TP38: OOB-MGMT-Port (ether23 untagged VLAN99) + Branch-Input-Firewall

Template mikrotik_routeros.j2: ether23 auf core+branch als OOB-Port
(pvid=99, admit-only-untagged-and-priority-tagged) + VLAN99 untagged=ether23.
Branch bekommt einen deny-by-default-Input-Filter (8 Regeln, src-Rahmen
spiegelt /ip service available-from), Core eine Regel "OOB->core mgmt".

Neue Skripte: ingest-tp38-oob.py (seedet firewall_filter in beiden
local_config_context_data) und der gc-configplan.py-Job tp38-oob (Deploy).
ConfigPlans angelegt+approved, Deploy steht noch aus.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

nautobot/gc-configplan.py

@@ -353,10 +353,72 @@ def job_tp42_dhcp_domain():
     return [(["crs326-core"], core_set, "TP42-dhcp-domain-bf")]
 
 
+def job_tp38_oob():
+    """TP38 (2026-09-15): OOB-MGMT-Port (ether23 untagged VLAN99) + Branch-Input-Firewall.
+
+    Zwei Geraete, zwei config_sets:
+    * branch: ether23 untaggen, VLAN99 um untagged=ether23 erweitern, 8 Input-Regeln
+      (deny-by-default). Die Regeln werden in der Reihenfolge angelegt, in der das
+      Template sie rendert — established zuerst, drop zuletzt — damit kein LOCKOUT:
+      die laufende Nautobot-SSH-Session (10.40.20.30) matcht auf Regel 1 (established),
+      bevor Regel 8 (drop) greift.
+    * core: ether23 untaggen, VLAN99 untagged=ether23, EINE Regel "OOB->core mgmt" mit
+      place-before vor die Log-Regel (sonst landet sie hinter dem finalen drop und
+      waere wirkungslos + non-compliant).
+
+    KEIN LOCKOUT-RISIKO: ether23 ist auf beiden Geraeten frei (running=false); der
+    VLAN99-Umbau aendert nur `untagged`, nicht `tagged`; der Deploy laeuft von Nautobot
+    (10.40.20.30), das in jeder gesetzten Firewall-Freigabe enthalten bleibt.
+    """
+    bridge_set = (
+        ':do { /interface bridge port set [find interface=ether23] pvid=99 '
+        'frame-types=admit-only-untagged-and-priority-tagged comment="TP38-OOB-MGMT" } '
+        'on-error={ :log info "tp38: ether23 set geworfen" }'
+    )
+    vlan_set = (
+        ':do { /interface bridge vlan set [find vlan-ids=99] untagged=ether23 } '
+        'on-error={ :log info "tp38: vlan99 untagged geworfen" }'
+    )
+
+    branch_fw = "\n".join([
+        'add action=accept chain=input comment="TP38: established" connection-state=established,related,untracked',
+        'add action=drop chain=input comment="TP38: invalid" connection-state=invalid',
+        'add action=accept chain=input comment="TP38: icmp" protocol=icmp',
+        'add action=accept chain=input comment="TP38: mndp" dst-port=5678 protocol=udp',
+        'add action=accept chain=input comment="TP38: mgmt LAN" dst-port=22,80,8291,8728 protocol=tcp src-address=10.40.0.0/16',
+        'add action=accept chain=input comment="TP38: mgmt mesh" dst-port=22,80,8291,8728 protocol=tcp src-address=100.96.0.0/12',
+        'add action=log chain=input comment="TP38: input log-only" log-prefix=TP38-BRANCH-WOULD-DROP',
+        'add action=drop chain=input comment="TP38: input deny-by-default"',
+    ])
+    branch_set = "\n".join([
+        bridge_set,
+        vlan_set,
+        *[f"/ip firewall filter {ln}" for ln in branch_fw.splitlines()],
+        ':log info ("tp38: branch pvid=" . [:tostr [/interface bridge port get [find interface=ether23] pvid]]'
+        ' . " fw=" . [:tostr [:len [/ip firewall filter find where comment~"TP38"]]] . "/8")',
+    ])
+
+    core_set = "\n".join([
+        bridge_set,
+        vlan_set,
+        '/ip firewall filter add action=accept chain=input comment="TP38: OOB->core mgmt" '
+        'dst-port=22,80,8291,8728 in-interface=vlan99 protocol=tcp '
+        'place-before=[find where log-prefix=TP5-INPUT-WOULD-DROP]',
+        ':log info ("tp38: core pvid=" . [:tostr [/interface bridge port get [find interface=ether23] pvid]]'
+        ' . " oob=" . [:tostr [:len [/ip firewall filter find where comment="TP38: OOB->core mgmt"]]])',
+    ])
+
+    return [
+        (["crs326-branch"], branch_set, "TP38-oob-branch"),
+        (["crs326-core"], core_set, "TP38-oob-core"),
+    ]
+
+
 JOBS = {
     "drift-cleanup": job_drift_cleanup,
     "mgmt-acl": job_mgmt_acl,
     "tp42-dhcp-domain": job_tp42_dhcp_domain,
+    "tp38-oob": job_tp38_oob,
 }