-networks + +Allow host networking in a container. The network stack of the container is +not isolated from the host and will use the host IP. + +The command translates to "--net host" when the container is created. + +:::{note} +**allow-host-networks** cannot be used with **network** +::: +``` + + +```{cfgcmd} set container name \ network \ + +Attaches user-defined network to a container. +Only one network must be specified and must already exist. +``` + + +```{cfgcmd} set container name \ network \ address \ + +Optionally set a specific static IPv4 or IPv6 address for the container. +This address must be within the named network prefix. + +:::{note} +The first IP in the container network is reserved by the +engine and cannot be used +::: +``` + + +```{cfgcmd} set container name \ name-server \ + +Optionally set a custom name server. +If a container network is used with DNS enabled, +this setting will not have any effect. +``` + + +```{cfgcmd} set container name \ description \ + +Set a container description +``` + + +```{cfgcmd} set container name \ environment \ value \ + +Add custom environment variables. +Multiple environment variables are allowed. +The following commands translate to "-e key=value" when the container +is created. + +:::{code-block} none +set container name mysql-server environment MYSQL_DATABASE value 'zabbix' +set container name mysql-server environment MYSQL_USER value 'zabbix' +set container name mysql-server environment MYSQL_PASSWORD value 'zabbix_pwd' +set container name mysql-server environment MYSQL_ROOT_PASSWORD value 'root_pwd' +::: +``` + + +```{cfgcmd} set container name \ port \ source \ + +``` +```{cfgcmd} set container name \ port \ destination \ +``` + +```{cfgcmd} set container name \ port \ protocol \ + +Publish a port for the container. + +:::{code-block} none +set container name zabbix-web-nginx-mysql port http source 80 +set container name zabbix-web-nginx-mysql port http destination 8080 +set container name zabbix-web-nginx-mysql port http protocol tcp +::: +``` +:::{note} +Port publishing cannot be used with **network**. For this purpose, a workaround +using destination NAT and static IP assignment for the container is available. +::: +```{cfgcmd} set container name \ volume \ source \ +``` + +```{cfgcmd} set container name \ volume \ destination \ + +Mount a volume into the container + +:::{code-block} none +set container name coredns volume 'corefile' source /config/coredns/Corefile +set container name coredns volume 'corefile' destination /etc/Corefile +::: +``` + +```{cfgcmd} set container name \ volume \ mode \ + +Volume is either mounted as rw (read-write - default) or ro (read-only) +``` + +```{cfgcmd} set container name \ tmpfs \ destination \ + +Mount a tmpfs *(ramdisk)* filesystem to the given path within the container. +``` + +```{cfgcmd} set container name \ tmpfs \ size \ + +Size in MB for tmpfs filesystem, maximum size is 64GB or 50% of the +systems total available memory. +``` + +```{cfgcmd} set container name \ uid \ +``` + +```{cfgcmd} set container name \ gid \ + +Set the User ID or Group ID of the container +``` + +```{cfgcmd} set container name \ restart [no | on-failure | always] + +Set the restart behavior of the container. + +- **no**: Do not restart containers on exit +- **on-failure**: Restart containers when they exit with a non-zero +exit code, retrying indefinitely (default) +- **always**: Restart containers when they exit, regardless of status, +retrying indefinitely +``` + +```{cfgcmd} set container name \ cpu-quota \ + +This specifies the number of CPU resources the container can use. + +Default is 0 for unlimited. +For example, 1.25 limits the container to use up to 1.25 cores +worth of CPU time. +This can be a decimal number with up to three decimal places. + +The command translates to "--cpus=\" when the container is created. +``` + +```{cfgcmd} set container name \ memory \ + +Constrain the memory available to the container. + +Default is 512 MB. Use 0 MB for unlimited memory. +``` + +```{cfgcmd} set container name \ device \ source \ +``` + +```{cfgcmd} set container name \ device \ destination \ + +Add a host device to the container. +``` + +```{cfgcmd} set container name \ capability \ + +Set container capabilities or permissions. + +- **net-admin**: Network operations (interface, firewall, routing tables) +- **net-bind-service**: Bind a socket to privileged ports +(port numbers less than 1024) +- **net-raw**: Permission to create raw network sockets +- **setpcap**: Capability sets (from bounded or inherited set) +- **sys-admin**: Administration operations (quotactl, mount, sethostname, +setdomainame) +- **sys-time**: Permission to set system clock +``` + +```{cfgcmd} set container name \ sysctl parameter \ value \ + +Set container sysctl values. + +The subset of possible parameters are: + +- Kernel Parameters: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem, +kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced +- Parameters beginning with fs.mqueue.* +- Parameters beginning with net.* (only if user-defined network is used) +``` + +```{cfgcmd} set container name \ label \ value \ + +Add metadata label for this container. +``` + +```{cfgcmd} set container name \ disable + +Disable a container. +``` + +### Container Health checks + + +By default, no health checks are run, even when defined by the image. + +```{cfgcmd} set container name \ health-check + +Default health check is run for the container if defined by the image. +``` + +```{cfgcmd} set container name \ health-check command \ + +Override the default health check command from the image for a container. +``` + +```{cfgcmd} set container name \ health-check interval \ + +Override the default health-check interval. For example: `60` +``` + +```{cfgcmd} set container name \ health-check timeout \ + +Override the default health-check timeout. For example: `10` +``` + +```{cfgcmd} set container name \ health-check retries \ + +Number of health check retries before container is considered unhealthy. For example: `1` +``` + +### Container Networks + +```{cfgcmd} set container network \ + +Creates a named container network +``` + +```{cfgcmd} set container network \ description + +A brief description what this network is all about. +``` + +```{cfgcmd} set container network \ prefix \ + +Define IPv4 and/or IPv6 prefix for a given network name. +Both IPv4 and IPv6 can be used in parallel. +``` + +```{cfgcmd} set container network \ mtu \ + +Configure {abbr}`MTU (Maximum Transmission Unit)` for a given network. It +is the size (in bytes) of the largest ethernet frame sent on this link. +``` + +```{cfgcmd} set container network \ no-name-server + +Disable Domain Name System (DNS) plugin for this network. +``` + +```{cfgcmd} set container network \ vrf \ + +Bind container network to a given VRF instance. +``` + +### Container Registry + +```{cfgcmd} set container registry \ + +Adds registry to list of unqualified-search-registries. By default, for any +image that does not include the registry in the image name, VyOS will use +docker.io and quay.io as the container registry. +``` + +```{cfgcmd} set container registry \ disable + +Disable a given container registry +``` + +```{cfgcmd} set container registry \ authentication username +``` + +```{cfgcmd} set container registry \ authentication password + +Some container registries require credentials to be used. + +Credentials can be defined here and will only be used when adding a +container image to the system. +``` + +```{cfgcmd} set container registry \ insecure + +Allow registry access over unencrypted HTTP or TLS connections with +untrusted certificates. +``` + +```{cfgcmd} set container registry \ mirror address \ +``` + +```{cfgcmd} set container registry \ mirror host-name \ +``` + +```{cfgcmd} set container registry \ mirror port \ +``` + +```{cfgcmd} set container registry \ mirror path \ + +Registry mirror, use ``(host-name|address)[:port][/path]``. + +If you have mirror http://192.168.1.1:8080 for docker.io, you can use ``docker.io/some/repo`` or run ``podman pull docker.io/some/repo`` + +:::{code-block} none +set container registry docker.io mirror address 192.168.1.1 +set container registry docker.io mirror port 8080 +set container registry docker.io insecure +::: +If http://192.168.1.1:8080 is your own registry, you can use ``192.168.1.1:8080/some/repo`` or run ``podman pull 192.168.1.1:8080/some/repo`` + +:::{code-block} none +set container registry 192.168.1.1:8080 insecure +::: +``` + +### Log Configuration + +```{cfgcmd} set container name \ log-driver [k8s-file | journald | none] + +Set the default log driver for containers. + +- **k8s-file**: Log to a plain text file in Kubernetes-style format. +- **journald**: Log to the system journal +- **none**: Disable logging for the container + +Current default is journald. + +``` + +## Operation Commands + +```{opcmd} add container image \ + +Pull a new image for container +``` +```{opcmd} show container + +Show the list of all active containers. +``` +```{opcmd} show container image + +Show the local container images. +``` +```{opcmd} show container log \ + +Show logs from a given container +``` +```{opcmd} show container network + +Show a list available container networks +``` +```{opcmd} restart container \ + +Restart a given container +``` +```{opcmd} update container image \ + +Update container image +``` +```{opcmd} delete container image \ [force] + +Delete a particular container image based on it's image ID. +You can also delete all container images at once. + +You can not delete a container image if it has more then one tag +assigned, this is why there is a `force` option to pass down to +the container image to also remove those images. +``` + +## Example Configuration + +For the sake of demonstration, [example #1 in the official documentation](https://www.zabbix.com/documentation/current/manual/installation/containers) +to the declarative VyOS CLI syntax. + +```none +set container network zabbix prefix 172.20.0.0/16 +set container network zabbix description 'Network for Zabbix component containers' + +set container name mysql-server image mysql:8.0 +set container name mysql-server network zabbix + +set container name mysql-server environment 'MYSQL_DATABASE' value 'zabbix' +set container name mysql-server environment 'MYSQL_USER' value 'zabbix' +set container name mysql-server environment 'MYSQL_PASSWORD' value 'zabbix_pwd' +set container name mysql-server environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd' + +set container name zabbix-java-gateway image zabbix/zabbix-java-gateway:alpine-5.2-latest +set container name zabbix-java-gateway network zabbix + +set container name zabbix-server-mysql image zabbix/zabbix-server-mysql:alpine-5.2-latest +set container name zabbix-server-mysql network zabbix + +set container name zabbix-server-mysql environment 'DB_SERVER_HOST' value 'mysql-server' +set container name zabbix-server-mysql environment 'MYSQL_DATABASE' value 'zabbix' +set container name zabbix-server-mysql environment 'MYSQL_USER' value 'zabbix' +set container name zabbix-server-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd' +set container name zabbix-server-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd' +set container name zabbix-server-mysql environment 'ZBX_JAVAGATEWAY' value 'zabbix-java-gateway' + +set container name zabbix-server-mysql port zabbix source 10051 +set container name zabbix-server-mysql port zabbix destination 10051 + +set container name zabbix-web-nginx-mysql image zabbix/zabbix-web-nginx-mysql:alpine-5.2-latest +set container name zabbix-web-nginx-mysql network zabbix + +set container name zabbix-web-nginx-mysql environment 'MYSQL_DATABASE' value 'zabbix' +set container name zabbix-web-nginx-mysql environment 'ZBX_SERVER_HOST' value 'zabbix-server-mysql' +set container name zabbix-web-nginx-mysql environment 'DB_SERVER_HOST' value 'mysql-server' +set container name zabbix-web-nginx-mysql environment 'MYSQL_USER' value 'zabbix' +set container name zabbix-web-nginx-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd' +set container name zabbix-web-nginx-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd' + +set container name zabbix-web-nginx-mysql port http source 80 +set container name zabbix-web-nginx-mysql port http destination 8080 +``` diff --git a/docs/configuration/container/index.rst b/docs/configuration/container/index.rst deleted file mode 100644 index 398f1941..00000000 --- a/docs/configuration/container/index.rst +++ /dev/null @@ -1,417 +0,0 @@ -:lastproofread: 2024-07-03 - -######### -Container -######### - -The VyOS container implementation is based on `Podman `_ as -a deamonless container engine. - -************* -Configuration -************* - -.. cfgcmd:: set container name image - - Sets the image name in the hub registry - - .. code-block:: none - - set container name mysql-server image mysql:8.0 - - If a registry is not specified, Docker.io will be used as the container - registry unless an alternative registry is specified using - **set container registry ** or the registry is included - in the image name - - .. code-block:: none - - set container name mysql-server image quay.io/mysql:8.0 - -.. cfgcmd:: set container name entrypoint - - Override the default entrypoint from the image for a container. - -.. cfgcmd:: set container name command - - Override the default command from the image for a container. - -.. cfgcmd:: set container name arguments - - Set the command arguments for a container. - -.. cfgcmd:: set container name host-name - - Set the host name for a container. - -.. cfgcmd:: set container name allow-host-pid - - The container and the host share the same process namespace. - This means that processes running on the host are visible inside the - container, and processes inside the container are visible on the host. - - The command translates to "--pid host" when the container is created. - -.. cfgcmd:: set container name allow-host-networks - - Allow host networking in a container. The network stack of the container is - not isolated from the host and will use the host IP. - - The command translates to "--net host" when the container is created. - - .. note:: **allow-host-networks** cannot be used with **network** - -.. cfgcmd:: set container name network - - Attaches user-defined network to a container. - Only one network must be specified and must already exist. - -.. cfgcmd:: set container name network address
- - Optionally set a specific static IPv4 or IPv6 address for the container. - This address must be within the named network prefix. - - .. note:: The first IP in the container network is reserved by the - engine and cannot be used - -.. cfgcmd:: set container name name-server
- - Optionally set a custom name server. - If a container network is used with DNS enabled, - this setting will not have any effect. - -.. cfgcmd:: set container name description - - Set a container description - -.. cfgcmd:: set container name environment value - - Add custom environment variables. - Multiple environment variables are allowed. - The following commands translate to "-e key=value" when the container - is created. - - .. code-block:: none - - set container name mysql-server environment MYSQL_DATABASE value 'zabbix' - set container name mysql-server environment MYSQL_USER value 'zabbix' - set container name mysql-server environment MYSQL_PASSWORD value 'zabbix_pwd' - set container name mysql-server environment MYSQL_ROOT_PASSWORD value 'root_pwd' - -.. cfgcmd:: set container name port source -.. cfgcmd:: set container name port destination -.. cfgcmd:: set container name port protocol - - Publish a port for the container. - - .. code-block:: none - - set container name zabbix-web-nginx-mysql port http source 80 - set container name zabbix-web-nginx-mysql port http destination 8080 - set container name zabbix-web-nginx-mysql port http protocol tcp - -.. note:: Port publishing cannot be used with **network**. For this purpose, a workaround - using destination NAT and static IP assignment for the container is available. - -.. cfgcmd:: set container name volume source -.. cfgcmd:: set container name volume destination - - Mount a volume into the container - - .. code-block:: none - - set container name coredns volume 'corefile' source /config/coredns/Corefile - set container name coredns volume 'corefile' destination /etc/Corefile - -.. cfgcmd:: set container name volume mode - - Volume is either mounted as rw (read-write - default) or ro (read-only) - -.. cfgcmd:: set container name tmpfs destination - - Mount a tmpfs *(ramdisk)* filesystem to the given path within the container. - -.. cfgcmd:: set container name tmpfs size - - Size in MB for tmpfs filesystem, maximum size is 64GB or 50% of the - systems total available memory. - -.. cfgcmd:: set container name uid -.. cfgcmd:: set container name gid - - Set the User ID or Group ID of the container - -.. cfgcmd:: set container name restart [no | on-failure | always] - - Set the restart behavior of the container. - - - **no**: Do not restart containers on exit - - **on-failure**: Restart containers when they exit with a non-zero - exit code, retrying indefinitely (default) - - **always**: Restart containers when they exit, regardless of status, - retrying indefinitely - -.. cfgcmd:: set container name cpu-quota - - This specifies the number of CPU resources the container can use. - - Default is 0 for unlimited. - For example, 1.25 limits the container to use up to 1.25 cores - worth of CPU time. - This can be a decimal number with up to three decimal places. - - The command translates to "--cpus=" when the container is created. - -.. cfgcmd:: set container name memory - - Constrain the memory available to the container. - - Default is 512 MB. Use 0 MB for unlimited memory. - -.. cfgcmd:: set container name device source -.. cfgcmd:: set container name device destination - - Add a host device to the container. - -.. cfgcmd:: set container name capability - - Set container capabilities or permissions. - - - **net-admin**: Network operations (interface, firewall, routing tables) - - **net-bind-service**: Bind a socket to privileged ports - (port numbers less than 1024) - - **net-raw**: Permission to create raw network sockets - - **setpcap**: Capability sets (from bounded or inherited set) - - **sys-admin**: Administration operations (quotactl, mount, sethostname, - setdomainame) - - **sys-time**: Permission to set system clock - -.. cfgcmd:: set container name sysctl parameter value - - Set container sysctl values. - - The subset of possible parameters are: - - - Kernel Parameters: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem, - kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced - - Parameters beginning with fs.mqueue.* - - Parameters beginning with net.* (only if user-defined network is used) - -.. cfgcmd:: set container name label