<div dir="ltr"><div class="gmail_default" style="font-size:small">Starting a design doc here:</div><div class="gmail_default" style="font-size:small"><a href="https://docs.google.com/document/d/1biSFdtwIUAGP9dLn9y3FQzvEm16JtQ1ouMq8rJKQlX4/edit#heading=h.96q79po3sbas">https://docs.google.com/document/d/1biSFdtwIUAGP9dLn9y3FQzvEm16JtQ1ouMq8rJKQlX4/edit#heading=h.96q79po3sbas</a><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">This has been seeded with material from various emails but will be flushed out from there. Please feel free to add comments or suggest content that we should include.</div><div class="gmail_default" style="font-size:small">Let me know if you need access and don't already have it (most should).</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">-Doug-</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Feb 20, 2023 at 10:01 PM Bart Kus <<a href="mailto:me@bartk.us">me@bartk.us</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I think I figured out mgmt VRF routing. It's a little more complicated <br>
than our existing routing. Here's the template I came up with tonight:<br>
<br>
# Portal actions:<br>
# Make sure a 10.44.#.0/24 is allocated for the site involved.<br>
# Make sure a 10.44.32.#/30 is allocated for the PtP involved.<br>
# Make sure a 10.44.48.#/32 is allocated for the router involved.<br>
<br>
# SnoDEM.Haystack example:<br>
/interface vlan<br>
add interface=ether1 name=ether1.mgmt vlan-id=1044<br>
add interface=wlan1 name=wlan1.mgmt vlan-id=1044<br>
/interface bridge<br>
add name=loopback0.mgmt<br>
/ip route vrf<br>
add interfaces=loopback0.mgmt,ether1.mgmt,wlan1.mgmt routing-mark=mgmt<br>
/ip address<br>
add address=<a href="http://10.44.48.0/32" rel="noreferrer" target="_blank">10.44.48.0/32</a> interface=loopback0.mgmt<br>
add address=<a href="http://10.44.1.10/24" rel="noreferrer" target="_blank">10.44.1.10/24</a> interface=ether1.mgmt<br>
add address=<a href="http://10.44.32.1/30" rel="noreferrer" target="_blank">10.44.32.1/30</a> interface=wlan1.mgmt<br>
/routing filter<br>
add action=accept chain=mgmt prefix=<a href="http://10.44.0.0/16" rel="noreferrer" target="_blank">10.44.0.0/16</a> prefix-length=16-32<br>
add action=accept chain=mgmt prefix=<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
add action=reject chain=mgmt<br>
/routing ospf instance<br>
# Use the loopback0.mgmt IP for router-id.<br>
add in-filter=mgmt name=mgmt out-filter=mgmt <br>
redistribute-connected=as-type-1 router-id=10.44.48.0 routing-table=mgmt<br>
/routing ospf area<br>
add instance=mgmt name=mgmt<br>
/routing ospf network<br>
add area=mgmt network=<a href="http://10.44.48.0/32" rel="noreferrer" target="_blank">10.44.48.0/32</a> # Is this a RouterOS bug? Should <br>
not need to be configured.<br>
add area=mgmt network=<a href="http://10.44.1.0/24" rel="noreferrer" target="_blank">10.44.1.0/24</a><br>
add area=mgmt network=<a href="http://10.44.32.0/30" rel="noreferrer" target="_blank">10.44.32.0/30</a><br>
# mgmt VRF OSPF interfaces will be added dynamically, no need to configure.<br>
<br>
# Haystack.SnoDEM example:<br>
/interface vlan<br>
add interface=ether1 name=ether1.mgmt vlan-id=1044<br>
add interface=wlan1 name=wlan1.mgmt vlan-id=1044<br>
/interface bridge<br>
add name=loopback0.mgmt<br>
/ip route vrf<br>
add interfaces=loopback0.mgmt,ether1.mgmt,wlan1.mgmt routing-mark=mgmt<br>
/ip address<br>
add address=<a href="http://10.44.32.2/30" rel="noreferrer" target="_blank">10.44.32.2/30</a> interface=wlan1.mgmt<br>
add address=<a href="http://10.44.0.11/24" rel="noreferrer" target="_blank">10.44.0.11/24</a> interface=ether1.mgmt<br>
add address=10.44.48.1 interface=loopback0.mgmt<br>
/routing filter<br>
add action=accept chain=mgmt prefix=<a href="http://10.44.0.0/16" rel="noreferrer" target="_blank">10.44.0.0/16</a> prefix-length=16-32<br>
add action=accept chain=mgmt prefix=<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
add action=reject chain=mgmt<br>
/routing ospf instance<br>
add in-filter=mgmt name=mgmt out-filter=mgmt <br>
redistribute-connected=as-type-1 router-id=10.44.48.1 routing-table=mgmt<br>
/routing ospf area<br>
add instance=mgmt name=mgmt<br>
/routing ospf network<br>
add area=mgmt network=<a href="http://10.44.48.1/32" rel="noreferrer" target="_blank">10.44.48.1/32</a> # Is this a RouterOS bug? Should <br>
not need to be configured.<br>
add area=mgmt network=<a href="http://10.44.32.0/30" rel="noreferrer" target="_blank">10.44.32.0/30</a><br>
add area=mgmt network=<a href="http://10.44.0.0/24" rel="noreferrer" target="_blank">10.44.0.0/24</a><br>
# mgmt VRF OSPF interfaces will be added dynamically, no need to configure.<br>
<br>
# Invariants on PtPs, can be configured blindly:<br>
/interface vlan<br>
add interface=ether1 name=ether1.mgmt vlan-id=1044<br>
add interface=wlan1 name=wlan1.mgmt vlan-id=1044<br>
/interface bridge<br>
add name=loopback0.mgmt<br>
/ip route vrf<br>
add interfaces=loopback0.mgmt,ether1.mgmt,wlan1.mgmt routing-mark=mgmt<br>
/routing filter<br>
add action=accept chain=mgmt prefix=<a href="http://10.44.0.0/16" rel="noreferrer" target="_blank">10.44.0.0/16</a> prefix-length=16-32<br>
add action=accept chain=mgmt prefix=<a href="http://0.0.0.0/0" rel="noreferrer" target="_blank">0.0.0.0/0</a><br>
add action=reject chain=mgmt<br>
<br>
I left enough address space between <a href="http://10.44.0.0/24" rel="noreferrer" target="_blank">10.44.0.0/24</a> -> <a href="http://10.44.31.0/24" rel="noreferrer" target="_blank">10.44.31.0/24</a> for 32 <br>
sites with contiguous allocation. I'll be perma-routing my home to this <br>
network, so I've allocated <a href="http://10.44.64.0/24" rel="noreferrer" target="_blank">10.44.64.0/24</a> for that. Any other admins can <br>
allocate above 64 if they want to have a local allocation in the mgmt <br>
VRF. We lose OSPF passwords with the dynamic interfaces. Not sure how <br>
much of a hole that opens up. Easily retrofitted if it becomes a <br>
problem though.<br>
<br>
This syntax is for RouterOS v6, v7 will be slightly different.<br>
<br>
Any thoughts on the potential RouterOS bug, or in general about this <br>
design before we stamp it out everywhere?<br>
<br>
--Bart<br>
<br>
_______________________________________________<br>
SecOps mailing list<br>
<a href="mailto:SecOps@hamwan.org" target="_blank">SecOps@hamwan.org</a><br>
<a href="http://mail01.fmt.hamwan.net/mailman/listinfo/secops" rel="noreferrer" target="_blank">http://mail01.fmt.hamwan.net/mailman/listinfo/secops</a><br>
</blockquote></div>