# VRF / FIB / VLAN Mapping Table # ----------------------------------------------------------------------------- # FIB | VLAN | Name | Description # -----|------|-------------------------|-------------------------------------- # 0 | - | mgmt_vrf | Management / Physical Access # 1 | - | core_vrf | Inter-VRF Routing Core # 16 | 16 | metal_vrf | Physical Server Network # 18 | 18 | intranet_vrf | Private Service Network # 20 | 20 | wifi_pri_vrf | Trusted Wireless # 21 | 21 | wifi_pub_vrf | Untrusted Wireless (IPv6 Only) # 22 | 22 | syslog_vrf | Centralized Logging # 23 | 23 | unused_vrf | Unassigned # 24 | 24 | unused_vrf | Unassigned # 25 | 25 | lan_vrf | Trusted Wired LAN # 26 | 26 | smtp_int_vrf | Internal SMTP # 27 | 27 | radius_vrf | Auth/Accounting # 28 | 28 | ldap_vrf | Directory Services # 29 | 29 | kerberos_vrf | Authentication (KDC) # 30 | 30 | live_vrf | Production Services # 31 | 31 | voip_vrf | Voice over IP # 32 | 32 | smtp_ext_vrf | Public SMTP # 33 | 33 | unused_vrf | Unassigned # 34 | 34 | unused_vrf | Unassigned # 48 | 48 | he_vrf | IPv6 Tunnel (Hurricane Electric) # 52 | 52 | dns_ext_vrf | External Authoritative DNS # 53 | 53 | unbound_vrf | Recursive DNS # 54 | 54 | dns_int_vrf | Internal PowerDNS # 56 | 56 | kamatera_vrf | Upstream VPS # 80 | 80 | squid_egr_vrf | Outbound Proxy (Peer) # 81 | 81 | squid_ing_vrf | Inbound Proxy (Filtering) # 123 | 123 | ntp_vrf | Time Synchronization # 128 | 128 | unused_vrf | Unassigned # 180 | 180 | haproxy_ext_vrf | External Load Balancing # 181 | 181 | haproxy_int_vrf | Internal Load Balancing # 255 | 255 | can_vrf | Control/WAN/Access Network # ----------------------------------------------------------------------------- # # VRF/VLAN Numbering # Doesn't correspond to anything reliably.. sometimes it does like VRF 53 is DNS but it's not a consistent # so it's not reliable. # # IPv4 (10.0.0.0/8): # VRF: /16 # VRF VLAN / DHCP addressing: the first /17 of each /16 # VIPs: the second /17 of each /16. Each VIP is assigned as a /31 where the second address is used for the hop, and # the first is used for the host (the actual VIP address is the first address of the /31.) # # IPv6 (ULA): # VRF: /32 # VRF VLAN / DHCP addressing: the *last* /33 of each /32 # VIPs: IPv6 uses the first /33 unlike in IPv4. This is a preference because the result is a smaller address for VIPs. # Each VIP is assigned as a /64 (eg: fd00:27::/64) where the peer address can be anything like fd00:27::3128/64. # # IPv6 (GUA): # Both the /64 and /48 coming in from Hurricane Electric are routed to VRF 1. From the /64 I'm segmenting it as /80, # for example: 2001:470:b:56f:180::/80, this gives: # # start: 2001:470:b:56f:180::0 # end: 2001:470:b:56f:180:ffff:ffff:ffff # # and each /80 can be further segmented by the peer networks. # # - Moved syslog VIP to intranet VRF (fd00:22::/32 still goes to FIB 22, but fd00:22::514/128 is routed to Intranet (18) # - Moved SMTP ext VIP to live VRF # # Notes for Bastille # # https://forums.freebsd.org/threads/jails-accessing-devices-from-bastille.79781/ # Kernel kld_list="ctld" # Boot Images ctld_enable="YES" ctld_fib="16" nfs_client_enable="YES" # General System Settings hostname="zima.netcrave.local" zfs_enable="YES" sshd_enable="YES" powerd_enable="YES" dumpdev="AUTO" clear_tmp_enable="YES" update_motd="NO" dynamic_motd="YES" wpa_supplicant_enable="YES" syslogd_enable="YES" # Time synchronization chronyd_enable="YES" chronyd_fib="123" gpsd_enable="YES" gpsd_flags="/dev/ttyU0 -F /var/run/gpsd.sock" # Virtualization & Containers bastille_enable="YES" bastille_zfs_enable="YES" # Network discovery lldpd_enable="YES" lldpd_flags="-I re0,re1,lagg0,wlan255 -M 4 -k -c" # Routing gateway_enable="YES" ipv6_gateway_enable="YES" # Syslog syslogd_enable="YES" # Firewall / NAT pf_enable="YES" pflog_enable="NO" # Network Hardware wlans_rtwn0="wlan255" ifconfig_re0="mtu 9000 up fib 0 group phys_hw" ifconfig_re1="mtu 9000 up fib 0 group phys_hw" # VLAN Configuration vlans_lagg0="16 17 18 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 48 52 53 54 56 80 81 123 128 180 181 255" # Routing protocols frr_enable="NO" # Cloned Interfaces cloned_interfaces="epair1000 lagg0 bridge0 epair0 \ epair1016 epair16 bridge16 \ epair1017 epair17 bridge17 \ epair1018 epair18 bridge18 epair218 \ epair1020 epair20 bridge20 \ epair1021 epair21 bridge21 \ epair1022 \ epair1023 \ epair1024 \ epair1025 epair25 bridge25 \ epair1026 epair26 \ epair1027 epair27 \ epair1028 epair28 \ epair1029 epair29 \ epair1030 epair30 bridge30 \ epair1031 epair31 bridge31 \ epair1032 epair32 \ epair1033 \ epair1034 \ epair1048 epair48 gif48 \ epair1052 epair52 \ epair1053 epair53 \ epair1054 epair54 \ epair1056 epair56 \ epair1080 epair80 \ epair1081 epair81 \ epair1123 epair123 \ epair1128 \ epair1180 epair180 \ epair1181 epair181 \ epair1255 epair255" # Management VRF ifconfig_epair1000a="inet 10.1.0.0/31 fib 0 mtu 9000 group mgmt_vrf group route_leak" ifconfig_epair1000a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:0::0/64 fib 0" ifconfig_epair1000b="inet 10.1.0.1/31 fib 1 mtu 9000 group mgmt_vrf group route_leak" ifconfig_epair1000b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:0::1/64 fib 1" ifconfig_lagg0="laggproto lacp laggport re0 laggport re1 fib 0 group mgmt_vrf" ifconfig_epair0a="fib 0 group mgmt_vrf" ifconfig_bridge0="inet 10.0.0.1/23 fib 0 addm lagg0 addm epair0a group mgmt_vrf" ifconfig_bridge0_ipv6="inet6 auto_linklocal -accept_rtadv fd00:0:8000::/64 fib 0" ifconfig_bridge0_alias0="inet6 fd00:0:8000::ffff/64" # intranet Bare-metal Servers VRF ifconfig_epair1016a="inet 10.1.16.0/31 fib 16 mtu 9000 group metal_vrf group route_leak" ifconfig_epair1016a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:16::0/64 fib 16" ifconfig_epair1016b="inet 10.1.16.1/31 fib 1 mtu 9000 group metal_vrf group route_leak" ifconfig_epair1016b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:16::1/64 fib 1" ifconfig_lagg0_16="fib 16 mtu 9000 group metal_vrf" ifconfig_epair16a="fib 16 mtu 9000 group metal_vrf" ifconfig_bridge16="inet 10.16.0.1/23 fib 16 addm lagg0.16 addm epair16a group metal_vrf" ifconfig_bridge16_ipv6="inet6 auto_linklocal -accept_rtadv fd00:16:8000::/64 fib 16" # Public bare-metal Servers VRF ifconfig_epair1017a="inet 10.1.17.0/31 fib 17 mtu 9000 group metalpub_vrf group route_leak" ifconfig_epair1017a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:17::0/64 fib 17" ifconfig_epair1017b="inet 10.1.17.1/31 fib 1 mtu 9000 group metalpub_vrf group route_leak" ifconfig_epair1017b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:17::1/64 fib 1" ifconfig_lagg0_17="fib 17 mtu 9000 group metalpub_vrf" ifconfig_epair17a="fib 17 mtu 9000 group metalpub_vrf" ifconfig_bridge17="inet 10.17.0.1/23 fib 17 addm lagg0.17 addm epair17a group metalpub_vrf" ifconfig_bridge17_ipv6="inet6 auto_linklocal -accept_rtadv fd00:17:8000::/64 fib 17" # Intranet Servers VRF (lives on a intranet bare-metal server) ifconfig_epair1018a="inet 10.1.18.0/31 fib 18 mtu 9000 group intranet_vrf group route_leak" ifconfig_epair1018a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:18::0/64 fib 18" ifconfig_epair1018b="inet 10.1.18.1/31 fib 1 mtu 9000 group intranet_vrf group route_leak" ifconfig_epair1018b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:18::1/64 fib 1" ifconfig_lagg0_18="fib 18 mtu 9000 group intranet_vrf" ifconfig_epair18a="fib 18 mtu 9000 group intranet_vrf" ifconfig_bridge18="inet 10.18.0.1/23 fib 18 addm lagg0.18 addm epair18a group intranet_vrf" ifconfig_bridge18_ipv6="inet6 auto_linklocal -accept_rtadv fd00:18:8000::/64 fib 18" ifconfig_epair218a="192.0.0.0/31 fib 18 mtu 9000 group intranet_vrf" # Private WiFi VRF ifconfig_epair1020a="inet 10.1.20.0/31 fib 20 mtu 9000 group privwifi_vrf group route_leak" ifconfig_epair1020a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:20::0/64 fib 20" ifconfig_epair1020b="inet 10.1.20.1/31 fib 1 mtu 9000 group privwifi_vrf group route_leak" ifconfig_epair1020b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:20::1/64 fib 1" ifconfig_lagg0_20="fib 20 mtu 9000 group privwifi_vrf" ifconfig_epair20a="fib 20 mtu 9000 group privwifi_vrf" ifconfig_bridge20="inet 10.20.0.1/23 fib 20 addm lagg0.20 addm epair20a group privwifi_vrf" ifconfig_bridge20_ipv6="inet6 auto_linklocal -accept_rtadv fd00:20:8000::/64 fib 20" # Public WiFi VRF ifconfig_epair1021a="fib 21 mtu 9000 group pubwifi_vrf group route_leak" ifconfig_epair1021a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:21::0/64 fib 21" ifconfig_epair1021b="fib 1 mtu 9000 group pubwifi_vrf group route_leak" ifconfig_epair1021b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:21::1/64 fib 1" ifconfig_lagg0_21="fib 21 mtu 9000 group pubwifi_vrf" ifconfig_epair21a="fib 21 mtu 9000 group pubwifi_vrf" ifconfig_bridge21="fib 21 addm lagg0.21 addm epair21a group pubwifi_vrf" ifconfig_bridge21_ipv6="inet6 auto_linklocal -accept_rtadv fd00:21:8000::/64 fib 21" # Syslog VRF ifconfig_epair1022a="inet 10.1.22.0/31 fib 22 mtu 9000 group syslog_vrf group route_leak" ifconfig_epair1022a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:22::0/64 fib 22" ifconfig_epair1022b="inet 10.1.22.1/31 fib 1 mtu 9000 group syslog_vrf group route_leak" ifconfig_epair1022b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:22::1/64 fib 1" ifconfig_lagg0_22="inet 10.22.0.1/23 fib 22 group syslog_vrf" ifconfig_lagg0_22_ipv6="inet6 auto_linklocal -accept_rtadv fd00:22:8000::/64 fib 22" # Unused VRF 23 ifconfig_epair1023a="inet 10.1.23.0/31 fib 23 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1023a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:23::0/64 fib 23" ifconfig_epair1023b="inet 10.1.23.1/31 fib 1 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1023b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:23::1/64 fib 1" ifconfig_lagg0_23="fib 23 mtu 9000 group unused_vrf" # Unused VRF 24 ifconfig_epair1024a="inet 10.1.24.0/31 fib 24 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1024a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:24::0/64 fib 24" ifconfig_epair1024b="inet 10.1.24.1/31 fib 1 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1024b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:24::1/64 fib 1" ifconfig_lagg0_24="fib 24 mtu 9000 group unused_vrf fib 24" # LAN VRF ifconfig_epair1025a="inet 10.1.25.0/31 fib 25 mtu 9000 group lan_vrf group route_leak" ifconfig_epair1025a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:25::0/64 fib 25" ifconfig_epair1025b="inet 10.1.25.1/31 fib 1 mtu 9000 group lan_vrf group route_leak" ifconfig_epair1025b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:25::1/64 fib 1" ifconfig_lagg0_25="fib 25 mtu 9000 group lan_vrf" ifconfig_epair25a="fib 25 mtu 9000 group lan_vrf" ifconfig_bridge25="inet 10.25.0.1/23 fib 25 addm lagg0.25 addm epair25a group lan_vrf" ifconfig_bridge25_ipv6="inet6 auto_linklocal -accept_rtadv fd00:25:8000::/64 fib 25" # Internal SMTP VRF ifconfig_epair1026a="inet 10.1.26.0/31 fib 26 mtu 9000 group smtp_int_vrf group route_leak" ifconfig_epair1026a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:26::0/64 fib 26" ifconfig_epair1026b="inet 10.1.26.1/31 fib 1 mtu 9000 group smtp_int_vrf group route_leak" ifconfig_epair1026b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:26::1/64 fib 1" ifconfig_lagg0_26="inet 10.26.0.1/23 fib 26 group smtp_int_vrf" ifconfig_lagg0_26_ipv6="inet6 auto_linklocal -accept_rtadv fd00:26:8000::/64 fib 26" ifconfig_epair26a="inet 10.26.255.1/31 fib 26 mtu 9000 group smtp_int_vrf group vip" ifconfig_epair26a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:26::/64 fib 26" # RADIUS VRF ifconfig_epair1027a="inet 10.1.27.0/31 fib 27 mtu 9000 group radius_vrf group route_leak" ifconfig_epair1027a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:27::0/64 fib 27" ifconfig_epair1027b="inet 10.1.27.1/31 fib 1 mtu 9000 group radius_vrf group route_leak" ifconfig_epair1027b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:27::1/64 fib 1" ifconfig_lagg0_27="inet 10.27.0.1/23 fib 27 group radius_vrf" ifconfig_lagg0_27_ipv6="inet6 auto_linklocal -accept_rtadv fd00:27:8000::/64 fib 27" ifconfig_epair27a="inet 10.27.255.1/31 fib 27 mtu 9000 group radius_vrf group vip" ifconfig_epair27a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:27::/64 fib 27" # LDAP VRF ifconfig_epair1028a="inet 10.1.28.0/31 fib 28 mtu 9000 group ldap_vrf group route_leak" ifconfig_epair1028a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:28::0/64 fib 28" ifconfig_epair1028b="inet 10.1.28.1/31 fib 1 mtu 9000 group ldap_vrf group route_leak" ifconfig_epair1028b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:28::1/64 fib 1" ifconfig_lagg0_28="inet 10.28.0.1/23 fib 28 group ldap_vrf" ifconfig_lagg0_28_ipv6="inet6 auto_linklocal -accept_rtadv fd00:28:8000::/64 fib 28" ifconfig_epair28a="inet 10.28.255.1/31 fib 28 mtu 9000 group ldap_vrf group vip" ifconfig_epair28a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:28::/64 fib 28" # Kerberos VRF ifconfig_epair1029a="inet 10.1.29.0/31 fib 29 mtu 9000 group kerberos_vrf group route_leak" ifconfig_epair1029a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:29::0/64 fib 29" ifconfig_epair1029b="inet 10.1.29.1/31 fib 1 mtu 9000 group kerberos_vrf group route_leak" ifconfig_epair1029b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:29::1/64 fib 1" ifconfig_lagg0_29="inet 10.29.0.1/23 fib 29 mtu 9000 group kerberos_vrf" ifconfig_lagg0_29_ipv6="inet6 auto_linklocal -accept_rtadv fd00:29:8000::/64 fib 29" ifconfig_epair29a="inet 10.29.255.1/31 fib 29 mtu 9000 group kerberos_vrf group vip" ifconfig_epair29a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:29::/64 fib 29" # Live Servers VRF ifconfig_epair1030a="inet 10.1.30.0/31 fib 30 mtu 9000 group live_vrf group route_leak" ifconfig_epair1030a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:30::0/64 fib 30" ifconfig_epair1030b="inet 10.1.30.1/31 fib 1 mtu 9000 group live_vrf group route_leak" ifconfig_epair1030b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:30::1/64 fib 1" ifconfig_lagg0_30="fib 30 mtu 9000 group live_vrf" ifconfig_epair30a="fib 30 mtu 9000 group live_vrf" ifconfig_bridge30="inet 10.30.0.1/23 fib 30 addm lagg0.30 addm epair30a group live_vrf" ifconfig_bridge30_ipv6="inet6 auto_linklocal -accept_rtadv fd00:30:8000::/64 fib 30" # VOIP VRF ifconfig_epair1031a="inet 10.1.31.0/31 fib 31 mtu 9000 group voip_vrf group route_leak" ifconfig_epair1031a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:31::0/64 fib 31" ifconfig_epair1031b="inet 10.1.31.1/31 fib 1 mtu 9000 group voip_vrf group route_leak" ifconfig_epair1031b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:31::1/64 fib 1" ifconfig_lagg0_31="fib 31 mtu 9000 group voip_vrf" ifconfig_epair31a="fib 31 mtu 9000 group voip_vrf" ifconfig_bridge31="inet 10.31.0.1/23 fib 31 addm lagg0.31 addm epair31a group voip_vrf" ifconfig_bridge31_ipv6="inet6 auto_linklocal -accept_rtadv fd00:31:8000::/64 fib 31" # Public SMTP ifconfig_epair1032a="inet 10.1.32.0/31 fib 32 mtu 9000 group smtp_ext_vrf group route_leak" ifconfig_epair1032a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:32::0/64 fib 32" ifconfig_epair1032b="inet 10.1.32.1/31 fib 1 mtu 9000 group smtp_ext_vrf group route_leak" ifconfig_epair1032b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:32::1/64 fib 1" ifconfig_lagg0_32="inet 10.32.0.1/23 fib 32 group smtp_ext_vrf" ifconfig_lagg0_32_ipv6="inet6 auto_linklocal -accept_rtadv fd00:32:8000::/64 fib 32" ifconfig_epair32a="inet 10.32.0.1/23 fib 32 mtu 9000 group smtp_ext_vrf group vip" ifconfig_epair32a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:32::/64 fib 32" # Unused VRF ifconfig_epair1033a="inet 10.1.33.0/31 fib 33 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1033a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:33::0/64 fib 33" ifconfig_epair1033b="inet 10.1.33.1/31 fib 1 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1033b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:33::1/64 fib 1" ifconfig_lagg0_33="fib 33 mtu 9000 group fs_vrf fib 33" # Unused VRF 34 ifconfig_epair1034a="inet 10.1.34.0/31 fib 34 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1034a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:34::0/64 fib 34" ifconfig_epair1034b="inet 10.1.34.1/31 fib 1 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1034b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:34::1/64 fib 1" ifconfig_lagg0_34="fib 34 mtu 9000 group unused_vrf fib 34" # Hurricane Electric Tunnel Broker VRF ifconfig_epair1048a="fib 48 mtu 9000 group he_vrf group route_leak fib 48" ifconfig_epair1048a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:48::0/64 fib 48" ifconfig_epair1048b="fib 1 mtu 9000 group he_vrf group route_leak" ifconfig_epair1048b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:48::1/64 fib 1" ifconfig_lagg0_48_ipv6="inet6 auto_linklocal -accept_rtadv fd00:48:8000::/64 fib 48 group he_vrf" ifconfig_epair48a="fib 48 mtu 9000 group he_vrf group vip" ifconfig_epair48a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:48::/64 fib 48" ifconfig_epair48a_alias0="inet6 auto_linklocal -accept_rtadv 2001:470:b:56f:48::/96 fib 48" ifconfig_gif48="tunnel 192.168.1.156 216.218.226.238 mtu 1480 fib 48 tunnelfib 255 group he_vrf" ifconfig_gif48_ipv6="inet6 auto_linklocal -accept_rtadv 2001:470:a:56f::2 2001:470:a:56f::1 prefixlen 128 fib 48" # Public DNS VRF ifconfig_epair1052a="inet 10.1.52.0/31 fib 52 mtu 9000 group dns_pub_vrf group route_leak" ifconfig_epair1052a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:52::0/64 fib 52" ifconfig_epair1052b="inet 10.1.52.1/31 fib 1 mtu 9000 group dns_pub_vrf group route_leak" ifconfig_epair1052b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:52::1/64 fib 1" ifconfig_lagg0_52="inet 10.52.0.1/23 fib 52 group dns1_vrf" ifconfig_lagg0_52_ipv6="inet6 auto_linklocal -accept_rtadv fd00:52:8000::/64 fib 52" ifconfig_epair52a="inet 10.52.255.1/31 fib 52 mtu 9000 group dns1_vrf group vip group powerdns" ifconfig_epair52a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:52::/64 fib 52" # Internal Unbound VRF ifconfig_epair1053a="inet 10.1.53.0/31 fib 53 mtu 9000 group ub_int_vrf group route_leak" ifconfig_epair1053a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:53::0/64 fib 53" ifconfig_epair1053b="inet 10.1.53.1/31 fib 1 mtu 9000 group ub_int_vrf group route_leak" ifconfig_epair1053b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:53::1/64 fib 1" ifconfig_lagg0_53="inet 10.53.0.1/23 fib 53 group unbound_vrf group ub_int_vrf" ifconfig_lagg0_53_ipv6="inet6 auto_linklocal -accept_rtadv fd00:53:8000::/64 fib 53" ifconfig_epair53a="inet 10.53.255.1/31 fib 53 mtu 9000 group ub_int_vrf group vip group unbound" ifconfig_epair53a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:53::/64 fib 53" # Private DNS VRF (PowerDNS) ifconfig_epair1054a="inet 10.1.54.0/31 fib 54 mtu 9000 group dns_priv_vrf group route_leak" ifconfig_epair1054a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:54::0/64 fib 54" ifconfig_epair1054b="inet 10.1.54.1/31 fib 1 mtu 9000 group dns_priv_vrf group route_leak" ifconfig_epair1054b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:54::1/64 fib 1" ifconfig_lagg0_54="inet 10.54.0.1/23 fib 54 group dns_priv_vrf group powerdns" ifconfig_lagg0_54_ipv6="inet6 auto_linklocal -accept_rtadv fd00:54:8000::/64 fib 54" ifconfig_epair54a="inet 10.54.255.1/31 fib 54 mtu 9000 group dns_priv_vrf group powerdns" ifconfig_epair54a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:54::/64 fib 54" # Kamatera VRF ifconfig_epair1056a="inet 10.1.56.0/31 fib 56 mtu 9000 group kamatera_vrf group route_leak" ifconfig_epair1056a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:56::0/64 fib 56" ifconfig_epair1056b="inet 10.1.56.1/31 fib 1 mtu 9000 group kamatera_vrf group route_leak" ifconfig_epair1056b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:56::1/64 fib 1" ifconfig_lagg0_56="inet 10.56.0.1/23 fib 56 group kamatera_vrf" ifconfig_lagg0_56_ipv6="inet6 auto_linklocal -accept_rtadv fd00:56:8000::/64 fib 56" ifconfig_epair56a="fib 56 mtu 9000 group kamatera_vrf" # Squid Egress VRF ifconfig_epair1080a="inet 10.1.80.0/31 fib 80 mtu 9000 group squid_egr_vrf group squid group route_leak" ifconfig_epair1080a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:80::0/64 fib 80" ifconfig_epair1080b="inet 10.1.80.1/31 fib 1 mtu 9000 group squid_egr_vrf group squid group route_leak" ifconfig_epair1080b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:80::1/64 fib 1" ifconfig_lagg0_80="inet 10.80.0.1/23 fib 80 group squid_egr_vrf group squid" ifconfig_lagg0_80_ipv6="inet6 auto_linklocal -accept_rtadv fd00:80:8000::/64 fib 80" ifconfig_epair80a="inet 10.80.255.1/31 fib 80 mtu 9000 group squid_egr_vrf group vip group squid" ifconfig_epair80a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:80::/64 fib 80" ifconfig_epair80a_alias0="inet6 auto_linklocal -accept_rtadv 2001:470:b:56f:80::/96 fib 80" # Squid Ingress VRF ifconfig_epair1081a="inet 10.1.81.0/31 fib 81 mtu 9000 group squid_ingr_vrf group squid group route_leak" ifconfig_epair1081a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:81::0/64 fib 81" ifconfig_epair1081b="inet 10.1.81.1/31 fib 1 mtu 9000 group squid_ingr_vrf group squid group route_leak" ifconfig_epair1081b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:81::1/64 fib 1" ifconfig_lagg0_81="inet 10.81.0.1/23 fib 81 group squid_ingr_vrf group squid" ifconfig_lagg0_81_ipv6="inet6 auto_linklocal -accept_rtadv fd00:81:8000::/64 fib 81" ifconfig_epair81a="inet 10.81.255.1/31 fib 81 mtu 9000 group squid_ingr_vrf group vip group squid" ifconfig_epair81a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:81::/64 fib 81" # NTP VRF ifconfig_epair1123a="inet 10.1.123.0/31 fib 123 mtu 9000 group ntp_vrf group ntp group route_leak" ifconfig_epair1123a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:123::0/64 fib 123" ifconfig_epair1123b="inet 10.1.123.1/31 fib 1 mtu 9000 group ntp_vrf group ntp group route_leak" ifconfig_epair1123b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:123::1/64 fib 1" ifconfig_lagg0_123="inet 10.123.0.1/23 fib 123 group ntp_vrf group ntp" ifconfig_lagg0_123_ipv6="inet6 auto_linklocal -accept_rtadv fd00:123:8000::/64 fib 123" ifconfig_epair123a="inet 10.123.255.1/31 fib 123 mtu 9000 group ntp_vrf group vip group ntp" ifconfig_epair123a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:123::/64 fib 123" # Unused VRF ifconfig_epair1128a="inet 10.1.128.0/31 fib 128 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1128a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:128::0/64 fib 128" ifconfig_epair1128b="inet 10.1.128.1/31 fib 1 mtu 9000 group unused_vrf group route_leak" ifconfig_epair1128b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:128::1/64 fib 1" ifconfig_lagg0_128="fib 128 group unused_vrf" # HAProxy External VRF ifconfig_epair1180a="inet 10.1.180.0/31 fib 180 mtu 9000 group haproxy_ext_vrf group haproxy group route_leak" ifconfig_epair1180a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:180::0/64 fib 180" ifconfig_epair1180b="inet 10.1.180.1/31 fib 1 mtu 9000 group haproxy_ext_vrf group haproxy group route_leak" ifconfig_epair1180b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:180::1/64 fib 1" ifconfig_lagg0_180="inet 10.180.0.1/23 fib 180 group haproxy_ext_vrf group haproxy" ifconfig_lagg0_180_ipv6="inet6 auto_linklocal -accept_rtadv fd00:180:8000::/64 fib 180" ifconfig_epair180a="inet 10.180.255.1/31 fib 180 mtu 9000 group haproxy_ext_vrf group vip group haproxy" ifconfig_epair180a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:180::/64 fib 180" ifconfig_epair180a_alias0="inet6 auto_linklocal -accept_rtadv 2001:470:b:56f:180::/96 fib 180" # HAProxy Internal VRF ifconfig_epair1181a="inet 10.1.181.0/31 fib 181 mtu 9000 group haproxy_int_vrf group haproxy group route_leak" ifconfig_epair1181a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:181::0/64 fib 181" ifconfig_epair1181b="inet 10.1.181.1/31 fib 1 mtu 9000 group haproxy_int_vrf group haproxy group route_leak" ifconfig_epair1181b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:181::1/64 fib 1" ifconfig_lagg0_181="inet 10.181.0.1/23 fib 181 group haproxy_int_vrf group haproxy" ifconfig_lagg0_181_ipv6="inet6 auto_linklocal -accept_rtadv fd00:181:8000::/64 fib 181" ifconfig_epair181a="inet 10.181.255.1/31 fib 181 mtu 9000 group haproxy_int_vrf group vip group haproxy" ifconfig_epair181a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:181::/64 fib 181" # CAN VRF ifconfig_epair1255a="inet 10.1.255.0/31 fib 255 mtu 9000 group can_vrf group route_leak" ifconfig_epair1255a_ipv6="inet6 auto_linklocal -accept_rtadv fe80:255::0/64 fib 255" ifconfig_epair1255b="inet 10.1.255.1/31 fib 1 mtu 9000 group can_vrf group route_leak" ifconfig_epair1255b_ipv6="inet6 auto_linklocal -accept_rtadv fe80:255::1/64 fib 1" ifconfig_wlan255="WPA inet 192.168.1.156/24 fib 255 group phys_hw group can_vrf group wan" ifconfig_wlan255_ipv6="inet6 accept_rtadv" ifconfig_lagg0_255="inet 10.255.0.1/23 fib 255 mtu 9000 group can_vrf" ifconfig_lagg0_255_ipv6="inet6 auto_linklocal -accept_rtadv fd00:255:8000::/64 fib 255" ifconfig_epair255a="inet 10.255.255.1/31 fib 255 mtu 9000 group can_vrf group vip" ifconfig_epair255a_ipv6="inet6 auto_linklocal -accept_rtadv fd00:255::/64 fib 255" # Core VRF routes route_core_to_0="10.0.0.0/16 10.1.0.0 -fib 1" route_core_to_16="10.16.0.0/16 10.1.16.0 -fib 1" route_core_to_17="10.17.0.0/16 10.1.17.0 -fib 1" route_core_to_18="10.18.0.0/16 10.1.18.0 -fib 1" route_core_to_20="10.20.0.0/16 10.1.20.0 -fib 1" route_core_to_22="10.22.0.0/16 10.1.22.0 -fib 1" route_core_to_23="10.23.0.0/16 10.1.23.0 -fib 1" route_core_to_24="10.24.0.0/16 10.1.24.0 -fib 1" route_core_to_25="10.25.0.0/16 10.1.25.0 -fib 1" route_core_to_26="10.26.0.0/16 10.1.26.0 -fib 1" route_core_to_27="10.27.0.0/16 10.1.27.0 -fib 1" route_core_to_28="10.28.0.0/16 10.1.28.0 -fib 1" route_core_to_29="10.29.0.0/16 10.1.29.0 -fib 1" route_core_to_30="10.30.0.0/16 10.1.30.0 -fib 1" route_core_smtpext_vip_to_30="10.32.255.0/32 10.1.30.0 -fib 1" route_core_to_31="10.31.0.0/16 10.1.31.0 -fib 1" route_core_to_32="10.32.0.0/16 10.1.32.0 -fib 1" route_core_to_33="10.33.0.0/16 10.1.33.0 -fib 1" route_core_to_34="10.34.0.0/16 10.1.34.0 -fib 1" route_core_to_52="10.52.0.0/16 10.1.52.0 -fib 1" route_core_to_53="10.53.0.0/16 10.1.53.0 -fib 1" route_core_to_54="10.54.0.0/16 10.1.54.0 -fib 1" route_core_to_56="10.56.0.0/16 10.1.56.0 -fib 1" route_core_to_80="10.80.0.0/16 10.1.80.0 -fib 1" route_core_to_81="10.81.0.0/16 10.1.81.0 -fib 1" route_core_to_123="10.123.0.0/16 10.1.123.0 -fib 1" route_core_to_128="10.128.0.0/16 10.1.128.0 -fib 1" route_core_to_180="10.180.0.0/16 10.1.180.0 -fib 1" route_core_to_181="10.181.0.0/16 10.1.181.0 -fib 1" route_core_to_255="10.255.0.0/16 10.1.255.0 -fib 1" route_core_default_gateway="default 10.1.255.0 -fib 1" route_core_to_can_hue="192.168.1.182/32 10.1.255.0 -fib 1" route_core_null_000_8="0.0.0.0/8 -reject -fib 1" route_core_null_010_8="10.0.0.0/8 -reject -fib 1" route_core_null_100_64_10="100.64.0.0/10 -reject -fib 1" route_core_null_169_254_16="10.1.0.0/16 -reject -fib 1" route_core_null_172_16_12="172.16.0.0/12 -reject -fib 1" route_core_null_192_0_0_24="192.0.0.0/24 -reject -fib 1" route_core_null_192_0_2_24="192.0.2.0/24 -reject -fib 1" route_core_null_192_88_99_24="192.88.99.0/24 -reject -fib 1" route_core_null_192_168_16="192.168.0.0/16 -reject -fib 1" route_core_null_198_18_15="198.18.0.0/15 -reject -fib 1" route_core_null_198_51_100_24="198.51.100.0/24 -reject -fib 1" route_core_null_203_0_113_24="203.0.113.0/24 -reject -fib 1" route_core_null_224_4="224.0.0.0/4 -reject -fib 1" route_core_null_233_252_24="233.252.0.0/24 -reject -fib 1" route_core_null_240_4="240.0.0.0/4 -reject -fib 1" route_core_null_6_8="6.0.0.0/8 -reject -fib 1" route_core_null_7_8="7.0.0.0/8 -reject -fib 1" route_core_null_11_8="11.0.0.0/8 -reject -fib 1" route_core_null_21_8="21.0.0.0/8 -reject -fib 1" route_core_null_22_8="22.0.0.0/8 -reject -fib 1" route_core_null_26_8="26.0.0.0/8 -reject -fib 1" route_core_null_28_8="28.0.0.0/8 -reject -fib 1" route_core_null_29_8="29.0.0.0/8 -reject -fib 1" route_core_null_30_8="30.0.0.0/8 -reject -fib 1" route_core_null_33_8="33.0.0.0/8 -reject -fib 1" route_core_null_55_8="55.0.0.0/8 -reject -fib 1" route_core_null_214_8="214.0.0.0/8 -reject -fib 1" route_core_null_215_8="215.0.0.0/8 -reject -fib 1" ipv6_route_core_to_0="-inet6 fd00::/32 fe80::%epair1000b -fib 1" ipv6_route_core_to_16="-inet6 fd00:16::/32 fe80:16::%epair1016b -fib 1" ipv6_route_core_to_17="-inet6 fd00:17::/32 fe80:17::%epair1017b -fib 1" ipv6_route_core_to_18="-inet6 fd00:18::/32 fe80:18::%epair1018b -fib 1" ipv6_route_core_to_20="-inet6 fd00:20:8000::/33 fe80:20::%epair1020b -fib 1" ipv6_route_core_to_21="-inet6 fd00:21:8000::/33 fe80:21::%epair1021b -fib 1" ipv6_route_core_to_22="-inet6 fd00:22::/32 fe80:22::%epair1022b -fib 1" ipv6_route_core_to_23="-inet6 fd00:23::/32 fe80:23::%epair1023b -fib 1" ipv6_route_core_to_24="-inet6 fd00:24::/32 fe80:24::%epair1024b -fib 1" ipv6_route_core_to_25="-inet6 fd00:25:8000::/33 fe80:25::%epair1025b -fib 1" ipv6_route_core_to_26="-inet6 fd00:26::/32 fe80:26::%epair1026b -fib 1" ipv6_route_core_to_27="-inet6 fd00:27::/32 fe80:27::%epair1027b -fib 1" ipv6_route_core_to_28="-inet6 fd00:28::/32 fe80:28::%epair1028b -fib 1" ipv6_route_core_to_29="-inet6 fd00:29::/32 fe80:29::%epair1029b -fib 1" ipv6_route_core_to_30="-inet6 fd00:30::/32 fe80:30::%epair1030b -fib 1" ipv6_route_core_to_31="-inet6 fd00:31::/32 fe80:31::%epair1031b -fib 1" ipv6_route_core_to_32="-inet6 fd00:32::/32 fe80:32::%epair1032b -fib 1" ipv6_route_core_to_33="-inet6 fd00:33::/32 fe80:33::%epair1033b -fib 1" ipv6_route_core_to_34="-inet6 fd00:34::/32 fe80:34::%epair1034b -fib 1" ipv6_route_core_to_48="-inet6 fd00:48::/32 fe80:48::%epair1048b -fib 1" ipv6_route_core_to_52="-inet6 fd00:52::/32 fe80:52::%epair1052b -fib 1" ipv6_route_core_to_53="-inet6 fd00:53::/32 fe80:53::%epair1053b -fib 1" ipv6_route_core_to_54="-inet6 fd00:54::/32 fe80:54::%epair1054b -fib 1" ipv6_route_core_to_56="-inet6 fd00:56::/32 fe80:56::%epair1056b -fib 1" ipv6_route_core_to_80="-inet6 fd00:80::/32 fe80:80::%epair1080b -fib 1" ipv6_route_core_to_81="-inet6 fd00:81::/32 fe80:81::%epair1081b -fib 1" ipv6_route_core_to_123="-inet6 fd00:123::/32 fe80:123::%epair1123b -fib 1" ipv6_route_core_to_128="-inet6 fd00:128::/32 fe80:128::%epair1128b -fib 1" ipv6_route_core_to_180="-inet6 fd00:180::/32 fe80:180::%epair1180b -fib 1" ipv6_route_core_to_181="-inet6 fd00:181::/32 fe80:181::%epair1181b -fib 1" ipv6_route_core_to_255="-inet6 fd00:255::/32 fe80:255::%epair1255b -fib 1" ipv6_route_core_gua_vip_to_external_haproxy="-inet6 2001:470:b:56f:180::/80 fe80:180::%epair1180b -fib 1" ipv6_route_core_gua_vip_to_squid_egress="-inet6 2001:470:b:56f:80::/80 fe80:80::%epair1080b -fib 1" ipv6_route_core_gua_pfx_to_public_wifi="-inet6 2001:470:b:56f:21::/80 fe80:21::%epair1021b -fib 1" ipv6_route_core_gua_vip_to_public_smtp="-inet6 2001:470:b:56f:32::/80 fe80:30::%epair1030b -fib 1" ipv6_route_core_gua_vip_to_live="-inet6 2001:470:b:56f:30::/80 fe80:30::%epair1030b -fib 1" ipv6_route_core_global_to_he="-inet6 2000::/3 fe80:48::%epair1048b -fib 1" ipv6_route_core_syslog_vip_to_intranet="-inet6 fd00:22::514/128 fe80:18::%epair1018b -fib 1" ipv6_route_core_null_v4mapped="-inet6 ::ffff:0:0/96 -reject -fib 1" ipv6_route_core_null_nat64="-inet6 64:ff9b::/96 -reject -fib 1" ipv6_route_core_null_nat64_1="-inet6 64:ff9b:1::/48 -reject -fib 1" ipv6_route_core_null_discard100="-inet6 100::/64 -reject -fib 1" ipv6_route_core_null_teredo2001="-inet6 2001::/32 -reject -fib 1" ipv6_route_core_null_orchid2001_20="-inet6 2001:20::/28 -reject -fib 1" ipv6_route_core_null_doc2001_db8="-inet6 2001:db8::/32 -reject -fib 1" ipv6_route_core_null_6to4_2002="-inet6 2002::/16 -reject -fib 1" ipv6_route_core_null_doc3fff="-inet6 3fff::/20 -reject -fib 1" ipv6_route_core_null_seg5f00="-inet6 5f00::/16 -reject -fib 1" ipv6_route_core_null_ula_fc00="-inet6 fc00::/7 -reject -fib 1" ipv6_route_core_null_multicast_ff00="-inet6 ff00::/8 -reject -fib 1" # Management VRF Routes route_mgmt_to_syslog="10.22.128.0/17 10.1.0.1 -fib 0" route_mgmt_to_internal_smtp="10.26.128.0/17 10.1.0.1 -fib 0" route_mgmt_to_radius="10.27.128.0/17 10.1.0.1 -fib 0" route_mgmt_to_ldap="10.28.128.0/17 10.1.0.1 -fib 0" route_mgmt_to_kerberos="10.29.128.0/17 10.1.0.1 -fib 0" route_mgmt_to_unbound="10.53.128.0/17 10.1.0.1 -fib 0" route_mgmt_to_ntp="10.123.128.0/17 10.1.0.1 -fib 0" route_mgmt_to_squid="10.81.128.0/17 10.1.0.1 -fib 0" route_mgmt_to_metal_nfs="10.16.0.3/32 10.1.0.1 -fib 0" ipv6_route_mgmt_to_syslog="-inet6 fd00:22::/33 fe80::1%epair1000a -fib 0" ipv6_route_mgmt_to_internal_smtp="-inet6 fd00:26::/33 fe80::1%epair1000a -fib 0" ipv6_route_mgmt_to_radius="-inet6 fd00:27::/33 fe80::1%epair1000a -fib 0" ipv6_route_mgmt_to_ldap="-inet6 fd00:28::/33 fe80::1%epair1000a -fib 0" ipv6_route_mgmt_kerberos="-inet6 fd00:29::/33 fe80::1%epair1000a -fib 0" ipv6_route_mgmt_to_unbound="-inet6 fd00:53::/33 fe80::1%epair1000a -fib 0" ipv6_route_mgmt_to_ntp="-inet6 fd00:123::/33 fe80::1%epair1000a -fib 0" ipv6_route_mgmt_to_squid="-inet6 fd00:81::/33 fe80::1%epair1000a -fib 0" ipv6_route_mgmt_to_metal_nfs="-inet6 fd00:16:8000::3/128 fe80::1%epair1000a -fib 0" # Bare-metal VRF Routes route_metal_to_syslog="10.22.128.0/17 10.1.16.1 -fib 16" route_metal_to_internal_smtp="10.26.128.0/17 10.1.16.1 -fib 16" route_metal_to_unbound="10.53.128.0/17 10.1.16.1 -fib 16" route_metal_to_squid_ingress="10.81.128.0/17 10.1.16.1 -fib 16" route_metal_to_ntp="10.123.128.0/17 10.1.16.1 -fib 16" route_metal_to_mgmt_router="10.0.0.1/32 10.1.16.1 -fib 16" ipv6_route_metal_to_syslog="-inet6 fd00:22::/33 fe80:16::1%epair1016a -fib 16" ipv6_route_metal_to_internal_smtp="-inet6 fd00:26::/33 fe80:16::1%epair1016a -fib 16" ipv6_route_metal_to_unbound="-inet6 fd00:53::/33 fe80:16::1%epair1016a -fib 16" ipv6_route_metal_to_squid_ingress="-inet6 fd00:81::/33 fe80:16::1%epair1016a -fib 16" ipv6_route_metal_to_ntp="-inet6 fd00:123::/33 fe80:16::1%epair1016a -fib 16" ipv6_route_metal_to_mgmt_router="-inet6 fd00::/128 fe80:16::1%epair1016a -fib 16" # Public Bare-metal VRF Routes route_metalpub_to_syslog="10.22.128.0/17 10.1.17.1 -fib 17" route_metalpub_to_unbound="10.53.128.0/17 10.1.17.1 -fib 17" route_metalpub_to_squid_ingress="10.81.128.0/17 10.1.17.1 -fib 17" route_metalpub_to_ntp="10.123.128.0/17 10.1.17.1 -fib 17" ipv6_route_metalpub_to_syslog="-inet6 fd00:22::/33 fe80:17::1%epair1017a -fib 17" ipv6_route_metalpub_to_unbound="-inet6 fd00:53::/33 fe80:17::1%epair1017a -fib 17" ipv6_route_metalpub_to_squid_ingress="-inet6 fd00:81::/33 fe80:17::1%epair1017a -fib 17" ipv6_route_metalpub_to_ntp="-inet6 fd00:123::/33 fe80:17::1%epair1017a -fib 17" # intranet VRF Routes route_intranet_to_syslog="10.22.128.0/17 10.1.18.1 -fib 18" route_intranet_to_internal_smtp="10.26.128.0/17 10.1.18.1 -fib 18" route_intranet_to_unbound="10.53.128.0/17 10.1.18.1 -fib 18" route_intranet_to_squid_ingress="10.81.128.0/17 10.1.18.1 -fib 18" route_intranet_to_ntp="10.123.128.0/17 10.1.18.1 -fib 18" ipv6_route_intranet_syslog_vip_to_intranet="-inet6 fd00:22::514/128 fd00:18:8000::2 -fib 18" ipv6_route_intranet_to_syslog="-inet6 fd00:22::/33 fe80:18::1%epair1018a -fib 18" ipv6_route_intranet_to_internal_smtp="-inet6 fd00:26::/33 fe80:18::1%epair1018a -fib 18" ipv6_route_intranet_to_unbound="-inet6 fd00:53::/33 fe80:18::1%epair1018a -fib 18" ipv6_route_intranet_to_squid_ingress="-inet6 fd00:81::/33 fe80:18::1%epair1018a -fib 18" ipv6_route_intranet_to_ntp="-inet6 fd00:123::/33 fe80:18::1%epair1018a -fib 18" # Private WiFi VRF Routes route_private_wifi_to_syslog="10.20.128.0/17 10.1.20.1 -fib 20" route_private_wifi_to_internal_smtp="10.26.128.0/17 10.1.20.1 -fib 20" route_private_wifi_to_unbound="10.53.128.0/17 10.1.20.1 -fib 20" route_private_wifi_to_squid_ingress="10.81.128.0/17 10.1.20.1 -fib 20" route_private_wifi_to_ntp="10.123.128.0/17 10.1.20.1 -fib 20" ipv6_route_private_wifi_to_syslog="-inet6 fd00:22::/33 fe80:20::1%epair1020a -fib 20" ipv6_route_private_wifi_to_unbound="-inet6 fd00:53::/33 fe80:20::1%epair1020a -fib 20" ipv6_route_private_wifi_to_squid_ingress="-inet6 fd00:81::/33 fe80:20::1%epair1020a -fib 20" ipv6_route_private_wifi_to_ntp="-inet6 fd00:123::/33 fe80:20::1%epair1020a -fib 20" # Public WiFi VRF Routes ipv6_route_public_wifi_to_syslog="-inet6 fd00:22::/33 fe80:21::1%epair1021a -fib 21" ipv6_route_public_wifi_to_unbound="-inet6 fd00:53::/33 fe80:21::1%epair1021a -fib 21" ipv6_route_public_wifi_to_squid_ingress="-inet6 fd00:81::/33 fe80:21::1%epair1021a -fib 21" ipv6_route_public_wifi_to_ntp="-inet6 fd00:123::/33 fe80:21::1%epair1021a -fib 21" # Syslog VRF Routes route_syslog_to_haproxy_internal_es="10.181.128.0/17 fe80:22::1%epair1022a -fib 22" # LAN VRF Routes route_lan_to_syslog="10.20.128.0/17 10.1.25.1 -fib 25" route_lan_to_internal_smtp="10.26.128.0/17 10.1.25.1 -fib 25" route_lan_to_unbound="10.53.128.0/17 10.1.25.1 -fib 25" route_lan_to_squid_ingress="10.81.128.0/17 10.1.25.1 -fib 25" route_lan_to_ntp="10.123.128.0/17 10.1.25.1 -fib 25" route_lan_to_sdf1="209.160.32.186 10.1.25.1 -fib 25" route_lan_to_sdf2="205.166.94.9 10.1.25.1 -fib 25" route_lan_to_sdf3="205.166.94.4 10.1.25.1 -fib 25" ipv6_route_lan_to_syslog="-inet6 fd00:22::/33 fe80:25::1%epair1025a -fib 25" ipv6_route_lan_to_internal_smtp="-inet6 fd00:26::/33 fe80:25::1%epair1025a -fib 25" ipv6_route_lan_to_unbound="-inet6 fd00:53::/33 fe80:25::1%epair1025a -fib 25" ipv6_route_lan_to_squid_ingress="-inet6 fd00:81::/33 fe80:25::1%epair1025a -fib 25" ipv6_route_lan_to_ntp="-inet6 fd00:123::/33 fe80:25::1%epair1025a -fib 25" # Internal SMTP VRF Routes route_internal_smtp_to_syslog="10.22.128.0/17 10.1.26.1 -fib 26" route_internal_smtp_to_ldap="10.28.128.0/17 10.1.26.1 -fib 26" route_internal_smtp_to_unbound="10.53.128.0/17 10.1.26.1 -fib 26" route_internal_smtp_to_squid_ingress="10.81.128.0/17 10.1.26.1 -fib 26" ipv6_route_internal_smtp_to_syslog="-inet6 fd00:22::/33 fe80:26::1%epair1026a -fib 26" ipv6_route_internal_smtp_to_ldap="-inet6 fd00:28::/33 fe80:26::1%epair1026a -fib 26" ipv6_route_internal_smtp_to_unbound="-inet6 fd00:53::/33 fe80:26::1%epair1026a -fib 26" ipv6_route_internal_smtp_to_squid_ingress="-inet6 fd00:81::/33 fe80:26::1%epair1026a -fib 26" # RADIUS VRF Routes route_radius_to_syslog="10.22.128.0/17 10.1.27.1 -fib 27" route_radius_to_ldap="10.28.128.0/17 10.1.27.1 -fib 27" route_radius_to_unbound="10.53.128.0/17 10.1.27.1 -fib 27" route_radius_to_squid_ingress="10.81.128.0/17 10.1.27.1 -fib 27" ipv6_route_radius_to_syslog="-inet6 fd00:22::/33 fe80:27::1%epair1027a -fib 27" ipv6_route_radius_to_ldap="-inet6 fd00:28::/33 fe80:27::1%epair1027a -fib 27" ipv6_route_radius_to_unbound="-inet6 fd00:53::/33 fe80:27::1%epair1027a -fib 27" ipv6_route_radius_to_squid_ingress="-inet6 fd00:81::/33 fe80:27::1%epair1027a -fib 27" # LDAP routes route_ldap_to_syslog="10.22.128.0/17 10.1.28.1 -fib 28" route_ldap_to_internal_smtp="10.26.128.0/17 10.1.28.1 -fib 28" route_ldap_to_radius="10.27.128.0/17 10.1.28.1 -fib 28" route_ldap_to_unbound="10.53.128.0/17 10.1.28.1 -fib 28" route_ldap_to_squid_ingress="10.81.128.0/17 10.1.28.1 -fib 28" ipv6_route_ldap_to_syslog="-inet6 fd00:22::/33 fe80:28::1%epair1028a -fib 28" ipv6_route_ldap_to_internal_smtp="-inet6 fd00:26::/33 fe80:28::1%epair1028a -fib 28" ipv6_route_ldap_to_radius="-inet6 fd00:27::/33 fe80:28::1%epair1028a -fib 28" ipv6_route_ldap_to_unbound="-inet6 fd00:53::/33 fe80:28::1%epair1028a -fib 28" ipv6_route_ldap_to_squid_ingress="-inet6 fd00:81::/33 fe80:28::1%epair1028a -fib 28" # Live Servers VRF Routes route_live_to_syslog="10.22.128.0/17 10.1.30.1 -fib 30" route_live_to_unbound="10.53.128.0/17 10.1.30.1 -fib 30" route_live_to_squid_ingress="10.81.128.0/17 10.1.30.1 -fib 30" route_smtpext_vip_to_slammer="10.32.255.0/32 10.30.0.3 -fib 30" ipv6_route_live_to_syslog="-inet6 fd00:22::/33 fe80:30::1%epair1030a-fib 30" ipv6_route_live_to_unbound="-inet6 fd00:53::/33 fe80:30::1%epair1030a -fib 30" ipv6_route_live_to_squid_ingress="-inet6 fd00:81::/33 fe80:30::1%epair1030a -fib 30" ipv6_route_live_gua_vip_to_slammer="-inet6 2001:470:b:56f::/64 fd00:30:8000::3 -fib 30" # VOIP VRF Routes route_voip_to_syslog="10.22.128.0/17 10.1.31.1 -fib 31" route_voip_to_unbound="10.53.128.0/17 10.1.31.1 -fib 31" route_voip_to_squid_ingress="10.81.128.0/17 10.1.31.1 -fib 31" ipv6_route_voip_to_syslog="-inet6 fd00:22::/33 fe80:31::1%epair1031a -fib 31" ipv6_route_voip_to_unbound="-inet6 fd00:53::/33 fe80:31::1%epair1031a -fib 31" ipv6_route_voip_to_squid_ingress="-inet6 fd00:81::/33 fe80:31::1%epair1031a -fib 31" # Hurricane Electric VRF Routes ipv6_route_he_to_global="-inet6 2000::/3 2001:470:a:56f::1 -fib 48" ipv6_route_he_gua_pfx_to_core1="-inet6 2001:470:e845::/48 fe80:48::1%epair1048a -fib 48" ipv6_route_he_gua_pfx_to_core2="-inet6 2001:470:b:56f::/64 fe80:48::1%epair1048a -fib 48" ipv6_route_he_to_syslog="-inet6 fd00:22::/33 fe80:48::1%epair1048a -fib 48" ipv6_route_he_to_unbound="-inet6 fd00:53::/33 fe80:48::1%epair1048a -fib 48" ipv6_route_he_null_v4mapped="-inet6 ::ffff:0:0/96 -reject -fib 48" ipv6_route_he_null_nat64="-inet6 64:ff9b::/96 -reject -fib 48" ipv6_route_he_null_nat64_1="-inet6 64:ff9b:1::/48 -reject -fib 48" ipv6_route_he_null_discard100="-inet6 100::/64 -reject -fib 48" ipv6_route_he_null_teredo2001="-inet6 2001::/32 -reject -fib 48" ipv6_route_he_null_orchid2001_20="-inet6 2001:20::/28 -reject -fib 48" ipv6_route_he_null_doc2001_db8="-inet6 2001:db8::/32 -reject -fib 48" ipv6_route_he_null_6to4_2002="-inet6 2002::/16 -reject -fib 48" ipv6_route_he_null_doc3fff="-inet6 3fff::/20 -reject -fib 48" ipv6_route_he_null_seg5f00="-inet6 5f00::/16 -reject -fib 48" ipv6_route_he_null_ula_fc00="-inet6 fc00::/7 -reject -fib 48" ipv6_route_he_null_multicast_ff00="-inet6 ff00::/8 -reject -fib 48" # Unbound Resolver VRF Routes route_unbound_to_internal="10.0.0.0/8 10.1.53.1 -fib 53" ipv6_route_unbound_to_internal="-inet6 fd00::/16 fe80:53::1%epair1053a -fib 53" # Private DNS VRF Routes route_private_dns_to_ldap="10.28.128.0/17 10.1.54.1 -fib 54" ipv6_route_private_dns_to_ldap="-inet6 fd00:28::/33 fe80:54::1%epair1054a -fib 54" # Kamatera VRF Routes route_kamatera_to_haproxy_external="10.180.128.0/17 10.1.56.1 -fib 56" ipv6_route_kamatera_to_haproxy_external="fd00:180::33 fe80:56::1%epair1056a -fib 56" # Squid Egress VRF Routes route_squid_egress_to_syslog="10.22.128.0/17 10.1.80.1 -fib 80" route_squid_egress_to_unbound="10.53.128.0/17 10.1.80.1 -fib 80" route_squid_egress_to_global="0.0.0.0/0 10.1.80.1 -fib 80" route_squid_egress_to_squid_ingress="10.81.128.0/17 10.1.80.1 -fib 80" route_squid_egress_to_haproxy_external="10.180.128.0/17 10.1.80.1 -fib 80" route_squid_egress_null_to_internal="10.0.0.0/8 -reject -fib 80" ipv6_route_squid_egress_to_global="-inet6 2000::/3 fe80:80::1%epair1080a -fib 80" ipv6_route_squid_egress_to_squid_ingress="-inet6 fd00:81::/33 fe80:80::1%epair1080a -fib 80" ipv6_route_squid_egress_to_haproxy_external="-inet6 fd00:180::/33 fe80:80::1%epair1080a -fib 80" ipv6_route_squid_egress_to_dns="-inet6 fd00:53::53/128 fe80:80::1%epair1080a -fib 80" ipv6_route_squid_egress_null_to_internal="-inet6 fd00::/8 -reject -fib 80" ipv6_route_squid_egress_to_syslog="-inet6 fd00:22::/32 fe80:80::1%epair1080a -fib 80" # Squid Ingress VRF Routes route_squid_ingress_to_internal="10.0.0.0/8 10.1.81.1 -fib 81" ipv6_route_squid_ingress_to_internal="-inet6 fd00::/16 fe80:81::1%epair1081a -fib 81" # NTP VRF Routes route_ntp_to_internal="10.0.0.0/8 10.1.123.1 -fib 123" ipv6_route_ntp_to_internal="-inet6 fd00::/16 fe80:123::1%epair1123a -fib 123" # HAProxy External VRF Routes route_haproxy_external_to_syslog="10.22.128.0/17 10.1.180.1 -fib 180" route_haproxy_external_to_unbound="10.53.128.0/17 10.1.180.1 -fib 180" route_haproxy_external_to_kamatera="10.56.128.0/17 10.1.180.1 -fib 180" route_haproxy_external_to_squid_egress="10.80.128.0/17 10.1.180.1 -fib 180" ipv6_route_haproxy_external_to_syslog="-inet6 fd00:22::/33 fe80:180::1%epair1180a -fib 180" ipv6_route_haproxy_external_to_unbound="-inet6 fd00:53::/33 fe80:180::1%epair1180a -fib 180" ipv6_route_haproxy_external_to_kamatera="-inet6 fd00:56::/33 fe80:180::1%epair1180a -fib 180" ipv6_route_haproxy_external_to_squid_egress="-inet6 fd00:80::/33 fe80:180::1%epair1180a -fib 180" ipv6_route_haproxy_external_to_global="-inet6 2000::/3 fe80:180::1%epair1180a -fib 180" # HAProxy Internal VRF Routes route_haproxy_internal_to_syslog="10.22.128.0/17 10.1.181.1 -fib 181" route_haproxy_internal_to_unbound="10.53.128.0/17 10.1.181.1 -fib 181" route_haproxy_internal_to_squid_ingress="10.80.128.0/17 10.1.181.1 -fib 181" ipv6_route_haproxy_internal_to_syslog="-inet6 fd00:22::/33 fe80:181::1%epair1181a -fib 181" ipv6_route_haproxy_internal_to_unbound="-inet6 fd00:53::/33 fe80:181::1%epair1181a -fib 181" ipv6_route_haproxy_internal_to_squid_ingress="-inet6 fd00:80::/33 fe80:181::1%epair181a -fib 181" # CAN VRF Routes route_can_to_global="0.0.0.0/0 192.168.1.1 -fib 255" route_can_to_unbound="10.53.128.0/17 10.1.255.1 -fib 255" route_can_to_squid_egress="10.80.128.0/17 10.1.255.1 -fib 255" route_can_to_ntp="10.123.128.0/17 10.1.255.1 -fib 255" route_can_to_lan="10.25.0.0/17 10.1.255.1 -fib 255" ipv6_route_can_to_intranet="fd00::/16 fe80:255::1%epair1255a -fib 255" ipv6_route_can_to_unbound="fd00:53::/33 fe80:255::1%epair1255a -fib 255" ipv6_route_can_to_squid_egress="fd00:81::/33 fe80:255::1%epair1255a -fib 255" ipv6_route_can_to_ntp="fd00:123::/33 fe80:255::1%epair1255a -fib 255" ipv6_route_can_to_lan="fd00:25::/33 fe80:255::1%epair1255a -fib 255" # All IPv4 Routes static_routes="core_to_0 core_to_16 core_to_17 \ core_to_18 core_to_20 core_to_22 core_to_23 core_to_24 core_to_25 core_to_26 \ core_to_27 core_to_28 core_to_29 core_to_30 core_to_31 core_to_32 core_to_33 \ core_to_34 core_to_52 core_to_53 core_to_54 core_to_56 core_to_80 core_to_81 \ core_to_123 core_to_128 core_to_180 core_to_181 core_to_255 \ core_default_gateway core_to_can_hue core_null_000_8 core_null_010_8 \ core_null_100_64_10 core_null_169_254_16 core_null_172_16_12 \ core_null_192_0_0_24 core_null_192_0_2_24 core_null_192_88_99_24 \ core_null_192_168_16 core_null_198_18_15 core_null_198_51_100_24 \ core_null_203_0_113_24 core_null_224_4 core_null_233_252_24 core_null_240_4 \ core_null_6_8 core_null_7_8 core_null_11_8 core_null_21_8 core_null_22_8 \ core_null_26_8 core_null_28_8 core_null_29_8 core_null_30_8 core_null_33_8 \ core_null_55_8 core_null_214_8 core_null_215_8 mgmt_to_syslog core_smtpext_vip_to_30 \ mgmt_to_internal_smtp mgmt_to_radius mgmt_to_ldap mgmt_to_kerberos \ mgmt_to_unbound mgmt_to_ntp mgmt_to_squid mgmt_to_metal_nfs metal_to_syslog \ metal_to_internal_smtp metal_to_unbound metal_to_squid_ingress metal_to_ntp \ metal_to_mgmt_router metalpub_to_syslog metalpub_to_unbound \ metalpub_to_squid_ingress metalpub_to_ntp intranet_to_syslog \ intranet_to_internal_smtp intranet_to_unbound intranet_to_squid_ingress \ intranet_to_ntp private_wifi_to_syslog private_wifi_to_internal_smtp \ private_wifi_to_unbound private_wifi_to_squid_ingress private_wifi_to_ntp \ syslog_to_haproxy_internal_es lan_to_syslog lan_to_internal_smtp \ lan_to_unbound lan_to_squid_ingress lan_to_ntp lan_to_sdf1 lan_to_sdf2 \ lan_to_sdf3 internal_smtp_to_syslog internal_smtp_to_ldap \ internal_smtp_to_unbound internal_smtp_to_squid_ingress radius_to_syslog \ radius_to_ldap radius_to_unbound radius_to_squid_ingress ldap_to_syslog \ ldap_to_internal_smtp ldap_to_radius ldap_to_unbound ldap_to_squid_ingress \ live_to_syslog live_to_unbound live_to_squid_ingress voip_to_syslog smtpext_vip_to_slammer \ voip_to_unbound voip_to_squid_ingress unbound_to_internal private_dns_to_ldap \ kamatera_to_haproxy_external squid_egress_to_syslog squid_egress_to_unbound \ squid_egress_to_global squid_egress_to_squid_ingress \ squid_egress_to_haproxy_external squid_egress_null_to_internal \ squid_ingress_to_internal ntp_to_internal haproxy_external_to_syslog \ haproxy_external_to_unbound haproxy_external_to_kamatera \ haproxy_external_to_squid_egress haproxy_internal_to_syslog \ haproxy_internal_to_unbound haproxy_internal_to_squid_ingress can_to_global \ can_to_unbound can_to_squid_egress can_to_ntp can_to_lan" # All IPv6 Routes ipv6_static_routes="core_to_0 core_to_16 core_to_17 core_to_18 core_to_20 core_to_21 core_to_22 \ core_to_23 core_to_24 core_to_25 core_to_26 core_to_27 core_to_28 core_to_29 \ core_to_30 core_to_31 core_to_32 core_to_33 core_to_34 core_to_48 core_to_52 \ core_to_53 core_to_54 core_to_56 core_to_80 core_to_81 core_to_123 core_to_128 \ core_to_180 core_to_181 core_to_255 core_gua_vip_to_external_haproxy \ core_gua_vip_to_squid_egress core_gua_pfx_to_public_wifi \ core_gua_vip_to_public_smtp core_gua_vip_to_live core_global_to_he \ core_syslog_vip_to_intranet core_null_v4mapped core_null_nat64 \ core_null_nat64_1 core_null_discard100 core_null_teredo2001 \ core_null_orchid2001_20 core_null_doc2001_db8 core_null_6to4_2002 \ core_null_doc3fff core_null_seg5f00 core_null_ula_fc00 \ core_null_multicast_ff00 mgmt_to_syslog mgmt_to_internal_smtp mgmt_to_radius \ mgmt_to_ldap mgmt_kerberos mgmt_to_unbound mgmt_to_ntp mgmt_to_squid \ mgmt_to_metal_nfs metal_to_syslog metal_to_internal_smtp metal_to_unbound \ metal_to_squid_ingress metal_to_ntp metal_to_mgmt_router metalpub_to_syslog \ metalpub_to_unbound metalpub_to_squid_ingress metalpub_to_ntp \ intranet_syslog_vip_to_intranet intranet_to_syslog intranet_to_internal_smtp \ intranet_to_unbound intranet_to_squid_ingress intranet_to_ntp \ private_wifi_to_syslog private_wifi_to_unbound private_wifi_to_squid_ingress \ private_wifi_to_ntp public_wifi_to_syslog public_wifi_to_unbound \ public_wifi_to_squid_ingress public_wifi_to_ntp lan_to_syslog \ lan_to_internal_smtp lan_to_unbound lan_to_squid_ingress lan_to_ntp \ internal_smtp_to_syslog internal_smtp_to_ldap internal_smtp_to_unbound \ internal_smtp_to_squid_ingress radius_to_syslog radius_to_ldap \ radius_to_unbound radius_to_squid_ingress ldap_to_syslog ldap_to_internal_smtp \ ldap_to_radius ldap_to_unbound ldap_to_squid_ingress live_to_syslog live_smtpext_gua_vip_to_slammer \ live_to_unbound live_to_squid_ingress live_gua_vip_to_slammer voip_to_syslog \ voip_to_unbound voip_to_squid_ingress he_to_global he_gua_pfx_to_core1 \ he_gua_pfx_to_core2 he_to_syslog he_to_unbound he_null_v4mapped he_null_nat64 \ he_null_nat64_1 he_null_discard100 he_null_teredo2001 he_null_orchid2001_20 \ he_null_doc2001_db8 he_null_6to4_2002 he_null_doc3fff he_null_seg5f00 \ he_null_ula_fc00 he_null_multicast_ff00 unbound_to_internal \ private_dns_to_ldap kamatera_to_haproxy_external squid_egress_to_global \ squid_egress_to_squid_ingress squid_egress_to_haproxy_external \ squid_egress_to_dns squid_egress_null_to_internal squid_egress_to_syslog \ squid_ingress_to_internal ntp_to_internal haproxy_external_to_syslog \ haproxy_external_to_unbound haproxy_external_to_kamatera \ haproxy_external_to_squid_egress haproxy_external_to_global \ haproxy_internal_to_syslog haproxy_internal_to_unbound \ haproxy_internal_to_squid_ingress can_to_intranet can_to_unbound \ can_to_squid_egress can_to_ntp can_to_lan"