История страницы

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group service DHCP_SERVER
  port-range 67
exit
object-group service DHCP_CLIENT
  port-range 68
exit

security zone SYNC
exit
security zone LAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
   vrrp ip address 198.51.100.1/24
   vrrp group 1
   vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp  authentication algorithm md5
    enable
  vrrpexit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 192.0.2.254/24
   vrrp id 2
  vrrp  ip address 192.0.2.1/24
  vrrp  group 1
    enable
  vrrpexit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 192.0.2.253/24
   vrrp id 2
  vrrp  ip address 192.0.2.1/24
  vrrp  group 1
    enable
  vrrpexit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol udp
    match source-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_SERVER
    enable
  exit
exit

ip dhcp-server
ip dhcp-server pool TRUSTED
  network 192.0.2.0/24
  address-range 192.0.2.10-192.0.2.100
  default-router 192.0.2.1
exit

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

object-group service DHCP_SERVER
  port-range 67
exit
object-group service DHCP_CLIENT
  port-range 68
exit

ip vrf LAN_ONE
exit
ip vrf LAN_TWO
exit

security zone SYNC
exit
security zone LAN_ONE
  ip vrf forwarding LAN_ONE
exit
security zone LAN_TWO
  ip vrf forwarding LAN_TWO
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp  ip address 198.51.100.1/24
   vrrp group 1
  vrrp  authentication key ascii-text encrypted 8CB5107EA7005AFF88B11079B51D
  vrrp  authentication algorithm md5
    enable
  vrrpexit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
exit
interface gigabitethernet 1/0/2.2
  ip vrf forwarding LAN_ONE
  security-zone LAN_ONE
  ip address 192.0.2.254/24
  vrrp id 4
  vrrp  ip address 192.0.2.1/24
   vrrp priority 120
  vrrp  group 2
  vrrp  enable
  exit
exit
interface gigabitethernet 1/0/2.3
  ip vrf forwarding LAN_TWO
  security-zone LAN_TWO
  ip address 128.66.0.254/24
  vrrp id 5
   vrrp ip address 128.66.0.1/24
   vrrp priority 110
  vrrp  group 3
    vrrpenable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
exit
interface gigabitethernet 2/0/2.2
  ip vrf forwarding LAN_ONE
  security-zone LAN_ONE
  ip address 192.0.2.253/24
  vrrp id 4
   vrrp ip address 192.0.2.1/24
  vrrp  priority 110
   vrrp group 2
    vrrpenable
  exit
exit
interface gigabitethernet 2/0/2.3
  ip vrf forwarding LAN_TWO
  security-zone LAN_TWO
  ip address 128.66.0.253/24
  vrrp id 5
  vrrp  ip address 128.66.0.1/24
   vrrp priority 120
  vrrp  group 3
    enable
  vrrpexit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN_ONE self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol udp
    match source-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_SERVER
    enable
  exit
exit
security zone-pair LAN_TWO self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol udp
    match source-port object-group DHCP_CLIENT
    match destination-port object-group DHCP_SERVER
    enable
  exit
exit

ip dhcp-server vrf LAN_ONE
ip dhcp-server pool LAN_ONE vrf LAN_ONE
  network 192.0.2.0/24
  address-range 192.0.2.10-192.0.2.253
  default-router 192.0.2.1
exit
ip dhcp-server vrf LAN_TWO
ip dhcp-server pool LAN_TWO vrf LAN_TWO
  network 128.66.0.0/24
  address-range 128.66.0.10-128.66.0.253
  default-router 128.66.0.1
exit

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone MGMT
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp  ip address 198.51.100.1/24
  vrrp  group 1
  vrrp  authentication key ascii-text encrypted 88B11079B51D
  vrrp  authentication algorithm md5
    enable
  vrrpexit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone MGMT
  ip address 192.0.2.254/24
  vrrp id 2
  vrrp  ip address 192.0.2.1/24
   vrrp group 1
  vrrp  enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone MGMT
  ip address 192.0.2.253/24
  vrrp id 2
   vrrp ip address 192.0.2.1/24
  vrrp  group 1
   vrrp enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair MGMT self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp  ip address 198.51.100.1/24
   vrrp group 1
   vrrp authentication key ascii-text encrypted 88B11079B51D
  vrrp  authentication algorithm md5
    enable
  vrrpexit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp id 3
  vrrp  ip address 203.0.113.2/30
  vrrp  group 1
    enable
  vrrpexit
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/30
  vrrp id 2
   vrrp ip address 192.0.2.1/24
  vrrp  group 1
   vrrp enable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp id 3
   vrrp ip address 203.0.113.2/30
   vrrp group 1
    vrrpenable
  exit
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.1/30
  vrrp id 2
  vrrp  ip address 192.0.2.1/24
   vrrp group 1
    enable
  vrrpexit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair LAN WAN
  rule 1
    action permit
    enable
  exit
exit

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp  ip address 198.51.100.1/24
   vrrp group 1
  vrrp  authentication key ascii-text encrypted 88B11079B51D
  vrrp  authentication algorithm md5
    enable
  vrrpexit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone WAN
  ip address 128.66.0.6/30
  vrrp id 3
   vrrp ip address 203.0.113.2/30
  vrrp  group 1
    vrrpenable
  exit
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/30
  vrrp id 2
  vrrp  ip address 192.0.2.1/24
   vrrp group 1
    vrrpenable
  exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone WAN
  ip address 128.66.0.5/30
  vrrp id 3
  vrrp  ip address 203.0.113.2/30
  vrrp  group 1
    enable
  vrrpexit
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.1/30
  vrrp id 2
  vrrp  ip address 192.0.2.1/24
   vrrp group 1
  vrrp  enable
  exit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
  vrrp  ip address 198.51.100.1/24
   vrrp group 1
  vrrp  authentication key ascii-text encrypted 88B11079B51D
   vrrp authentication algorithm md5
    vrrpenable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp id 2
   vrrp ip address 192.0.2.1/24
   vrrp group 1
    enable
  vrrpexit
exit
interface gigabitethernet 1/0/3
  security-zone WAN
  ip address 128.66.0.2/30
  vrrp id 3
   vrrp ip address 203.0.113.1/30
   vrrp group 1
    enable
 vrrp exit
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp id 2
   vrrp ip address 192.0.2.1/24
   vrrp group 1
    enable
 vrrp exit
exit
interface gigabitethernet 2/0/3
  security-zone WAN
  ip address 128.66.0.1/30
  vrrp id 3
  vrrp  ip address 203.0.113.1/30
  vrrp  group 1
    enable
  vrrpexit
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:c0:00
  exit
  unit 2
    mac-address a2:00:00:10:d0:00
  exit
  enable
exit

hostname ESR-1 unit 1
hostname ESR-2 unit 2

security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit

bridge 1
  vlan 1
  security-zone SYNC
  ip address 198.51.100.254/24 unit 1
  ip address 198.51.100.253/24 unit 2
  vrrp id 1
   vrrp ip address 198.51.100.1/24
   vrrp group 1
   vrrp authentication key ascii-text encrypted 88B11079B51D
   vrrp authentication algorithm md5
   vrrp enable
  exit
  enable
exit

interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2
  security-zone LAN
  ip address 192.0.2.254/24
  vrrp id 2
   vrrp ip address 192.0.2.1/24
   vrrp group 1
    enable
  vrrpexit
exit

interface gigabitethernet 1/0/3
  security-zone WAN
  ip address 203.0.113.1/30
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2
  security-zone LAN
  ip address 192.0.2.253/24
  vrrp id 2
   vrrp ip address 192.0.2.1/24
   vrrp group 1
    enable
  vrrpexit
exit

interface gigabitethernet 2/0/3
  security-zone WAN
  ip address 203.0.113.5/30
exit

security zone-pair SYNC self
  rule 1
    action permit
    match protocol icmp
    enable
  exit
  rule 2
    action permit
    match protocol vrrp
    enable
  exit
  rule 3
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
exit

cluster
  cluster-interface bridge 1
  unit 1
    mac-address a2:00:00:10:a0:00
  exit
  unit 2
    mac-address a2:00:00:10:b0:00
  exit
  enable
exit
 
hostname HUB-1 unit 1
hostname HUB-2 unit 2
 
security zone SYNC
exit
security zone LAN
exit
security zone WAN
exit
 
ip access-list extended LOCAL_1
  rule 1
    action permit
    match source-address 198.51.100.2 255.255.255.255
    enable
  exit
exit
ip access-list extended LOCAL_2
  rule 1
    action permit
    match source-address 198.51.100.6 255.255.255.255
    enable
  exit
exit
 
route-map PBR_LOCAL
  rule 1
    match ip access-group LOCAL_1
    action set ip next-hop verify-availability 198.51.100.1 1
  exit
  rule 2
    match ip access-group LOCAL_2
    action set ip next-hop verify-availability 198.51.100.5 1
  exit
exit
route-map DMVPN_BGP_OUT_CLOUD_TWO
  rule 1
    match ip address 0.0.0.0/0
    action set metric bgp 2000
  exit
exit
route-map DMVPN_BGP_OUT_CLOUD_ONE
  rule 1
    match ip address 0.0.0.0/0
    action set metric bgp 1000
  exit
exit
 
ip local policy route-map PBR_LOCAL
  
bridge 1
  vlan 1
  security-zone SYNC
  ip address 192.0.2.5/29 unit 1
  ip address 192.0.2.6/29 unit 2 
  vrrp id 1
   vrrp ip address 192.0.2.1/29
  vrrp  group 1
    enable
  vrrpexit
  enable
exit
  
interface gigabitethernet 1/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 1/0/2.100
  security-zone WAN
  ip address 192.0.2.9/29
  vrrp id 2
   vrrp ip address 198.51.100.2/30
  vrrp  group 1
  vrrp  enable
  exit
  wan load-balance nexthop 198.51.100.1
  wan load-balance enable
exit
interface gigabitethernet 1/0/2.200
  security-zone WAN
  ip address 192.0.2.17/29
  vrrp id 3
   vrrp ip address 198.51.100.6/30
   vrrp group 1
    vrrpenable
  exit 
  wan load-balance nexthop 198.51.100.5
  wan load-balance enable
exit
interface gigabitethernet 1/0/3
  security-zone LAN
  ip address 128.66.0.2/24
  vrrp id 4
   vrrp ip address 128.66.0.1/24
  vrrp  group 1
  vrrp  enable
  exit 
exit
interface gigabitethernet 2/0/1
  mode switchport
  spanning-tree disable
exit
interface gigabitethernet 2/0/2.100
  security-zone WAN
  ip address 192.0.2.10/29
  vrrp id 2
   vrrp ip address 198.51.100.2/30
   vrrp group 1
    vrrpenable
  exit
  wan load-balance nexthop 198.51.100.1
  wan load-balance enable
exit
interface gigabitethernet 2/0/2.200
  security-zone WAN
  ip address 192.0.2.18/29
  vrrp id 3
   vrrp ip address 198.51.100.6/30
   vrrp group 1
    vrrpenable
  exit 
  wan load-balance nexthop 198.51.100.5
  wan load-balance enable
exit
interface gigabitethernet 2/0/3
  security-zone LAN
  ip address 128.66.0.3/24
  vrrp id 4
   vrrp ip address 128.66.0.1/24
   vrrp group 1
    enable
  exit vrrp
exit
  
security zone-pair SYNC self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
  rule 3
    action permit
    match protocol icmp
    enable
  exit
exit
security zone-pair LAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
security zone-pair WAN self
  rule 1
    action permit
    match protocol vrrp
    enable
  exit
  rule 2
    action permit
    match protocol ah
    enable
  exit
exit
 
ip route 0.0.0.0/0 wan load-balance rule 1
 
wan load-balance rule 1
  outbound interface gigabitethernet 1/0/2.100
  outbound interface gigabitethernet 1/0/2.200
  outbound interface gigabitethernet 2/0/2.200
  outbound interface gigabitethernet 2/0/2.100
  enable
exit