Christoph Emsenhuber
f482aafc84
crs326-core ist jetzt der produktive L3-Router (ersetzt ap1, das plattgemacht + getrennt wurde). Nach dem Cutover fehlten DHCP, WAN, WG-Hub und DNS-Upstream -> aus dem letzten ap1-Backup (ap1-pre-core-cutover-20260806-073616) wiederhergestellt. - DHCP: 7 Server (dhcp-v10..v99) + 8 Networks + 54 Leases (routeros/tp21-core-dhcp-from-ap1.rsc; VLAN1-Legacy + omada-inform weg) - WAN: dhcp-client vlan100 -> Liwest 90.146.33.177, NAT-Masquerade (nur WAN-Variante; disabled bridge/ether1-Regeln bewusst nicht), Blackhole-Selbst-Default-Route entfernt - WG-Hub (TP10): Interface + fm/dw-Peers + Routen; Privkey aus gitignored ap1-wg-hub.privkey -> Hub-Pubkey unveraendert, beide Spokes handshaken (routeros/tp21-core-wan-wg-restore.rsc, Privkey redacted) - DNS: allow-remote-requests=yes + plain 1.1.1.1 (core hat certs=0 -> DoH-Cloudflare-Gateway ist TODO); entsperrte auch FM (Hub-DNS) - Identity ap1 -> crs326-core; routers.yaml auf Zielschema core .99.1 / branch .99.2 / ap1 .99.11 / ap2 .99.12 - disabled/invalid-Fallen bereinigt: WG-Forward-Regeln mit stale *1D Interface-ID -> wg-hub; tote gateway=""-WG-Routen entfernt Doku: teilprojekte.md TP21.1 + CLAUDE.md HW-Tabelle nachgezogen. Offene TODOs: DoH-Restore, Nautobot-Write-back, branch-88er-Check, core ether4, ap1/ap2-Reprovisionierung (WLAN-Rebuild). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
72 lines
3.4 KiB
Plaintext
72 lines
3.4 KiB
Plaintext
# TP21.1 — crs326-branch Bootstrap (Stand 2026-08-08, Rev 4)
|
|
#
|
|
# Hintergrund:
|
|
# - WinBox-MAC-Scan zeigt 0.0.0.0, solange das Gerät auf dem Discovery-VLAN keine IP hat.
|
|
# - Sichere Bring-up-Reihenfolge: Ports → VLAN-Tabelle → VLAN-Interfaces → IPs →
|
|
# vlan-filtering → Werkseinstellungen bereinigen.
|
|
# - bridge MUSS in jeder Bridge-VLAN-Zeile tagged sein, sonst sieht die CPU das VLAN nicht.
|
|
# - NAS-Ports (ether2/8) sind tagged VLAN20 (NAS spricht selbst tagged).
|
|
#
|
|
# Vor dem Import: ether1 (Uplink) und ether24 (ap2) abziehen.
|
|
# Nach dem Import: WinBox auf 10.40.10.2 verbinden, dann uplink einstecken.
|
|
|
|
/system identity set name=crs326-branch
|
|
|
|
/interface bridge port
|
|
# Trunk-Ports (Uplink + AP + NAS)
|
|
set [find interface=ether1] pvid=1 disabled=no
|
|
set [find interface=ether2] pvid=1 disabled=no
|
|
set [find interface=ether8] pvid=1 disabled=no
|
|
set [find interface=ether24] pvid=1 disabled=no
|
|
|
|
# ACCESS-Ports
|
|
set [find interface=ether3] pvid=10 disabled=no
|
|
set [find interface=ether4] pvid=10 disabled=no
|
|
set [find interface=ether5] pvid=40 disabled=no
|
|
set [find interface=ether6] pvid=40 disabled=no
|
|
set [find interface=ether7] pvid=20 disabled=no
|
|
|
|
# Restliche Ethernet-Ports flexibel als INFRA vorbelegen, aber enabled
|
|
set [find interface=ether9] pvid=20 disabled=no
|
|
set [find interface=ether10] pvid=20 disabled=no
|
|
set [find interface=ether11] pvid=20 disabled=no
|
|
set [find interface=ether12] pvid=20 disabled=no
|
|
set [find interface=ether13] pvid=20 disabled=no
|
|
set [find interface=ether14] pvid=20 disabled=no
|
|
set [find interface=ether15] pvid=20 disabled=no
|
|
set [find interface=ether16] pvid=20 disabled=no
|
|
set [find interface=ether17] pvid=20 disabled=no
|
|
set [find interface=ether18] pvid=20 disabled=no
|
|
set [find interface=ether19] pvid=20 disabled=no
|
|
set [find interface=ether20] pvid=20 disabled=no
|
|
set [find interface=ether21] pvid=20 disabled=no
|
|
set [find interface=ether22] pvid=20 disabled=no
|
|
set [find interface=ether23] pvid=20 disabled=no
|
|
set [find interface=sfp-sfpplus1] pvid=1 disabled=yes
|
|
set [find interface=sfp-sfpplus2] pvid=1 disabled=yes
|
|
|
|
/interface bridge vlan
|
|
add bridge=bridge tagged=ether1,ether24,bridge untagged=ether3,ether4 vlan-ids=10 comment=MAIN
|
|
add bridge=bridge tagged=ether1,ether2,ether8,ether24,bridge untagged=ether7,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,ether22,ether23 vlan-ids=20 comment=INFRA
|
|
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=30 comment=IOT
|
|
add bridge=bridge tagged=ether1,ether24,bridge untagged=ether5,ether6 vlan-ids=40 comment=MEDIA
|
|
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=50 comment=UNTRUSTED
|
|
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=90 comment=GUEST
|
|
add bridge=bridge tagged=ether1,ether24,bridge vlan-ids=99 comment=MGMT
|
|
|
|
/interface vlan add name=vlan10 interface=bridge vlan-id=10 comment="TEMP Mgmt VLAN10"
|
|
/interface vlan add name=vlan99 interface=bridge vlan-id=99 comment=MGMT
|
|
|
|
/ip address
|
|
add address=10.40.99.2/24 interface=vlan99 comment="TP21-mgmt-target"
|
|
add address=10.40.10.2/24 interface=vlan10 comment="TEMP Bring-up VLAN10"
|
|
|
|
/ip dns set servers=10.40.99.1 allow-remote-requests=no
|
|
|
|
/interface bridge set [find name=bridge] vlan-filtering=yes
|
|
|
|
/ip route add dst-address=0.0.0.0/0 gateway=10.40.99.1 comment="TP21-default"
|
|
|
|
:do { /ip address remove [find address="192.168.88.1/24"] } on-error={}
|
|
:do { /ip dhcp-client disable [find interface=bridge] } on-error={}
|