autovpn config updates

aristanetworks · Aug 28, 2024 · 9a4653e · 9a4653e
1 parent aafa161
commit 9a4653e
Show file tree

Hide file tree

Showing 7 changed files with 32 additions and 8 deletions.
diff --git a/tech-library/wan/autovpn/zbackend-infra/configs/DC1-R1.cfg b/tech-library/wan/autovpn/zbackend-infra/configs/DC1-R1.cfg
@@ -58,7 +58,6 @@ router adaptive-virtual-topology
       avt profile DEFAULT-AVT-PROFILE id 1
 !
 router path-selection
-   peer dynamic source stun
    tcp mss ceiling ipv4 ingress
    !
    path-group INET id 1
@@ -105,6 +104,9 @@ ip security
       mode transport
       !
       flow entropy udp
+   !
+   key controller
+      profile IPSEC-PROFILE
 !
 interface Dps1
    description TEP IP
@@ -177,6 +179,8 @@ router bgp 65000
    neighbor WAN-OVERLAY-PEERS peer group
    neighbor WAN-OVERLAY-PEERS remote-as 65000
    neighbor WAN-OVERLAY-PEERS update-source Dps1
+   neighbor WAN-OVERLAY-PEERS bfd
+   neighbor WAN-OVERLAY-PEERS bfd interval 5000 min-rx 5000 multiplier 3
    neighbor WAN-OVERLAY-PEERS password 7 Jasxt4q1i1EVo3kE0U5v4w==
    neighbor WAN-OVERLAY-PEERS maximum-routes 0
    neighbor 10.0.1.201 peer group DC1-EVPN-PEERS

diff --git a/tech-library/wan/autovpn/zbackend-infra/configs/DC1-R2.cfg b/tech-library/wan/autovpn/zbackend-infra/configs/DC1-R2.cfg
@@ -172,6 +172,8 @@ router bgp 65000
    neighbor WAN-OVERLAY-PEERS peer group
    neighbor WAN-OVERLAY-PEERS remote-as 65000
    neighbor WAN-OVERLAY-PEERS update-source Dps1
+   neighbor WAN-OVERLAY-PEERS bfd
+   neighbor WAN-OVERLAY-PEERS bfd interval 5000 min-rx 5000 multiplier 3
    neighbor WAN-OVERLAY-PEERS route-reflector-client
    neighbor WAN-OVERLAY-PEERS password 7 Jasxt4q1i1EVo3kE0U5v4w==
    neighbor WAN-OVERLAY-PEERS maximum-routes 0

diff --git a/tech-library/wan/autovpn/zbackend-infra/configs/DC2-R1.cfg b/tech-library/wan/autovpn/zbackend-infra/configs/DC2-R1.cfg
@@ -58,14 +58,13 @@ router adaptive-virtual-topology
       avt profile DEFAULT-AVT-PROFILE id 1
 !
 router path-selection
-   peer dynamic source stun
    tcp mss ceiling ipv4 ingress
    !
    path-group INET id 1
       ipsec profile IPSEC-PROFILE
       !
       local interface Ethernet2
-         stun server-profile DC2-R2-Ethernet2 DC1-R2-Ethernet2
+         stun server-profile DC1-R2-Ethernet2 DC2-R2-Ethernet2
       !
       peer dynamic
       !
@@ -105,6 +104,9 @@ ip security
       mode transport
       !
       flow entropy udp
+   !
+   key controller
+      profile IPSEC-PROFILE
 !
 interface Dps1
    description TEP IP
@@ -177,6 +179,8 @@ router bgp 65000
    neighbor WAN-OVERLAY-PEERS peer group
    neighbor WAN-OVERLAY-PEERS remote-as 65000
    neighbor WAN-OVERLAY-PEERS update-source Dps1
+   neighbor WAN-OVERLAY-PEERS bfd
+   neighbor WAN-OVERLAY-PEERS bfd interval 5000 min-rx 5000 multiplier 3
    neighbor WAN-OVERLAY-PEERS password 7 Jasxt4q1i1EVo3kE0U5v4w==
    neighbor WAN-OVERLAY-PEERS maximum-routes 0
    neighbor 10.0.2.201 peer group DC1-EVPN-PEERS

diff --git a/tech-library/wan/autovpn/zbackend-infra/configs/DC2-R2.cfg b/tech-library/wan/autovpn/zbackend-infra/configs/DC2-R2.cfg
@@ -172,6 +172,8 @@ router bgp 65000
    neighbor WAN-OVERLAY-PEERS peer group
    neighbor WAN-OVERLAY-PEERS remote-as 65000
    neighbor WAN-OVERLAY-PEERS update-source Dps1
+   neighbor WAN-OVERLAY-PEERS bfd
+   neighbor WAN-OVERLAY-PEERS bfd interval 5000 min-rx 5000 multiplier 3
    neighbor WAN-OVERLAY-PEERS route-reflector-client
    neighbor WAN-OVERLAY-PEERS password 7 Jasxt4q1i1EVo3kE0U5v4w==
    neighbor WAN-OVERLAY-PEERS maximum-routes 0

diff --git a/tech-library/wan/autovpn/zbackend-infra/configs/S1-R1.cfg b/tech-library/wan/autovpn/zbackend-infra/configs/S1-R1.cfg
@@ -58,7 +58,6 @@ router adaptive-virtual-topology
       avt profile DEFAULT-AVT-PROFILE id 1
 !
 router path-selection
-   peer dynamic source stun
    tcp mss ceiling ipv4 ingress
    !
    path-group INET id 1
@@ -105,6 +104,9 @@ ip security
       mode transport
       !
       flow entropy udp
+   !
+   key controller
+      profile IPSEC-PROFILE
 !
 interface Dps1
    description TEP IP
@@ -158,6 +160,8 @@ router bgp 65000
    neighbor WAN-OVERLAY-PEERS peer group
    neighbor WAN-OVERLAY-PEERS remote-as 65000
    neighbor WAN-OVERLAY-PEERS update-source Dps1
+   neighbor WAN-OVERLAY-PEERS bfd
+   neighbor WAN-OVERLAY-PEERS bfd interval 5000 min-rx 5000 multiplier 3
    neighbor WAN-OVERLAY-PEERS password 7 Jasxt4q1i1EVo3kE0U5v4w==
    neighbor WAN-OVERLAY-PEERS maximum-routes 0
    neighbor 10.1.1.3 peer group WAN-OVERLAY-PEERS

diff --git a/tech-library/wan/autovpn/zbackend-infra/configs/S1-R2.cfg b/tech-library/wan/autovpn/zbackend-infra/configs/S1-R2.cfg
@@ -58,14 +58,13 @@ router adaptive-virtual-topology
       avt profile DEFAULT-AVT-PROFILE id 1
 !
 router path-selection
-   peer dynamic source stun
    tcp mss ceiling ipv4 ingress
    !
    path-group INET id 1
       ipsec profile IPSEC-PROFILE
       !
       local interface Ethernet2
-         stun server-profile DC1-R2-Ethernet2 DC2-R2-Ethernet2
+         stun server-profile DC2-R2-Ethernet2 DC1-R2-Ethernet2
       !
       peer dynamic
       !
@@ -105,6 +104,9 @@ ip security
       mode transport
       !
       flow entropy udp
+   !
+   key controller
+      profile IPSEC-PROFILE
 !
 interface Dps1
    description TEP IP
@@ -154,6 +156,8 @@ router bgp 65000
    neighbor WAN-OVERLAY-PEERS peer group
    neighbor WAN-OVERLAY-PEERS remote-as 65000
    neighbor WAN-OVERLAY-PEERS update-source Dps1
+   neighbor WAN-OVERLAY-PEERS bfd
+   neighbor WAN-OVERLAY-PEERS bfd interval 5000 min-rx 5000 multiplier 3
    neighbor WAN-OVERLAY-PEERS password 7 Jasxt4q1i1EVo3kE0U5v4w==
    neighbor WAN-OVERLAY-PEERS maximum-routes 0
    neighbor 10.1.1.3 peer group WAN-OVERLAY-PEERS

diff --git a/tech-library/wan/autovpn/zbackend-infra/configs/S2-R1.cfg b/tech-library/wan/autovpn/zbackend-infra/configs/S2-R1.cfg
@@ -58,14 +58,13 @@ router adaptive-virtual-topology
       avt profile DEFAULT-AVT-PROFILE id 1
 !
 router path-selection
-   peer dynamic source stun
    tcp mss ceiling ipv4 ingress
    !
    path-group INET id 1
       ipsec profile IPSEC-PROFILE
       !
       local interface Ethernet2
-         stun server-profile DC1-R2-Ethernet2 DC2-R2-Ethernet2
+         stun server-profile DC2-R2-Ethernet2 DC1-R2-Ethernet2
       !
       peer dynamic
       !
@@ -107,6 +106,9 @@ ip security
       mode transport
       !
       flow entropy udp
+   !
+   key controller
+      profile IPSEC-PROFILE
 !
 interface Dps1
    description TEP IP
@@ -162,6 +164,8 @@ router bgp 65000
    neighbor WAN-OVERLAY-PEERS peer group
    neighbor WAN-OVERLAY-PEERS remote-as 65000
    neighbor WAN-OVERLAY-PEERS update-source Dps1
+   neighbor WAN-OVERLAY-PEERS bfd
+   neighbor WAN-OVERLAY-PEERS bfd interval 5000 min-rx 5000 multiplier 3
    neighbor WAN-OVERLAY-PEERS password 7 Jasxt4q1i1EVo3kE0U5v4w==
    neighbor WAN-OVERLAY-PEERS maximum-routes 0
    neighbor 10.1.1.3 peer group WAN-OVERLAY-PEERS