howto/Edgeos-Config-Example-number-2.md
... ...
@@ -1,8 +1,6 @@
1
-# EdgeRouterPro-8 config example with v1.9.0
2
-
3
-After a lot of searching and trying I [Phil/ALS7] finnaly got a working config
4
-Also thanx to drathir for his patience and support
1
+## EdgeRouterPro-8 DN42 config example with v1.9.0
5 2
3
+After a lot of searching and trying I [Phil/ALS7] finnaly got a working config
6 4
7 5
##Features
8 6
... ...
@@ -13,141 +11,46 @@ Also thanx to drathir for his patience and support
13 11
14 12
--> still work in Progress
15 13
16
-* Basic EdgeOS knowledge is required
17
-
18
-1) you need to create all required fields in the registry --> look at howto/Getting startet page
19
-
20
-2) get a peer --> ask nice @irc
21
-
22
-3) You need following data from the peer
23
-
24
---tunnel options, secret key
25
---ASN from the peer
26
---ip's
27
-
28
-...
14
+1) you need to create all required fields in the registry --> look at [[Getting started]] page.
29 15
30 16
The data i used are the following:
31 17
32
-Own ASN: AS111111
33
-Own IPv4: 172.AA.AA.64/27
34
-Own IPv6: fdBB:BBBB:CCCC::/48
18
+Own ASN: AS4242422684
19
+Own IPv4: 172.20.4.64/27
20
+Own IPv6: fd33:ac1d:d1ce::/48
35 21
36
-Peer OpenVPN Remote Address: X.X.X.X
37
-Peer OpenVPN Remote Host: X.X.X.Y
38
-Peer OpenVPN IP for you: fdAA::BBB/64
39
-Peer OpenVPN IP: fdAA::CC
40
-Peer OpenVPN Port: 1194
41
-Peer OpenVPN encryption: aes256
42
-Peer ASN: AS222222
43
-Peer BGP Neighbour IPv4: Z.Z.Z.Z
44
-Peer BGP Neighbour IPv6: fdAA::CC
22
+2) get a peer --> ask nice @ [[IRC]]
45 23
24
+3) You need following data
46 25
47
-### Copy OpenVPN key to the ErPro
48
-
49
-copy vpn key to /config/auth/giveITaName
50
-
51
- sudo su
52
- cd /config
53
- mkdir auth
54
- cd auth
55
- cat > giveITaName
26
+--tunnel options, secret key
27
+--ASN from the peer (in this example i use remote-as XXXXX)
28
+--ip's
56 29
57
-now paste the key in the terminal window, hit return once and kill cat with CTRL+C
58
-last thing to do is type exit
30
+...
59 31
60
-### Create IPv4 OpenVPN Interface
61 32
62
-Set up Interface vtunX -- i used vtun0
33
+start a ssh session to your router
63 34
64
- configure
65
- set interface openssh vtun0
66
- set interfaces openvpn vtun0 mode site-to-site
67
- set interfaces openvpn vtun0 local-port 1194
68
- set interfaces openvpn vtun0 remote-port 1194
69
- set interfaces openvpn vtun0 local-address 172.AA.AA.64
70
- set interfaces openvpn vtun0 remote-address X.X.X.X
71
- set interfaces openvpn vtun0 remote-host X.X.X.Y
72
- set interfaces openvpn vtun0 shared-secret-key-file /config/auth/giveITaName
73
- set interfaces openvpn vtun0 encryption aes256
35
+copy vpn key to /config/auth/giveITaName -- Create folder if needed
74 36
75
- set interfaces openvpn vtun0 openvpn-option "--comp-lzo" //if your peer support compression
76
-
77
- commit
78
- save
79
- exit
37
+configure
38
+set interface openssh vtun0
39
+set interfaces openvpn vtun0 mode site-to-site
40
+set interfaces openvpn vtun0 local-port 1194 //you get the port from your peer
41
+set interfaces openvpn vtun0 remote-port 1194 //you get the port from your peer
42
+set interfaces openvpn vtun0 local-address 172.20.4.64 //your sife dn42 ip address
43
+set interfaces openvpn vtun0 remote-address X.X.X.X //dn42 link address from your peer
44
+set interfaces openvpn vtun0 remote-host X.X.X.Y //clearnet ip address from your peer
45
+set interfaces openvpn vtun0 shared-secret-key-file /config/auth/giveITaName // your keyfile
46
+set interfaces openvpn vtun0 openvpn-option "--comp-lzo" //if your peer support compression
47
+commit
48
+save
80 49
81 50
Now the ipv4 tunnel should be up&running
82 51
83
-Check it with:
84
-
85
- show interfaces openvpn
86
- show interfaces openvpn detail
87
- show openvpn status site-to-site
88
-
89
-### Create IPv4 BGP Session
90
-
91
-#### Open Firewall
92
-
93
-* You need to open the firewall to local for the tunnel Interface on port 179/tcp
94
-
95
-#### Configure the BGP Neighbor
96
-
97
-* You must not use AS before the as numbers !!
98
-
99
-With this step you create the basic bgp session
100
-
101
- configure
102
- set protocols bgp 111111 neighbor Z.Z.Z.Z remote-as 222222
103
- set protocols bgp 111111 neighbor Z.Z.Z.Z soft-reconfiguration inbound
104
- set protocols bgp 111111 neighbor update-source 172.AA.AA.64
105
- commit
106
- save
107
-
108
-When commit this configuration you should be able to see a BGP neighbor session start and come up. You can check this with:
109
-
110
- show ip bgp summary
111
-
112
-#### Set route to blackhole
113
-
114
-so bgp can announce the route
115
-
116
- set protocols static route 172.AA.AA.64/27 blackhole
117
- commit
118
- save
119
-
120
-#### Announce prefix to BGP
121
-
122
- set protocols bgp 111111 network 172.A.A.64/27
123
- commit
124
- save
125
- exit
126
-
127
-You should now be able to see networks being advertised via
128
-
129
- show ip bgp neighbors Z.Z.Z.Z advertised-routes
130
-
131
-### Define Nameservers
132
-
133
-Now ping to 172.23.0.53 ... thats the nameserver we are using
134
-If everything is allright it should work
135
-
136
-#### NS Config
137 52
138
-Enter the configure mode
139 53
140
- configure
141
- set service dns forwarding name-server 8.8.8.8
142
- set service dns forwarding name-server 8.8.4.4
143
- set service dns forwarding options rebind-domain-ok=/dn42/
144
- set service dns forwarding options server=/23.172.in-addr.arpa/172.23.0.53
145
- set service dns forwarding options server=/22.172.in-addr.arpa/172.23.0.53
146
- set service dns forwarding options server=/dn42/172.23.0.53
147
- commit
148
- save
149
- exit
150 54
151
-Now try to access any .dn42 tld
152 55
153 56