BNG SLAVE - Nokia 7750 SR-7
Información General
| Parámetro | Valor |
|---|---|
| Hostname | SLAVE |
| Modelo | Nokia 7750 SR-7 (SRSIM 25.10.R2) |
| IP de Gestión | 10.99.1.3 |
| Loopback | 10.0.0.2/32 |
| AS (Base Router) | 65510 |
| AS (VPRN 9999) | 65520 |
| Puerto SSH | 56613 |
| SRRP Priority | 50 (Backup) |
Rol
Este es el BNG secundario del ISP. En condiciones normales es SRRP Backup y anuncia los prefijos públicos con mayor AS-Path prepend para que el tráfico de retorno se dirija al MASTER.
Diferencias con MASTER
| Parámetro | MASTER | SLAVE |
|---|---|---|
| Hostname | MASTER | SLAVE |
| Loopback | 10.0.0.1 | 10.0.0.2 |
| Management IP | 10.99.1.2 | 10.99.1.3 |
| Inter-BNG IP | 172.99.1.0 | 172.99.1.1 |
| Interface name | to_SLAVE | to_MASTER |
| eBGP C1 neighbor | 172.16.1.1 | 172.16.1.3 |
| eBGP C2 neighbor | 172.16.2.1 | 172.16.2.3 |
| eBGP C1 local IP | 172.16.1.0 | 172.16.1.2 |
| eBGP C2 local IP | 172.16.2.0 | 172.16.2.2 |
| LIG source IP | 172.19.1.2 | 172.20.1.2 |
| LIG dest IP | 172.19.1.1 | 172.20.1.1 |
| Default export C1 | Master | Backup |
| Default export C2 | Master | Backup |
| SRRP Priority | 200 | 50 |
| MCS Peer | 10.0.0.2 | 10.0.0.1 |
| MCS Source | 10.0.0.1 | 10.0.0.2 |
1. SYSTEM NAME
/configure system
/configure system name "SLAVE"
2. TIME
/configure system time
/configure system time zone
/configure system time zone standard
/configure system time zone standard name est
/configure system time ntp admin-state enable
/configure system time ntp server 216.239.35.12 router-instance "9999"
3. GRPC
/configure system grpc admin-state enable
/configure system grpc allow-unsecure-connection
/configure system grpc gnmi auto-config-save true
/configure system grpc rib-api admin-state enable
4. NETCONF
/configure system management-interface netconf listen admin-state enable
/configure system management-interface configuration-save configuration-backups 5
/configure system management-interface configuration-save incremental-saves false
/configure system management-interface netconf auto-config-save true
5. SNMP
/configure system management-interface snmp packet-size 9216
/configure system management-interface snmp streaming admin-state enable
/configure system security snmp community "public" access-permissions r
/configure system security snmp community "public" version v2c
6. SSH
/configure system login-control ssh inbound-max-sessions 30
/configure system security ssh server-cipher-list-v2 cipher 190 name aes256-ctr
/configure system security ssh server-cipher-list-v2 cipher 192 name aes192-ctr
/configure system security ssh server-cipher-list-v2 cipher 194 name aes128-ctr
/configure system security ssh server-cipher-list-v2 cipher 200 name aes128-cbc
/configure system security ssh server-cipher-list-v2 cipher 205 name 3des-cbc
/configure system security ssh server-cipher-list-v2 cipher 225 name aes192-cbc
/configure system security ssh server-cipher-list-v2 cipher 230 name aes256-cbc
/configure system security ssh client-cipher-list-v2 cipher 190 name aes256-ctr
/configure system security ssh client-cipher-list-v2 cipher 192 name aes192-ctr
/configure system security ssh client-cipher-list-v2 cipher 194 name aes128-ctr
/configure system security ssh client-cipher-list-v2 cipher 200 name aes128-cbc
/configure system security ssh client-cipher-list-v2 cipher 205 name 3des-cbc
/configure system security ssh client-cipher-list-v2 cipher 225 name aes192-cbc
/configure system security ssh client-cipher-list-v2 cipher 230 name aes256-cbc
/configure system security ssh server-mac-list-v2 mac 200 name hmac-sha2-512
/configure system security ssh server-mac-list-v2 mac 210 name hmac-sha2-256
/configure system security ssh server-mac-list-v2 mac 215 name hmac-sha1
/configure system security ssh server-mac-list-v2 mac 220 name hmac-sha1-96
/configure system security ssh server-mac-list-v2 mac 225 name hmac-md5
/configure system security ssh server-mac-list-v2 mac 240 name hmac-md5-96
/configure system security ssh client-mac-list-v2 mac 200 name hmac-sha2-512
/configure system security ssh client-mac-list-v2 mac 210 name hmac-sha2-256
/configure system security ssh client-mac-list-v2 mac 215 name hmac-sha1
/configure system security ssh client-mac-list-v2 mac 220 name hmac-sha1-96
/configure system security ssh client-mac-list-v2 mac 225 name hmac-md5
/configure system security ssh client-mac-list-v2 mac 240 name hmac-md5-96
7. SYSTEM USERS PROFILES
/configure system security aaa local-profiles profile "administrative" default-action permit-all
/configure system security aaa local-profiles profile "administrative" entry 10 match "configure system security"
/configure system security aaa local-profiles profile "administrative" entry 10 action permit
/configure system security aaa local-profiles profile "administrative" entry 20 match "show system security"
/configure system security aaa local-profiles profile "administrative" entry 20 action permit
/configure system security aaa local-profiles profile "administrative" entry 30 match "tools perform security"
/configure system security aaa local-profiles profile "administrative" entry 30 action permit
/configure system security aaa local-profiles profile "administrative" entry 40 match "tools dump security"
/configure system security aaa local-profiles profile "administrative" entry 40 action permit
/configure system security aaa local-profiles profile "administrative" entry 42 match "tools dump system security"
/configure system security aaa local-profiles profile "administrative" entry 42 action permit
/configure system security aaa local-profiles profile "administrative" entry 50 match "admin system security"
/configure system security aaa local-profiles profile "administrative" entry 50 action permit
/configure system security aaa local-profiles profile "administrative" entry 100 match "configure li"
/configure system security aaa local-profiles profile "administrative" entry 100 action deny
/configure system security aaa local-profiles profile "administrative" entry 110 match "show li"
/configure system security aaa local-profiles profile "administrative" entry 110 action deny
/configure system security aaa local-profiles profile "administrative" entry 111 match "clear li"
/configure system security aaa local-profiles profile "administrative" entry 111 action deny
/configure system security aaa local-profiles profile "administrative" entry 112 match "tools dump li"
/configure system security aaa local-profiles profile "administrative" entry 112 action deny
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization action true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization cancel-commit true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization close-session true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization commit true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization copy-config true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization create-subscription true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization delete-config true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization discard-changes true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization edit-config true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization get true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization get-config true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization get-data true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization get-schema true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization kill-session true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization lock true
/configure system security aaa local-profiles profile "administrative" netconf base-op-authorization validate true
/configure system security aaa local-profiles profile "default" entry 10 match "exec"
/configure system security aaa local-profiles profile "default" entry 10 action permit
/configure system security aaa local-profiles profile "default" entry 20 match "exit"
/configure system security aaa local-profiles profile "default" entry 20 action permit
/configure system security aaa local-profiles profile "default" entry 30 match "help"
/configure system security aaa local-profiles profile "default" entry 30 action permit
/configure system security aaa local-profiles profile "default" entry 40 match "logout"
/configure system security aaa local-profiles profile "default" entry 40 action permit
/configure system security aaa local-profiles profile "default" entry 50 match "password"
/configure system security aaa local-profiles profile "default" entry 50 action permit
/configure system security aaa local-profiles profile "default" entry 60 match "show config"
/configure system security aaa local-profiles profile "default" entry 60 action deny
/configure system security aaa local-profiles profile "default" entry 65 match "show li"
/configure system security aaa local-profiles profile "default" entry 65 action deny
/configure system security aaa local-profiles profile "default" entry 66 match "clear li"
/configure system security aaa local-profiles profile "default" entry 66 action deny
/configure system security aaa local-profiles profile "default" entry 67 match "tools dump li"
/configure system security aaa local-profiles profile "default" entry 67 action deny
/configure system security aaa local-profiles profile "default" entry 68 match "state li"
/configure system security aaa local-profiles profile "default" entry 68 action deny
/configure system security aaa local-profiles profile "default" entry 70 match "show"
/configure system security aaa local-profiles profile "default" entry 70 action permit
/configure system security aaa local-profiles profile "default" entry 75 match "state"
/configure system security aaa local-profiles profile "default" entry 75 action permit
/configure system security aaa local-profiles profile "default" entry 80 match "enable-admin"
/configure system security aaa local-profiles profile "default" entry 80 action permit
/configure system security aaa local-profiles profile "default" entry 90 match "enable"
/configure system security aaa local-profiles profile "default" entry 90 action permit
/configure system security aaa local-profiles profile "default" entry 100 match "configure li"
/configure system security aaa local-profiles profile "default" entry 100 action deny
8. SYSTEM USERS
/configure system security user-params local-user user "admin" restricted-to-home false
/configure system security user-params local-user user "admin" access console true
/configure system security user-params local-user user "admin" access ftp true
/configure system security user-params local-user user "admin" access netconf true
/configure system security user-params local-user user "admin" access grpc true
/configure system security user-params local-user user "admin" password "lab123"
/configure system security user-params local-user user "admin" restricted-to-home false
/configure system security user-params local-user user "admin" access console true
/configure system security user-params local-user user "admin" console member ["administrative"]
9. LOGS
/configure log filter "1001" named-entry "10" description "Collect only events of major severity or higher"
/configure log filter "1001" named-entry "10" action forward
/configure log filter "1001" named-entry "10" match severity gte major
/configure log log-id "77" description "Default System Log to Syslog"
/configure log log-id "77" source main true
/configure log log-id "77" destination syslog "1"
/configure log route-preference primary outband
/configure log syslog "1" description "syslog container"
/configure log syslog "1" address 10.99.1.16
/configure log syslog "1" facility local6
/configure log syslog "1" severity info
/configure log syslog "1" port 5514
/configure log syslog "1" hostname use-system-name
/configure log log-id "99" description "Default System Log"
/configure log log-id "99" source main true
/configure log log-id "99" destination memory max-entries 500
/configure log log-id "100" description "Default Serious Errors Log"
/configure log log-id "100" filter "1001"
/configure log log-id "100" source main true
/configure log log-id "100" destination memory max-entries 500
10. CARDS
10.1. IOM
/configure card 1 card-type iom5-e
10.2. MDA
/configure card 1 mda 1 mda-type me6-100gb-qsfp28
/configure card 2 card-type iom4-e-b
/configure card 2 mda 1 mda-type isa2-bb
10.3. SFM
/configure sfm 1 sfm-type m-sfm6-7/12
11. ROUTER BASE
/configure router "Base"
/configure router "Base" autonomous-system 65510
/configure router "Base" interface "system"
/configure router "Base" interface "system" ipv4
/configure router "Base" interface "system" ipv4 primary
/configure router "Base" interface "system" ipv4 primary address 10.0.0.2
/configure router "Base" interface "system" ipv4 primary prefix-length 32
12. PORTS
12.1. PORT TO BNG1
/configure port 1/1/c1 admin-state enable
/configure port 1/1/c1 connector breakout c1-100g
/configure port 1/1/c1/1 admin-state enable
/configure port 1/1/c1/1 ethernet mode hybrid
/configure port 1/1/c1/1 ethernet encap-type dot1q
12.2. PORT TO OLT
/configure port 1/1/c2 admin-state enable
/configure port 1/1/c2 connector breakout c1-100g
/configure port 1/1/c2/1 admin-state enable
/configure port 1/1/c2/1 ethernet mode hybrid
/configure port 1/1/c2/1 ethernet encap-type qinq
12.3. PORT TO LIG
/configure port 1/1/c3 admin-state enable
/configure port 1/1/c3 connector breakout c1-100g
/configure port 1/1/c3/1 admin-state enable
/configure port 1/1/c3/1 ethernet mode hybrid
/configure port 1/1/c3/1 ethernet encap-type dot1q
12.4. PORT TO DNS
/configure port 1/1/c4 admin-state enable
/configure port 1/1/c4 connector breakout c1-100g
/configure port 1/1/c4/1 admin-state enable
/configure port 1/1/c4/1 ethernet mode hybrid
12.5. PORT TO CARRIER1
/configure port 1/1/c5 admin-state enable
/configure port 1/1/c5 connector breakout c1-100g
/configure port 1/1/c5/1 admin-state enable
/configure port 1/1/c5/1 ethernet mode hybrid
/configure port 1/1/c5/1 ethernet encap-type dot1q
12.6. PORT TO CARRIER2
/configure port 1/1/c6 admin-state enable
/configure port 1/1/c6 connector breakout c1-100g
/configure port 1/1/c6/1 admin-state enable
/configure port 1/1/c6/1 ethernet mode hybrid
/configure port 1/1/c6/1 ethernet encap-type dot1q
13. INTERFACE TO BNG1
/configure router "Base" interface "to_MASTER" admin-state enable
/configure router "Base" interface "to_MASTER" port 1/1/c1/1:0
/configure router "Base" interface "to_MASTER" ipv4 primary address 172.99.1.1
/configure router "Base" interface "to_MASTER" ipv4 primary prefix-length 31
/configure router "Base" interface "to_MASTER" ipv4 bfd admin-state enable
/configure router "Base" interface "to_MASTER" ipv4 bfd receive 500
/configure router "Base" interface "to_MASTER" ipv4 bfd multiplier 3
14. IS-IS
/configure router "Base" isis 0 admin-state enable
/configure router "Base" isis 0 level-capability 2
/configure router "Base" isis 0 traffic-engineering true
/configure router "Base" isis 0 area-address [49.0001]
/configure router "Base" isis 0 timers spf-wait spf-max-wait 2000
/configure router "Base" isis 0 timers spf-wait spf-initial-wait 200
/configure router "Base" isis 0 timers spf-wait spf-second-wait 100
/configure router "Base" isis 0 timers lsp-wait lsp-max-wait 5000
/configure router "Base" isis 0 timers lsp-wait lsp-initial-wait 100
/configure router "Base" isis 0 timers lsp-wait lsp-second-wait 1000
/configure router "Base" isis 0 loopfree-alternate
/configure router "Base" isis 0 interface "system" admin-state enable
/configure router "Base" isis 0 interface "system" level-capability 2
/configure router "Base" isis 0 interface "to_MASTER" admin-state enable
/configure router "Base" isis 0 interface "to_MASTER" interface-type point-to-point
/configure router "Base" isis 0 interface "to_MASTER" bfd-liveness ipv4
/configure router "Base" isis 0 level 2 wide-metrics-only true
15. LDP
/configure router "Base" ldp interface-parameters interface "to_MASTER" admin-state enable
/configure router "Base" ldp interface-parameters interface "to_MASTER" bfd-liveness ipv4 true
/configure router "Base" ldp interface-parameters interface "to_MASTER" ipv4 admin-state enable
/configure router "Base" ldp targeted-session peer 10.0.0.1 admin-state enable
16. IBGP
/configure router "Base" bgp admin-state enable
/configure router "Base" bgp loop-detect discard-route
/configure router "Base" bgp min-route-advertisement 2
/configure router "Base" bgp vpn-apply-export true
/configure router "Base" bgp vpn-apply-import true
/configure router "Base" bgp rapid-withdrawal true
/configure router "Base" bgp peer-ip-tracking true
/configure router "Base" bgp family ipv4 true
/configure router "Base" bgp family ipv6 true
/configure router "Base" bgp rapid-update vpn-ipv4 true
/configure router "Base" bgp rapid-update vpn-ipv6 true
16.1. GROUPS
/configure router "Base" bgp group "iBGP" admin-state enable
/configure router "Base" bgp group "iBGP" type internal
/configure router "Base" bgp group "iBGP" local-address 10.0.0.2
/configure router "Base" bgp group "iBGP" bfd-liveness true
/configure router "Base" bgp group "iBGP" family ipv4 true
/configure router "Base" bgp group "iBGP" family vpn-ipv4 true
/configure router "Base" bgp group "iBGP" family vpn-ipv6 true
/configure router "Base" bgp group "iBGP" local-as as-number 65510
16.2. NEIGHBORS
/configure router "Base" bgp neighbor "10.0.0.1" admin-state enable
/configure router "Base" bgp neighbor "10.0.0.1" description "to_MASTER"
/configure router "Base" bgp neighbor "10.0.0.1" group "iBGP"
17. COMMUNITIES
/configure policy-options community "internet-vrf" member "target:65510:9999"
/configure policy-options community "subscriber-vrf" member "target:65510:9998"
18 PREFIX-LIST
/configure policy-options prefix-list "default-ipv4" prefix 0.0.0.0/0 type exact
19. EXPORT/IMPORT POLICIES INTER-VPRNs
19.1.1. DIRECT
/configure policy-options policy-statement "export-to-9998" entry 10 from protocol name [direct]
/configure policy-options policy-statement "export-to-9998" entry 10 action action-type accept
/configure policy-options policy-statement "export-to-9998" entry 10 action community add ["internet-vrf"]
19.1.2. STATIC
/configure policy-options policy-statement "export-to-9998" entry 20 from protocol name [static]
/configure policy-options policy-statement "export-to-9998" entry 20 action action-type accept
/configure policy-options policy-statement "export-to-9998" entry 20 action community add ["internet-vrf"]
19.1.3. BGP
/configure policy-options policy-statement "export-to-9998" entry 30 from protocol name [bgp]
/configure policy-options policy-statement "export-to-9998" entry 30 action action-type accept
/configure policy-options policy-statement "export-to-9998" entry 30 action community add ["internet-vrf"]
19.1.4. NAT
/configure policy-options policy-statement "export-to-9998" entry 40 from protocol name [nat]
/configure policy-options policy-statement "export-to-9998" entry 40 action action-type accept
/configure policy-options policy-statement "export-to-9998" entry 40 action community add ["internet-vrf"]
19.2.1. DIRECT
/configure policy-options policy-statement "export-to-9999" entry 10 from protocol name [direct]
/configure policy-options policy-statement "export-to-9999" entry 10 action action-type accept
/configure policy-options policy-statement "export-to-9999" entry 10 action community add ["subscriber-vrf"]
19.2.2. STATIC
/configure policy-options policy-statement "export-to-9999" entry 20 from protocol name [static]
/configure policy-options policy-statement "export-to-9999" entry 20 action action-type accept
/configure policy-options policy-statement "export-to-9999" entry 20 action community add ["subscriber-vrf"]
19.2.3. NAT
/configure policy-options policy-statement "export-to-9999" entry 30 from prefix-list ["default-ipv4"]
/configure policy-options policy-statement "export-to-9999" entry 30 from protocol name [nat]
/configure policy-options policy-statement "export-to-9999" entry 30 action action-type accept
/configure policy-options policy-statement "export-to-9999" entry 30 action community add ["subscriber-vrf"]
19.2.4. SUB MGMT
/configure policy-options policy-statement "export-to-9999" entry 50 from protocol name [sub-mgmt]
/configure policy-options policy-statement "export-to-9999" entry 50 action action-type accept
/configure policy-options policy-statement "export-to-9999" entry 50 action community add ["subscriber-vrf"]
19.2.5. MANAGED
/configure policy-options policy-statement "export-to-9999" entry 60 from protocol name [managed]
/configure policy-options policy-statement "export-to-9999" entry 60 action action-type accept
/configure policy-options policy-statement "export-to-9999" entry 60 action community add ["subscriber-vrf"]
/configure policy-options policy-statement "export-to-9999" default-action action-type reject
19.3. IMPORT FROM 9998
/configure policy-options policy-statement "import-from-9998" entry 10 from community name "subscriber-vrf"
/configure policy-options policy-statement "import-from-9998" entry 10 action action-type accept
19.4. IMPORT FROM 9999
/configure policy-options policy-statement "import-from-9999" entry 10 from community name "internet-vrf"
/configure policy-options policy-statement "import-from-9999" entry 10 action action-type accept
20. INTER-VPRN
/configure service vprn "9998" bgp-ipvpn mpls admin-state enable
/configure service vprn "9998" bgp-ipvpn mpls route-distinguisher "65510:9998"
/configure service vprn "9998" bgp-ipvpn mpls vrf-import policy ["import-from-9999"]
/configure service vprn "9998" bgp-ipvpn mpls vrf-export policy ["export-to-9999"]
/configure service vprn "9998" bgp-ipvpn mpls auto-bind-tunnel resolution any
/configure service vprn "9999" bgp-ipvpn mpls admin-state enable
/configure service vprn "9999" bgp-ipvpn mpls route-distinguisher "65510:9999"
/configure service vprn "9999" bgp-ipvpn mpls vrf-import policy ["import-from-9998"]
/configure service vprn "9999" bgp-ipvpn mpls vrf-export policy ["export-to-9998"]
/configure service vprn "9999" bgp-ipvpn mpls auto-bind-tunnel resolution any
21. RADIUS
21.1. ROUTER MANAGEMENT
/configure router "management"
/configure router "management" radius
/configure router "management" radius server "radius"
/configure router "management" radius server "radius" address 10.99.1.8
/configure router "management" radius server "radius" secret testlab123
/configure router "management" radius server "radius" accept-coa true
21.2. RADIUS POLICY
/configure aaa
/configure aaa radius server-policy "radius_policy"
/configure aaa radius server-policy "radius_policy" servers
/configure aaa radius server-policy "radius_policy" servers retry-count 5
/configure aaa radius server-policy "radius_policy" servers router-instance "management"
/configure aaa radius server-policy "radius_policy" servers source-address 10.99.1.3
/configure aaa radius server-policy "radius_policy" servers server 1
/configure aaa radius server-policy "radius_policy" servers server 1 server-name "radius"
/configure aaa radius server-policy "radius_policy" acct-on-off
21.3. RADIUS ACCOUNTING-POLICY
/configure subscriber-mgmt radius-accounting-policy "accounting"
/configure subscriber-mgmt radius-accounting-policy "accounting" radius-server-policy "radius_policy"
/configure subscriber-mgmt radius-accounting-policy "accounting" session-id-format number
/configure subscriber-mgmt radius-accounting-policy "accounting" queue-instance-accounting
/configure subscriber-mgmt radius-accounting-policy "accounting" queue-instance-accounting admin-state disable
/configure subscriber-mgmt radius-accounting-policy "accounting" queue-instance-accounting interim-update false
/configure subscriber-mgmt radius-accounting-policy "accounting" session-accounting
/configure subscriber-mgmt radius-accounting-policy "accounting" session-accounting admin-state enable
/configure subscriber-mgmt radius-accounting-policy "accounting" session-accounting interim-update true
/configure subscriber-mgmt radius-accounting-policy "accounting" session-accounting host-update true
/configure subscriber-mgmt radius-accounting-policy "accounting" update-interval
/configure subscriber-mgmt radius-accounting-policy "accounting" update-interval interval 720
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute acct-authentic true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute acct-delay-time true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute acct-triggered-reason true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute called-station-id true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute circuit-id true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute delegated-ipv6-prefix true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute framed-ip-address true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute framed-ip-netmask true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute framed-ipv6-prefix true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute framed-ipv6-route true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute framed-route true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute ipv6-address true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute mac-address true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute nas-identifier true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute nat-port-range true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute remote-id true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute sla-profile true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute std-acct-attributes true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute sub-profile true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute subscriber-id true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute tunnel-server-attrs true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute user-name true
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute nas-port-id
/configure subscriber-mgmt radius-accounting-policy "accounting" include-radius-attribute nas-port-type
21.4. RADIUS AUTHENTICATION-POLICY
/configure subscriber-mgmt radius-authentication-policy "autpolicy"
/configure subscriber-mgmt radius-authentication-policy "autpolicy" password testlab123
/configure subscriber-mgmt radius-authentication-policy "autpolicy" pppoe-access-method pap-chap
/configure subscriber-mgmt radius-authentication-policy "autpolicy" radius-server-policy "radius_policy"
/configure subscriber-mgmt radius-authentication-policy "autpolicy" re-authentication true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" fallback
/configure subscriber-mgmt radius-authentication-policy "autpolicy" fallback action
/configure subscriber-mgmt radius-authentication-policy "autpolicy" fallback action user-db "clientes"
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute access-loop-options true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute called-station-id true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute dhcp-options true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute dhcp-vendor-class-id true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute mac-address true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute nas-identifier true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute pppoe-service-name true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute remote-id true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute tunnel-server-attrs true
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute acct-session-id
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute acct-session-id type session
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute calling-station-id
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute calling-station-id type sap-string
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute nas-port-id
/configure subscriber-mgmt radius-authentication-policy "autpolicy" include-radius-attribute nas-port-type
21.5. AUTHENTICATION ORIGIN
/configure subscriber-mgmt authentication-origin
/configure subscriber-mgmt authentication-origin overrides
/configure subscriber-mgmt authentication-origin overrides priority 3
/configure subscriber-mgmt authentication-origin overrides priority 3 source radius
22. QOS
22.1. QOS SAP-INGRESS
/configure qos
/configure qos sap-ingress "10"
/configure qos sap-ingress "10" queue 1
/configure qos sap-ingress "10" queue 11
/configure qos sap-ingress "10" queue 11 multipoint true
/configure qos sap-ingress "10" fc "af"
/configure qos sap-ingress "10" fc "af" queue 1
/configure qos sap-ingress "10" fc "be"
/configure qos sap-ingress "10" fc "be" queue 1
/configure qos sap-ingress "10" fc "ef"
/configure qos sap-ingress "10" fc "ef" queue 1
/configure qos sap-ingress "10" fc "h1"
/configure qos sap-ingress "10" fc "h1" queue 1
/configure qos sap-ingress "10" fc "h2"
/configure qos sap-ingress "10" fc "h2" queue 1
/configure qos sap-ingress "10" fc "l1"
/configure qos sap-ingress "10" fc "l1" queue 1
/configure qos sap-ingress "10" fc "l2"
/configure qos sap-ingress "10" fc "l2" queue 1
/configure qos sap-ingress "10" fc "nc"
/configure qos sap-ingress "10" fc "nc" queue 1
22.2. QOS SAP-EGRESS
/configure qos sap-egress "10"
/configure qos sap-egress "10" queue 1
/configure qos sap-egress "10" fc be
/configure qos sap-egress "10" fc be queue 1
/configure qos sap-egress "10" fc l2
/configure qos sap-egress "10" fc l2 queue 1
/configure qos sap-egress "10" fc af
/configure qos sap-egress "10" fc af queue 1
/configure qos sap-egress "10" fc l1
/configure qos sap-egress "10" fc l1 queue 1
/configure qos sap-egress "10" fc h2
/configure qos sap-egress "10" fc h2 queue 1
/configure qos sap-egress "10" fc ef
/configure qos sap-egress "10" fc ef queue 1
/configure qos sap-egress "10" fc h1
/configure qos sap-egress "10" fc h1 queue 1
/configure qos sap-egress "10" fc nc
/configure qos sap-egress "10" fc nc queue 1
23. ESM
23.1. IPOE POLICY
/configure subscriber-mgmt
/configure subscriber-mgmt ipoe-session-policy "ipoe"
23.2. PPPOE POLICY
/configure subscriber-mgmt ppp-policy "pppoe"
/configure subscriber-mgmt ppp-policy "pppoe" ppp-authentication pref-pap
/configure subscriber-mgmt ppp-policy "pppoe" ppp-initial-delay true
/configure subscriber-mgmt ppp-policy "pppoe" ppp-mtu 1500
/configure subscriber-mgmt ppp-policy "pppoe" reply-on-padt true
/configure subscriber-mgmt ppp-policy "pppoe" keepalive
/configure subscriber-mgmt ppp-policy "pppoe" keepalive interval 10
/configure subscriber-mgmt ppp-policy "pppoe" keepalive hold-up-multiplier 4
23.3. SUB-PROFILE
/configure subscriber-mgmt sub-profile "subprofile"
/configure subscriber-mgmt sub-profile "subprofile" radius-accounting
/configure subscriber-mgmt sub-profile "subprofile" radius-accounting policy ["accounting"]
/configure subscriber-mgmt sub-profile "subprofile" radius-accounting session-optimized-stop true
23.4. SUB-IDENT POLICY
/configure subscriber-mgmt sub-ident-policy "subident"
/configure subscriber-mgmt sub-ident-policy "subident" sla-profile-map
/configure subscriber-mgmt sub-ident-policy "subident" sla-profile-map use-direct-map-as-default true
/configure subscriber-mgmt sub-ident-policy "subident" sub-profile-map
/configure subscriber-mgmt sub-ident-policy "subident" sub-profile-map use-direct-map-as-default true
23.5. SLA PROFILE
/configure subscriber-mgmt sla-profile "100M" egress qos sap-egress policy-name "10"
/configure subscriber-mgmt sla-profile "100M" egress qos sap-egress overrides queue 1 stat-mode v4-v6
/configure subscriber-mgmt sla-profile "100M" egress qos sap-egress overrides queue 1 rate pir 100000
/configure subscriber-mgmt sla-profile "100M" egress qos sap-egress overrides queue 1 rate cir 100000
/configure subscriber-mgmt sla-profile "100M" host-limits overall 10
/configure subscriber-mgmt sla-profile "100M" host-limits ipv4 dhcp 1
/configure subscriber-mgmt sla-profile "100M" host-limits ipv6 pd-ipoe-dhcp 1
/configure subscriber-mgmt sla-profile "100M" host-limits ipv6 wan-ipoe-dhcp 1
/configure subscriber-mgmt sla-profile "100M" ingress ip-filter "10"
/configure subscriber-mgmt sla-profile "100M" ingress qos sap-ingress policy-name "10"
/configure subscriber-mgmt sla-profile "100M" ingress qos sap-ingress overrides queue 1 stat-mode v4-v6
/configure subscriber-mgmt sla-profile "100M" ingress qos sap-ingress overrides queue 1 rate pir 100000
/configure subscriber-mgmt sla-profile "100M" ingress qos sap-ingress overrides queue 1 rate cir 100000
23.6. MSAP POLICY
/configure subscriber-mgmt msap-policy "msap" sub-sla-mgmt subscriber-limit 131071
/configure subscriber-mgmt msap-policy "msap" sub-sla-mgmt sub-ident-policy "subident"
/configure subscriber-mgmt msap-policy "msap" sub-sla-mgmt defaults sla-profile "100M"
/configure subscriber-mgmt msap-policy "msap" sub-sla-mgmt defaults sub-profile "subprofile"
/configure subscriber-mgmt msap-policy "msap" sub-sla-mgmt defaults subscriber-id auto-id
/configure subscriber-mgmt msap-policy "msap" sub-sla-mgmt single-sub-parameters profiled-traffic-only true
/configure subscriber-mgmt msap-policy "msap" ies-vprn-only-sap-parameters anti-spoof next-hop-ip-and-mac-addr
/configure subscriber-mgmt msap-policy "msap" ies-vprn-only-sap-parameters ingress qos queuing-type service
23.7. LOCAL USER DATABASE
/configure subscriber-mgmt local-user-db clientes
/configure subscriber-mgmt local-user-db clientes admin-state enable
/configure subscriber-mgmt local-user-db clientes ipoe match-list [mac]
/configure subscriber-mgmt local-user-db clientes ppp match-list [user-name]
/configure subscriber-mgmt local-user-db "clientes" ipoe match-list [encap-tag-range]
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-ipv6-only" admin-state enable
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-ipv6-only" host-identification encap-tag-range from "50.*"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-ipv6-only" host-identification encap-tag-range to "50.*"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-ipv6-only" ipv6 address-pool "IPv6"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-ipv6-only" ipv6 delegated-prefix-pool "IPv6"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-ipv6-only" ipv6 delegated-prefix-length 64
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-dual-stack" admin-state enable
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-dual-stack" host-identification encap-tag-range from "51.*"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-dual-stack" host-identification encap-tag-range to "51.*"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-dual-stack" ipv4 address pool primary "cgnat"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-dual-stack" ipv6 address-pool "IPv6-dual-stack"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-dual-stack" ipv6 delegated-prefix-pool "IPv6-dual-stack"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-dual-stack" ipv6 delegated-prefix-length 64
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-vip" admin-state enable
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-vip" host-identification encap-tag-range from "52.*"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-vip" host-identification encap-tag-range to "52.*"
/configure subscriber-mgmt local-user-db "clientes" ipoe host "default-vip" ipv4 address pool primary one-to-one
23.8. SHCV POLICY
/configure subscriber-mgmt shcv-policy "host-connectivity-verify"
/configure subscriber-mgmt shcv-policy "host-connectivity-verify" trigger
/configure subscriber-mgmt shcv-policy "host-connectivity-verify" trigger inactivity
/configure subscriber-mgmt shcv-policy "host-connectivity-verify" trigger inactivity admin-state enable
/configure subscriber-mgmt shcv-policy "host-connectivity-verify" trigger inactivity timeout 60
24. NAT
24.1. ISA
/configure isa
/configure isa nat-group 1
/configure isa nat-group 1 admin-state enable
/configure isa nat-group 1 redundancy
/configure isa nat-group 1 redundancy active-mda-limit 1
/configure isa nat-group 1 session-limits
/configure isa nat-group 1 session-limits watermarks
/configure isa nat-group 1 session-limits watermarks low 80
/configure isa nat-group 1 session-limits watermarks high 90
/configure isa nat-group 1 mda 2/1
24.2. VPRN 9999
/configure service vprn "9999"
/configure service vprn "9999" admin-state enable
/configure service vprn "9999" customer "1"
/configure service vprn "9999" autonomous-system 65520
24.3. VPRN 9999 INTERFACE TO LIG
/configure service vprn "9999" interface "to_LIG"
/configure service vprn "9999" interface "to_LIG" admin-state enable
/configure service vprn "9999" interface "to_LIG" ipv4 primary
/configure service vprn "9999" interface "to_LIG" ipv4 primary address 172.20.1.2
/configure service vprn "9999" interface "to_LIG" ipv4 primary prefix-length 30
/configure service vprn "9999" interface "to_LIG" sap 1/1/c3/1:0 admin-state enable
/configure service vprn "9999" interface "to_LIG" ipv6 address 2001:db8:fffe::2 prefix-length 126
24.4. VPRN 9999 INTERFACE TO CARRIER1
/configure service vprn "9999" interface "to_CARRIER1" admin-state enable
/configure service vprn "9999" interface "to_CARRIER1" ipv4 primary address 172.16.1.2
/configure service vprn "9999" interface "to_CARRIER1" ipv4 primary prefix-length 31
/configure service vprn "9999" interface "to_CARRIER1" sap 1/1/c5/1:0 admin-state enable
/configure service vprn "9999" interface "to_CARRIER1" ipv6 address 2001:db8:f1::5 prefix-length 126
24.5. VPRN 9999 INTERFACE TO CARRIER2
/configure service vprn "9999" interface "to_CARRIER2" admin-state enable
/configure service vprn "9999" interface "to_CARRIER2" ipv4 primary address 172.16.2.2
/configure service vprn "9999" interface "to_CARRIER2" ipv4 primary prefix-length 31
/configure service vprn "9999" interface "to_CARRIER2" sap 1/1/c6/1:0 admin-state enable
/configure service vprn "9999" interface "to_CARRIER2" ipv6 address 2001:db8:f2::5 prefix-length 126
24.6. NAT OUTSIDE 64
/configure service vprn "9999" nat outside pool "nat64-pool" admin-state enable
/configure service vprn "9999" nat outside pool "nat64-pool" type large-scale
/configure service vprn "9999" nat outside pool "nat64-pool" nat-group 1
/configure service vprn "9999" nat outside pool "nat64-pool" port-reservation ports 200
/configure service vprn "9999" nat outside pool "nat64-pool" address-range 199.199.199.199 end 199.199.199.199
24.7. NAT POLICY 64
/configure service nat nat-policy "nat64-pol" pool router-instance "9999"
/configure service nat nat-policy "nat64-pol" pool name "nat64-pool"
/configure service nat nat-policy "nat64-pol" alg pptp true
/configure service nat nat-policy "nat64-pol" alg rtsp true
/configure service nat nat-policy "nat64-pol" alg sip true
24.8. NAT INSIDE 64
/configure service vprn "9998" nat inside large-scale nat64 admin-state enable
/configure service vprn "9998" nat inside large-scale nat64 prefix 64:ff9b::/96
/configure service vprn "9998" nat inside large-scale nat64 subscriber-prefix-length 64
/configure service vprn "9998" nat inside large-scale nat64 ipv6-mtu 1500
/configure service vprn "9998" nat inside large-scale nat-policy "nat64-pol" nat64
24.9. NAT FILTER 64
/configure filter ipv6-filter "10" default-action accept
/configure filter ipv6-filter "10" entry 10 match dst-ip address 64:ff9b::
/configure filter ipv6-filter "10" entry 10 match dst-ip mask ffff:ffff:ffff:ffff:ffff:ffff::
/configure filter ipv6-filter "10" entry 10 action nat nat-type nat64
/configure filter ipv6-filter "10" entry 10 action nat nat-type nat64 nat-policy "nat64-pol"
/configure subscriber-mgmt sla-profile "100M" ingress ipv6-filter "10"
25. IMPORT/EXPORT POLICIES
25.1. PREFIX LISTS
/configure policy-options prefix-list "public-nat-v4" prefix 99.99.99.99/32 type exact
/configure policy-options prefix-list "public-nat-v4" prefix 199.199.199.199/32 type exact
/configure policy-options prefix-list "public-nat-v4" prefix 88.88.88.88/29 type exact
/configure policy-options prefix-list "public-v6" prefix 2001:db8:100::/56 type exact
/configure policy-options prefix-list "public-v6" prefix 2001:db8:200::/48 type exact
/configure policy-options prefix-list "public-v6" prefix 2001:db8:cccc::/56 type exact
/configure policy-options prefix-list "public-v6" prefix 2001:db8:dddd::/48 type exact
25.2. IMPORT CARRIER 1
/configure policy-options policy-statement "IMPORT-CARRIER1" entry 10 from protocol name [bgp]
/configure policy-options policy-statement "IMPORT-CARRIER1" entry 10 action action-type accept
/configure policy-options policy-statement "IMPORT-CARRIER1" entry 10 action local-preference 250
/configure policy-options policy-statement "IMPORT-CARRIER1" default-action action-type reject
25.3. IMPORT CARRIER 2
/configure policy-options policy-statement "IMPORT-CARRIER2" entry 10 from protocol name [bgp]
/configure policy-options policy-statement "IMPORT-CARRIER2" entry 10 action action-type accept
/configure policy-options policy-statement "IMPORT-CARRIER2" entry 10 action local-preference 100
/configure policy-options policy-statement "IMPORT-CARRIER2" default-action action-type reject
25.4. EXPORT CARRIER 1 -IF=MASTER
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 5 from prefix-list ["public-nat-v4"]
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 5 from protocol name [nat]
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 5 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 5 action metric set 10
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 10 from prefix-list ["public-nat-v4"]
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 10 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 10 action metric set 10
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 20 from prefix-list ["public-v6"]
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 20 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C1_Master" entry 20 action metric set 10
/configure policy-options policy-statement "public_to_ISP_C1_Master" default-action action-type reject
25.5. EXPORT CARRIER 1 -IF=BACKUP
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 5 from prefix-list ["public-nat-v4"]
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 5 from protocol name [nat]
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 5 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 5 action as-path-prepend as-path 65520
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 5 action as-path-prepend repeat 3
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 5 action metric set 100
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 10 from prefix-list ["public-nat-v4"]
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 10 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 10 action as-path-prepend as-path 65520
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 10 action as-path-prepend repeat 3
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 10 action metric set 100
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 20 from prefix-list ["public-v6"]
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 20 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 20 action as-path-prepend as-path 65520
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 20 action as-path-prepend repeat 3
/configure policy-options policy-statement "public_to_ISP_C1_Backup" entry 20 action metric set 100
/configure policy-options policy-statement "public_to_ISP_C1_Backup" default-action action-type reject
25.6. EXPORT CARRIER 2 -IF=MASTER
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 5 from prefix-list ["public-nat-v4"]
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 5 from protocol name [nat]
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 5 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 5 action as-path-prepend as-path 65520
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 5 action as-path-prepend repeat 2
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 5 action metric set 10
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 10 from prefix-list ["public-nat-v4"]
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 10 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 10 action as-path-prepend as-path 65520
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 10 action as-path-prepend repeat 2
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 10 action metric set 10
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 20 from prefix-list ["public-v6"]
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 20 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 20 action as-path-prepend as-path 65520
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 20 action as-path-prepend repeat 2
/configure policy-options policy-statement "public_to_ISP_C2_Master" entry 20 action metric set 10
/configure policy-options policy-statement "public_to_ISP_C2_Master" default-action action-type reject
25.7. EXPORT CARRIER 2 -IF=BACKUP
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 5 from prefix-list ["public-nat-v4"]
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 5 from protocol name [nat]
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 5 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 5 action as-path-prepend as-path 65520
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 5 action as-path-prepend repeat 4
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 5 action metric set 100
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 10 from prefix-list ["public-nat-v4"]
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 10 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 10 action as-path-prepend as-path 65520
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 10 action as-path-prepend repeat 4
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 10 action metric set 100
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 20 from prefix-list ["public-v6"]
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 20 action action-type accept
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 20 action as-path-prepend as-path 65520
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 20 action as-path-prepend repeat 4
/configure policy-options policy-statement "public_to_ISP_C2_Backup" entry 20 action metric set 100
/configure policy-options policy-statement "public_to_ISP_C2_Backup" default-action action-type reject
26. eBGP
/configure service vprn "9999" bgp admin-state enable
/configure service vprn "9999" bgp rapid-withdrawal true
/configure service vprn "9999" bgp peer-ip-tracking true
/configure service vprn "9999" bgp family ipv4 true
/configure service vprn "9999" bgp family ipv6 true
26.1. GROUPS
/configure service vprn "9999" bgp group "eBGP-CARRIERS" admin-state enable
/configure service vprn "9999" bgp group "eBGP-CARRIERS" type external
/configure service vprn "9999" bgp group "eBGP-CARRIERS" bfd-liveness true
/configure service vprn "9999" bgp group "eBGP-CARRIERS" family ipv4 true
/configure service vprn "9999" bgp group "eBGP-CARRIERS" family ipv6 true
26.2. NEIGHBORS
/configure service vprn "9999" bgp neighbor "172.16.1.3" admin-state enable
/configure service vprn "9999" bgp neighbor "172.16.1.3" description "to_CARRIER1"
/configure service vprn "9999" bgp neighbor "172.16.1.3" group "eBGP-CARRIERS"
/configure service vprn "9999" bgp neighbor "172.16.1.3" peer-as 65501
/configure service vprn "9999" bgp neighbor "172.16.1.3" import policy ["IMPORT-CARRIER1"]
/configure service vprn "9999" bgp neighbor "172.16.1.3" export policy ["public_to_ISP_C1_Backup"]
/configure service vprn "9999" bgp neighbor "172.16.2.3" admin-state enable
/configure service vprn "9999" bgp neighbor "172.16.2.3" description "to_CARRIER2"
/configure service vprn "9999" bgp neighbor "172.16.2.3" group "eBGP-CARRIERS"
/configure service vprn "9999" bgp neighbor "172.16.2.3" peer-as 65502
/configure service vprn "9999" bgp neighbor "172.16.2.3" import policy ["IMPORT-CARRIER2"]
/configure service vprn "9999" bgp neighbor "172.16.2.3" export policy ["public_to_ISP_C2_Backup"]
27. VPRN 9998
/configure service vprn "9998"
/configure service vprn "9998" admin-state enable
/configure service vprn "9998" customer "1"
/configure service vprn "9998" management
/configure service vprn "9998" management allow-ftp true
/configure service vprn "9998" management allow-ssh true
/configure service vprn "9998" management allow-netconf true
/configure service vprn "9998" management allow-grpc true
28. DHCP SERVERS
28.1. DHCP IPV6
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" admin-state enable
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool-selection use-pool-from-client
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool-selection use-link-address scope pool
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" delegated-prefix minimum 56
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" delegated-prefix maximum 64
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" options option dns-server ipv6-address [ 2001:db8:aaab::2 2001:db8:aaaa::2 ]
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:100::/56 preferred-lifetime 43200
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:100::/56 valid-lifetime 86400
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:100::/56 renew-time 21600
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:100::/56 rebind-time 36000
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:100::/56 failover-control-type remote prefix-type wan-host true
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:100::/56 prefix-type pd false
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:200::/48 preferred-lifetime 43200
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:200::/48 valid-lifetime 86400
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:200::/48 renew-time 21600
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:200::/48 rebind-time 36000
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:200::/48 prefix-type wan-host false
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" prefix 2001:db8:200::/48 failover-control-type remote prefix-type pd true
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" failover admin-state enable
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" failover ignore-mclt-on-takeover true
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" failover partner-down-delay 3600
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6" failover peer 10.0.0.1 sync-tag "dhcpv6-only"
28.2. LOOPBACK DHCP
/configure service vprn "9998" interface "loopback"
/configure service vprn "9998" interface "loopback" admin-state enable
/configure service vprn "9998" interface "loopback" loopback true
/configure service vprn "9998" interface "loopback" ipv4
/configure service vprn "9998" interface "loopback" ipv4 local-dhcp-server "suscriptores"
/configure service vprn "9998" interface "loopback" ipv4 primary
/configure service vprn "9998" interface "loopback" ipv4 primary address 7.7.7.7
/configure service vprn "9998" interface "loopback" ipv4 primary prefix-length 32
/configure service vprn "9998" interface "loopback" ipv4 primary prefix-length 32
/configure service vprn "9998" interface "loopback" ipv6 local-dhcp-server "suscriptores_v6"
/configure service vprn "9998" interface "loopback" ipv6 address fd07:47::aaab prefix-length 128
28.3. INTERFACE toDNS
/configure service vprn "9998" interface "toDNS64" admin-state enable
/configure service vprn "9998" interface "toDNS64" ipv4 primary address 192.168.4.1
/configure service vprn "9998" interface "toDNS64" sap 1/1/c4/1:0 admin-state enable
/configure service vprn "9998" interface "toDNS64" ipv4 primary prefix-length 30
/configure service vprn "9998" interface "toDNS64" ipv6 address 2001:db8:aaab::1 prefix-length 126
29. SUBSCRIBER INTERFACE
/configure service vprn "9998" subscriber-interface "services"
/configure service vprn "9998" subscriber-interface "services" admin-state enable
/configure service vprn "9998" subscriber-interface "services" wan-mode mode128
29.1. IPV4
/configure service vprn "9998" subscriber-interface "services" ipv4
/configure service vprn "9998" subscriber-interface "services" ipv4 allow-unmatching-subnets true
/configure service vprn "9998" subscriber-interface "services" ipv4 default-dns [8.8.8.8 8.8.4.4]
/configure service vprn "9998" subscriber-interface "services" ipv4 address 100.80.0.6
/configure service vprn "9998" subscriber-interface "services" ipv4 address 100.80.0.6 prefix-length 29
/configure service vprn "9998" subscriber-interface "services" ipv4 address 100.80.0.6 gateway 100.80.0.1
/configure service vprn "9998" subscriber-interface "services" ipv4 dhcp
/configure service vprn "9998" subscriber-interface "services" ipv4 dhcp gi-address 100.80.0.1
/configure service vprn "9998" subscriber-interface "services" ipv4 address 192.168.5.6 prefix-length 29 gateway 192.168.5.1
29.2. IPV6
/configure service vprn "9998" subscriber-interface "services" ipv6 allow-unmatching-prefixes true
/configure service vprn "9998" subscriber-interface "services" ipv6 delegated-prefix-length variable
/configure service vprn "9998" subscriber-interface "services" ipv6 prefix 2001:db8:100::/56 host-type wan
/configure service vprn "9998" subscriber-interface "services" ipv6 prefix 2001:db8:200::/48 host-type pd
/configure service vprn "9998" subscriber-interface "services" ipv6 prefix 2001:db8:cccc::/56 host-type wan
/configure service vprn "9998" subscriber-interface "services" ipv6 prefix 2001:db8:dddd::/48 host-type pd
/configure service vprn "9998" subscriber-interface "services" ipv6 link-local-address address fe80::7e20:64ff:fe84:8365
30. GROUP-INTERFACES
30.1. HSI RESIDENTIAL
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only"
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" radius-auth-policy "autpolicy"
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ingress-stats true
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" oper-up-while-empty true
30.2. HSI RESIDENTIAL IPV6
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 urpf-check mode strict-no-ecmp
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 dhcp6 pd-managed-route
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 dhcp6 relay admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 dhcp6 relay link-address 2001:db8:100::
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 dhcp6 relay server ["fd07:47::aaab" "fd07:47::aaaa"]
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 dhcp6 relay client-applications dhcp true
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 dhcp6 relay client-applications ppp true
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 dhcp6 proxy-server admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 router-advertisements admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 router-advertisements options other-stateful-configuration true
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 router-advertisements prefix-options autonomous false
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipv6 router-advertisements options managed-configuration true
30.3. HSI RESIDENTIAL IPOE POLICY
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipoe-session
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipoe-session admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipoe-session ipoe-session-policy "ipoe"
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipoe-session user-db "clientes"
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipoe-session session-limit 131071
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" ipoe-session sap-session-limit 131071
30.4. HSI RESIDENTIAL PPPOE POLICY
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" pppoe
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" pppoe admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" pppoe policy "pppoe"
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" pppoe session-limit 131071
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" pppoe sap-session-limit 131071
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" pppoe user-db "clientes"
31. SERVICES FOR dual-stack
31.1. NAT FILTER dual-stack
/configure filter ip-filter "10" default-action accept
/configure filter ip-filter "10" entry 1 match dst-ip address 100.80.0.0
/configure filter ip-filter "10" entry 1 match dst-ip mask 255.255.255.248
/configure filter ip-filter "10" entry 1 action accept
/configure filter ip-filter "10" entry 2 match src-ip address 100.80.0.0
/configure filter ip-filter "10" entry 2 match src-ip mask 255.255.255.248
/configure filter ip-filter "10" entry 2 action nat
31.2. NAT OUTSIDE dual-stack
/configure service vprn "9999" nat
/configure service vprn "9999" nat outside
/configure service vprn "9999" nat outside pool "dtpool"
/configure service vprn "9999" nat outside pool "dtpool" admin-state enable
/configure service vprn "9999" nat outside pool "dtpool" type large-scale
/configure service vprn "9999" nat outside pool "dtpool" nat-group 1
/configure service vprn "9999" nat outside pool "dtpool" mode napt
/configure service vprn "9999" nat outside pool "dtpool" large-scale
/configure service vprn "9999" nat outside pool "dtpool" large-scale subscriber-limit 8
/configure service vprn "9999" nat outside pool "dtpool" large-scale deterministic
/configure service vprn "9999" nat outside pool "dtpool" large-scale deterministic port-reservation 64
/configure service vprn "9999" nat outside pool "dtpool" address-range 99.99.99.99 end 99.99.99.99
31.3. NAT POLICY dual-stack
/configure service
/configure service nat
/configure service nat nat-policy "natpol"
/configure service nat nat-policy "natpol" pool
/configure service nat nat-policy "natpol" pool router-instance "9999"
/configure service nat nat-policy "natpol" pool name "dtpool"
/configure service nat nat-policy "natpol" alg
/configure service nat nat-policy "natpol" alg pptp true
/configure service nat nat-policy "natpol" alg rtsp true
/configure service nat nat-policy "natpol" alg sip true
31.4. NAT INSIDE dual-stack
/configure service vprn "9998" nat
/configure service vprn "9998" nat inside
/configure service vprn "9998" nat inside large-scale
/configure service vprn "9998" nat inside large-scale nat44
/configure service vprn "9998" nat inside large-scale nat44 max-subscriber-limit 8
/configure service vprn "9998" nat inside large-scale nat44 deterministic
/configure service vprn "9998" nat inside large-scale nat44 deterministic prefix-map 100.80.0.0/29 nat-policy "natpol"
/configure service vprn "9998" nat inside large-scale nat44 deterministic prefix-map 100.80.0.0/29 nat-policy "natpol" admin-state enable
/configure service vprn "9998" nat inside large-scale nat44 deterministic prefix-map 100.80.0.0/29 nat-policy "natpol" map 100.80.0.0 to 100.80.0.7
/configure service vprn "9998" nat inside large-scale nat44 deterministic prefix-map 100.80.0.0/29 nat-policy "natpol" map 100.80.0.0 to 100.80.0.7 first-outside-address 99.99.99.99
/configure service vprn "9998" nat inside large-scale nat44 destination-prefix 0.0.0.0/0
31.5. DHCP IPV4 dual-stack
/configure service vprn "9998" dhcp-server
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores"
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" admin-state enable
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool-selection
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool-selection use-gi-address
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool-selection use-pool-from-client
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat"
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" minimum-free
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" minimum-free percent 3
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" options
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" options option dns-server
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" options option dns-server ipv4-address [8.8.8.8 8.8.4.4]
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" options option lease-time
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" options option lease-time duration 315446399
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" subnet 100.80.0.0/29
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" subnet 100.80.0.0/29 options
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" subnet 100.80.0.0/29 options option default-router
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" subnet 100.80.0.0/29 options option default-router ipv4-address [100.80.0.1]
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" subnet 100.80.0.0/29 options option lease-time
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" subnet 100.80.0.0/29 options option lease-time duration 315446399
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" subnet 100.80.0.0/29 address-range 100.80.0.2 end 100.80.0.4 failover-control-type remote
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" subnet 100.80.0.0/29 exclude-addresses 100.80.0.1 end 100.80.0.1
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" failover admin-state enable
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" failover ignore-mclt-on-takeover true
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" failover partner-down-delay 3600
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "cgnat" failover peer 10.0.0.1 sync-tag "dhcpv4-dual-stack"
31.6. DHCP IPV6 dual-stack
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" admin-state enable
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool-selection use-pool-from-client
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool-selection use-link-address scope pool
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" delegated-prefix minimum 56
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" delegated-prefix maximum 64
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" options option dns-server ipv6-address [ 2001:db8:aaab::2 2001:db8:aaaa::2 ]
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:cccc::/56 preferred-lifetime 43200
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:cccc::/56 valid-lifetime 86400
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:cccc::/56 renew-time 21600
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:cccc::/56 rebind-time 36000
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:cccc::/56 failover-control-type remote prefix-type wan-host true
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:cccc::/56 prefix-type pd false
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:dddd::/48 preferred-lifetime 43200
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:dddd::/48 valid-lifetime 86400
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:dddd::/48 renew-time 21600
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:dddd::/48 rebind-time 36000
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:dddd::/48 prefix-type wan-host false
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" prefix 2001:db8:dddd::/48 failover-control-type remote prefix-type pd true
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" failover admin-state enable
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" failover ignore-mclt-on-takeover true
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" failover partner-down-delay 3600
/configure service vprn "9998" dhcp-server dhcpv6 "suscriptores_v6" pool "IPv6-dual-stack" failover peer 10.0.0.1 sync-tag "dhcpv6-dual-stack"
31.7. HSI dual-stack
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack"
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" radius-auth-policy "autpolicy"
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ingress-stats true
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" oper-up-while-empty true
31.8. HSI dual-stack IPV4
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 urpf-check
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 urpf-check mode strict-no-ecmp
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 neighbor-discovery
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 neighbor-discovery populate true
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp server [7.7.7.7]
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp trusted true
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp gi-address 100.80.0.1
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp proxy-server
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp proxy-server admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp proxy-server emulated-server 100.80.0.1
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp lease-populate
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp lease-populate max-leases 131071
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp client-applications
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp client-applications dhcp true
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv4 dhcp client-applications ppp true
31.9. HSI dual-stack IPV6
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 urpf-check mode strict-no-ecmp
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 dhcp6 pd-managed-route
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 dhcp6 relay admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 dhcp6 relay link-address 2001:db8:cccc::
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 dhcp6 relay server ["fd07:47::aaab" "fd07:47::aaaa"]
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 dhcp6 relay client-applications dhcp true
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 dhcp6 relay client-applications ppp true
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 dhcp6 proxy-server admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 router-advertisements admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 router-advertisements options other-stateful-configuration true
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 router-advertisements prefix-options autonomous false
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipv6 router-advertisements options managed-configuration true
31.10. HSI dual-stack IPOE POLICY
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipoe-session
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipoe-session admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipoe-session ipoe-session-policy "ipoe"
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipoe-session user-db "clientes"
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipoe-session session-limit 131071
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" ipoe-session sap-session-limit 131071
31.11. HSI dual-stack PPPOE POLICY
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" pppoe
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" pppoe admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" pppoe policy "pppoe"
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" pppoe session-limit 131071
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" pppoe sap-session-limit 131071
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" pppoe user-db "clientes"
32. SERVICES FOR VIP
32.1. NAT FILTER VIP
/configure filter ip-filter "20" default-action accept
/configure filter ip-filter "20" entry 1 match dst-ip address 192.168.5.0
/configure filter ip-filter "20" entry 1 match dst-ip mask 255.255.255.248
/configure filter ip-filter "20" entry 1 action accept
/configure filter ip-filter "20" entry 2 match src-ip address 192.168.5.0
/configure filter ip-filter "20" entry 2 match src-ip mask 255.255.255.248
/configure filter ip-filter "20" entry 2 action nat
32.2. NAT OUTSIDE VIP
/configure service vprn "9999" nat outside pool "one-to-one"
/configure service vprn "9999" nat outside pool "one-to-one" admin-state enable
/configure service vprn "9999" nat outside pool "one-to-one" type large-scale
/configure service vprn "9999" nat outside pool "one-to-one" nat-group 1
/configure service vprn "9999" nat outside pool "one-to-one" mode one-to-one
/configure service vprn "9999" nat outside pool "one-to-one" applications
/configure service vprn "9999" nat outside pool "one-to-one" applications agnostic true
/configure service vprn "9999" nat outside pool "one-to-one" port-forwarding range-start 0
/configure service vprn "9999" nat outside pool "one-to-one" port-forwarding range-end 0
/configure service vprn "9999" nat outside pool "one-to-one" port-reservation port-blocks 1
/configure service vprn "9999" nat outside pool "one-to-one" large-scale subscriber-limit 1
/configure service vprn "9999" nat outside pool "one-to-one" address-range 88.88.88.88 end 88.88.88.95
32.3. NAT POLICY VIP
/configure service nat nat-policy "natvip" pool
/configure service nat nat-policy "natvip" pool router-instance "9999"
/configure service nat nat-policy "natvip" pool name "one-to-one"
32.4. NAT INSIDE VIP
/configure service vprn "9998" nat inside large-scale nat44 deterministic prefix-map 192.168.5.0/29 nat-policy "natvip" admin-state enable
/configure service vprn "9998" nat inside large-scale nat44 deterministic prefix-map 192.168.5.0/29 nat-policy "natvip" map 192.168.5.0 to 192.168.5.7 first-outside-address 88.88.88.88
32.5. DHCP IPV4 VIP
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one"
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" minimum-free percent 3
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" options option dns-server ipv4-address [8.8.8.8 8.8.4.4]
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" options option lease-time duration 315446399
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" subnet 192.168.5.0/29 options option default-router ipv4-address [192.168.5.1]
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" subnet 192.168.5.0/29 options option lease-time duration 315446399
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" subnet 192.168.5.0/29 address-range 192.168.5.2 end 192.168.5.4 failover-control-type remote
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" subnet 192.168.5.0/29 exclude-addresses 192.168.5.1 end 192.168.5.1
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" failover admin-state enable
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" failover ignore-mclt-on-takeover true
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" failover partner-down-delay 3600
/configure service vprn "9998" dhcp-server dhcpv4 "suscriptores" pool "one-to-one" failover peer 10.0.0.1 sync-tag "dhcpv4-vip"
32.6. HSI VIP
/configure service vprn "9998" subscriber-interface "services" group-interface "vip"
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" radius-auth-policy "autpolicy"
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ingress-stats true
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" oper-up-while-empty true
32.7. HSI VIP IPV4
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 urpf-check
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 urpf-check mode strict-no-ecmp
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 neighbor-discovery
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 neighbor-discovery populate true
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp server [7.7.7.7]
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp trusted true
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp gi-address 192.168.5.1
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp proxy-server
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp proxy-server admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp proxy-server emulated-server 192.168.5.1
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp lease-populate
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp lease-populate max-leases 131071
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp client-applications
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp client-applications dhcp true
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipv4 dhcp client-applications ppp true
32.8. HSI VIP IPOE POLICY
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipoe-session
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipoe-session admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipoe-session ipoe-session-policy "ipoe"
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipoe-session user-db "clientes"
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipoe-session session-limit 131071
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" ipoe-session sap-session-limit 131071
32.9. SLA PROFILE VIP
/configure subscriber-mgmt sla-profile "100M-VIP" egress qos sap-egress policy-name "10"
/configure subscriber-mgmt sla-profile "100M-VIP" egress qos sap-egress overrides queue 1 stat-mode v4-v6
/configure subscriber-mgmt sla-profile "100M-VIP" egress qos sap-egress overrides queue 1 rate pir 100000
/configure subscriber-mgmt sla-profile "100M-VIP" egress qos sap-egress overrides queue 1 rate cir 100000
/configure subscriber-mgmt sla-profile "100M-VIP" host-limits overall 10
/configure subscriber-mgmt sla-profile "100M-VIP" ingress ip-filter "20"
/configure subscriber-mgmt sla-profile "100M-VIP" ingress qos sap-ingress policy-name "10"
/configure subscriber-mgmt sla-profile "100M-VIP" ingress qos sap-ingress overrides queue 1 stat-mode v4-v6
/configure subscriber-mgmt sla-profile "100M-VIP" ingress qos sap-ingress overrides queue 1 rate pir 100000
/configure subscriber-mgmt sla-profile "100M-VIP" ingress qos sap-ingress overrides queue 1 rate cir 100000
33. MULTI-CHASSIS REDUNDANCY
/configure redundancy multi-chassis peer 10.0.0.1 admin-state enable
/configure redundancy multi-chassis peer 10.0.0.1 source-address 10.0.0.2
/configure redundancy multi-chassis peer 10.0.0.1 sync admin-state enable
/configure redundancy multi-chassis peer 10.0.0.1 sync local-dhcp-server true
/configure redundancy multi-chassis peer 10.0.0.1 sync srrp true
/configure redundancy multi-chassis peer 10.0.0.1 sync sub-host-trk true
/configure redundancy multi-chassis peer 10.0.0.1 sync sub-mgmt ipoe true
/configure redundancy multi-chassis peer 10.0.0.1 sync sub-mgmt pppoe true
/configure redundancy multi-chassis peer 10.0.0.1 sync tags port 1/1/c2/1 sync-tag "mcs"
34. REDUNDANT-INTERFACE
34.1. SDP
/configure service sdp 10 admin-state enable
/configure service sdp 10 delivery-type mpls
/configure service sdp 10 ldp true
/configure service sdp 10 keep-alive admin-state enable
/configure service sdp 10 far-end ip-address 10.0.0.1
34.2. REDUNDANT-INTERFACE
/configure service vprn "9998" redundant-interface "network-BNGs" admin-state enable
/configure service vprn "9998" redundant-interface "network-BNGs" spoke-sdp 10:1 admin-state enable
/configure service vprn "9998" redundant-interface "network-BNGs" ipv4 primary address 192.168.12.1
/configure service vprn "9998" redundant-interface "network-BNGs" ipv4 primary prefix-length 31
34.3. RI over GI
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" redundant-interface "network-BNGs"
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" redundant-interface "network-BNGs"
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" redundant-interface "network-BNGs"
35. VRRP
/configure vrrp policy 1
36. SRRP
36.1. SUBSCRIBER INTERFACE TRACK SRRP 1
/configure service vprn "9998" subscriber-interface "services" ipv6 prefix 2001:db8:100::/56 host-type wan track-srrp 1
/configure service vprn "9998" subscriber-interface "services" ipv6 prefix 2001:db8:200::/48 host-type pd track-srrp 1
36.2. SUBSCRIBER INTERFACE TRACK SRRP 2
/configure service vprn "9998" subscriber-interface "services" ipv6 prefix 2001:db8:cccc::/56 host-type wan track-srrp 2
/configure service vprn "9998" subscriber-interface "services" ipv6 prefix 2001:db8:dddd::/48 host-type pd track-srrp 2
/configure service vprn "9998" subscriber-interface "services" ipv4 address 100.80.0.6 track-srrp 2
36.3. SUBSCRIBER INTERFACE TRACK SRRP 3
/configure service vprn "9998" subscriber-interface "services" ipv4 address 192.168.5.6 prefix-length 29 gateway 192.168.5.1 track-srrp 3
36.4. GROUP INTERFACE TRACK SRRP 1
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" dynamic-routes-track-srrp
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" sap 1/1/c2/1:4094.1 admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" srrp 1 admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" srrp 1 policy 1
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" srrp 1 message-path 1/1/c2/1:4094.1
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" srrp 1 priority 50
/configure service vprn "9998" subscriber-interface "services" group-interface "ipv6-only" srrp 1 keep-alive-interval 30
36.5. GROUP-INTERFACE TRACK SRRP 2
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" dynamic-routes-track-srrp
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" sap 1/1/c2/1:4094.2 admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" srrp 2 admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" srrp 2 policy 1
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" srrp 2 message-path 1/1/c2/1:4094.2
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" srrp 2 priority 50
/configure service vprn "9998" subscriber-interface "services" group-interface "dual-stack" srrp 2 keep-alive-interval 30
36.6. GROUP-INTERFACE TRACK SRRP 3
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" dynamic-routes-track-srrp
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" sap 1/1/c2/1:4094.3 admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" srrp 3 admin-state enable
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" srrp 3 policy 1
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" srrp 3 message-path 1/1/c2/1:4094.3
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" srrp 3 priority 50
/configure service vprn "9998" subscriber-interface "services" group-interface "vip" srrp 3 keep-alive-interval 30
37. VPLS
/configure service vpls "capture-sap"
/configure service vpls "capture-sap" admin-state enable
/configure service vpls "capture-sap" service-id 2
/configure service vpls "capture-sap" customer "1"
37.1. CAPTURE S-VLAN 50
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.*
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* radius-auth-policy "autpolicy"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* trigger-packet
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* trigger-packet dhcp true
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* trigger-packet dhcp6 true
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* trigger-packet pppoe true
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* msap-defaults
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* msap-defaults policy "msap"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* msap-defaults service-name "9998"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* msap-defaults group-interface "ipv6-only"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* ipoe-session
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* ipoe-session admin-state enable
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* ipoe-session ipoe-session-policy "ipoe"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* ipoe-session user-db "clientes"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* pppoe
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* pppoe policy "pppoe"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* pppoe user-db "clientes"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:50.* track-srrp 1
37.2. CAPTURE S-VLAN 51
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.*
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* radius-auth-policy "autpolicy"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* trigger-packet
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* trigger-packet dhcp true
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* trigger-packet dhcp6 true
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* trigger-packet pppoe true
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* msap-defaults
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* msap-defaults policy "msap"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* msap-defaults service-name "9998"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* msap-defaults group-interface "dual-stack"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* ipoe-session
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* ipoe-session admin-state enable
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* ipoe-session ipoe-session-policy "ipoe"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* ipoe-session user-db "clientes"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* pppoe
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* pppoe policy "pppoe"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* pppoe user-db "clientes"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:51.* track-srrp 2
37.3. CAPTURE S-VLAN 52
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.*
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* radius-auth-policy "autpolicy"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* trigger-packet
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* trigger-packet dhcp true
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* trigger-packet pppoe true
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* msap-defaults
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* msap-defaults policy "msap"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* msap-defaults service-name "9998"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* msap-defaults group-interface "vip"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* ipoe-session
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* ipoe-session admin-state enable
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* ipoe-session ipoe-session-policy "ipoe"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* ipoe-session user-db "clientes"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* pppoe
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* pppoe policy "pppoe"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* pppoe user-db "clientes"
/configure service vpls "capture-sap" capture-sap 1/1/c2/1:52.* track-srrp 3
38. EVENT HANDLING SYSTEM
38.1. PYTHON SCRIPT
/configure python python-script "srrp_bgp_policy" admin-state enable
/configure python python-script "srrp_bgp_policy" urls ["cf3:\scripts\srrp_bgp_policy.py"]
/configure python python-script "srrp_bgp_policy" version python3
38.2. SCRIPT POLICY
/configure system script-control script-policy "Policy-SRRPSwitch" admin-state enable
/configure system script-control script-policy "Policy-SRRPSwitch" results "cf3:\resultsSRRPSwitch"
/configure system script-control script-policy "Policy-SRRPSwitch" max-completed 5
/configure system script-control script-policy "Policy-SRRPSwitch" python-script name "srrp_bgp_policy"
38.3. EVENT HANDLING
/configure log event-handling handler "Handler-SRRPSwitch" admin-state enable
/configure log event-handling handler "Handler-SRRPSwitch" entry 1 admin-state enable
/configure log event-handling handler "Handler-SRRPSwitch" entry 1 min-delay 1
/configure log event-handling handler "Handler-SRRPSwitch" entry 1 script-policy name "Policy-SRRPSwitch"
#/configure log event-handling handler "Handler-SRRPSwitch" entry 1 script-policy owner "TiMOS CLI"
38.4. LOG FILTER
/configure log filter "10" default-action drop
/configure log filter "10" named-entry "1" description "Match mc_redundancy SRRP events for EHS"
/configure log filter "10" named-entry "1" action forward
/configure log filter "10" named-entry "1" match application eq mc-redundancy
38.5. EVENT TRIGGER
/configure log event-trigger mc-redundancy event tmnxSrrpTrapNewMaster admin-state enable
/configure log event-trigger mc-redundancy event tmnxSrrpTrapNewMaster description "SRRP state change - trigger pySROS policy script"
/configure log event-trigger mc-redundancy event tmnxSrrpTrapNewMaster entry 1 admin-state enable
/configure log event-trigger mc-redundancy event tmnxSrrpTrapNewMaster entry 1 handler "Handler-SRRPSwitch"
/configure log event-trigger mc-redundancy event tmnxSrrpTrapNewMaster entry 1 filter "10"
/configure log event-trigger mc-redundancy event tmnxSrrpBecameBackup admin-state enable
/configure log event-trigger mc-redundancy event tmnxSrrpBecameBackup description "SRRP state change - trigger pySROS policy script"
/configure log event-trigger mc-redundancy event tmnxSrrpBecameBackup entry 1 admin-state enable
/configure log event-trigger mc-redundancy event tmnxSrrpBecameBackup entry 1 handler "Handler-SRRPSwitch"
/configure log event-trigger mc-redundancy event tmnxSrrpBecameBackup entry 1 filter "10"
39. LAWFUL INTERCEPTION
39.1. PERFIL LI
/configure system security aaa local-profiles profile "li"
/configure system security aaa local-profiles profile "li" default-action deny-all
/configure system security aaa local-profiles profile "li" entry 10 match "edit-config li exclusive"
/configure system security aaa local-profiles profile "li" entry 10 action permit
/configure system security aaa local-profiles profile "li" entry 20 match "li"
/configure system security aaa local-profiles profile "li" entry 20 action permit
/configure system security aaa local-profiles profile "li" entry 30 match "show li"
/configure system security aaa local-profiles profile "li" entry 30 action permit
/configure system security aaa local-profiles profile "li" entry 40 match "admin save li"
/configure system security aaa local-profiles profile "li" entry 40 action permit
/configure system security aaa local-profiles profile "li" entry 50 match "quit-config"
/configure system security aaa local-profiles profile "li" entry 50 action permit
/configure system security aaa local-profiles profile "li" entry 60 match "edit-config private"
/configure system security aaa local-profiles profile "li" entry 60 action permit
/configure system security aaa local-profiles profile "li" entry 70 match "configure system security user-params local-user"
/configure system security aaa local-profiles profile "li" entry 70 action permit
/configure system security aaa local-profiles profile "li" entry 80 match "tools perform security"
/configure system security aaa local-profiles profile "li" entry 80 action permit
/configure system security aaa local-profiles profile "li" entry 100 match "commit"
/configure system security aaa local-profiles profile "li" entry 100 action permit
/configure system security aaa local-profiles profile "li" entry 110 match "validate"
/configure system security aaa local-profiles profile "li" entry 110 action permit
/configure system security aaa local-profiles profile "li" entry 120 match "admin save"
/configure system security aaa local-profiles profile "li" entry 120 action permit
/configure system security aaa local-profiles profile "li" entry 130 match "info"
/configure system security aaa local-profiles profile "li" entry 130 action permit
/configure system security aaa local-profiles profile "li" entry 140 match "back"
/configure system security aaa local-profiles profile "li" entry 140 action permit
/configure system security aaa local-profiles profile "li" netconf base-op-authorization action true
/configure system security aaa local-profiles profile "li" netconf base-op-authorization cancel-commit true
/configure system security aaa local-profiles profile "li" netconf base-op-authorization close-session true
/configure system security aaa local-profiles profile "li" netconf base-op-authorization commit true
/configure system security aaa local-profiles profile "li" netconf base-op-authorization edit-config true
/configure system security aaa local-profiles profile "li" netconf base-op-authorization get true
/configure system security aaa local-profiles profile "li" netconf base-op-authorization get-config true
/configure system security aaa local-profiles profile "li" netconf base-op-authorization validate true
39.2. LI ADMINISTRADOR
/configure system security user-params local-user user "liadmin" password "admin123"
/configure system security user-params local-user user "liadmin" restricted-to-home false
/configure system security user-params local-user user "liadmin" access console true
/configure system security user-params local-user user "liadmin" access netconf true
/configure system security user-params local-user user "liadmin" access li true
/configure system security user-params local-user user "liadmin" console member ["li"]
39.3. MIRROR DESTINATION
/configure mirror mirror-dest "li-dest-1"
/configure mirror mirror-dest "li-dest-1" admin-state enable
/configure mirror mirror-dest "li-dest-1" service-id 111111
/configure mirror mirror-dest "li-dest-1" encap layer-3-encap header-type ip-udp-shim
/configure mirror mirror-dest "li-dest-1" encap layer-3-encap direction-bit true
/configure mirror mirror-dest "li-dest-1" encap layer-3-encap router-instance "9999"
/configure mirror mirror-dest "li-dest-1" encap layer-3-encap gateway ip-address source 172.20.1.2
/configure mirror mirror-dest "li-dest-1" encap layer-3-encap gateway ip-address destination 172.20.1.1
/configure mirror mirror-dest "li-dest-1" encap layer-3-encap gateway udp-port source 11111
/configure mirror mirror-dest "li-dest-1" encap layer-3-encap gateway udp-port destination 11111
39.4. CONFIG EN LIADMIN
#This procedure can you make in CLI:
#log log-id "1" netconf-stream "li"
#log log-id "1" source li true
#log log-id "1" destination netconf
#by subscriber
#li-source "li-dest-1" subscriber "ONT-001" ingress true
#li-source "li-dest-1" subscriber "ONT-001" egress true
#li-source "li-dest-1" subscriber "ONT-001" intercept-id 1001
#li-source "li-dest-1" subscriber "ONT-001" session-id 1
#by sap
#li-source "li-dest-1" sap 1/1/c1/1:50.150 ingress true
#li-source "li-dest-1" sap 1/1/c1/1:50.150 egress true
#li-source "li-dest-1" sap 1/1/c1/1:50.150 intercept-id 2001
#li-source "li-dest-1" sap 1/1/c1/1:50.150 session-id 1
#Check in LI: show li li-source "111111"