version 8.4R3.3; groups { INTERFACE-BACKBONE { interfaces { <*> { mtu 9192; encapsulation cisco-hdlc; sonet-options { fcs 32; } unit 0 { family inet { mtu 9180; filter { input backbone-in; output interface-out; } } family iso { mtu 1497; } family inet6 { mtu 9180; filter { input v6filter; output v6filter; } } family mpls { mtu 9180; } } } <so-*> { mtu 9192; encapsulation cisco-hdlc; sonet-options { fcs 32; } unit <*> { family inet { mtu 9180; filter { input backbone-in; output interface-out; } } family iso { mtu 1497; } family inet6 { mtu 9180; filter { input v6filter; output v6filter; } } family mpls { mtu 9180; } } } <ge-*> { mtu 9192; unit <*> { family inet { mtu 9174; filter { input backbone-in; output interface-out; } } family iso { mtu 1497; } family inet6 { mtu 9174; filter { input v6filter; output v6filter; } } family mpls { mtu 9174; } } } } } re0 { system { host-name NEWY-re0; } } re1 { system { host-name NEWY-re1; } } INTERFACE-CONNECTOR { interfaces { <so-*> { mtu 9192; encapsulation cisco-hdlc; sonet-options { fcs 32; rfc-2615; } unit <*> { family inet { mtu 9180; filter { input connector-in; output interface-out; } } family inet6 { mtu 9180; filter { input v6filter; output v6filter; } } } } <at-*> { unit <*> { family inet { filter { input connector-in; output interface-out; } } family inet6 { filter { input v6filter; output v6filter; } } } } <ge-*> { unit <*> { family inet { filter { input connector-in; output interface-out; } } family inet6 { filter { input v6filter; output v6filter; } } } } } } CONNECTOR6; CONNECTOR; ITN; MSDP-SA-Limit-per-peer-group { protocols { msdp { group <*> { peer <*> { active-source-limit { maximum 100000; threshold 90000; } } } } } } } apply-groups [ re0 re1 ]; system { domain-name net.internet2.edu; time-zone UTC; dump-on-panic; authentication-order [ radius password ]; location country-code US; ports { auxiliary type vt100; } root-authentication { Authentication Data Removed } name-server { 134.68.1.9; 129.79.5.100; } radius-server { 134.68.107.17 { timeout 5; source-address 64.57.28.242; } 129.79.216.162 { timeout 5; source-address 64.57.28.242; } } Login Stanza Removed services { ssh { connection-limit 30; } } syslog { archive files 100; user * { any critical; } /* brent's pine.ucs.indiana.edu */ host 129.79.9.1 { change-log any; interactive-commands info; facility-override local6; } /* syslog.grnoc.iu.edu */ host 134.68.107.9 { any info; authorization info; interactive-commands info; facility-override local6; } file messages { any notice; authorization info; archive size 1m files 100; } console { user critical; } } ntp { server 129.79.5.100; server 134.68.1.9 prefer; server 198.32.10.252; server 198.32.10.254; } } chassis { no-source-route; dump-on-panic; redundancy { failover { on-loss-of-keepalives; on-disk-failure; } keepalive-time 5; } routing-engine { on-disk-failure reboot; } fpc 0 { pic 1 { no-concatenate; } } } interfaces { so-0/0/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: NEWY-WASH OC-192 | I2-NEWY-WASH-O192-03914"; family inet { address 64.57.28.10/31; } family inet6 { address 2001:468:ff:609::2/64; } } } so-0/1/0 { description "Unused OC192 [NO-MONITOR]"; } ge-0/2/0 { apply-groups INTERFACE-CONNECTOR; description "Northern Crossroads (NOX) via Internet2 New York Metro Infinera Ring | I2-BOST-NEWY-10GE-04181"; vlan-tagging; mtu 9192; unit 110 { description "Northern Crossroads (NOX) R&E VLAN"; vlan-id 110; family inet { mtu 9000; address 192.5.89.222/30; } family inet6 { mtu 9000; address 2001:468:ff:0646::2/64; } } unit 111 { description "[CPS] Northern Crossroads (NOX)"; vlan-id 111; family inet { mtu 9000; address 207.210.142.2/30; } family inet6 { mtu 9000; address 2001:468:ffff:0646::2/64; } } } ge-1/0/0 { apply-groups INTERFACE-CONNECTOR; mtu 9192; unit 0 { description Nysernet; family inet { mtu 9000; address 199.109.4.154/30; } family inet6 { mtu 9000; address 2001:468:900:315::2/64; } } } ge-1/2/0 { description "Internet2 CPS switch (via Internet2 New York Metro Infinera Ring)"; vlan-tagging; unit 6 { description "[CPS] PAIX New York Public Switch (10G)"; vlan-id 6; family inet { mtu 1500; address 198.32.118.55/24; } } unit 10 { description "PAIX NY Management Subnet"; vlan-id 10; family inet { address 64.57.28.161/28; } } unit 100 { description "[CPS] Global Crossing Private v4 unicast peering"; vlan-id 100; family inet { mtu 1500; filter { input connector-in; } address 64.208.110.26/30; } } unit 101 { description "[CPS] Global Crossing Private v6 and multicast peering"; vlan-id 101; family inet { mtu 1500; filter { input connector-in; } address 64.208.110.186/30; } family inet6 { mtu 1500; address 2001:450:2008:21::2/64; } } unit 102 { description "[CPS] Google private peering"; vlan-id 102; family inet { mtu 1500; filter { input connector-in; } address 64.57.29.20/31; } } } so-1/3/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: CHIC-NEWY OC-192 | I2-CHIC-NEWY-O192-03913"; family inet { address 64.57.28.15/31; } family inet6 { address 2001:468:ff:206::2/64; } } } ge-2/0/0 { description racklan/HP; vlan-tagging; mtu 9192; unit 12 { description "NEWY Observatory 1G vlan"; vlan-id 12; family inet { mtu 9000; address 64.57.17.97/28; } family inet6 { mtu 9000; address 2001:468:6:12::1/64; address 2001:468:6:12::17:97/64; } } } ge-2/0/1 { mtu 9180; unit 0 { description "nms-rthr1 p2p connection"; family inet { mtu 9000; address 64.57.17.81/30; } family inet6 { mtu 9000; address 2001:468:6:101::1/64; address 2001:468:6:101::17:81/64; } } } ge-2/0/2 { mtu 9180; unit 0 { description "nms-rthr2 p2p connection"; family inet { mtu 9000; address 64.57.17.85/30; } family inet6 { mtu 9000; address 2001:468:6:100::1/64; address 2001:468:6:100::17:85/64; } } } so-2/3/0 { apply-groups INTERFACE-CONNECTOR; } inactive: so-3/1/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE - OC-192 to CHINng"; family inet { address 198.32.8.83/31; } family inet6 { address 2001:468:ff:0f15::2/64; } family mpls { mtu 9180; } } } ge-3/2/0 { disable; } ge-4/0/0 { inactive: apply-groups INTERFACE-CONNECTOR; description sw.manlan.internet2.edu:Te11/3; vlan-tagging; mtu 9192; encapsulation vlan-ccc; unit 1 { description "MANLAN Rack Lan"; vlan-id 1; family inet { mtu 1500; filter { output manlan-management; } address 198.32.154.6/25; address 198.32.14.129/27; } family iso; } unit 16 { description "DRAC Project"; vlan-id 16; family inet { mtu 9000; address 198.32.154.133/30; } } unit 102 { description "GEANT | AS:20965"; vlan-id 102; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 198.32.11.50/31; } family iso; family inet6 { mtu 9000; filter { input v6filter; output v6filter; } address 2001:468:ff:15c5::1/64; } } unit 104 { description CAnet-Toronto; vlan-id 104; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 205.189.32.117/30; } family inet6 { filter { input v6filter; output v6filter; } address 2001:410:101:23::2/64; } } unit 107 { description SINET; vlan-id 107; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 150.99.200.194/30; } family inet6 { filter { input v6filter; output v6filter; } } } unit 108 { description QATAR; vlan-id 108; family inet { mtu 1500; filter { input connector-in; output interface-out; } address 80.231.134.30/30; } family inet6 { filter { input v6filter; output v6filter; } } } unit 109 { description CAnet-Montreal; vlan-id 109; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 205.189.32.93/30; } family inet6 { filter { input v6filter; output v6filter; } address 2001:410:101:24::2/64; } } unit 110 { description CERN; vlan-id 110; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 198.32.11.85/30; } } unit 112 { description ESnet; vlan-id 112; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 198.124.216.158/30; } } unit 113 { description ESnet-v6-only; vlan-id 199; family inet6 { mtu 9000; filter { input v6filter; output v6filter; } address 2001:468:ff:15c6::1/64; } } unit 114 { description "MCIT/ENERGI (Egypt)"; vlan-id 114; family inet { mtu 1486; filter { input connector-in; output interface-out; } address 198.32.11.65/30; } family inet6 { mtu 1486; filter { input v6filter; output v6filter; } address 2001:468:ff:6c1::1/64; } } unit 115 { description "LHCnet (CERN)"; vlan-id 115; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 198.32.11.69/30; } } unit 117 { description "TWAREN| AS:7539"; vlan-id 117; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 211.79.48.158/30; } family inet6 { mtu 9000; filter { input v6filter; output v6filter; } address 2001:E10:FFFF:307::2/64; } } unit 120 { description "SURFnet | AS:1103"; vlan-id 120; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 64.57.28.65/30; } family inet6 { mtu 9000; filter { input v6filter; output v6filter; } address 2001:468:ff:6c2::1/64; } } unit 4003 { encapsulation vlan-ccc; vlan-id 4003; } } ge-4/1/0 { description "HP 5406 Racklan Switch"; vlan-tagging; mtu 9192; unit 10 { description "NEWY Racklan"; vlan-id 10; family inet { mtu 9000; filter { output racklan-access; } address 64.57.24.254/24; } } unit 11 { description "NEWY Observatory vlan"; vlan-id 11; family inet { mtu 9000; address 64.57.17.65/28; } family inet6 { mtu 9000; address 2001:468:6:11::1/64; address 2001:468:6:11::17:65/64; } } unit 20 { description "NEWT VINI Mgmt"; vlan-id 20; family inet { mtu 9000; address 64.57.18.225/29; } family inet6 { mtu 9000; address 2001:468:6:20::1/64; address 2001:468:6:20::18:225/64; } } unit 21 { description "NEWT VINI Data"; vlan-id 21; family inet { mtu 9000; address 64.57.18.81/28; } family inet6 { mtu 9000; address 2001:468:6:21::1/64; address 2001:468:6:21::18:81/64; } } unit 30 { description "NEWY 100x100 Inband"; vlan-id 30; family inet { mtu 9000; address 64.57.23.81/29; } family inet6 { mtu 9000; address 2001:468:6:30::1/64; address 2001:468:6:30::23:81/64; } } unit 31 { description "NEWY 100x100 Mgmt"; vlan-id 31; family inet { mtu 9000; address 64.57.23.113/29; } family inet6 { mtu 9000; address 2001:468:6:31::1/64; address 2001:468:6:31::23:113/64; } } unit 50 { description "ISIS collector"; vlan-id 50; family iso { mtu 1497; } } } ge-4/2/0 { description "HOPI 10GigE"; vlan-tagging; mtu 9192; encapsulation vlan-ccc; } ge-4/3/0 { apply-groups INTERFACE-CONNECTOR; description "MAGPI via Internet2 DWS | I2-NEWY-PHIL-10GE-04177"; vlan-tagging; mtu 9192; unit 12 { description "MAGPI IP Connection"; vlan-id 12; family inet { mtu 9000; address 216.27.100.54/30; } family inet6 { mtu 9000; address 2001:468:ff:0658::1/64; } } unit 38 { description "[CPS] MAGPI"; vlan-id 38; family inet { mtu 1500; address 216.27.100.62/30; } family inet6 { mtu 1500; address 2001:468:ffff:0658::1/64; } } } dsc { unit 0 { description "Discard Interface"; family inet { address 198.32.11.6/32 { destination 198.32.11.7; } } } } fxp0 { description "Management Ethernet - Unused"; disable; } lo0 { unit 0 { description "Internal Peering Point"; family inet { filter { input loopback-strict-in; } address 198.32.8.238/32; address 64.57.28.242/32 { preferred; } } family iso { address 49.0000.0000.0000.0021.00; address 49.0000.0000.0000.0030.00; } family inet6 { filter { input loopback-strict-in6; } address 2001:468:6::1/128; } } unit 1 { description "Loopback for CPS VRF"; family inet { filter { input loopback-strict-in; } address 64.57.29.242/32; } family inet6 { filter { input loopback-strict-in6; } address 2001:468:ff06::1/128; } } } } forwarding-options { sampling { input { family inet { rate 100; max-packets-per-second 7000; } } output { inactive: file filename flowdata files 2 size 500000 world-readable; cflowd 64.57.17.71 { port 4195; version 5; no-local-dump; autonomous-system-type origin; } } } } routing-options { interface-routes { rib-group { inet if-rg; inet6 if6-rg; } } rib inet6.0 { static { rib-group static6-rg; route 2001:468::/32 { reject; install; readvertise; community 11537:950; } } aggregate { route 2001:468:000f::/48; route 2001:468:0006::/48; route 2001:468:ff:0f00::/56; } } rib inet.2 { martians { 0.0.0.0/8 orlonger; 1.0.0.0/8 orlonger; 2.0.0.0/8 orlonger; 5.0.0.0/8 orlonger; 10.0.0.0/8 orlonger; 23.0.0.0/8 orlonger; 27.0.0.0/8 orlonger; 31.0.0.0/8 orlonger; 36.0.0.0/8 orlonger; 37.0.0.0/8 orlonger; 39.0.0.0/8 orlonger; 42.0.0.0/8 orlonger; 46.0.0.0/8 orlonger; 49.0.0.0/8 orlonger; 50.0.0.0/8 orlonger; 100.0.0.0/8 orlonger; 101.0.0.0/8 orlonger; 102.0.0.0/8 orlonger; 103.0.0.0/8 orlonger; 104.0.0.0/8 orlonger; 105.0.0.0/8 orlonger; 106.0.0.0/8 orlonger; 107.0.0.0/8 orlonger; 108.0.0.0/8 orlonger; 109.0.0.0/8 orlonger; 110.0.0.0/8 orlonger; 111.0.0.0/8 orlonger; 112.0.0.0/8 orlonger; 113.0.0.0/8 orlonger; 127.0.0.0/8 orlonger; 169.254.0.0/16 orlonger; 172.16.0.0/12 orlonger; 173.0.0.0/8 orlonger; 174.0.0.0/8 orlonger; 175.0.0.0/8 orlonger; 176.0.0.0/8 orlonger; 177.0.0.0/8 orlonger; 178.0.0.0/8 orlonger; 179.0.0.0/8 orlonger; 180.0.0.0/8 orlonger; 181.0.0.0/8 orlonger; 182.0.0.0/8 orlonger; 183.0.0.0/8 orlonger; 184.0.0.0/8 orlonger; 185.0.0.0/8 orlonger; 192.0.2.0/24 orlonger; 192.168.0.0/16 orlonger; 197.0.0.0/8 orlonger; 198.18.0.0/15 orlonger; 240.0.0.0/4 orlonger; } } static { rib-group static-rg; defaults { active; } route 198.32.8.0/22 { discard; community 11537:950; } route 198.32.154.0/24 { discard; community 11537:950; } /* Abilene Observatory */ route 198.32.12.0/22 { discard; community 11537:950; } route 64.57.16.0/20 { discard; community 11537:950; } route 198.32.154.144/28 discard; route 67.17.81.229/32 next-hop 64.208.110.185; } martians { 0.0.0.0/8 orlonger; 1.0.0.0/8 orlonger; 2.0.0.0/8 orlonger; 5.0.0.0/8 orlonger; 10.0.0.0/8 orlonger; 23.0.0.0/8 orlonger; 27.0.0.0/8 orlonger; 31.0.0.0/8 orlonger; 36.0.0.0/8 orlonger; 37.0.0.0/8 orlonger; 39.0.0.0/8 orlonger; 42.0.0.0/8 orlonger; 46.0.0.0/8 orlonger; 49.0.0.0/8 orlonger; 50.0.0.0/8 orlonger; 100.0.0.0/8 orlonger; 101.0.0.0/8 orlonger; 102.0.0.0/8 orlonger; 103.0.0.0/8 orlonger; 104.0.0.0/8 orlonger; 105.0.0.0/8 orlonger; 106.0.0.0/8 orlonger; 107.0.0.0/8 orlonger; 108.0.0.0/8 orlonger; 109.0.0.0/8 orlonger; 110.0.0.0/8 orlonger; 111.0.0.0/8 orlonger; 112.0.0.0/8 orlonger; 113.0.0.0/8 orlonger; 127.0.0.0/8 orlonger; 169.254.0.0/16 orlonger; 172.16.0.0/12 orlonger; 173.0.0.0/8 orlonger; 174.0.0.0/8 orlonger; 175.0.0.0/8 orlonger; 176.0.0.0/8 orlonger; 177.0.0.0/8 orlonger; 178.0.0.0/8 orlonger; 179.0.0.0/8 orlonger; 180.0.0.0/8 orlonger; 181.0.0.0/8 orlonger; 182.0.0.0/8 orlonger; 183.0.0.0/8 orlonger; 184.0.0.0/8 orlonger; 185.0.0.0/8 orlonger; 192.0.2.0/24 orlonger; 192.168.0.0/16 orlonger; 197.0.0.0/8 orlonger; 198.18.0.0/15 orlonger; 223.0.0.0/8 orlonger; } aggregate { defaults { community 11537:950; discard; } route 64.57.16.0/21; route 64.57.24.0/22; route 64.57.28.0/22; } rib-groups { if-rg { import-rib [ inet.0 inet.2 ]; } if6-rg { import-rib [ inet6.0 inet6.2 ]; } mcast-rpf-rg { import-rib inet.2; } mcast-rpf6-rg { import-rib inet6.2; } isis-rg { import-rib [ inet.0 inet.2 ]; } isis6-rg { import-rib [ inet6.0 inet6.2 ]; } static-rg { import-rib [ inet.0 inet.2 ]; } static6-rg { import-rib [ inet6.0 inet6.2 ]; } } router-id 64.57.28.242; autonomous-system 11537; multicast { scope SGI-Dogfight { prefix 224.0.1.2/32; interface all; } scope 224.0.1.3/32 { prefix 224.0.1.3/32; interface all; } scope SUN-NIS { prefix 224.0.1.8/32; interface all; } scope SVRLOC { prefix 224.0.1.22/32; interface all; } scope MS-DS { prefix 224.0.1.24/32; interface all; } scope NBC-PRO { prefix 224.0.1.25/32; interface all; } scope SVRLOC-DA { prefix 224.0.1.35/32; interface all; } scope AutoRP-Announce { prefix 224.0.1.39/32; interface all; } scope AutoRP-Discovery { prefix 224.0.1.40/32; interface all; } scope HP-DEVICE-DISC { prefix 224.0.2.1/32; interface all; } scope SUN-RPC { prefix 224.0.2.2/32; interface all; } scope Norton-Ghost-1 { prefix 224.77.0.0/16; interface all; } scope Altiris { prefix 225.1.2.3/32; interface all; } scope Norton-Ghost-2 { prefix 226.77.0.0/16; interface all; } scope Norton-Ghost-3 { prefix 229.55.150.208/32; interface all; } scope ImageCast-1 { prefix 234.42.42.40/30; interface all; } scope ImageCast-2 { prefix 234.142.142.42/31; interface all; } scope ImageCast-3 { prefix 234.142.142.44/30; interface all; } scope ImageCast-4 { prefix 234.142.142.48/28; interface all; } scope ImageCast-5 { prefix 234.142.142.64/26; interface all; } scope ImageCast-6 { prefix 234.142.142.128/29; interface all; } scope ImageCast-7 { prefix 234.142.142.136/30; interface all; } scope ImageCast-8 { prefix 234.142.142.140/31; interface all; } scope ImageCast-9 { prefix 234.142.142.142/32; interface all; } ssm-groups 232.0.0.0/8; forwarding-cache { threshold { suppress 50000; reuse 25000; } } } } /* msdp */ protocols { igmp { interface all { version 3; } } mld { interface all; } rsvp { /* BACKBONE to WASH */ interface so-0/0/0.0; /* BACKBONE to CHIC */ interface so-1/3/0.0; } mpls { statistics { file mpls-stat; interval 60; } ipv6-tunneling; optimize-timer 360; preference 200; label-switched-path NEWY->STTL { to 198.32.8.200; fast-reroute; } label-switched-path NEWY->ATLA { to 64.57.28.243; fast-reroute; } label-switched-path NEWY->CHIC { to 64.57.28.241; fast-reroute; } label-switched-path NEWY->KANS { to 64.57.28.245; fast-reroute; } label-switched-path NEWY->WASH { to 64.57.28.249; fast-reroute; } label-switched-path NEWY->SALT { to 64.57.28.246; fast-reroute; } label-switched-path NEWY->LOSA { to 64.57.28.248; fast-reroute; } label-switched-path NEWY->HOUS { to 64.57.28.244; fast-reroute; } /* BACKBONE to WASH */ interface so-0/0/0.0; /* BACKBONE to CHIC */ interface so-1/3/0.0; } bgp { log-updown; group CONNECTOR { type external; metric-out igp; /* Multihop needs to be enabled to support discard routing */ multihop { ttl 1; } family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ]; remove-private; neighbor 192.5.89.221 { description NOX; import [ SANITY-IN SET-PREF NOX-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 10578; } neighbor 199.109.4.153 { description Nysernet; import [ SANITY-IN SET-PREF NYSERNET-IN CONNECTOR-IN ]; export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 LEAK-NMS1 ]; peer-as 3754; } neighbor 216.27.100.53 { description MAGPI; import [ SANITY-IN SET-PREF MAGPI-IN CONNECTOR-IN ]; Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ]; peer-as 10466; } } group CONNECTOR6 { type external; metric-out igp; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ]; remove-private; neighbor 2001:468:900:315::1 { description "NYsernet-New York"; import [ SANITY6 SET-PREF NYSERNET-IN6 ]; /* export policy to allow more specifics for dual-homed load-balancing purposes */ export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6-WITH-SPECIFICS ]; peer-as 3754; } neighbor 2001:468:ff:0646::1 { description NOX; import [ SANITY6 SET-PREF NOX-IN6 ]; Authentication Data Removed peer-as 10578; } neighbor 2001:468:ff:0658::2 { description MAGPI; import [ SANITY6 SET-PREF MAGPI-IN6 ]; Authentication Data Removed peer-as 10466; } } group FEDNET { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER FEDNET-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 FEDNET-OUT ]; remove-private; neighbor 198.124.216.157 { description "ESnet via MANLAN"; Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 AMPATH-TO-ESNET GEANT-TO-ESNET FEDNET-OUT ]; peer-as 293; } } group FEDNET6 { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER FEDNET-IN6 ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 FEDNET-OUT6 ]; remove-private; neighbor 2001:468:ff:15c6::2 { description ESNET; family inet6 { any; } Authentication Data Removed peer-as 293; } } group ISP-MCAST { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER ISP-MCAST-IN ]; family inet { multicast { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ISP-MCAST-OUT ]; remove-private; neighbor 64.208.110.185 { description "Global Crossing private peering"; Authentication Data Removed peer-as 3549; } } group ISP-V6 { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER ISP-V6-IN ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ISP-V6-OUT ]; remove-private; neighbor 2001:450:2008:21::1 { description "Global Crossing private peering"; Authentication Data Removed peer-as 3549; } } group ITN { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER ITN-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ITN-OUT ]; remove-private; neighbor 80.231.134.29 { description QATAR; family inet { unicast; } Authentication Data Removed peer-as 29384; } neighbor 205.189.32.94 { description CAnet-Montreal; Authentication Data Removed peer-as 6509; } neighbor 205.189.32.118 { description CAnet-Toronto; Authentication Data Removed peer-as 6509; } neighbor 150.99.200.193 { description SINET; Authentication Data Removed peer-as 2907; } neighbor 198.32.11.66 { description "MCIT/ENERGI (Egypt)"; Authentication Data Removed peer-as 33789; } neighbor 198.32.11.51 { description "GEANT M160 via MANLAN 10GigE"; family inet { unicast { prefix-limit { maximum 5000; teardown 90; } } multicast { prefix-limit { maximum 5000; teardown 90; } } } Authentication Data Removed export [ SANITY-OUT ORIGINATE4 ESNET-TO-GEANT NREN-TO-GEANT ITN-OUT ]; peer-as 20965; } neighbor 198.32.11.70 { description "LHCNet (CERN)"; Authentication Data Removed peer-as 1297; } neighbor 211.79.48.157 { description "TWAREN | AS:7539"; Authentication Data Removed peer-as 7539; } neighbor 198.32.11.86 { description CERN; Authentication Data Removed peer-as 513; } neighbor 64.57.28.66 { description "SURFnet Backup | AS:1103"; Authentication Data Removed peer-as 1103; } } group ITN6 { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER ITN-IN6 ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ITN-OUT6 ]; remove-private; neighbor 2001:410:101:23::1 { description CAnet-Toronto; Authentication Data Removed peer-as 6509; } neighbor 2001:410:101:24::1 { description CAnet-Montreal; Authentication Data Removed peer-as 6509; } neighbor 2001:468:ff:15c5::2 { description GEANT; Authentication Data Removed peer-as 20965; } neighbor 2001:E10:FFFF:307::1 { description TWAREN; Authentication Data Removed peer-as 7539; } neighbor 2001:468:ff:6c2::2 { description "SURFnet Backup | AS:1103"; Authentication Data Removed peer-as 1103; } } /* Use OTHER group for sessions to route-servers, monitoring hosts, etc */ inactive: group OTHER { metric-out igp; import REJECT-ALL; remove-private; } group OTHER-INTERNAL { type internal; import REJECT-ALL; peer-as 11537; neighbor 134.68.246.49 { description "arbor11.ren-isac.net -- Arbor Peakflow [NO-MONITOR]"; local-address 64.57.28.242; family inet { unicast; } cluster 134.68.246.49; } neighbor 134.68.246.51 { description "arbor21.ren-isac.net -- Arbor Peakflow [NO-MONITOR]"; local-address 64.57.28.242; family inet { unicast; } cluster 134.68.246.51; } neighbor 64.57.17.71 { description "nms-rpsv.newy zebra bgpd [NO-MONITOR]"; local-address 64.57.17.65; family inet { unicast; multicast; } cluster 64.57.17.65; } neighbor 2001:468:6:11::17:71 { description "nms-rpsv.newy zebra bgpd [NO-MONITOR]"; family inet6 { unicast; multicast; } } neighbor 156.56.103.99 { description "IU ANML monitor--contact Ripley"; multihop { ttl 10; } local-address 64.57.28.242; hold-time 65535; family inet { unicast; } } } inactive: group NONITN { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER NONITN-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 NONITN-OUT ]; remove-private; } inactive: group NONITN6 { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 NONITN-OUT6 ]; remove-private; } group INTERNET2 { type internal; local-address 64.57.28.242; family inet { any; } family inet-vpn { unicast; } family inet6-vpn { unicast; } Authentication Data Removed export NEXT-HOP-SELF; peer-as 11537; neighbor 198.32.8.200 { description STTLng; } neighbor 64.57.28.241 { description CHIC; } neighbor 64.57.28.243 { description ATLA; } neighbor 64.57.28.244 { description HOUS; } neighbor 64.57.28.245 { description KANS; } neighbor 64.57.28.246 { description SALT; } inactive: neighbor 64.57.28.247 { description SEAT; } neighbor 64.57.28.248 { description LOSA; } neighbor 64.57.28.249 { description WASH; } } group INTERNET2-IPv6 { type internal; local-address 2001:468:6::1; family inet6 { any; } Authentication Data Removed export NEXT-HOP-SELF; peer-as 11537; neighbor 2001:468:16::1 { description "STTLng;"; } neighbor 2001:468:1::1 { description ATLA; } neighbor 2001:468:2::1 { description CHIC; } neighbor 2001:468:3::1 { description HOUS; } neighbor 2001:468:4::1 { description KANS; } neighbor 2001:468:5::1 { description LOSA; } neighbor 2001:468:7::1 { description SALT; } inactive: neighbor 2001:468:8::1 { description SEAT; } neighbor 2001:468:9::1 { description WASH; } } inactive: group MULTICAST-ONLY { type external; metric-out igp; import [ SANITY-LIST SET-LOCPREF-PEERS FROM-ITN ]; family inet { multicast { prefix-limit { maximum 10000; teardown 90; } } } } } isis { export V6-IGP-AGG; spf-delay 200; no-authentication-check; rib-group { inet isis-rg; inet6 isis6-rg; } level 2 wide-metrics-only; /* BB: OC-192 to WASH */ interface so-0/0/0.0 { level 1 disable; level 2 metric 278; } /* BACKBONE to CHIC */ interface so-1/3/0.0 { level 1 disable; level 2 metric 1400; } interface ge-4/1/0.30 { level 1 disable; level 2 passive; } interface ge-4/1/0.31 { level 2 passive; level 1 disable; } interface ge-4/1/0.50 { level 1 disable; level 2 metric 9999; } /* Run IS-IS Passively on all Interfaces */ interface all { level 1 disable; level 2 passive; } } msdp { apply-groups MSDP-SA-Limit-per-peer-group; rib-group mcast-rpf-rg; active-source-limit { maximum 200000; threshold 190000; } group FEDNET { export MSDP-FILTER; import MSDP-FILTER; /* ESNET */ peer 134.55.3.3 { local-address 198.124.216.158; } } group ITN { export MSDP-FILTER; import MSDP-FILTER; /* CAnet-Montreal */ peer 205.189.32.94 { local-address 205.189.32.93; } /* CAnet-Toronto */ peer 205.189.32.118 { local-address 205.189.32.117; } /* TWAREN via Manlan vlan 117 */ peer 211.79.48.157 { local-address 211.79.48.158; } /* GEANT 10GE via MANLAN */ peer 62.40.114.43 { local-address 198.32.11.50; } /* SURFnet via MANLAN */ peer 64.57.28.66 { local-address 64.57.28.65; } } /* Use OTHER group for sessions to route-servers, monitoring hosts, etc */ inactive: group OTHER { export MSDP-FILTER; import REJECT-ALL; } group CONNECTOR { export MSDP-FILTER; import MSDP-FILTER; /* Nysernet */ peer 199.109.4.153 { local-address 199.109.4.154; } /* NOX */ peer 192.5.89.221 { local-address 192.5.89.222; } /* MAGPI */ peer 216.27.100.53 { local-address 216.27.100.54; } } group INTERNET2 { mode mesh-group; local-address 64.57.28.242; /* STTLng */ peer 198.32.8.200; /* CHIC */ peer 64.57.28.241; /* ATLA */ peer 64.57.28.243; /* HOUS */ peer 64.57.28.244; /* KANS */ peer 64.57.28.245; /* SALT */ peer 64.57.28.246; /* SEAT */ inactive: peer 64.57.28.247; /* LOSA */ peer 64.57.28.248; /* WASH */ peer 64.57.28.249; } group ISP-MCAST { export MSDP-FILTER; import MSDP-FILTER; /* Global Crossing (private peering) */ peer 67.17.81.229 { local-address 64.208.110.186; } } } pim { rib-group { inet mcast-rpf-rg; inet6 mcast-rpf6-rg; } import pim-join-filter; rp { bootstrap-import REJECT-ALL; bootstrap-export REJECT-ALL; local { family inet { address 198.32.8.238; group-ranges { 224.0.0.0/4; } } } embedded-rp; static { address 2001:468::1 { group-ranges { ff05::/16; } } address 2001:660:3007:300:1:: { group-ranges { ff0e::/16; ff1e::/16; } } address 2001:700:e000:501::2 { group-ranges { ff3e:30:2001:700::/64; } } } } interface all { mode sparse; version 2; } interface fxp0.0 { disable; } interface ge-3/0/0.102 { mode sparse; version 2; } } } policy-options { prefix-list ALLOW-ALL { 0.0.0.0/0; } prefix-list MATCH-ALL { 0.0.0.0/0; } prefix-list BGP-PEERS { apply-path "protocols bgp group <*> neighbor <*>"; } prefix-list MSDP-PEERS { apply-path "protocols msdp group <*> peer <*>"; } Prefix Stanza Removed prefix-list BGP-PEERS6 { apply-path "protocols bgp group <*> neighbor <*:*>"; } /* List of prefixes which Abilene originates */ prefix-list INTERNAL { /* Internet2 Backbone */ 64.57.16.0/20; /* Abilene Backbone */ 198.32.8.0/22; /* Abilene Observatory */ 198.32.12.0/22; /* MANLAN */ 198.32.154.0/24; } /* List of IPv6 prefixes Abilene originates */ prefix-list INTERNAL6 { 2001:468::/32; } Prefix Stanza Removed prefix-list QUERY-HOSTS-INTERNAL { /* nocmon.net.internet2.edu -- temp monitoring host */ 64.57.25.18/32; /* winger.uits.iu.edu -- snapp */ 129.79.6.137/32; /* pine.ucs.indiana.edu -- sweeny */ 129.79.9.1/32; /* alertmon-dev.grnoc.iu.edu */ 129.79.216.72/32; /* dc-snmp.wcc.grnoc.iu.edu */ 129.79.216.79/32; /* dc-1.grnoc.iu.edu -- SNMP Data Collector */ 134.68.107.22/32; /* snmp.grnoc.iu.edu -- SNMP Data Collection */ 134.68.107.23/32; 134.68.107.113/32; /* mon-dev.grnoc.iu.edu */ 134.68.107.123/32; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; } prefix-list QUERY-HOSTS-EXTERNAL { /* Boston University--ticket#11647 */ 128.197.10.4/32; /* Boston University--ticket#11647 */ 128.197.11.51/32; /* Boston University--ticket#11647 */ 128.197.11.223/32; /* Boston University--ticket#11647 */ 128.197.11.224/32; /* added ndb2-blmt to QUERY-HOSTS-EXTERNAL */ 129.79.5.18/32; /* arbor11.ren-isac.net -- Arbor Peakflow1 */ 134.68.246.49/32; /* arbor21.ren-isac.net -- Arbor Peakflow2 */ 134.68.246.51/32; /* ANML - ArborNetworks */ 156.56.103.9/32; /* ANML - ArborNetworks */ 156.56.103.10/32; /* ANML - ArborNetworks */ 156.56.103.11/32; /* ANML - ArborNetworks */ 156.56.103.12/32; /* ANML - ArborNetworks */ 156.56.103.53/32; /* Ohio ITEC - nf6.itec.oar.net */ 192.148.251.26/32; /* Ohio ITEC - nf7.itec.oar.net */ 192.148.251.27/32; /* netflow2.internet2.edu -- I2 Netflow Collector */ 198.108.90.142/32; /* discvenue.internet2.edu */ 207.75.164.82/32; /* Internet2 - thunderbird.internet2.edu - ticket# 5679 */ 207.75.164.95/32; /* netflow2.internet2.edu -- I2 Netflow Collector */ 207.75.165.99/32; } prefix-list TACACS-SERVERS { /* tacacs2.grnoc.iu.edu */ 129.79.216.162/32; /* tacacs.grnoc.iu.edu */ 134.68.107.17/32; } Prefix Stanza Removed prefix-list DNS-SERVERS { 129.79.5.100/32; 134.68.1.9/32; } prefix-list NTP-SERVERS { /* ntp.indiana.edu */ 129.79.5.100/32; /* ntp-1.gw.uiuc.edu */ 130.126.24.24/32; 134.68.1.9/32; /* ntp-e.abilene.ucaid.edu */ 198.32.10.254/32; /* ntp-w.abilene.ucaid.edu */ 198.32.11.141/32; } prefix-list NMS1-SPECIFICS { /* SNVA */ 198.32.8.108/30; /* WASH */ 198.32.8.112/30; /* ATLA */ 198.32.8.156/30; /* CHIN */ 198.32.8.160/30; /* DNVR */ 198.32.8.164/30; /* HSTN */ 198.32.8.168/30; /* IPLS */ 198.32.8.172/30; /* KSCY */ 198.32.8.176/30; /* LOSA */ 198.32.8.180/30; /* NYCM */ 198.32.8.184/30; /* STTL */ 198.32.8.188/30; } prefix-list NYSERNET-PARTICIPANT { 67.99.160.0/21; 67.99.160.0/22; 128.59.0.0/16; 128.84.0.0/16; 128.113.0.0/16; 128.113.11.0/24; 128.122.0.0/16; 128.151.0.0/16; 128.205.0.0/16; 128.213.0.0/16; 128.226.0.0/16; 128.228.0.0/16; 128.230.0.0/16; 128.253.0.0/16; 129.5.0.0/16; 129.21.0.0/16; 129.49.0.0/16; 129.161.0.0/16; 129.236.0.0/16; 130.245.0.0/16; 132.236.0.0/16; 134.74.0.0/16; 140.251.0.0/16; 146.95.0.0/16; 146.96.0.0/16; 146.111.0.0/16; 146.245.0.0/16; 148.84.0.0/16; 149.4.0.0/16; 149.125.0.0/16; 150.210.0.0/16; 156.111.0.0/16; 156.145.0.0/16; 157.139.0.0/16; 160.39.0.0/16; 163.238.0.0/16; 169.226.0.0/16; 192.5.43.0/24; 192.5.53.0/24; 192.12.82.0/24; 192.12.89.0/24; 192.12.90.0/24; 192.35.82.0/24; 192.35.210.0/24; 192.42.55.0/24; 192.76.177.0/24; 192.77.9.0/24; 192.77.173.0/24; 192.86.139.0/24; 198.61.16.0/20; 198.83.28.0/22; 198.83.112.0/20; 198.180.141.0/24; 199.89.214.0/24; 199.109.0.0/16; 199.109.2.0/24; 199.109.4.0/24; 199.109.5.0/24; 199.109.6.0/30; 199.109.8.0/22; 199.109.12.0/22; 199.109.16.0/22; 199.109.20.0/22; 199.109.24.0/22; 199.109.28.0/22; 199.109.32.0/22; 199.109.40.0/22; 199.109.44.0/22; 199.109.100.0/24; 199.109.200.0/21; 199.219.128.0/18; 199.219.192.0/20; 199.219.208.0/21; 199.219.216.0/24; 204.9.168.0/22; 204.168.181.0/24; 204.168.182.0/23; 204.168.184.0/21; 205.232.16.0/21; 207.10.4.0/24; 207.10.5.0/24; 207.10.6.0/24; 207.10.7.0/24; 207.10.196.0/24; 207.10.197.0/24; 207.10.198.0/24; 207.10.199.0/24; 207.127.120.0/21; 207.127.224.0/22; 207.159.192.0/18; 209.2.48.0/22; 209.2.54.0/23; 216.165.0.0/17; } prefix-list NYSERNET-CORPORATE { 129.34.0.0/16; 198.81.209.0/24; 198.83.46.0/24; 198.180.207.0/24; 198.182.248.0/24; 199.164.149.0/24; 199.181.149.0/24; 199.222.58.0/24; 199.222.59.0/24; 199.222.71.0/24; 204.107.83.0/24; } prefix-list NYSERNET-SPONSORED { 205.232.8.0/21; 209.2.160.0/21; 216.73.240.0/20; } prefix-list NYSERNET-SEGP { 38.96.188.0/24; 63.144.174.0/24; 63.144.175.0/24; 65.88.72.0/22; 65.88.88.0/23; 67.99.185.0/24; 128.153.0.0/16; 129.85.0.0/16; 129.98.0.0/16; 137.143.0.0/16; 137.238.0.0/16; 138.92.0.0/16; 139.127.0.0/16; 146.203.0.0/16; 147.4.0.0/16; 148.100.0.0/16; 149.31.0.0/16; 149.123.0.0/16; 168.169.0.0/16; 170.161.0.0/16; 192.31.156.0/24; 192.33.253.0/24; 192.231.122.0/23; 192.231.124.0/23; 192.246.178.0/24; 192.246.224.0/22; 192.246.228.0/23; 192.246.231.0/24; 192.246.232.0/22; 192.246.235.0/24; 192.246.239.0/24; 192.246.253.0/24; 198.22.176.0/24; 198.105.32.0/20; 198.180.129.0/24; 198.199.181.0/24; 199.190.222.0/23; 199.190.224.0/23; 204.97.72.0/24; 204.168.248.0/21; 205.232.96.0/20; 207.10.8.0/21; 207.127.176.0/21; 216.182.132.0/24; 216.182.136.0/22; 216.226.96.0/19; } prefix-list NYSERNET6-PARTICIPANT { 2001:468:900::/40; 2001:468:1100::/40; 2001:468:1508::/48; 2001:18d8::/32; } prefix-list NOX-PARTICIPANT { 12.0.48.0/20; 12.6.208.0/20; 18.0.0.0/8; 63.164.11.0/24; /* Temporary route - remove after 08-11-08 - JD */ 64.251.112.0/20; 65.112.0.0/20; 67.221.64.0/19; 72.164.152.0/24; 75.130.96.0/24; 128.30.0.0/15; 128.36.0.0/16; 128.52.0.0/16; 128.103.0.0/16; 128.119.0.0/16; 128.148.0.0/16; 128.197.0.0/16; 129.10.0.0/16; 129.55.0.0/16; 129.64.0.0/16; 129.170.0.0/16; 130.64.0.0/16; 130.111.0.0/16; 130.132.0.0/16; 130.189.0.0/16; 130.215.0.0/16; 131.128.0.0/16; 131.142.0.0/16; 132.177.0.0/16; 132.183.0.0/16; 132.198.0.0/16; 134.174.0.0/16; 136.167.0.0/16; 136.244.0.0/16; 137.99.0.0/16; 138.16.0.0/16; 138.29.0.0/16; 140.234.0.0/16; 140.247.0.0/16; 141.133.0.0/16; 148.85.0.0/16; 155.33.0.0/16; 155.37.0.0/16; 155.41.0.0/16; 155.41.96.0/19; 155.41.128.0/17; 155.52.0.0/16; 160.79.139.0/24; 168.122.0.0/16; 170.223.0.0/16; 192.5.66.0/24; 192.5.89.0/24; 192.5.136.0/22; 192.5.140.0/23; 192.5.206.0/23; 192.5.208.0/24; 192.5.224.0/24; 192.12.185.0/24; 192.12.186.0/23; 192.12.188.0/22; 192.26.149.0/24; 192.26.150.0/24; 192.52.61.0/24; 192.52.62.0/23; 192.52.64.0/23; 192.54.224.0/24; 192.73.31.0/24; 192.80.66.0/24; 192.80.83.0/24; 192.131.102.0/24; 192.160.243.0/24; 192.160.244.0/24; 192.189.138.0/24; 198.113.29.0/24; 199.93.245.0/24; 199.94.0.0/16; 199.94.32.0/19; 199.94.48.0/24; 204.8.152.0/21; 204.139.0.0/21; 204.167.52.0/24; 207.188.245.0/24; 207.210.142.0/24; 207.210.143.0/24; } prefix-list NOX-CORPORATE { 167.216.167.0/26; 204.179.122.0/24; } prefix-list NOX-SPONSORED { 64.130.229.160/27; 66.9.106.224/27; 66.9.198.0/24; 66.9.199.0/24; 66.220.243.0/24; 68.112.227.0/24; 68.184.42.64/27; 128.128.0.0/16; 129.44.167.0/24; 131.229.0.0/16; 134.88.230.0/24; 134.88.231.0/24; 134.88.235.0/24; 138.110.0.0/16; 148.45.0.0/16; 158.65.0.0/16; 158.136.0.0/16; 192.80.61.0/24; 192.133.12.0/24; 192.133.83.0/24; 199.92.170.0/24; } prefix-list NOX-SEGP { 12.6.252.0/24; 12.16.126.192/26; 63.145.155.0/24; 64.45.64.0/18; 64.147.48.0/20; 64.202.80.0/20; 64.251.48.0/20; 64.251.60.0/22; 64.254.160.0/20; 65.18.0.0/18; 65.18.64.0/19; 65.18.96.0/20; 66.181.224.0/20; 66.206.128.0/20; 66.206.144.0/21; 66.206.148.0/24; 66.206.152.0/22; 66.206.156.0/24; 66.206.157.0/24; 66.206.158.0/24; 66.206.159.0/24; 66.218.144.0/20; 69.16.0.0/17; 69.43.113.0/24; 69.43.114.0/24; 69.43.120.0/24; 72.10.96.0/19; 72.19.64.0/18; 76.78.80.0/22; 129.5.0.0/16; 129.63.0.0/16; 129.133.0.0/16; 129.161.0.0/16; 131.109.0.0/16; 134.88.0.0/16; 134.181.0.0/16; 134.241.0.0/16; 134.241.27.0/24; 134.241.32.0/24; 134.241.140.0/22; 137.49.0.0/16; 139.140.0.0/16; 140.232.0.0/16; 146.189.0.0/16; 148.166.0.0/16; 149.130.0.0/16; 149.152.0.0/16; 155.36.0.0/16; 155.43.0.0/16; 155.47.0.0/16; 157.252.0.0/16; 158.121.0.0/16; 158.123.0.0/17; 158.123.128.0/17; 159.247.232.0/22; 159.247.236.0/23; 169.244.0.0/16; 192.31.112.0/24; 192.33.12.0/24; 192.43.249.0/24; 192.83.228.0/24; 192.101.188.0/24; 192.107.38.0/24; 192.107.134.0/24; 192.124.153.0/24; 192.132.64.0/24; 192.135.181.0/24; 192.136.22.0/24; 192.138.176.0/24; 192.138.177.0/24; 192.138.178.0/24; 192.152.243.0/24; 192.188.67.0/24; 192.195.196.0/24; 198.7.224.0/19; 198.102.172.0/24; 198.102.211.0/24; 198.148.217.0/24; 198.182.161.0/24; 198.182.162.0/23; 198.183.156.0/24; 198.202.151.0/24; 199.33.141.0/24; 199.184.247.0/24; 204.17.79.64/27; 204.17.80.0/27; 205.172.224.0/22; 206.208.184.0/21; 207.159.160.0/19; 207.166.224.0/19; 207.210.128.0/19; 208.47.162.0/23; 208.47.164.0/23; 209.80.128.0/17; 209.166.112.0/20; 209.222.192.0/19; 216.19.112.0/20; 216.20.0.0/17; 216.87.96.0/19; } prefix-list NOX6-PARTICIPANT { 2001:468:600::/40; 2001:468:1e00::/40; /* University of Main */ 2610:48::/32; 2610:58::/32; } prefix-list MAGPI-PARTICIPANT { 12.161.8.0/21; 66.36.56.0/21; 66.180.176.0/20; 66.250.44.0/24; 128.4.0.0/16; 128.6.0.0/16; 128.91.0.0/16; 128.112.0.0/16; 128.175.0.0/16; 128.180.0.0/16; 128.235.0.0/16; 129.25.0.0/16; 129.32.0.0/16; 130.91.0.0/16; 130.219.0.0/16; 140.180.0.0/16; 140.208.0.0/16; 144.118.0.0/16; 147.31.0.0/16; 149.150.0.0/16; 155.247.0.0/16; 158.130.0.0/16; 159.14.0.0/16; 165.123.0.0/16; 165.230.0.0/16; 192.12.88.0/24; 192.76.178.0/24; 192.84.2.0/24; 198.32.42.0/24; 198.32.242.128/25; 198.151.130.0/24; 199.65.255.0/24; 204.52.215.0/24; 204.153.48.0/22; 205.172.164.0/24; 216.27.97.0/24; 216.27.99.0/24; 216.27.100.0/22; 216.27.100.0/23; } prefix-list MAGPI-CORPORATE { 12.144.59.0/24; } prefix-list MAGPI-SPONSORED { 12.151.0.0/23; 12.151.1.0/24; 38.115.60.0/24; 66.28.32.0/23; 131.249.0.0/16; 147.140.0.0/16; 153.104.0.0/16; 167.21.180.0/22; 167.21.184.0/22; 192.231.162.0/23; 192.231.164.0/24; 192.231.210.0/24; 198.138.53.0/24; 198.138.54.0/23; 198.138.56.0/22; 198.138.60.0/24; 204.14.12.0/22; 204.75.178.0/24; 204.108.128.0/17; 207.103.37.0/24; 207.103.38.0/24; 207.103.55.0/24; 207.103.56.0/24; 207.103.72.0/24; 207.103.89.0/24; 207.103.90.0/24; 207.103.91.0/24; 207.103.189.0/24; 207.103.190.0/24; 207.103.191.0/24; 207.103.192.0/24; 207.103.218.0/24; 207.103.219.0/24; 209.18.48.0/20; 209.50.137.0/24; 209.50.138.0/24; 209.71.5.0/24; 209.71.6.0/24; 209.71.7.0/24; 209.71.10.0/24; 209.71.25.0/24; 209.71.46.0/24; 216.27.98.0/23; 216.27.102.0/24; 216.162.80.0/20; 216.228.128.0/20; } prefix-list MAGPI-SEGP { 8.10.208.0/24; 65.170.110.0/24; 65.194.220.0/22; 65.194.224.0/24; 72.2.96.0/20; 74.214.96.0/19; 76.74.64.0/24; 76.74.65.0/24; 76.74.66.0/24; 76.74.67.0/24; 76.74.68.0/24; 76.74.69.0/24; 76.74.70.0/24; 76.74.71.0/24; 76.74.72.0/24; 76.74.73.0/24; 76.74.77.0/24; 130.68.0.0/16; 130.156.0.0/16; 131.125.0.0/16; 132.238.0.0/16; 134.198.0.0/16; 134.210.0.0/16; 139.147.0.0/16; 146.94.0.0/16; 147.106.0.0/16; 149.151.0.0/16; 150.250.0.0/16; 151.198.208.96/27; 155.246.0.0/16; 159.91.0.0/16; 167.21.6.0/24; 167.21.7.0/24; 167.21.8.0/24; 167.21.9.0/24; 167.21.254.0/24; 170.235.0.0/16; 192.16.204.0/24; 192.100.64.0/24; 192.107.43.0/24; 192.107.45.0/24; 192.107.108.0/24; 192.108.16.0/24; 192.108.106.0/24; 192.112.54.0/24; 192.133.105.0/24; 192.135.209.0/24; 192.150.150.0/24; 192.154.128.0/23; 192.154.130.0/24; 192.231.202.0/24; 192.231.207.0/24; 192.245.88.0/24; 198.22.129.0/24; 198.133.170.0/24; 198.138.207.0/24; 198.138.208.0/23; 198.138.210.0/24; 199.2.216.0/24; 204.13.204.0/22; 204.96.142.0/24; 204.96.143.0/24; 204.143.61.0/24; 204.143.62.0/23; 204.143.64.0/22; 204.143.68.0/24; 204.152.148.0/23; 204.186.48.64/27; 204.186.135.0/24; 204.186.151.0/24; 204.186.161.0/24; 204.186.191.128/27; 205.173.168.0/21; 205.174.96.0/20; 205.235.32.0/19; 205.238.205.0/24; 205.247.245.0/24; 206.82.16.0/20; 206.219.64.0/19; 207.200.160.0/20; 207.200.170.0/24; 207.200.171.0/24; 208.67.140.0/22; 208.70.120.0/22; 208.73.176.0/22; 208.87.76.0/24; 208.87.77.0/24; 208.87.78.0/24; 208.87.79.0/24; 209.50.150.128/26; 209.50.153.224/27; 209.173.1.96/27; 209.173.4.0/27; 209.173.7.96/27; 209.173.11.0/27; 209.173.14.160/27; 209.173.14.192/27; 209.173.16.0/24; 209.173.17.64/26; 209.173.17.192/26; 209.173.18.0/24; 209.242.176.0/20; 216.27.98.0/23; 216.144.171.160/27; 216.220.89.0/24; 216.220.90.0/24; 216.220.94.0/24; 216.220.95.0/24; } prefix-list MAGPI-PARTICIPANT6 { 2001:468:1800::/40; 2607:F3B0::/32; 2607:F470::/32; } prefix-list RADIUS-SERVERS { 129.79.216.162/32; 134.68.107.17/32; } prefix-list BGP-PEERS-CPS { apply-path "routing-instances cps protocols bgp group <*> neighbor <*>"; } prefix-list MAGPI-CPS { 128.180.0.0/16; 198.32.42.0/24; 216.27.100.0/23; } prefix-list QUERY-HOSTS; prefix-list BGP-PEERS6-CPS { apply-path "routing-instances cps protocols bgp group CONNECTORS6 neighbor <*>"; } prefix-list RACKLAN-ACCESS { /* ARIN Allocation */ 64.57.16.0/20; /* ISI East */ 65.114.168.0/24; /* ndb2-blmt.abilene.ucaid.edu */ 129.79.5.18/32; /* DNS Resolver */ 129.79.5.100/32; /* ndb1-blmt.abilene.ucaid.edu */ 129.79.5.225/32; /* IUB */ 129.79.9.0/24; 129.79.216.64/27; 129.79.216.160/27; /* DNS Resolver */ 134.68.1.9/32; /* IUPUI */ 134.68.11.0/24; 134.68.107.0/24; 134.68.142.0/24; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; /* VPN Groups */ 156.56.175.0/27; /* jump.grnoc.iu.edu */ 192.12.206.196/32; /* sd-pc.grnoc.iu.edu */ 192.12.206.228/32; /* Internet2 Ann Arbor */ 207.75.164.0/23; } prefix-list OARNETRACKLAN-ACCESS { 192.148.251.0/24; 199.18.152.96/28; } prefix-list OBSERVATORY-SSH { /* sysmon.grnoc.iu.edu */ 134.68.107.4/32; /* login.net.internet2.edu */ 134.68.107.10/32; /* nms-base */ 134.68.107.34/32; /* nms-login */ 134.68.107.36/32; /* skip */ 134.68.142.50/32; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; /* jump */ 192.12.206.196/32; } prefix-list OBSERVATORY-SSH6 { 0::0/0; } prefix-list NOC-PARTICIPANT; prefix-list MANLAN-ACCESS { 64.57.16.0/20; 129.79.5.18/32; 129.79.5.100/32; 129.79.5.225/32; 129.79.9.0/24; 129.79.216.64/27; 129.79.216.160/27; 134.68.1.9/32; 134.68.11.0/24; 134.68.107.0/24; 134.68.142.0/24; 149.165.129.24/32; 156.56.175.0/27; 192.12.206.196/32; 192.12.206.228/32; } policy-statement AMPATH-TO-ESNET { term FROM-REACCIUN { from as-path REACCIUN; then { as-path-prepend 11537; accept; } } term FROM-ANSP { from as-path ANSP; then { as-path-prepend 11537; accept; } } term FROM-RETINA { from as-path RETINA; then { as-path-prepend 11537; accept; } } } policy-statement BLOCK-COMM-ASN { term block-commercial-as { from as-path COMMERCIAL; then reject; } then next policy; } policy-statement CONNECTOR-IN { /* remove BGP communities which connectors should not announce */ term remove-comms { then { community delete LOW-PEERS; community delete HIGH-PEERS; next term; } } term discard { from { community DISCARD; /* only allow /24-/32 masks for discard routes */ route-filter 0.0.0.0/0 prefix-length-range /24-/32; } to rib inet.0; then { /* add no-export so these are leaked outside of Abilene */ community add NO-EXPORT; /* set next-hop to the destination-address on the dsc.0 interface */ next-hop 198.32.11.7; accept; } } /* allow unicast routes upto /27; note: routes have already passed the individual connector policy */ term allow-unicast { from { route-filter 0.0.0.0/0 upto /27; } to rib inet.0; then { community add PARTICIPANT; accept; } } term allow-multicast { from { route-filter 0.0.0.0/0 upto /27; } to rib inet.2; then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement CPS-AS12989-OUT { term match { from community CPS-AS12989-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS15169-OUT { term match { from community CPS-AS15169-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS20940-OUT { term match { from community CPS-AS20940-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS22773-OUT { term match { from community CPS-AS22773-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS22822-OUT { term match { from community CPS-AS22822-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS29791-OUT { term match { from community CPS-AS29791-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS3549-OUT { term match { from community CPS-AS3549-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS36619-OUT { term match { from community CPS-AS36619-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS4565-OUT { term match { from community CPS-AS4565-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS6079-OUT { term match { from community CPS-AS6079-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS6327-OUT { term match { from community CPS-AS6327-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS6939-OUT { term match { from community CPS-AS6939-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS812-OUT { term match { from community CPS-AS812-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS9505-OUT { term match { from community CPS-AS9505-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-CONNECTOR-IN { term discard { from { community DISCARD; /* only allow /24-/32 masks for discard routes */ route-filter 0.0.0.0/0 prefix-length-range /24-/32; } then { /* add no-export so these are leaked outside of Abilene */ community add NO-EXPORT; /* set next-hop to the destination-address on the dsc.0 interface */ next-hop discard; accept; } } /* allow unicast routes upto /27; note: routes have already passed the individual connector policy */ term allow-unicast { from { route-filter 0.0.0.0/0 upto /24; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-CONNECTOR-OUT { /* announce routes from CPS peer networks */ term announce-peers { from { protocol bgp; community CPS-PEERS; } then accept; } term announce-internal { from { protocol static; route-filter 198.32.9.0/24 exact; } then accept; } term reject { then reject; } } policy-statement CPS-CONNECTOR-OUT6 { term announce-peers { from { protocol bgp; community CPS-PEERS; family inet6; } then accept; } term announce-internal { from { protocol static; family inet6; route-filter 2001:468:ff00::/40 exact; } then accept; } term reject { then reject; } } policy-statement CPS-EXPORT { term direct { from protocol direct; then { community add CPS; accept; } } term bgp { from protocol bgp; then { community add CPS; accept; } } term reject { then reject; } } policy-statement CPS-IMPORT { term bgp { from community CPS; then accept; } term reject { then reject; } } policy-statement CPS-MAGPI-IN { term accept { from { protocol bgp; prefix-list-filter MAGPI-CPS orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-MAGPI-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter MAGPI-PARTICIPANT6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-NOX-IN { term accept { from { protocol bgp; prefix-list-filter NOX-PARTICIPANT orlonger; prefix-list-filter NOX-SPONSORED orlonger; prefix-list-filter NOX-SEGP orlonger; prefix-list-filter NOX-CORPORATE orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-NOX-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter NOX6-PARTICIPANT exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-PEER-OUT { /* Don't annouce any route with a private AS in the path */ term block-private-asn { from as-path PRIVATE; then reject; } /* Don't announce reserved and special prefixes */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } /* Announce Connector prefixes >= /24 */ term announce { from { protocol bgp; community CPS-CONNECTOR; route-filter 0.0.0.0/0 upto /24; } then next policy; } /* Originate a BGP for our Lookback Addresses */ term originate { from { protocol static; route-filter 198.32.9.0/24 exact; route-filter 64.57.29.0/24 exact; } then accept; } term reject { then reject; } } policy-statement CPS-PEERCONTROLS-OUT { term block { from community CPS-BLOCK; then reject; } term prepend1 { from community CPS-PREPEND1; then { as-path-prepend 11537; accept; } } term prepend2 { from community CPS-PREPEND2; then { as-path-prepend "11537 11537"; accept; } } term prepend3 { from community CPS-PREPEND3; then { as-path-prepend "11537 11537 11537"; accept; } } term reject { then reject; } } policy-statement CPS-PEERS-IN { /* Reject any BGP prefix if a private AS is in the path */ term reject-private-asn { from as-path PRIVATE; then reject; } /* Reject BGP prefixes that should never appear in the routing table */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } /* Reject BGP prefixes which Abilene originates */ term block-internal { from { prefix-list INTERNAL; } then reject; } term accept { from { protocol bgp; route-filter 0.0.0.0/0 upto /24; } then { community add CPS-PEERS; accept; } } term reject { then reject; } } policy-statement CPS-REMOVE-COMMS { term remove { then { community delete HIGH-PEERS; community delete LOW-PEERS; community delete LOW; community delete HIGH; community delete DISCARD; community delete CPS; } } } /* ESNET->GEANT backup advertisements (UCAID approved) */ policy-statement ESNET-TO-GEANT { term FROM-ESNET { from as-path ESNET; then { as-path-prepend 11537; accept; } } } /* import policy for FEDNET peers */ policy-statement FEDNET-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term set-community { from protocol bgp; then { community add FEDNET; accept; } } } policy-statement FEDNET-IN6 { term set-community { from protocol bgp; then { community add FEDNET; accept; } } } /* export policy from FEDNET peers */ policy-statement FEDNET-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce ITN routes from peers w/exception to reach FEDNETs (ie IFTNs) */ term allow-iftn { from { protocol bgp; community IFTN; } then accept; } /* don't announce nlri=unicast routes from fednet or international peers */ term block-fednet-itn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET ITN NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement FEDNET-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement GEANT-TO-ESNET { term FROM-GEANT { from as-path GEANT; then { as-path-prepend 11537; accept; } } } policy-statement IFTN-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term block-as112 { from { route-filter 192.175.48.0/24 orlonger; } then reject; } term set-community { from protocol bgp; then { community add ITN; community add IFTN; accept; } } } policy-statement IFTN-OUT { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term allow-multicast { from { protocol bgp; rib inet.2; } then accept; } term block { from { protocol bgp; community [ NONITN CONNECTOR-ONLY ]; } then reject; } term accept { from protocol bgp; then accept; } } /* import policy for mcast-only peerings with commercial ISPs */ policy-statement ISP-MCAST-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term allow { from protocol bgp; to rib inet.2; then { community add COMMERCIAL-PEER; accept; } } term reject { then reject; } } policy-statement ISP-MCAST-OUT { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term no-export { from community BLOCK-TO-COMMERCIAL; then reject; } /* only advertise participant routes */ term allow { from { protocol bgp; rib inet.2; community PARTICIPANT; } then accept; } term reject { then reject; } } policy-statement ISP-V6-IN { term allow { from protocol bgp; to rib inet6.0; then { community add COMMERCIAL-PEER; accept; } } term reject { then reject; } } policy-statement ISP-V6-OUT { term no-export { from community BLOCK-TO-COMMERCIAL; then reject; } /* only advertise participant routes */ term accept { from { protocol bgp; community PARTICIPANT; family inet6; } then accept; } term reject { then reject; } } policy-statement ITN-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term block-as112 { from { route-filter 192.175.48.0/24 orlonger; } then reject; } term set-community { from protocol bgp; then { community add ITN; accept; } } } policy-statement ITN-IN6 { term set-community { from protocol bgp; then { community add ITN; accept; } } } policy-statement ITN-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* don't announce nlri=unicast routes from fednet or nonitn peers */ term block-fednet-nonitn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement ITN-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement LEAK-NMS1 { term leak { from { protocol isis; prefix-list NMS1-SPECIFICS; } then accept; } then next policy; } policy-statement MAGPI-IN { term participant { from { protocol bgp; prefix-list-filter MAGPI-PARTICIPANT orlonger; } then next policy; } term corporate { from { protocol bgp; prefix-list-filter MAGPI-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter MAGPI-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term segp { from { protocol bgp; prefix-list-filter MAGPI-SEGP orlonger; } then { community add SEGP; next policy; } } term segp-exception { from { protocol bgp; route-filter 208.67.140.0/30 exact; } then { community add SEGP; accept; } } term reject-unicast { to rib inet.0; then reject; } } policy-statement MAGPI-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter MAGPI-PARTICIPANT6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement MSDP-FILTER { term bad-groups { from { route-filter 224.0.1.2/32 exact; route-filter 224.0.1.3/32 exact; route-filter 224.0.1.8/32 exact; route-filter 224.0.1.22/32 exact; route-filter 224.0.1.24/32 exact; route-filter 224.0.1.25/32 exact; route-filter 224.0.1.35/32 exact; route-filter 224.0.1.39/32 exact; route-filter 224.0.1.40/32 exact; route-filter 224.0.1.60/32 exact; route-filter 224.0.2.1/32 exact; route-filter 224.0.2.2/32 exact; route-filter 224.77.0.0/16 orlonger; route-filter 225.1.2.3/32 exact; route-filter 226.77.0.0/16 orlonger; route-filter 229.55.150.208/32 exact; route-filter 234.42.42.40/30 orlonger; route-filter 234.142.142.42/31 orlonger; route-filter 234.142.142.44/30 orlonger; route-filter 234.142.142.48/28 orlonger; route-filter 234.142.142.64/26 orlonger; route-filter 234.142.142.128/29 orlonger; route-filter 234.142.142.136/30 orlonger; route-filter 234.142.142.140/31 orlonger; route-filter 234.142.142.142/32 exact; route-filter 232.0.0.0/8 orlonger; route-filter 239.0.0.0/8 orlonger; } then reject; } term bad-sources { from { source-address-filter 10.0.0.0/8 orlonger; source-address-filter 127.0.0.0/8 orlonger; source-address-filter 172.16.0.0/12 orlonger; source-address-filter 192.168.0.0/16 orlonger; } then reject; } term bad-planetlab { from { source-address-filter 198.32.154.179/32 exact; source-address-filter 198.32.154.187/32 exact; source-address-filter 198.32.154.195/32 exact; source-address-filter 198.32.154.202/32 exact; source-address-filter 198.32.154.210/32 exact; source-address-filter 198.32.154.218/32 exact; source-address-filter 198.32.154.226/32 exact; source-address-filter 198.32.154.235/32 exact; source-address-filter 198.32.154.243/32 exact; source-address-filter 198.32.154.250/32 exact; } then reject; } term allow { then accept; } } policy-statement NEXT-HOP-SELF { from protocol bgp; then { next-hop self; } } policy-statement NEXT-v4-v6-self { from protocol bgp; then { next-hop 198.32.9.193; } } policy-statement NONITN-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term set-community { from protocol bgp; then { community add NONITN; accept; } } } policy-statement NONITN-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* don't announce nlri=unicast routes from fednet or international peers */ term block-fednet-itn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET ITN NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement NONITN-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement NOX-IN { term participant { from { protocol bgp; prefix-list-filter NOX-PARTICIPANT orlonger; } then next policy; } term corporate { from { protocol bgp; prefix-list-filter NOX-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter NOX-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term segp { from { protocol bgp; prefix-list-filter NOX-SEGP orlonger; } then { community add SEGP; next policy; } } term reject-unicast { to rib inet.0; then reject; } } policy-statement NOX-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter NOX6-PARTICIPANT exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } /* ESNET->GEANT backup advertisements (UCAID approved) */ policy-statement NREN-TO-GEANT { term FROM { from as-path NREN; then accept; } } policy-statement NYSERNET-IN { term participant { from { protocol bgp; prefix-list-filter NYSERNET-PARTICIPANT orlonger; } then next policy; } term corporate { from { protocol bgp; prefix-list-filter NYSERNET-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter NYSERNET-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term segp { from { protocol bgp; prefix-list-filter NYSERNET-SEGP orlonger; } then { community add SEGP; next policy; } } term participant-exception { from { protocol bgp; route-filter 199.109.200.0/21 upto /28; } then next policy; } term reject-unicast { to rib inet.0; then reject; } } policy-statement NYSERNET-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter NYSERNET6-PARTICIPANT exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } /* Redistribute aggregates from static into BGP */ policy-statement ORIGINATE4 { term internal-addresses { from { protocol static; prefix-list INTERNAL; } then accept; } } /* Redistribute aggregates from static into BGP & block more specifics */ policy-statement ORIGINATE6 { term announce-aggregates { from { protocol static; prefix-list INTERNAL6; } then accept; } term block-more-specifics { from { route-filter 2001:468::/32 longer; } then reject; } } /* Redistribute aggregates from static into BGP - do not block more specifics */ policy-statement ORIGINATE6-WITH-SPECIFICS { term announce-aggregates { from { protocol static; prefix-list INTERNAL6; } then accept; } } policy-statement PREF-IEEAF-12 { then { metric 2; } } policy-statement PREF-IEEAF-192 { then { metric 1; } } policy-statement REJECT-ALL { then reject; } /* Remove certain BGP communities on import - only applied to peers */ policy-statement REMOVE-COMMS-IN { term remove { then { /* remove connector local-pref communities */ community delete HIGH; community delete LOW; /* remove discard community */ community delete DISCARD; } } } /* Remove certain BGP communities on export - applied to connectors and peers */ policy-statement REMOVE-COMMS-OUT { term remove { then { /* remove connector and peer local-pref communities */ community delete HIGH-PEERS; community delete LOW-PEERS; community delete LOW; community delete HIGH; /* remove discard community */ community delete DISCARD; } } } policy-statement REMOVE-GBXv6 { /* remove global-crossing v6 advertisements to geant--ticket 8032 */ term is-gbx { from as-path GBX; then reject; } term not-gbx { then next term; } } /* reject routes we should never accept */ policy-statement SANITY-IN { /* Reject any BGP prefix if a private AS is in the path */ term block-private-asn { from as-path PRIVATE; then reject; } /* Reject any BGP NLRI=Unicast prefix if a commercial ISP's AS is in the path */ term block-commercial-asn { from as-path COMMERCIAL; to rib inet.0; then reject; } term block-nlr-transit { from as-path NLR; then reject; } /* Reject BGP prefixes that should never appear in the routing table */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } /* Reject BGP prefixes which Abilene originates */ term block-internal { from { prefix-list INTERNAL; } then reject; } } /* Block announcements for prefixes we should never announce */ policy-statement SANITY-OUT { /* Don't annouce any route with a private AS in the path */ term block-private-asn { from as-path PRIVATE; then reject; } /* Don't announce NLRI=Unicast routes if a commercial ISP's AS is in the path */ term block-commercial-asn { from { rib inet.0; as-path COMMERCIAL; } then reject; } /* Don't announce reserved and special prefixes */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } } policy-statement SANITY6 { /* Block routes with a private AS in the path */ term block-private-asns { from { as-path PRIVATE; family inet6; } then reject; } /* Only accept routes within certain allocated blocks */ term accept { /* see http://www.iana.org/assignments/ipv6-unicast-address-assignments */ from { route-filter 2001::/16 upto /49; route-filter 2002::/16 exact; route-filter 2003::/16 upto /49; route-filter 2400::/12 upto /49; route-filter 2600::/12 upto /49; route-filter 2a00::/12 upto /49; route-filter 2800::/12 upto /49; route-filter 2001:b000::/20 upto /49; route-filter 2c00::/12 upto /49; route-filter 2610::/12 upto /49; route-filter 2620::/12 upto /49; } then next policy; } term reject { then reject; } } /* set local-pref on connector routes based on communities */ policy-statement SET-PREF { term high { from community HIGH; then { local-preference 260; next policy; } } term low { from community LOW; then { local-preference 140; next policy; } } term normal { then { local-preference 200; } } } policy-statement SET-PREF-BACKUP { term equal-to-peers { from community EQUAL-TO-PEERS; then { local-preference 100; next policy; } } term lower-than-peers { from community LOWER-THAN-PEERS; then { local-preference 60; next policy; } } } /* set local-pref on peer routes based on communities */ policy-statement SET-PREF-PEER { term high { from community HIGH-PEERS; then { local-preference 160; next policy; } } term low { from community LOW-PEERS; then { local-preference 40; next policy; } } term normal { then { local-preference 100; } } } policy-statement V6-IGP-AGG { term allow-aggregate { from { protocol aggregate; family inet6; } then accept; } term deny-more-specifics { from { family inet6; route-filter 2001:468:ff:1500::/56 longer; route-filter 2001:468:0015::/48 longer; route-filter 2001:468:ff:0f00::/56 longer; route-filter 2001:468:000f::/48 longer; } then reject; } term accept-all-other-v6 { from { protocol [ isis direct ]; family inet6; } then accept; } } /* Temporary fix for scoping 239/8 */ policy-statement pim-join-filter { term internal-links { from { /* List of Backbone Interfaces */ interface [ so-0/0/0.0 so-1/3/0.0 ]; route-filter 239.0.0.0/8 orlonger; } then accept; } term external-links { from { route-filter 239.0.0.0/8 orlonger; } then reject; } term all-links { then accept; } } community BLOCK-TO-COMMERCIAL members 11537:2002; community COMMERCIAL-PEER members 11537:2001; community CONNECTOR-ONLY members 11537:3500; community CORE members 11537:900; community CORPORATE members 11537:2000; community CPS members target:11537:1; community CPS-AS12989-OUT members *:12989; community CPS-AS15169-OUT members *:15169; community CPS-AS20940-OUT members *:20940; community CPS-AS22773-OUT members *:22773; community CPS-AS22822-OUT members *:22822; community CPS-AS29791-OUT members *:29791; community CPS-AS3549-OUT members *:3549; community CPS-AS36619-OUT members *:36619; community CPS-AS4565-OUT members *:4565; community CPS-AS6079-OUT members *:6079; community CPS-AS6327-OUT members *:6327; community CPS-AS6939-OUT members *:6939; community CPS-AS812-OUT members *:812; community CPS-AS9505-OUT members *:9505; community CPS-BLOCK members 65000:*; community CPS-CONNECTOR members 11537:25100; community CPS-PEERS members 11537:25200; community CPS-PREPEND1 members 65001:*; community CPS-PREPEND2 members 65002:*; community CPS-PREPEND3 members 65003:*; community DISCARD members 11537:911; community EQUAL-TO-PEERS members 11537:100; community FEDNET members 11537:3000; community HIGH members 11537:260; community HIGH-PEERS members 11537:160; community IFTN members 11537:2502; community ITN members 11537:2501; community LOW members 11537:140; community LOW-PEERS members 11537:40; community LOWER-THAN-PEERS members 11537:60; community NO-EXPORT members no-export; community NOAGG6 members 11537:6; community NONITN members 11537:2500; community PARTICIPANT members 11537:950; community SEGP members 11537:910; community SPONSORED members 11537:902; as-path COMMERCIAL-IGRID ".*1.* | .*174.* | .*209.* | .*701.* | .*1239.* | .*1673.* | .*1740.* | .*1800.* | .*1833.* | .*2551.* | .*2548.* | .*2685.* | .*2914.* | .*3549.* | .*3561.* | .*3847.* | .*3951.* | .*3967.* | .*4183.* | .*4200.* | .*5683.* | .*6113.* | .*6172.* | .*6461.* | .*7018.*"; as-path COMM1 .*3265.*; as-path COMMERCIAL ".* (1|174|701|1239|1673|1740|1800|1833|2551|2548|2685|2914|3549|3561|3847|3951|3967|4183|4200|5683|6113|6172|6461|7018) .*"; as-path PRIVATE ".* (64512-65535) .*"; /* temporary for ESNET->GEANT advertisements */ as-path ESNET "293 .*"; as-path ABILENE ".* 11537 .*"; as-path GEANT "20965 .*"; as-path REACCIUN "20312 .*"; as-path ANSP "1251 .*"; as-path RETINA "3597 .*"; as-path GBX ".* 3549 .*"; as-path NREN "24 .*"; as-path NLR ".* 19401 .*"; } Firewall Stanza Removed removed version 8.4R3.3; groups { INTERFACE-BACKBONE { interfaces { <*> { mtu 9192; encapsulation cisco-hdlc; sonet-options { fcs 32; } unit 0 { family inet { mtu 9180; filter { input backbone-in; output interface-out; } } family iso { mtu 1497; } family inet6 { mtu 9180; filter { input v6filter; output v6filter; } } family mpls { mtu 9180; } } } } } re0 { system { host-name WASH-re0; } } re1 { system { host-name WASH-re1; } } INTERFACE-CONNECTOR { interfaces { <so-*> { mtu 9192; encapsulation cisco-hdlc; sonet-options { fcs 32; rfc-2615; } unit <*> { family inet { mtu 9180; filter { input connector-in; output interface-out; } } family inet6 { mtu 9180; filter { input v6filter; output v6filter; } } } } <at-*> { unit <*> { encapsulation atm-snap; family inet { filter { input connector-in; output interface-out; } } family inet6 { filter { input v6filter; output v6filter; } } } } <ge-*> { unit <*> { family inet { filter { input connector-in; output interface-out; } } family inet6 { filter { input v6filter; output v6filter; } } } } } } MSDP { protocols { msdp { group CONNECTOR { peer <*> { active-source-limit { maximum 2000; threshold 1800; } } } group ITN { peer <*> { active-source-limit { maximum 500; threshold 450; } } } group FEDNET { peer <*> { active-source-limit { maximum 4000; threshold 3600; } } } group NONITN { peer <*> { active-source-limit { maximum 4000; threshold 3600; } } } } } } CONNECTOR; } apply-groups [ re0 re1 ]; system { domain-name abilene.ucaid.edu; time-zone UTC; dump-on-panic; authentication-order [ radius password ]; location country-code US; root-authentication { Authentication Data Removed } name-server { 129.79.5.100; 134.68.1.9; } radius-server { 134.68.107.17 { timeout 5; source-address 64.57.28.249; } 129.79.216.162 { timeout 5; source-address 64.57.28.249; } } Login Stanza Removed services { ssh { connection-limit 30; } } syslog { archive files 100; user * { any critical; } /* brent's pine.ucs.indiana.edu */ host 129.79.9.1 { change-log any; interactive-commands info; facility-override local6; } /* syslog.grnoc.iu.edu */ host 134.68.107.9 { any info; authorization info; interactive-commands info; facility-override local6; } file messages { any notice; authorization info; archive size 1m files 100; } console { user critical; } } ntp { server 129.79.5.100; server 134.68.1.9 prefer; } } chassis { no-source-route; dump-on-panic; redundancy { failover { on-loss-of-keepalives; on-disk-failure; } keepalive-time 5; } routing-engine { on-disk-failure reboot; } } interfaces { so-0/0/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: NEWY-WASH OC-192 | I2-NEWY-WASH-O192-03914"; family inet { address 64.57.28.11/31; } family inet6 { address 2001:468:ff:0609::1/64; } family mpls { mtu 9180; } } } ge-0/1/0 { apply-groups INTERFACE-CONNECTOR; description "NGIX-EAST via Movaz LVL3->CLPK"; vlan-tagging; mtu 9192; unit 88 { description "redCLARA via NGIX and AWave-FIU"; vlan-id 88; family inet { mtu 9000; filter { input connector-in; } address 198.32.11.105/30; } family inet6 { mtu 9000; address 2001:468:ff:18c5::1/64; } } unit 98 { description "RNP via Atlantic Wave"; vlan-id 98; family inet { mtu 9000; address 64.57.28.61/30; } } unit 166 { description "NREN via UMD NGIX | AS24"; vlan-id 166; family inet { mtu 9000; filter { input connector-in; } address 198.32.11.21/30; } family inet6 { mtu 9000; address 2001:468:ff:18c2::1/64; } } unit 183 { description "MAX backup peering via NGIX-East"; vlan-id 183; family inet { mtu 9000; filter { input connector-in; } address 206.196.177.106/30; } family inet6 { mtu 9000; address 2001:468:ff:185c::1/64; } } unit 187 { description "Mid-Atlantic Crossroads (MAX) Back-Up viz NGIX-East CPS-IPv6"; vlan-id 187; family inet6 { address 2001:468:ffff:185c::1/64; } } unit 188 { description "Mid-Atlantic Crossroads (MAX) Back-Up via NGIX-East CPS-IPv4"; vlan-id 188; family inet { mtu 9000; address 206.196.177.27/31; } } unit 194 { description "ESNET via NGIX"; vlan-id 194; family inet { mtu 9000; filter { input connector-in; } address 198.124.194.10/30; } } unit 195 { description "ESNET IPv6 via NGIX"; vlan-id 195; family inet6 { mtu 9000; address 2001:468:ff:9c3::1/64; } } unit 202 { description "GEANT (Frankfurt OC-192)"; vlan-id 202; family inet { mtu 9000; address 62.40.125.18/30; } family inet6 { mtu 9000; address 2001:0798:0014:10AA::12/126; } } unit 297 { description "NISN (via UMD NGIX) | AS:297"; vlan-id 173; family inet { mtu 9000; filter { input connector-in; } address 192.84.8.254/30; } } unit 668 { description "DREN - Washington DC | AS:668"; vlan-id 174; family inet { mtu 9000; filter { input connector-in; } address 138.18.47.34/30; } family inet6 { mtu 9000; address 2001:468:ff:18c4::1/64; } } unit 669 { description "Wright-Patterson AFB/Wright State Univ ctr in Dayton via DREN"; vlan-id 164; family inet { mtu 9000; filter { input connector-in; } address 138.18.47.42/30; } } unit 901 { description "NREN backup via NGIX | AS24"; vlan-id 901; family inet { mtu 9000; filter { input connector-in; } address 64.57.28.40/31; } family inet6 { mtu 9000; address 2001:468:ff:09c1::1/64; } } unit 987 { description "DREN v6-only, AS668"; vlan-id 987; family inet { mtu 1500; address 10.254.254.9/31; } family inet6 { mtu 1500; address 2001:468:ff:18c3::1/64; } } unit 1842 { description "US Geological Survey ( via UMD NGIX)) | AS:1842"; vlan-id 162; family inet { mtu 4470; filter { input connector-in; } address 137.227.2.182/30; } } } ge-0/2/0 { apply-groups INTERFACE-CONNECTOR; description "Merit via Internet2 DWS | I2-CLEV-WASH-10GE-004179"; vlan-tagging; mtu 9192; unit 352 { description "OSCnet mcast-only peering vlan"; vlan-id 352; family inet { mtu 9000; address 199.18.156.242/30; } family inet6 { mtu 9000; address 2001:468:ff:9c2::1/64; } } unit 359 { description "OSCnet R&E VLAN"; vlan-id 359; family inet { mtu 9000; address 192.88.192.138/30; } family inet6 { mtu 9000; address 2001:468:ff:d4b::1/64; } } unit 921 { description "OSCnet [CPS]"; vlan-id 921; family inet { mtu 9000; address 199.18.156.246/30; } family inet6 { mtu 9000; address 2001:468:ffff:d4b::1/64; } } unit 1004 { description "Merit R&E via Cleveland"; vlan-id 1004; family inet { mtu 9000; address 192.122.183.10/30; } } unit 1005 { description "[CPS] Merit via Cleveland"; vlan-id 1005; family inet { mtu 9000; address 198.109.37.22/30; } } } so-1/1/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: ATLA-WASH OC-192 | I2-ATLA-WASH-O192-03916"; family inet { address 64.57.28.7/31; } family inet6 { address 2001:468:ff:109::2/64; } } } ge-2/0/0 { description "Racklan HP 1Gig"; vlan-tagging; mtu 9192; unit 12 { description "WASH Observatory 1G vlan"; vlan-id 12; family inet { mtu 9000; } } } ge-2/0/1 { mtu 9192; unit 0 { description "nms-rthr1 p2p connection"; family inet { mtu 9000; address 64.57.16.17/30; } family inet6 { mtu 9000; address 2001:468:9:101::1/64; address 2001:468:9:101::16:17/64; } } } ge-2/0/2 { mtu 9192; unit 0 { description "nms-rthr2 p2p connection"; family inet { mtu 9000; address 64.57.16.21/30; } family inet6 { mtu 9000; address 2001:468:9:100::1/64; address 2001:468:9:100::16:21/64; } } } so-2/1/0 { apply-groups INTERFACE-CONNECTOR; no-keepalives; mtu 9192; clocking internal; encapsulation frame-relay; sonet-options { rfc-2615; } unit 110 { description "Mid-Atlantic Crossroads (MAX)"; point-to-point; dlci 110; family inet { mtu 9180; address 206.196.178.46/30; } family inet6 { mtu 9180; address 2001:468:c00:ffee::2/64; } } unit 120 { description "Mid-Atlantic Crossroads (MAX) Primary CPS-IPv6"; dlci 120; family inet6 { address 2001:468:ffff:9c4::1/64; } } unit 130 { description "Mid-Atlantic Crossroads(MAX) Primary CPS-IPv4"; dlci 130; family inet { address 206.196.177.25/31; } } } so-2/2/0 { apply-groups INTERFACE-CONNECTOR; unit 0 { description "NSF DRAGON"; family inet { address 140.173.1.238/30; } } } so-3/0/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: CHIC-WASH OC-192 | I2-CHIC-WASH-O192-03915"; family inet { address 64.57.28.13/31; } family inet6 { address 2001:468:ff:0209::1/64; } family mpls { mtu 9180; } } } ge-3/1/0 { description "to HP5406 B3 10GE"; vlan-tagging; mtu 9180; inactive: unit 10 { description WASH-OOB; vlan-id 10; family inet { address 64.57.24.254/24; } } unit 11 { description "WASH Observatory vlan"; vlan-id 11; family inet { mtu 9000; address 64.57.16.1/28; } family inet6 { mtu 9000; address 2001:468:9:11::1/64; address 2001:468:9:11::16:1/64; } } unit 12 { description "WASH Obs 1Gig (temp)"; vlan-id 12; family inet { mtu 9000; address 64.57.16.33/28; } family inet6 { mtu 9000; address 2001:468:9:12::1/64; address 2001:468:9:12::16:33/64; } } unit 13 { description "HOPI WASH Management"; vlan-id 13; family inet { mtu 9000; address 64.57.23.1/28; } } unit 20 { description "WASH VINI Mgmt"; vlan-id 20; family inet { mtu 9000; address 64.57.18.249/29; } } unit 21 { description "WASH VINI Data"; vlan-id 21; family inet { mtu 9000; address 64.57.18.129/28; } } unit 30 { description "WASH 100x100 Inband"; vlan-id 30; family inet { mtu 9000; address 64.57.23.89/29; } family inet6 { mtu 9000; address 2001:468:9:30::1/64; address 2001:468:9:30::23:89/64; } } unit 31 { description "WASH 100x100 Mgmt"; vlan-id 31; family inet { mtu 9000; address 64.57.23.121/29; } family inet6 { mtu 9000; address 2001:468:9:31::1/64; address 2001:468:9:31::23:121/64; } } unit 50 { description "ISIS vlan"; vlan-id 50; family iso { mtu 1497; } } } ge-3/2/0 { apply-groups INTERFACE-CONNECTOR; description "Internet2 WASH Ciena CoreDirector"; vlan-tagging; mtu 9192; unit 3 { description "Drexel via Internet2 Ciena CoreDirector | I2-PHIL-WASH-VLAN-04191"; vlan-id 3; family inet { mtu 9000; address 204.238.76.6/30; } family inet6 { mtu 9000; address 2001:468:ff:0960::1/64; } } unit 4 { description "Drexel v4 CPS via Internet2 CienaCoreDirector|I2-PHIL-WASH-VLAN-04191 [NO-MONITOR]"; vlan-id 4; family inet { mtu 9000; address 204.238.76.2/30; } } unit 5 { description "Drexel v6 CPS via Internet2 CienaCoreDirector|I2-PHIL-WASH-VLAN-04191 [NO-MONITOR]"; vlan-id 5; family inet6 { mtu 9000; address 2001:468:ffff:960::1/64; } } unit 506 { description "3ROX via Internet2 Ciena CoreDirector | I2-PITT-WASH-VLAN-04178"; vlan-id 506; family inet { mtu 9000; address 192.88.115.25/31; } family inet6 { address 2001:5e8:0:fffd:0:2:2:2/120; } } unit 507 { description "3ROX [CPS]"; vlan-id 507; family inet { mtu 1500; address 192.88.115.117/31; } } unit 509 { description "3ROX IPv6 [CPS]"; vlan-id 509; family inet6 { mtu 1500; address 2001:5E8:0:FFFD:0:2:3:2/120; } } } ge-3/3/0 { description HOPI-DC; vlan-tagging; mtu 9180; encapsulation vlan-ccc; } dsc { unit 0 { family inet { address 198.32.11.6/32 { destination 198.32.11.7; } } } } fxp0 { description "Management Ethernet - Unused"; disable; } lo0 { unit 0 { description "Internal Peering Point"; family inet { filter { input loopback-strict-in; } address 198.32.8.238/32; address 64.57.28.249/32 { preferred; } } family iso { address 49.0000.0000.0000.0300.00; } family inet6 { filter { input loopback-strict-in6; } address 2001:468:9::1/128; } } unit 1 { description "Loopback for CPS VRF"; family inet { filter { input loopback-strict-in; } address 64.57.29.249/32; } family inet6 { filter { input loopback-strict-in6; } address 2001:468:ff09::1/128; } } } } forwarding-options { sampling { input { family inet { rate 100; max-packets-per-second 7000; } } output { inactive: file filename flowdata files 2 size 500000 world-readable; cflowd 64.57.16.4 { port 4196; version 5; no-local-dump; autonomous-system-type origin; } } } helpers { bootp { interface { ge-0/2/0 { server 64.57.24.1; } } } } } routing-options { interface-routes { rib-group { inet if-rg; inet6 if6-rg; } } rib inet6.0 { static { rib-group static6-rg; route 2001:468::/32 { reject; install; readvertise; community 11537:950; } } aggregate { route 2001:468:ff:1200::/56; route 2001:468:0012::/48; } } rib inet.2 { martians { 0.0.0.0/8 orlonger; 1.0.0.0/8 orlonger; 2.0.0.0/8 orlonger; 5.0.0.0/8 orlonger; 10.0.0.0/8 orlonger; 23.0.0.0/8 orlonger; 27.0.0.0/8 orlonger; 31.0.0.0/8 orlonger; 36.0.0.0/8 orlonger; 37.0.0.0/8 orlonger; 39.0.0.0/8 orlonger; 42.0.0.0/8 orlonger; 46.0.0.0/8 orlonger; 49.0.0.0/8 orlonger; 50.0.0.0/8 orlonger; 100.0.0.0/8 orlonger; 101.0.0.0/8 orlonger; 102.0.0.0/8 orlonger; 103.0.0.0/8 orlonger; 104.0.0.0/8 orlonger; 105.0.0.0/8 orlonger; 106.0.0.0/8 orlonger; 107.0.0.0/8 orlonger; 108.0.0.0/8 orlonger; 109.0.0.0/8 orlonger; 110.0.0.0/8 orlonger; 111.0.0.0/8 orlonger; 112.0.0.0/8 orlonger; 113.0.0.0/8 orlonger; 127.0.0.0/8 orlonger; 169.254.0.0/16 orlonger; 172.16.0.0/12 orlonger; 173.0.0.0/8 orlonger; 174.0.0.0/8 orlonger; 175.0.0.0/8 orlonger; 176.0.0.0/8 orlonger; 177.0.0.0/8 orlonger; 178.0.0.0/8 orlonger; 179.0.0.0/8 orlonger; 180.0.0.0/8 orlonger; 181.0.0.0/8 orlonger; 182.0.0.0/8 orlonger; 183.0.0.0/8 orlonger; 184.0.0.0/8 orlonger; 185.0.0.0/8 orlonger; 192.0.2.0/24 orlonger; 192.168.0.0/16 orlonger; 197.0.0.0/8 orlonger; 198.18.0.0/15 orlonger; 223.0.0.0/8 orlonger; 240.0.0.0/4 orlonger; } } static { rib-group static-rg; defaults { active; } route 198.32.8.0/22 { discard; community 11537:950; } route 198.32.154.0/24 { discard; community 11537:950; } route 198.32.12.0/22 { discard; community 11537:950; } route 64.57.16.0/20 { discard; community 11537:950; } route 198.32.154.144/28 discard; } martians { 0.0.0.0/8 orlonger; 1.0.0.0/8 orlonger; 2.0.0.0/8 orlonger; 5.0.0.0/8 orlonger; 10.0.0.0/8 orlonger; 23.0.0.0/8 orlonger; 27.0.0.0/8 orlonger; 31.0.0.0/8 orlonger; 36.0.0.0/8 orlonger; 37.0.0.0/8 orlonger; 39.0.0.0/8 orlonger; 42.0.0.0/8 orlonger; 46.0.0.0/8 orlonger; 49.0.0.0/8 orlonger; 50.0.0.0/8 orlonger; 100.0.0.0/8 orlonger; 101.0.0.0/8 orlonger; 102.0.0.0/8 orlonger; 103.0.0.0/8 orlonger; 104.0.0.0/8 orlonger; 105.0.0.0/8 orlonger; 106.0.0.0/8 orlonger; 107.0.0.0/8 orlonger; 108.0.0.0/8 orlonger; 109.0.0.0/8 orlonger; 110.0.0.0/8 orlonger; 111.0.0.0/8 orlonger; 112.0.0.0/8 orlonger; 113.0.0.0/8 orlonger; 127.0.0.0/8 orlonger; 169.254.0.0/16 orlonger; 172.16.0.0/12 orlonger; 173.0.0.0/8 orlonger; 174.0.0.0/8 orlonger; 175.0.0.0/8 orlonger; 176.0.0.0/8 orlonger; 177.0.0.0/8 orlonger; 178.0.0.0/8 orlonger; 179.0.0.0/8 orlonger; 180.0.0.0/8 orlonger; 181.0.0.0/8 orlonger; 182.0.0.0/8 orlonger; 183.0.0.0/8 orlonger; 184.0.0.0/8 orlonger; 185.0.0.0/8 orlonger; 192.0.2.0/24 orlonger; 192.168.0.0/16 orlonger; 197.0.0.0/8 orlonger; 198.18.0.0/15 orlonger; 223.0.0.0/8 orlonger; } aggregate { defaults { community 11537:950; discard; } route 64.57.16.0/21; route 64.57.24.0/22; route 64.57.28.0/22; } rib-groups { if-rg { import-rib [ inet.0 inet.2 ]; } if6-rg { import-rib [ inet6.0 inet6.2 ]; } mcast-rpf-rg { import-rib inet.2; } mcast-rpf6-rg { import-rib inet6.2; } isis-rg { import-rib [ inet.0 inet.2 ]; } isis6-rg { import-rib [ inet6.0 inet6.2 ]; } static-rg { import-rib [ inet.0 inet.2 ]; } static6-rg { import-rib [ inet6.0 inet6.2 ]; } } router-id 64.57.28.249; autonomous-system 11537; multicast { scope SGI-Dogfight { prefix 224.0.1.2/32; interface all; } scope 224.0.1.3/32 { prefix 224.0.1.3/32; interface all; } scope SUN-NIS { prefix 224.0.1.8/32; interface all; } scope SVRLOC { prefix 224.0.1.22/32; interface all; } scope MS-DS { prefix 224.0.1.24/32; interface all; } scope NBC-PRO { prefix 224.0.1.25/32; interface all; } scope SVRLOC-DA { prefix 224.0.1.35/32; interface all; } scope AutoRP-Announce { prefix 224.0.1.39/32; interface all; } scope AutoRP-Discovery { prefix 224.0.1.40/32; interface all; } scope HP-DEVICE-DISC { prefix 224.0.2.1/32; interface all; } scope SUN-RPC { prefix 224.0.2.2/32; interface all; } scope Norton-Ghost-1 { prefix 224.77.0.0/16; interface all; } scope Altiris { prefix 225.1.2.3/32; interface all; } scope Norton-Ghost-2 { prefix 226.77.0.0/16; interface all; } scope Norton-Ghost-3 { prefix 229.55.150.208/32; interface all; } scope ImageCast-1 { prefix 234.42.42.40/30; interface all; } scope ImageCast-2 { prefix 234.142.142.42/31; interface all; } scope ImageCast-3 { prefix 234.142.142.44/30; interface all; } scope ImageCast-4 { prefix 234.142.142.48/28; interface all; } scope ImageCast-5 { prefix 234.142.142.64/26; interface all; } scope ImageCast-6 { prefix 234.142.142.128/29; interface all; } scope ImageCast-7 { prefix 234.142.142.136/30; interface all; } scope ImageCast-8 { prefix 234.142.142.140/31; interface all; } scope ImageCast-9 { prefix 234.142.142.142/32; interface all; } ssm-groups 232.0.0.0/8; forwarding-cache { threshold { suppress 50000; reuse 25000; } } } } protocols { igmp { interface all { version 2; } interface ge-2/2/0.12 { version 2; static { group 239.2.22.5; group 239.2.22.4; } } interface ge-2/2/3.0 { version 3; } } mld { interface all; } router-advertisement { interface ge-2/2/0.12 { no-other-stateful-configuration; prefix 2001:468:12:2::1/64; } interface ge-2/2/0.13 { no-other-stateful-configuration; prefix 2001:468:12:3::1/64; } interface ge-2/2/0.11 { no-other-stateful-configuration; prefix 2001:468:12:1::1/64; } interface ge-2/2/1.0 { no-other-stateful-configuration; prefix 2001:468:12:4::1/64; } interface ge-2/2/2.0 { no-other-stateful-configuration; prefix 2001:468:12:5::1/64; } interface ge-2/2/0.14 { no-other-stateful-configuration; prefix 2001:468:12:6::1/64; } interface ge-2/2/0.15 { no-other-stateful-configuration; prefix 2001:468:12:7::1/64; } interface ge-2/2/3.0 { no-other-stateful-configuration; prefix 2001:468:12:8::1/64; } } rsvp { /* BACKBONE to CHIC */ interface so-3/0/0.0; /* BACKBONE to NEWY */ interface so-0/0/0.0; /* BACKBONE TO ATLA */ interface so-1/1/0.0; } mpls { statistics { file mpls-stat; interval 60; } ipv6-tunneling; optimize-timer 360; preference 200; label-switched-path WASH->STTL { to 198.32.8.200; fast-reroute; } label-switched-path WASH->ATLA { to 64.57.28.243; fast-reroute; } label-switched-path WASH->CHIC { to 64.57.28.241; fast-reroute; } label-switched-path WASH->KANS { to 64.57.28.245; fast-reroute; } label-switched-path WASH->NEWY { to 64.57.28.242; fast-reroute; } label-switched-path WASH->SALT { to 64.57.28.246; fast-reroute; } label-switched-path WASH->LOSA-I2 { to 64.57.28.248; fast-reroute; } label-switched-path WASH->HOUS { to 64.57.28.244; fast-reroute; } path toITEC { 198.86.17.65 strict; 128.109.66.2 strict; 128.109.41.254 strict; } /* BACKBONE TO NEWY */ interface so-0/0/0.0; /* BACKBONE TO CHIC */ interface so-3/0/0.0; /* BACKBONE TO ATLA */ interface so-1/1/0.0; } bgp { log-updown; /* IPv4 iBGP Peers */ group INTERNET2 { type internal; local-address 64.57.28.249; family inet { any; } family inet-vpn { unicast; } family inet6-vpn { unicast; } Authentication Data Removed export NEXT-HOP-SELF; peer-as 11537; neighbor 198.32.8.200 { description STTLng; } neighbor 64.57.28.241 { description CHIC; } neighbor 64.57.28.242 { description NEWY; } neighbor 64.57.28.243 { description ATLA; } neighbor 64.57.28.244 { description HOUS; } neighbor 64.57.28.245 { description KANS; } neighbor 64.57.28.246 { description SALT; } inactive: neighbor 64.57.28.247 { description SEAT; } neighbor 64.57.28.248 { description LOSA; } } /* IPv6 iBGP Peers */ group INTERNET2-IPv6 { type internal; local-address 2001:468:9::1; family inet6 { any; } Authentication Data Removed export NEXT-HOP-SELF; peer-as 11537; neighbor 2001:468:16::1 { description "STTLng;"; } neighbor 2001:468:1::1 { description ATLA; } neighbor 2001:468:2::1 { description CHIC; } neighbor 2001:468:3::1 { description HOUS; } neighbor 2001:468:4::1 { description KANS; } neighbor 2001:468:5::1 { description LOSA; } neighbor 2001:468:6::1 { description NEWY; } neighbor 2001:468:7::1 { description SALT; } inactive: neighbor 2001:468:8::1 { description SEAT; } } group OTHER-INTERNAL { type internal; import REJECT-ALL; peer-as 11537; neighbor 134.68.246.49 { description "rtr.wash.net.internet2.edu/REN-ISAC [NO-MONITOR]"; local-address 64.57.28.249; family inet { unicast; } cluster 134.68.246.49; } neighbor 64.57.16.4 { description "nms-rpsv.wash zebra bgpd [NO-MONITOR]"; local-address 64.57.16.1; family inet { unicast; multicast; } cluster 64.57.16.1; } neighbor 2001:468:9:11::16:4 { description "nms-rpsv.wash zebra bgpd [NO-MONITOR]"; local-address 2001:468:9:11::1; family inet6 { unicast; multicast; } } neighbor 134.68.246.51 { description "rtr.wash.net.internet2.edu/REN-ISAC [NO-MONITOR]"; local-address 64.57.28.249; family inet { unicast; } cluster 134.68.246.51; } neighbor 156.56.103.99 { multihop { ttl 10; } local-address 64.57.28.249; hold-time 65535; family inet { unicast; } } } group CONNECTOR { type external; metric-out igp; multihop { ttl 1; } family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ]; remove-private; neighbor 206.196.178.45 { description "Mid-Atlantic Crossroads (MAX)"; import [ SANITY-IN SET-PREF MAX-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 10886; } neighbor 192.88.192.137 { description OSCnet; import [ SANITY-IN SET-PREF OARNET-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 3112; } neighbor 204.238.76.5 { description "Drexel University"; import [ SANITY-IN SET-PREF DREXEL-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 11834; } neighbor 192.88.115.24 { description 3ROX; import [ SANITY-IN SET-PREF PSC-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 5050; } neighbor 206.196.177.105 { description "Mid-Atlantic Crossroads BACKUP peering through NGIX-East"; import [ SANITY-IN SET-PREF MAX-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 10886; } neighbor 138.18.47.41 { description "Wright State Univ campus inside of Wright-Patterson AFB, Dayton, through DREN/MCI"; import [ SANITY-IN SET-PREF WSU-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 668; } neighbor 199.18.156.241 { description "OARNET mcast-only for their non-I2 customers"; import [ SANITY-IN SET-PREF OARNET-MULTICAST-IN ]; family inet { multicast; } Authentication Data Removed peer-as 600; } } group CONNECTOR6 { type external; metric-out igp; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ]; remove-private; neighbor 2001:468:c00:ffee::1 { description "Mid-Atlantic Crossroads (MAX)"; import [ SANITY6 SET-PREF MAX-IN6 ]; Authentication Data Removed peer-as 10886; } /* turned down temporarily - see ticket 10397 */ inactive: neighbor 2001:468:ff:d4b::2 { description OARnet; import [ SANITY6 SET-PREF OARNET-IN6 ]; Authentication Data Removed peer-as 3112; } neighbor 2001:5e8:0:fffd:0:2:2:1 { description "Three Rivers Optical Exchange (3ROX)"; import [ SANITY6 SET-PREF PSC-IN6 ]; Authentication Data Removed peer-as 5050; } neighbor 2001:468:ff:185c::2 { description "Mid-Atlantic Crossroads BACKUP via NGIX-E"; import [ SANITY6 SET-PREF MAX-IN6 ]; Authentication Data Removed peer-as 10886; } neighbor 2001:468:ff:0960::2 { description "Drexel [NO-MONITOR]"; import [ SANITY6 SET-PREF DREXEL-IN6 ]; Authentication Data Removed peer-as 11834; } neighbor 2001:468:ff:9c2::2 { description "OARnet IPv6 Multicast [NO-MONITOR]"; import [ SANITY6 SET-PREF OARNET-IN6 ]; family inet6 { any; } Authentication Data Removed peer-as 600; } } inactive: group ISP-MCAST { import [ SANITY-IN SET-PREF-PEER ISP-MCAST-IN ]; family inet { multicast { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ISP-MCAST-OUT ]; remove-private; } group FEDNET { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER FEDNET-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 FEDNET-OUT ]; remove-private; neighbor 140.173.1.237 { description DRAGON; /* treated as a connector */ import [ SANITY-IN SET-PREF DRAGON-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 7082; include-mp-next-hop; } neighbor 192.84.8.253 { description NISN; Authentication Data Removed peer-as 297; } neighbor 138.18.47.33 { description "Dren (Worldcom via UMD NGIX)"; Authentication Data Removed peer-as 668; } neighbor 198.32.11.22 { description "NREN-Goddard via NGIX"; hold-time 30; family inet { unicast { prefix-limit { maximum 3000; teardown 90; } } multicast { prefix-limit { maximum 5000; teardown 90; } } } Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 GEANT-TO-NREN CLARA-TO-NREN FEDNET-OUT ]; peer-as 24; } neighbor 64.57.28.41 { description "NREN-McLEAN via NGIX"; hold-time 30; family inet { unicast { prefix-limit { maximum 3000; teardown 90; } } multicast { prefix-limit { maximum 5000; teardown 90; } } } Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 GEANT-TO-NREN CLARA-TO-NREN FEDNET-OUT ]; peer-as 24; } neighbor 198.124.194.9 { description "ESNET via NGIX"; Authentication Data Removed peer-as 293; } neighbor 137.227.2.181 { description "US Geological Survey"; Authentication Data Removed peer-as 22284; } } group ITN { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER ITN-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ITN-OUT ]; remove-private; /* ESNET routes exported to GEANT as backup per UCAID agreement with Dante */ neighbor 62.40.125.17 { description "GEANT (Frankfurt) via MAX"; family inet { unicast { prefix-limit { maximum 5000; teardown 90; } } multicast { prefix-limit { maximum 5000; teardown 90; } } } Authentication Data Removed export [ DATATAG-DEMO SANITY-OUT ORIGINATE4 ORIGINATE6 ESNET-TO-GEANT NREN-TO-GEANT ITN-OUT ]; peer-as 20965; } neighbor 198.32.11.106 { description "CLARA via NGIX and Awave-FIU"; Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ESNET-TO-AMPATH ITN-OUT ]; peer-as 27750; } neighbor 64.57.28.62 { description "RNP via Atlantic Wave"; Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ESNET-TO-AMPATH ITN-OUT ]; peer-as 1916; } } group ITN6 { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER ITN-IN6 ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ITN-OUT6 ]; remove-private; neighbor 2001:0798:0014:10AA::11 { description "GEANT - Frankfurt IPv6"; Authentication Data Removed peer-as 20965; } neighbor 2001:468:ff:18c5::2 { description "CLARA via NGIX & Awave-FIU"; Authentication Data Removed peer-as 27750; } } group FEDNET6 { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER FEDNET-IN6 ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 FEDNET-OUT6 ]; remove-private; neighbor 2001:468:ff:18c2::2 { description "NREN-Goddard via NGIX"; family inet6 { unicast { prefix-limit { maximum 3000; teardown 90; } } } Authentication Data Removed peer-as 24; } neighbor 2001:468:ff:18c3::2 { description "DREN v6-only testbed"; family inet6 { any; } Authentication Data Removed peer-as 668; } neighbor 2001:468:ff:18c4::2 { description "DREN network"; family inet6 { any; } Authentication Data Removed peer-as 668; } neighbor 2001:468:ff:09c1::2 { description "NREN-McLean via NGIX & Dragon"; family inet6 { unicast { prefix-limit { maximum 3000; teardown 90; } } } Authentication Data Removed peer-as 24; } neighbor 2001:468:ff:9c3::2 { description "ESNET IPv6 via NGIX [NO-MONITOR]"; family inet6 { any; } Authentication Data Removed peer-as 293; } } } isis { export V6-IGP-AGG; spf-delay 200; no-authentication-check; rib-group { inet isis-rg; inet6 isis6-rg; } level 2 wide-metrics-only; /* BACKBONE TO NEWY */ interface so-0/0/0.0 { level 1 disable; level 2 metric 278; } /* BACKBONE TO ATLA */ interface so-1/1/0.0 { level 1 disable; level 2 metric 700; } /* BACKBONE TO CHIC */ interface so-3/0/0.0 { level 1 disable; level 2 metric 905; } interface ge-3/1/0.30 { level 1 disable; level 2 passive; } interface ge-3/1/0.31 { level 1 disable; level 2 passive; } interface ge-3/1/0.50 { level 1 disable; level 2 metric 9999; } /* Run IS-IS Passively on all interface */ interface all { level 1 disable; level 2 passive; } } msdp { inactive: apply-groups MSDP; rib-group mcast-rpf-rg; group INTERNET2 { mode mesh-group; local-address 64.57.28.249; /* STTLng */ peer 198.32.8.200; /* SNVAng */ peer 198.32.8.201; /* CHIC */ peer 64.57.28.241; /* NEWY */ peer 64.57.28.242; /* ATLA */ peer 64.57.28.243; /* HOUS */ peer 64.57.28.244; /* KANS */ peer 64.57.28.245; /* SALT */ peer 64.57.28.246; /* SEAT */ inactive: peer 64.57.28.247; /* LOSA */ peer 64.57.28.248; } group CONNECTOR { export MSDP-FILTER; import MSDP-FILTER; /* MAX */ peer 206.196.178.45 { local-address 206.196.178.46; } /* OARNET */ peer 192.88.192.137 { local-address 192.88.192.138; } /* OARNET MCAST-ONLY */ peer 199.18.156.241 { local-address 199.18.156.242; } /* MAX backup peering via NGIX-E */ peer 206.196.177.105 { local-address 206.196.177.106; } /* Drexel University */ peer 204.238.76.5 { local-address 204.238.76.6; } /* Three Rivers Optical Exchange (3ROX) */ peer 192.88.115.24 { local-address 192.88.115.25; } } group FEDNET { export MSDP-FILTER; import MSDP-FILTER; /* NISN (via NGIX-E) */ peer 192.84.8.253 { local-address 192.84.8.254; } /* DREN (via NGIX-E) */ peer 138.18.9.253 { local-address 138.18.47.34; } /* NREN (via NGIX-E) */ peer 198.32.11.22 { local-address 198.32.11.21; } } group ITN { export MSDP-FILTER; import MSDP-FILTER; /* CLARA via NGIX-AWave */ peer 198.32.11.106 { local-address 198.32.11.105; } /* RNP via Atlantic Wave */ peer 64.57.28.62 { local-address 64.57.28.61; } /* GEANT - Frankfort */ peer 62.40.125.17 { local-address 62.40.125.18; } } } pim { rib-group { inet mcast-rpf-rg; inet6 mcast-rpf6-rg; } import pim-join-filter; rp { bootstrap-import REJECT-ALL; bootstrap-export REJECT-ALL; local { family inet { address 198.32.8.238; group-ranges { 224.0.0.0/4; } } } embedded-rp; static { address 2001:468::1 { group-ranges { ff05::/16; } } address 2001:660:3007:300:1:: { group-ranges { ff0e::/16; ff1e::/16; } } address 2001:700:e000:501::2 { group-ranges { ff3e:30:2001:700::/64; } } } } interface all { mode sparse; version 2; } interface fxp0.0 { disable; } /* Merit shared access circuit - VC to Qwest */ interface so-2/1/2.0 { disable; } } connections { lsp-switch U->IPLStoIPLS->WASH { transmit-lsp IPLS->WASH; ## 'IPLS->WASH' is not defined receive-lsp IU->IPLS; } lsp-switch WASH->IPLStoIPLS->IU { transmit-lsp IPLS->IU; ## 'IPLS->IU' is not defined receive-lsp WASH->IPLS; } lsp-switch ITEC->WASHtoWASH->IPLS { transmit-lsp WASH->IPLS; ## 'WASH->IPLS' is not defined receive-lsp ITEC->WASH; } } } policy-options { prefix-list ALLOW-ALL { 0.0.0.0/0; } prefix-list BGP-PEERS { apply-path "protocols bgp group <*> neighbor <*>"; } prefix-list BGP-PEERS6 { apply-path "protocols bgp group <*> neighbor <*:*>"; } /* List of prefixes which Abilene originates */ prefix-list INTERNAL { /* Internet2 Backbone */ 64.57.16.0/20; /* Abilene Backbone */ 198.32.8.0/22; /* Abilene Observatory */ 198.32.12.0/22; /* MANLAN */ 198.32.154.0/24; } /* List of IPv6 prefixes Abilene originates */ prefix-list INTERNAL6 { 2001:468::/32; } prefix-list MSDP-PEERS { apply-path "protocols msdp group <*> peer <*>"; } Prefix Stanza Removed Prefix Stanza Removed prefix-list QUERY-HOSTS-INTERNAL { /* nocmon.net.internet2.edu -- temp monitoring host */ 64.57.25.18/32; /* winger.uits.iu.edu -- snapp */ 129.79.6.137/32; /* pine.ucs.indiana.edu -- sweeny */ 129.79.9.1/32; /* alertmon-dev.grnoc.iu.edu */ 129.79.216.72/32; /* dc-snmp.wcc.grnoc.iu.edu */ 129.79.216.79/32; /* dc-1.grnoc.iu.edu -- SNMP Data Collector */ 134.68.107.22/32; /* snmp.grnoc.iu.edu -- SNMP Data Collection */ 134.68.107.23/32; 134.68.107.113/32; /* mon-dev.grnoc.iu.edu */ 134.68.107.123/32; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; } prefix-list QUERY-HOSTS-EXTERNAL { /* nocmon.net.internet2.edu -- temp monitoring host */ 64.57.25.18/32; /* Boston University--ticket#11647 */ 128.197.10.4/32; /* Boston University--ticket#11647 */ 128.197.11.51/32; /* Boston University--ticket#11647 */ 128.197.11.223/32; /* Boston University--ticket#11647 */ 128.197.11.224/32; /* added ndb2-blmt to QUERY-HOSTS-EXTERNAL */ 129.79.5.18/32; /* alertmon-dev.grnoc.iu.edu */ 129.79.216.72/32; 134.68.107.113/32; /* arbor11.ren-isac.net -- Arbor Peakflow1 */ 134.68.246.49/32; /* arbor21.ren-isac.net -- Arbor Peakflow2 */ 134.68.246.51/32; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; /* ANML - ArborNetworks */ 156.56.103.9/32; /* ANML - ArborNetworks */ 156.56.103.10/32; /* ANML - ArborNetworks */ 156.56.103.11/32; /* ANML - ArborNetworks */ 156.56.103.12/32; /* ANML - ArborNetworks */ 156.56.103.53/32; /* Ohio ITEC - nf6.itec.oar.net */ 192.148.251.26/32; /* Ohio ITEC - nf7.itec.oar.net */ 192.148.251.27/32; /* netflow2.internet2.edu -- I2 Netflow Collector */ 198.108.90.142/32; /* discvenue.internet2.edu */ 207.75.164.95/32; /* netflow2.internet2.edu -- I2 Netflow Collector */ 207.75.165.99/32; } prefix-list TACACS-SERVERS { /* tacacs2.grnoc.iu.edu */ 129.79.216.162/32; /* tacacs.grnoc.iu.edu */ 134.68.107.17/32; } Prefix Stanza Removed prefix-list DNS-SERVERS { 129.79.5.100/32; 134.68.1.9/32; } prefix-list NTP-SERVERS { /* ntp.indiana.edu */ 129.79.5.100/32; /* ntp-1.gw.uiuc.edu */ 130.126.24.24/32; 134.68.1.9/32; /* ntp-e.abilene.ucaid.edu */ 198.32.10.254/32; /* ntp-w.abilene.ucaid.edu */ 198.32.11.141/32; } prefix-list INGIG; prefix-list CPS-INGIG { /* Ball State University */ 12.159.195.0/24; /* Ball State University */ 12.159.206.0/23; /* Ball State University */ 12.159.209.0/24; /* Monroe County Community School Corporation */ 66.244.122.0/23; /* Purdue University Calumet */ 69.51.160.0/19; /* CSPAN Archives */ 72.12.215.0/24; /* Purdue University */ 128.10.0.0/16; /* Purdue University */ 128.46.0.0/16; /* Purdue University */ 128.210.0.0/16; /* Purdue University */ 128.211.0.0/16; /* Indiana University */ 129.79.0.0/16; /* Saint Joseph's College */ 131.93.0.0/16; /* Indiana University */ 134.68.0.0/16; /* Indiana State University */ 139.102.0.0/16; /* Indiana University */ 140.182.0.0/16; /* Saint Mary's College */ 147.53.0.0/16; /* Ball State University */ 147.226.0.0/16; /* Indiana University */ 149.159.0.0/16; /* Indiana University */ 149.160.0.0/14; /* Indiana University */ 149.164.0.0/16; /* Indiana University */ 149.165.0.0/16; /* Indiana University */ 149.166.0.0/16; /* Valparaiso University */ 152.228.0.0/16; /* Indiana University */ 156.56.0.0/16; /* IHETS */ 157.91.0.0/16; /* Earlham College */ 159.28.0.0/16; /* Vincennes University */ 159.218.0.0/16; /* DePauw University */ 163.120.0.0/16; /* Purdue University North Central */ 163.245.0.0/16; /* IHETS */ 165.138.0.0/16; /* IHETS */ 165.139.0.0/16; /* Indianapolis Public Schools */ 167.217.0.0/16; /* IVYTech Community College of Indiana */ 168.91.0.0/16; /* Indiana Purdue Fort Wayne */ 168.102.0.0/17; /* State of Indiana */ 192.104.19.0/24; /* University of Indianapolis */ 192.146.191.0/24; /* University of Indianapolis */ 192.146.192.0/24; /* Manchester College */ 192.189.3.0/24; /* Hanover College */ 192.200.128.0/21; /* University of Southern Indiana */ 192.206.9.0/24; /* University of Southern Indiana */ 192.206.10.0/23; /* Franklin College of Indiana */ 192.207.174.0/23; /* Franklin College of Indiana */ 192.207.176.0/23; /* Franklin College of Indiana */ 192.207.178.0/24; /* Goshen College */ 198.51.243.0/24; /* Goshen College */ 198.51.244.0/24; /* Private Academic Library Network of Indiana */ 198.62.84.0/24; /* Tri-State University */ 198.62.98.0/24; /* IHETS */ 199.8.0.0/16; /* Purdue University - Agriculture Information Technology */ 204.52.32.0/20; /* Purdue University - Agriculture Information Technology */ 204.52.48.0/20; /* Vigo County School Corp. */ 205.137.32.0/20; /* Purdue University Calumet */ 205.215.64.0/18; /* Indiana State Library */ 208.119.0.0/16; } prefix-list RADIUS-SERVERS { 129.79.216.162/32; 134.68.107.17/32; } prefix-list BGP-PEERS-CPS { apply-path "routing-instances cps protocols bgp group <*> neighbor <*>"; } prefix-list MAX-PARTICIPANT { 63.164.28.0/22; 63.171.236.0/24; 65.113.61.0/24; 65.114.168.128/25; 65.114.168.192/26; 65.123.202.0/25; 65.160.123.0/24; 65.162.18.0/23; 65.172.14.0/24; 65.172.70.0/24; 66.208.61.0/24; 128.8.0.0/16; 128.82.0.0/16; 128.143.0.0/16; 128.150.0.0/16; 128.164.0.0/16; 128.172.0.0/16; 128.173.0.0/16; 128.177.16.0/23; 128.177.18.0/24; 128.220.0.0/16; 128.231.0.0/16; 128.239.0.0/16; 128.244.0.0/16; 129.2.0.0/16; 129.43.0.0/16; 129.165.0.0/16; 129.174.0.0/16; 130.14.0.0/16; 130.129.0.0/16; 134.231.0.0/16; 136.242.0.0/16; 137.54.0.0/16; 137.187.0.0/16; 137.198.0.0/16; 138.220.0.0/16; 139.70.0.0/16; 140.90.0.0/16; 140.147.0.0/16; 140.173.153.0/29; 140.173.170.0/24; 140.173.174.0/26; 140.173.180.0/24; 141.142.204.0/24; 141.161.0.0/16; 141.166.0.0/16; 147.9.0.0/16; 148.129.0.0/16; 148.129.64.0/19; 148.129.128.0/19; 155.206.0.0/16; 156.40.0.0/16; 157.98.0.0/16; 159.230.0.0/16; 161.253.0.0/16; 162.99.224.0/19; 162.129.0.0/16; 164.106.0.0/16; 164.114.0.0/16; 165.112.0.0/16; 169.154.0.0/17; 169.154.128.0/17; 192.5.215.0/24; 192.12.209.0/24; 192.26.10.0/24; 192.35.48.0/24; 192.35.49.0/24; 192.35.129.0/24; 192.52.179.0/24; 192.54.96.0/24; 192.58.3.0/24; 192.58.232.0/24; 192.64.69.0/24; 192.70.187.0/24; 192.86.97.0/24; 192.86.98.0/24; 192.86.99.0/24; 192.86.100.0/24; 192.86.101.0/24; 192.86.102.0/24; 192.86.103.0/24; 192.86.104.0/24; 192.86.105.0/24; 192.86.106.0/24; 192.102.88.0/24; 192.107.190.0/24; 192.107.195.0/24; 192.124.118.0/24; 192.156.228.0/24; 192.231.145.0/24; 192.231.146.0/24; 192.231.147.0/24; 192.239.66.0/24; 198.10.49.0/24; 198.31.12.0/24; 198.62.77.0/24; 198.77.76.0/24; 198.77.177.0/24; 198.82.0.0/16; 198.118.0.0/15; 198.181.231.0/24; 198.186.238.0/23; 198.206.32.0/20; 198.206.48.0/21; 199.0.138.0/23; 199.26.254.0/24; 199.75.86.0/23; 199.79.165.0/24; 199.79.166.0/24; 199.111.162.0/23; 199.111.164.0/22; 199.111.168.0/21; 199.111.176.0/20; 199.111.192.0/18; 199.125.175.0/24; 199.249.158.0/24; 204.91.114.0/24; 204.192.128.0/17; 204.194.224.0/22; 204.194.228.0/23; 205.128.154.0/23; 205.131.248.0/21; 205.156.0.0/19; 205.156.32.0/20; 205.156.48.0/21; 205.160.38.0/23; 205.253.57.0/24; 206.196.160.0/19; 206.196.176.0/21; 206.229.212.0/22; 206.241.0.0/22; 206.241.3.0/24; 206.241.145.0/24; 206.241.148.0/23; 206.241.252.0/24; 206.241.253.0/24; 207.77.112.0/20; 207.245.162.0/24; 208.16.73.0/24; 208.22.77.0/24; 208.22.78.0/24; 208.35.27.64/26; 216.38.95.0/24; } prefix-list MAX-SPONSORED { 65.127.220.0/23; 67.133.232.0/23; 160.111.0.0/16; 160.253.0.0/16; 192.12.83.0/24; 192.207.234.0/24; 192.239.84.0/24; 192.245.136.0/24; 198.91.32.0/21; 198.91.40.0/23; 199.33.3.0/24; 199.133.3.0/24; 199.133.32.0/24; 199.133.35.0/24; 199.133.38.0/24; 199.133.45.0/24; 199.133.46.0/24; 199.133.47.0/24; 199.133.48.0/24; 199.133.49.0/24; 199.133.51.0/24; 199.133.52.0/24; 199.133.54.0/24; 199.133.55.0/24; 199.133.56.0/24; 199.133.57.0/24; 199.133.58.0/24; 199.133.59.0/24; 199.133.60.0/24; 199.133.61.0/24; 199.133.62.0/24; 199.133.63.0/24; 199.133.64.0/24; 199.133.66.0/24; 199.133.67.0/24; 199.133.69.0/24; 199.133.72.0/24; 199.133.74.0/24; 199.133.75.0/24; 199.133.153.0/24; 199.133.179.0/24; 205.128.219.0/24; 205.128.220.0/22; } prefix-list MAX-SEGP { 4.17.88.0/21; 4.79.201.0/26; 64.5.128.0/20; 64.5.141.0/24; 64.5.144.0/24; 64.5.145.0/24; 64.5.147.0/24; 64.5.148.0/24; 64.5.152.0/24; 64.5.155.0/24; 64.5.159.0/24; 64.26.64.0/18; 65.160.148.0/23; 65.168.144.0/24; 66.250.190.0/24; 66.250.191.0/24; 76.7.54.0/23; 130.85.0.0/16; 131.118.0.0/16; 131.171.0.0/16; 134.192.0.0/16; 136.160.0.0/16; 137.45.0.0/16; 138.78.0.0/16; 151.188.0.0/16; 158.103.0.0/16; 169.156.0.0/16; 192.33.115.0/24; 192.33.116.0/24; 192.33.117.0/24; 192.131.232.0/24; 192.146.226.0/24; 192.188.199.0/24; 198.38.16.0/20; 198.51.208.0/24; 198.69.82.0/24; 198.200.181.0/24; 198.202.0.0/21; 199.88.192.0/24; 204.52.128.0/22; 204.62.32.0/20; 204.62.48.0/22; 204.152.152.0/23; 204.153.76.0/22; 207.86.27.160/27; 208.27.92.0/22; 208.40.149.48/28; 208.40.161.64/27; 208.40.177.0/24; 208.40.194.0/24; 209.114.143.0/24; 209.114.144.0/23; 209.114.187.8/29; 209.114.187.240/29; 209.116.253.32/27; 209.243.32.0/20; 216.54.48.0/23; 216.152.80.0/20; } prefix-list MAX-PARTICIPANTS6 { 2001:468:C00::/40; 2001:468:ffff:9c4::/64; 2001:468:ffff:185c::/64; 2001:04d0:9c00::/40; } prefix-list OARNET-PARTICIPANT { 64.247.64.0/18; 128.146.0.0/16; 129.22.0.0/16; 129.137.0.0/16; 130.101.0.0/16; 130.108.0.0/16; 131.123.0.0/16; 131.183.0.0/16; 132.235.0.0/16; 140.254.0.0/16; 164.107.0.0/16; 169.240.0.0/16; 192.5.109.0/24; 192.5.110.0/24; 192.5.111.0/24; 192.5.112.0/24; 192.5.113.0/24; 192.88.191.0/24; 192.88.192.0/24; 192.88.193.0/24; 192.88.194.0/24; 192.88.195.0/24; 192.132.213.0/24; 192.138.88.0/24; 192.148.235.0/24; 192.148.236.0/22; 192.148.240.0/21; 192.148.244.0/24; 192.148.248.0/22; 192.148.250.0/24; 192.148.251.0/24; 192.153.27.0/24; 192.153.28.0/24; 192.153.36.0/24; 192.153.37.0/24; 192.153.38.0/24; /* Ohio Supercomputing Center */ 192.153.39.0/24; 192.153.40.0/24; 192.153.41.0/24; 192.157.5.0/24; 192.232.26.0/23; /* OSU */ 192.232.26.0/24; /* OSU */ 192.232.27.0/24; 192.232.28.0/24; /* OARnet */ 198.30.86.0/24; /* OARnet */ 198.30.87.0/24; 199.26.250.0/24; 199.190.226.0/24; 199.249.228.0/24; 204.128.178.0/24; /* OARnet */ 206.244.200.0/21; } prefix-list OARNET-SPONSORED { 204.152.48.0/24; 204.152.49.0/24; 205.142.196.0/24; 205.142.197.0/24; 205.142.198.0/24; 205.142.199.0/24; } prefix-list OARNET-SEGP { 64.18.32.0/20; 64.113.176.0/20; 64.254.64.0/20; 65.182.112.0/20; 66.114.0.0/19; 66.144.22.0/24; 66.144.23.0/24; 66.145.194.0/24; 66.145.203.0/24; 66.203.16.0/20; 66.203.32.0/19; 129.1.0.0/16; 131.187.0.0/16; 131.238.0.0/16; 132.162.0.0/16; 134.53.0.0/16; 136.227.0.0/16; 136.247.0.0/16; 137.148.0.0/16; 138.28.0.0/16; 140.103.0.0/16; 140.106.0.0/16; 140.141.0.0/16; 140.220.0.0/16; 140.228.0.0/16; 141.110.0.0/16; 141.139.0.0/16; 143.105.0.0/16; 143.206.0.0/16; 144.50.0.0/16; 146.78.0.0/16; 146.85.0.0/16; 149.143.0.0/16; 150.134.0.0/16; 156.63.57.0/24; 156.63.144.0/24; 156.63.176.0/24; 157.134.0.0/16; 163.11.0.0/16; 164.83.0.0/16; 192.42.153.0/24; 192.55.234.0/24; 192.68.223.0/24; 192.70.252.0/24; 192.131.123.0/24; 192.150.115.0/24; 192.153.31.0/24; 192.153.32.0/24; 192.153.33.0/24; 192.153.34.0/24; /* The National Underground Railroad Freedom Center (NURFC) */ 192.153.35.0/24; 192.232.30.0/24; 198.30.0.0/16; 198.140.201.0/24; 198.203.64.0/18; 198.234.184.0/23; 198.234.187.0/24; 198.234.188.0/22; 198.234.192.0/22; 198.234.196.0/23; 198.234.200.0/21; 199.18.0.0/16; /* Mount Union College */ 199.18.32.0/20; /* Mount Union College */ 199.18.204.0/22; /* Mount Union College */ 199.18.208.0/22; /* Mount Union College */ 199.18.234.0/23; /* Mount Union College */ 199.18.236.0/22; /* Mount Union College */ 199.18.238.0/24; /* Mount Union College */ 199.18.239.0/24; 199.120.181.0/24; 199.218.0.0/16; 204.9.144.0/21; 204.10.216.0/21; 204.11.184.0/21; 204.89.239.0/24; 204.128.217.0/24; 205.133.0.0/16; 206.21.0.0/16; 206.244.0.0/16; /* Mount Union College */ 206.244.128.0/22; /* Cleveland Institute of Art */ 208.50.108.0/24; 208.71.72.0/21; 208.108.0.0/16; 208.122.64.0/19; 208.122.96.0/20; 209.34.112.0/20; 216.48.128.0/20; } prefix-list OARNET-PARTICIPANTS6 { 2610:a8::/32; } prefix-list DREXEL-PARTICIPANT { 129.25.0.0/16; 144.118.0.0/16; 192.54.238.0/24; 198.17.30.0/24; 204.238.76.0/24; } prefix-list DREXEL-SEGP { 144.26.0.0/16; /* West Chester University */ 144.80.0.0/16; 147.64.0.0/16; 148.137.0.0/16; 151.161.0.0/16; 156.12.0.0/16; 157.62.0.0/16; 157.160.0.0/16; 158.83.0.0/16; 166.66.0.0/16; 192.147.113.0/24; 192.148.218.0/24; 192.148.234.0/24; 192.149.243.0/24; 192.152.127.0/24; 192.153.187.0/24; 192.190.237.0/24; 192.206.29.0/24; 192.234.172.0/24; 198.206.191.0/24; 199.5.197.0/24; 199.5.198.0/23; 199.5.200.0/24; 204.108.160.0/19; 204.235.144.0/21; 204.235.148.0/23; 204.235.158.0/23; 204.235.160.0/20; 205.149.64.0/19; 206.225.96.0/19; 209.250.192.0/19; } prefix-list PSC-PARTICIPANT { 63.118.64.0/23; 66.71.0.0/17; 128.2.0.0/16; 128.118.0.0/16; 128.182.0.0/16; 128.237.0.0/16; 130.49.0.0/16; 130.203.0.0/16; 136.142.0.0/16; 146.186.0.0/16; 147.73.0.0/16; 150.212.0.0/16; 150.231.0.0/16; 157.182.0.0/16; 192.5.146.0/24; 192.5.157.0/24; 192.5.159.0/24; 192.12.32.0/24; 192.58.107.0/24; 192.68.217.0/24; 192.80.210.0/24; 192.88.99.0/24; 192.88.114.0/24; 192.88.115.0/24; 192.88.209.0/24; 192.88.210.0/24; 192.101.140.0/24; 198.32.224.0/24; 199.111.112.0/20; 199.164.236.0/24; 204.155.176.0/20; 204.194.24.0/22; 204.194.28.0/22; } prefix-list PSC-SPONSORED { 147.72.107.0/24; 147.72.108.0/22; 147.72.112.0/22; 147.72.116.0/23; 147.72.118.0/24; 198.206.16.0/20; } prefix-list PSC-SEGP { 63.133.224.0/24; 63.133.225.0/24; 63.133.226.0/24; 63.133.227.0/24; 63.133.228.0/24; 63.133.229.0/24; 63.133.230.0/24; 63.133.231.0/24; 63.133.232.0/24; 63.133.233.0/24; 63.133.234.0/24; 63.133.235.0/24; 63.133.236.0/24; 63.133.237.0/24; 63.133.238.0/24; 63.133.239.0/24; 63.133.240.0/24; 63.133.241.0/24; 63.133.242.0/24; 63.133.243.0/24; 63.133.244.0/24; 63.133.245.0/24; 63.133.246.0/24; 63.133.247.0/24; 63.133.248.0/24; 63.133.249.0/24; 63.133.250.0/24; 63.133.251.0/24; 63.133.252.0/24; 63.133.253.0/24; 63.133.254.0/24; 64.83.132.0/24; 64.83.133.0/24; 64.83.134.0/24; 64.83.135.0/24; 64.83.136.0/24; 64.83.137.0/24; 64.83.138.0/24; 64.83.140.0/24; 64.83.141.0/24; 64.83.142.0/24; 64.83.143.0/24; 64.83.152.0/24; 64.83.153.0/24; 64.83.155.0/24; 64.83.158.0/24; 65.110.114.0/24; 66.230.74.32/28; 72.237.88.0/22; 147.72.67.192/26; 150.232.0.0/16; 208.40.149.48/28; 208.40.161.64/27; 208.40.177.0/24; 208.40.180.0/24; 208.40.194.0/24; 209.114.143.0/24; 209.114.144.0/23; 209.114.187.240/29; } prefix-list SOX-BACKUP-PARTICIPANT { 64.156.8.128/25; 64.156.216.128/25; 65.115.176.0/24; 128.23.0.0/16; 128.61.0.0/16; 128.163.0.0/16; 128.163.11.0/24; 128.186.0.0/16; 128.192.0.0/16; 128.227.0.0/16; 129.59.0.0/16; 129.171.0.0/16; 129.171.0.0/19; 129.171.32.0/19; 129.171.64.0/19; 129.171.96.0/19; 129.171.128.0/19; 129.171.160.0/19; 129.171.192.0/19; 129.171.224.0/19; 129.252.0.0/16; 130.127.0.0/16; 130.160.0.0/16; 130.207.0.0/16; 131.91.0.0/16; 131.144.128.0/20; 131.204.0.0/16; 131.247.0.0/16; 132.170.0.0/16; 138.26.0.0/16; 139.62.0.0/16; 143.215.0.0/16; 144.174.0.0/16; 146.201.0.0/16; 146.229.0.0/16; 149.168.0.0/16; 152.2.0.0/16; 152.3.0.0/16; 152.7.0.0/16; 152.11.0.0/16; 152.14.0.0/16; 152.16.0.0/16; 152.19.0.0/16; 159.178.0.0/16; 160.36.0.0/16; 160.129.0.0/16; 163.246.0.0/16; 164.111.0.0/16; 165.6.5.0/24; 165.6.6.0/24; 165.6.7.0/24; 165.6.24.0/24; 168.223.0.0/16; 170.140.0.0/16; 192.31.89.0/24; 192.70.171.0/24; 192.80.53.0/24; 192.88.124.0/24; 192.111.108.0/24; 192.111.109.0/24; 192.111.110.0/24; 192.111.123.0/24; 192.249.1.0/24; 192.249.2.0/23; 192.249.4.0/22; 192.249.8.0/21; 192.249.11.0/24; 198.78.192.0/19; 198.137.16.0/20; 199.4.250.0/23; 199.4.250.0/24; 199.4.251.0/24; 199.76.32.0/20; 199.76.144.0/20; 199.76.160.0/19; 199.76.192.0/24; 199.77.128.0/17; 199.90.0.0/16; 199.242.231.0/24; 199.242.232.0/24; 199.242.233.0/24; 204.29.106.0/23; 204.68.64.0/19; 204.85.191.0/24; 204.85.192.0/18; 204.89.132.0/23; 204.89.132.0/24; 204.89.133.0/24; 204.145.157.0/24; 204.145.215.0/24; 204.198.72.0/22; 204.198.76.0/23; 204.211.0.0/16; 204.238.30.0/24; 206.240.24.0/22; 206.240.192.0/19; 206.240.216.0/24; 206.240.220.0/24; 206.240.221.0/24; 207.4.0.0/16; 207.192.0.0/18; 209.149.48.0/20; } prefix-list SOX-BACKUP-CORPORATE { 12.107.208.0/23; 66.187.224.0/20; 204.85.14.0/24; } prefix-list SOX-BACKUP-SPONSORED { 66.187.234.0/24; 74.255.42.0/24; 143.88.0.0/16; 147.70.0.0/16; 150.182.128.0/18; 152.97.0.0/16; 161.45.0.0/16; 163.118.0.0/16; 192.30.208.0/24; 192.67.134.0/24; 192.83.232.0/24; 204.62.251.0/24; 204.152.130.0/24; 204.152.131.0/24; 204.246.192.0/21; 205.167.24.0/24; 205.167.25.0/24; 216.64.76.0/24; } prefix-list SOX-BACKUP-SEGP { 72.158.165.0/24; 98.17.253.0/24; 128.109.0.0/16; 128.192.0.0/16; 129.66.0.0/16; 129.66.20.0/24; 130.218.0.0/16; 130.254.0.0/16; 131.144.0.0/16; 134.224.0.0/16; 137.220.0.0/16; 141.165.0.0/16; 147.133.0.0/16; 149.149.0.0/16; 150.216.0.0/16; 152.1.0.0/16; 152.2.0.0/15; 152.4.0.0/14; 152.8.0.0/13; 152.16.0.0/12; 152.32.0.0/12; 152.36.0.0/16; 152.48.0.0/14; 152.53.0.0/19; 152.54.0.0/20; 153.9.0.0/16; 157.89.0.0/16; 157.149.0.0/16; 158.93.0.0/16; 160.10.0.0/16; 161.6.0.0/16; 167.7.38.0/24; 167.7.39.0/24; 167.7.210.0/27; 167.7.241.0/24; 167.7.248.64/27; 167.7.251.0/27; 168.8.0.0/15; 168.12.0.0/14; 168.16.0.0/15; 168.18.0.0/15; 168.20.0.0/15; 168.22.0.0/15; 168.24.0.0/15; 168.26.0.0/15; 168.28.0.0/15; 168.30.0.0/15; 169.150.0.0/16; 170.180.0.0/14; 170.185.0.0/16; 192.48.117.0/24; 192.88.111.0/24; 192.101.21.0/24; 192.101.22.0/23; 192.101.24.0/24; 192.103.126.0/24; 192.107.44.0/24; 192.111.112.0/24; 192.122.237.0/24; 192.137.210.0/24; 192.147.30.0/24; 192.152.249.0/24; 192.154.33.0/24; 192.154.38.0/24; 192.154.41.0/24; 192.154.43.0/24; 192.154.45.0/24; 192.154.54.0/24; 192.154.55.0/24; 192.154.61.0/24; 192.154.62.0/24; 192.154.64.0/24; 192.154.67.0/24; 192.154.78.0/24; 192.189.244.0/24; 192.203.127.0/24; 192.211.32.0/21; 192.211.40.0/22; 192.211.44.0/24; 192.211.45.0/24; 192.245.165.0/24; 192.245.221.0/24; 192.245.222.0/24; 192.245.223.0/24; 192.245.224.0/24; 198.49.31.0/24; 198.72.72.0/22; 198.85.0.0/16; 198.86.0.0/16; 198.135.235.0/24; 198.137.22.0/24; 198.179.130.0/24; 198.180.132.0/22; 198.190.216.0/24; 198.200.158.0/24; 198.204.92.0/24; 198.232.64.0/18; 198.232.96.0/21; 199.5.154.0/23; 199.20.16.0/20; 199.33.130.0/24; 199.33.131.0/24; 199.33.132.0/24; 199.33.133.0/24; 199.33.134.0/24; 199.80.8.0/21; 199.88.16.0/20; 199.248.173.0/24; 199.248.174.0/24; 199.248.175.0/24; 199.248.176.0/24; 199.248.177.0/24; 199.248.178.0/24; 204.27.217.0/24; 204.29.64.0/18; 204.84.0.0/15; 205.174.48.0/20; 205.204.238.0/24; 205.204.242.0/24; 206.197.240.0/24; 206.219.128.0/18; 207.157.0.0/17; 207.232.128.0/18; 209.133.128.0/17; 216.69.0.0/18; 216.109.0.0/18; 216.249.132.0/22; 216.249.144.0/20; 216.249.160.0/20; 216.249.176.0/20; } prefix-list SOX-BACKUP-EXCEPTION-SEGP { 167.7.127.176/29; 167.7.248.112/29; 167.7.248.120/29; 167.7.248.208/29; 167.7.251.32/29; 167.7.251.64/29; 167.7.251.80/29; 167.7.251.96/29; 167.7.251.128/28; 167.7.251.144/28; 167.7.251.160/28; 167.7.251.192/29; } prefix-list SOX-BACKUP-EXCEPTION-FEDNET { 128.219.0.0/16; 134.167.0.0/16; 160.91.0.0/16; 192.31.96.0/24; 192.103.127.0/24; 192.188.177.0/24; 192.188.182.0/24; 198.124.41.0/24; 198.136.139.0/24; 198.148.251.0/24; 198.203.246.0/24; 198.207.237.0/24; 198.207.238.0/23; 198.207.240.0/24; 199.201.153.0/24; 199.201.154.0/24; 199.201.156.0/23; 199.201.158.0/24; } prefix-list SOX-BACKUP-EXCEPTION-SPONSORED { 146.82.167.176/29; 199.77.192.16/29; } prefix-list OARNET-CPSONLY { 12.41.33.0/24; 64.18.32.0/20; 64.31.64.0/18; 64.31.64.0/19; 65.163.228.0/23; 66.100.144.0/24; 66.100.145.0/24; 66.100.146.0/24; 66.100.147.0/24; 66.100.148.0/24; 66.100.149.0/24; 66.100.150.0/24; 128.156.0.0/16; 131.167.0.0/16; 134.243.0.0/16; 139.88.0.0/16; 162.50.0.0/16; 192.12.205.0/24; 192.55.90.0/23; 192.58.246.0/24; 192.68.143.0/24; 192.131.246.0/24; 192.148.236.0/24; 192.148.237.0/24; 192.148.238.0/24; 192.148.239.0/24; 192.153.26.0/23; 192.153.26.0/24; 192.153.28.0/22; 192.153.29.0/24; 192.153.30.0/24; 192.232.16.0/20; 198.4.94.0/24; 198.179.229.0/24; 198.242.35.0/24; 199.0.140.0/22; 199.26.177.0/24; 199.74.236.0/24; 199.74.237.0/24; 199.176.156.0/24; 199.178.128.0/18; 204.29.170.0/24; 204.90.74.0/24; 206.131.208.0/20; 207.42.216.0/24; 209.11.224.0/20; 216.28.31.0/24; } prefix-list PSC-PARTICIPANT6 { 2001:468:200::/40; 2001:5e8::/32; 2001:5e8::/33; 2002::/16; 2610:8::/32; } prefix-list WSU-PARTICIPANT { 192.148.236.0/24; } prefix-list WSU-EXCEPTION { 138.18.22.16/30; } prefix-list DRAGON-PARTICIPANT { 140.173.0.0/16; } prefix-list DREXEL-PARTICIPANTS6 { 2001:468:2000::/40; } prefix-list OARNET-MULTICAST-ROUTES { 128.146.0.0/16; 129.22.0.0/16; 131.123.0.0/16; 131.123.0.0/19; 131.123.32.0/20; 131.123.48.0/20; 131.123.64.0/19; 131.123.96.0/19; 131.123.128.0/17; 137.148.0.0/16; 140.254.0.0/16; 164.107.0.0/16; 192.5.109.0/24; 192.12.205.0/24; 192.68.143.0/24; 192.148.244.0/24; 192.150.115.0/24; 192.153.26.0/24; 192.153.41.0/24; 199.18.139.0/24; 199.18.140.0/24; 199.18.141.0/24; 206.21.72.0/24; 206.21.144.0/24; 206.21.145.0/24; 206.21.146.0/23; 206.21.148.0/22; 206.21.152.0/21; 206.244.152.0/22; } prefix-list PSC-EXCEPTION-SEGP { 208.40.149.48/28; 208.40.161.64/27; 209.114.187.8/29; 209.114.187.240/29; } prefix-list BGP-PEERS6-CPS { apply-path "routing-instances cps protocols bgp group CONNECTORS6 neighbor <*>"; } prefix-list CPS-3ROX-CPS-ONLY { 12.169.112.0/24; 63.118.64.0/23; 147.72.64.0/18; 147.128.0.0/16; 147.128.68.0/22; 150.212.0.0/16; 158.83.0.0/16; 162.51.0.0/16; 163.129.0.0/16; 169.144.0.0/16; 192.88.115.0/24; 204.9.144.0/21; 209.131.80.0/20; 216.152.144.0/20; } prefix-list OBSERVATORY-SSH { /* sysmon.grnoc.iu.edu */ 134.68.107.4/32; /* login.net.internet2.edu */ 134.68.107.10/32; /* nms-base */ 134.68.107.34/32; /* nms-login */ 134.68.107.36/32; /* skip */ 134.68.142.50/32; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; /* jump */ 192.12.206.196/32; } prefix-list OBSERVATORY-SSH6 { 0::0/0; } policy-statement CLARA-TO-NREN { term FROM-CLARA { from as-path CLARA; then accept; } } /* generic import policy for all connectors */ policy-statement CONNECTOR-IN { /* remove BGP communities which connectors should not announce */ term remove-comms { then { community delete LOW-PEERS; community delete HIGH-PEERS; next term; } } term discard { from { community DISCARD; /* only allow /24-/32 masks for discard routes */ route-filter 0.0.0.0/0 prefix-length-range /24-/32; } to rib inet.0; then { /* add no-export so these are leaked outside of Abilene */ community add NO-EXPORT; /* set next-hop to the destination-address on the dsc.0 interface */ next-hop 198.32.11.7; accept; } } /* allow unicast routes upto /27; note: routes have already passed the individual connector policy */ term allow-unicast { from { route-filter 0.0.0.0/0 upto /27; } to rib inet.0; then { community add PARTICIPANT; accept; } } term allow-multicast { from { route-filter 0.0.0.0/0 upto /27; } to rib inet.2; then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement CPS-3ROX-IN { term accept { from { protocol bgp; prefix-list-filter PSC-PARTICIPANT orlonger; prefix-list-filter PSC-SEGP orlonger; prefix-list-filter PSC-SPONSORED orlonger; prefix-list-filter PSC-EXCEPTION-SEGP exact; prefix-list-filter CPS-3ROX-CPS-ONLY orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-3ROX-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter PSC-PARTICIPANT6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement CPS-CONNECTOR-IN { term discard { from { community DISCARD; /* only allow /24-/32 masks for discard routes */ route-filter 0.0.0.0/0 prefix-length-range /24-/32; } then { /* add no-export so these are leaked outside of Abilene */ community add NO-EXPORT; /* set next-hop to the destination-address on the dsc.0 interface */ next-hop discard; accept; } } /* allow unicast routes upto /27; note: routes have already passed the individual connector policy */ term allow-unicast { from { route-filter 0.0.0.0/0 upto /24; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-CONNECTOR-OUT { /* announce routes from CPS peer networks */ term announce-peers { from { protocol bgp; community CPS-PEERS; } then accept; } term announce-internal { from { protocol static; route-filter 198.32.9.0/24 exact; route-filter 64.57.29.0/24 exact; } then accept; } term reject { then reject; } } policy-statement CPS-CONNECTOR-OUT6 { term announce-peers { from { protocol bgp; community CPS-PEERS; family inet6; } then accept; } term announce-internal { from { protocol static; family inet6; route-filter 2001:468:ff00::/40 exact; } then accept; } term reject { then reject; } } policy-statement CPS-DREXEL-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter DREXEL-PARTICIPANTS6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-EXPORT { term direct { from protocol direct; then { community add CPS; accept; } } term bgp { from protocol bgp; then { community add CPS; accept; } } term reject { then reject; } } policy-statement CPS-IMPORT { term bgp { from community CPS; then accept; } term reject { then reject; } } policy-statement CPS-MAX-IN { term accept { from { protocol bgp; prefix-list-filter MAX-PARTICIPANT orlonger; prefix-list-filter MAX-SEGP orlonger; prefix-list-filter MAX-SPONSORED orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-MAX-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter MAX-PARTICIPANTS6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-OARNET-IN { term accept { from { protocol bgp; prefix-list-filter OARNET-PARTICIPANT orlonger; prefix-list-filter OARNET-SPONSORED orlonger; prefix-list-filter OARNET-SEGP orlonger; prefix-list-filter OARNET-CPSONLY orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-OSCNET-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter OARNET-PARTICIPANTS6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement DATATAG-DEMO { term 1 { from { protocol static; route-filter 198.32.154.144/28 exact; } then accept; } } policy-statement DRAGON-IN { term participant { from { protocol bgp; prefix-list-filter DRAGON-PARTICIPANT orlonger; } then accept; } term reject-unicast { to rib inet.0; then reject; } } policy-statement DREXEL-IN { term participant { from { protocol bgp; prefix-list-filter DREXEL-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter DREXEL-SEGP orlonger; } then { community add SEGP; next policy; } } term reject-unicast { to rib inet.0; then reject; } } policy-statement DREXEL-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter DREXEL-PARTICIPANTS6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement ESNET-TO-AMPATH { term FROM-ESNET { from as-path ESNET; then accept; } } policy-statement ESNET-TO-GEANT { term FROM-ESNET { from as-path ESNET; then { as-path-prepend 11537; accept; } } } /* import policy for FEDNET peers */ policy-statement FEDNET-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term set-community { from protocol bgp; then { community add FEDNET; accept; } } } /* import policy for IPv6 FEDNET peers */ policy-statement FEDNET-IN6 { term set-community { from protocol bgp; then { community add FEDNET; accept; } } } /* export policy from FEDNET peers */ policy-statement FEDNET-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce ITN routes from peers w/exception to reach FEDNETs (ie IFTNs) */ term allow-iftn { from { protocol bgp; community IFTN; } then accept; } /* don't announce nlri=unicast routes from fednet or international peers */ term block-fednet-itn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET ITN NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement FEDNET-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement GEANT-TO-NREN { term FROM-GEANT { from as-path GEANT; then accept; } } /* import policy for mcast-only peerings with commercial ISPs */ policy-statement ISP-MCAST-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term allow { from protocol bgp; to rib inet.2; then { community add COMMERCIAL-PEER; accept; } } term reject { then reject; } } /* export policy for mcast-only peerings with commerical ISPs */ policy-statement ISP-MCAST-OUT { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term no-export { from community BLOCK-TO-COMMERCIAL; then reject; } /* only advertise participant routes */ term allow { from { protocol bgp; rib inet.2; community PARTICIPANT; } then accept; } term reject { then reject; } } /* import policy for IPv6 peerings with commercial ISPs */ policy-statement ISP-V6-IN { term allow { from protocol bgp; to rib inet6.0; then { community add COMMERCIAL-PEER; accept; } } term reject { then reject; } } /* export policy for IPv6 peerings with commercial ISPs */ policy-statement ISP-V6-OUT { term no-export { from community BLOCK-TO-COMMERCIAL; then reject; } /* only advertise participant routes */ term accept { from { protocol bgp; community PARTICIPANT; family inet6; } then accept; } term reject { then reject; } } /* import policy for IPv4 ITN peerings */ policy-statement ITN-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term block-as112 { from { route-filter 192.175.48.0/24 orlonger; } then reject; } term set-community { from protocol bgp; then { community add ITN; accept; } } } /* import policy for IPv6 ITN peerings */ policy-statement ITN-IN6 { term set-community { from protocol bgp; then { community add ITN; accept; } } } policy-statement ITN-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* don't announce nlri=unicast routes from fednet or nonitn peers */ term block-fednet-nonitn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement ITN-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement MAX-IN { term participant { from { protocol bgp; prefix-list-filter MAX-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter MAX-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter MAX-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term reject-unicast { then reject; } } policy-statement MAX-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter MAX-PARTICIPANTS6 exact; } then { community add PARTICIPANT; accept; } } term accept-v6-transit { from { as-path MAX-V6-TRANSIT; family inet6; } then { local-preference 100; community add COMMERCIAL-PEER; accept; } } term reject { then reject; } } policy-statement MSDP-FILTER { term bad-groups { from { route-filter 224.0.1.2/32 exact; route-filter 224.0.1.3/32 exact; route-filter 224.0.1.8/32 exact; route-filter 224.0.1.22/32 exact; route-filter 224.0.1.24/32 exact; route-filter 224.0.1.25/32 exact; route-filter 224.0.1.35/32 exact; route-filter 224.0.1.39/32 exact; route-filter 224.0.1.40/32 exact; route-filter 224.0.1.60/32 exact; route-filter 224.0.2.1/32 exact; route-filter 224.0.2.2/32 exact; route-filter 224.77.0.0/16 orlonger; route-filter 225.1.2.3/32 exact; route-filter 226.77.0.0/16 orlonger; route-filter 229.55.150.208/32 exact; route-filter 234.42.42.40/30 orlonger; route-filter 234.142.142.42/31 orlonger; route-filter 234.142.142.44/30 orlonger; route-filter 234.142.142.48/28 orlonger; route-filter 234.142.142.64/26 orlonger; route-filter 234.142.142.128/29 orlonger; route-filter 234.142.142.136/30 orlonger; route-filter 234.142.142.140/31 orlonger; route-filter 234.142.142.142/32 exact; route-filter 232.0.0.0/8 orlonger; route-filter 239.0.0.0/8 orlonger; } then reject; } term bad-sources { from { source-address-filter 10.0.0.0/8 orlonger; source-address-filter 127.0.0.0/8 orlonger; source-address-filter 172.16.0.0/12 orlonger; source-address-filter 192.168.0.0/16 orlonger; } then reject; } term bad-planetlab { from { source-address-filter 198.32.154.179/32 exact; source-address-filter 198.32.154.187/32 exact; source-address-filter 198.32.154.195/32 exact; source-address-filter 198.32.154.202/32 exact; source-address-filter 198.32.154.210/32 exact; source-address-filter 198.32.154.218/32 exact; source-address-filter 198.32.154.226/32 exact; source-address-filter 198.32.154.235/32 exact; source-address-filter 198.32.154.243/32 exact; source-address-filter 198.32.154.250/32 exact; } then reject; } term allow { then accept; } } policy-statement NEXT-HOP-SELF { from protocol bgp; then { next-hop self; } } /* import policy for IPv4 ITN peerings */ policy-statement NONITN-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term set-community { from protocol bgp; then { community add NONITN; accept; } } } /* import policy for IPv6 NONITN peerings */ policy-statement NONITN-IN6 { term set-community { from protocol bgp; then { community add NONITN; accept; } } } policy-statement NONITN-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* don't announce nlri=unicast routes from fednet or international peers */ term block-fednet-itn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET ITN NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement NONITN-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement NREN-TO-GEANT { term FROM-NREN { from as-path NREN; then accept; } } policy-statement OARNET-IN { term participant { from { protocol bgp; prefix-list-filter OARNET-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter OARNET-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter OARNET-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term reject-unicast { then reject; } } policy-statement OARNET-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter OARNET-PARTICIPANTS6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement OARNET-MULTICAST-IN { term allow-muticast { from { prefix-list OARNET-MULTICAST-ROUTES; } to rib inet.2; then { community add PARTICIPANT; accept; } } term reject { then reject; } } /* Redistribute IPv4 aggregates from static into BGP */ policy-statement ORIGINATE4 { term internal-addresses { from { protocol static; prefix-list INTERNAL; } then accept; } } /* Redistribute IPv6 Aggregates from static into BGP */ policy-statement ORIGINATE6 { term announce-aggregates { from { protocol static; prefix-list INTERNAL6; } then accept; } term block-more-specifics { from { route-filter 2001:468::/32 longer; } then reject; } } policy-statement PSC-IN { term participant { from { protocol bgp; prefix-list-filter PSC-PARTICIPANT orlonger; } then next policy; } term sponsored { from { protocol bgp; prefix-list-filter PSC-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term segp { from { protocol bgp; prefix-list-filter PSC-SEGP orlonger; } then { community add SEGP; next policy; } } term exception_segp { from { protocol bgp; prefix-list-filter PSC-EXCEPTION-SEGP exact; } then { community add SEGP; community add PARTICIPANT; accept; } } term sox-backup-participant { from { protocol bgp; prefix-list-filter SOX-BACKUP-PARTICIPANT orlonger; } then next policy; } term sox-backup-corporate { from { protocol bgp; prefix-list-filter SOX-BACKUP-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term sox-backup-sponsored { from { protocol bgp; prefix-list-filter SOX-BACKUP-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term sox-backup-segp { from { protocol bgp; prefix-list-filter SOX-BACKUP-SEGP orlonger; } then { community add SEGP; next policy; } } term sox-backup-exception-sponsored { from { protocol bgp; prefix-list-filter SOX-BACKUP-EXCEPTION-SPONSORED exact; } then { community add SPONSORED; community add PARTICIPANT; accept; } } term sox-backup-exception-segp { from { protocol bgp; prefix-list-filter SOX-BACKUP-EXCEPTION-SEGP exact; } then { community add SEGP; community add PARTICIPANT; accept; } } term sox-backup-exception-fednet { from { protocol bgp; prefix-list-filter SOX-BACKUP-EXCEPTION-FEDNET orlonger; } then { community add FEDNET; next policy; } } term reject-unicast { to rib inet.0; then reject; } } policy-statement PSC-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter PSC-PARTICIPANT6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement REJECT-ALL { then reject; } /* Remove certain BGP communities on import - only applied to peers */ policy-statement REMOVE-COMMS-IN { term remove { then { /* remove connector local-pref communities */ community delete HIGH; community delete LOW; /* remove discard community */ community delete DISCARD; } } } /* Remove certain BGP communities on export - applied to connectors and peers */ policy-statement REMOVE-COMMS-OUT { term remove { then { /* remove connector and peer local-pref communities */ community delete HIGH-PEERS; community delete LOW-PEERS; community delete LOW; community delete HIGH; /* remove discard community */ community delete DISCARD; } } } /* reject routes we should never accept */ policy-statement SANITY-IN { /* Reject any BGP prefix if a private AS is in the path */ term block-private-asn { from as-path PRIVATE; then reject; } /* Reject any BGP NLRI=Unicast prefix if a commercial ISP's AS is in the path */ term block-commercial-asn { from as-path COMMERCIAL; to rib inet.0; then reject; } term block-nlr-transit { from as-path NLR; then reject; } /* Reject BGP prefixes that should never appear in the routing table */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } /* Reject BGP prefixes which Abilene originates */ term block-internal { from { prefix-list INTERNAL; } then reject; } } /* Block announcements for prefixes we should never announce */ policy-statement SANITY-OUT { /* Don't annouce any route with a private AS in the path */ term block-private-asn { from as-path PRIVATE; then reject; } /* Don't announce NLRI=Unicast routes if a commercial ISP's AS is in the path */ term block-commercial-asn { from { rib inet.0; as-path COMMERCIAL; } then reject; } /* Don't announce reserved and special prefixes */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } } /* Block IPv6 routes that should never been accepted or announced */ policy-statement SANITY6 { /* Block routes with a private AS in the path */ term block-private-asns { from { as-path PRIVATE; family inet6; } then reject; } /* Only accept routes within certain allocated blocks */ term accept { /* see http://www.iana.org/assignments/ipv6-unicast-address-assignments */ from { route-filter 2001::/16 upto /49; route-filter 2002::/16 exact; route-filter 2003::/16 upto /49; route-filter 2400::/12 upto /49; route-filter 2600::/12 upto /49; route-filter 2a00::/12 upto /49; route-filter 2800::/12 upto /49; route-filter 2001:b000::/20 upto /49; route-filter 2c00::/12 upto /49; route-filter 2610::/12 upto /49; route-filter 2620::/12 upto /49; } then next policy; } term reject { then reject; } } /* set local-pref on connector routes based on communities */ policy-statement SET-PREF { term high { from community HIGH; then { local-preference 260; next policy; } } term low { from community LOW; then { local-preference 140; next policy; } } term normal { then { local-preference 200; } } } /* set local-pref on peer routes based on communities */ policy-statement SET-PREF-PEER { term high { from community HIGH-PEERS; then { local-preference 160; next policy; } } term low { from community LOW-PEERS; then { local-preference 40; next policy; } } term normal { then { local-preference 100; } } } policy-statement V6-IGP-AGG { term allow-aggregate { from { protocol aggregate; family inet6; } then accept; } term deny-more-specifics { from { family inet6; route-filter 2001:468:ff:1200::/56 longer; route-filter 2001:468:0012::/48 longer; } then reject; } term accept-all-other-v6 { from { protocol [ isis direct ]; family inet6; } then accept; } } policy-statement WSU-IN { term participant { from { protocol bgp; prefix-list-filter WSU-PARTICIPANT orlonger; } then next policy; } term exception_participant { from { protocol bgp; prefix-list-filter WSU-EXCEPTION exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } /* Temporary fix for scoping 239/8 */ policy-statement pim-join-filter { term internal-links { from { interface [ so-0/0/0.0 so-3/0/0.0 so-1/1/0.0 ]; route-filter 239.0.0.0/8 orlonger; } then accept; } term external-links { from { route-filter 239.0.0.0/8 orlonger; } then reject; } term all-links { then accept; } } community BLOCK-TO-COMMERCIAL members 11537:2002; community COMMERCIAL-PEER members 11537:2001; community CONNECTOR-ONLY members 11537:3500; community CORE members 11537:900; community CORPORATE members 11537:2000; community CPS members target:11537:1; community CPS-CONNECTOR members 11537:25100; community CPS-PEERS members 11537:25200; community DISCARD members 11537:911; community FEDNET members 11537:3000; community HIGH members 11537:260; community HIGH-PEERS members 11537:160; community IFTN members 11537:2502; community ITN members 11537:2501; community LOW members 11537:140; community LOW-PEERS members 11537:40; community NO-EXPORT members no-export; community NOAGG6 members 11537:6; community NONITN members 11537:2500; community PARTICIPANT members 11537:950; community SEGP members 11537:910; community SPONSORED members 11537:902; as-path ABILENE ".* 11537 .*"; as-path COMMERCIAL ".* (1|174|701|1239|1673|1740|1800|1833|2551|2548|2685|2914|3549|3561|3847|3951|3967|4183|4200|5683|6113|6172|6461|7018) .*"; as-path PRIVATE ".* (64512-65535) .*"; as-path NLR ".* 19401 .*"; as-path GEANT "20965 .*"; as-path CLARA "27750 .*"; as-path ESNET "293 .*"; as-path NREN "24 .*"; as-path MAX-V6-TRANSIT "10886 (293|2914|3257|4788|6939|10745|13645|23504|30071|33437)+ .*"; } class-of-service { classifiers { exp MPLS { forwarding-class assured-forwarding { loss-priority low code-points 100; } forwarding-class expedited-forwarding { loss-priority low code-points 010; } forwarding-class best-effort { loss-priority low code-points 000; } forwarding-class network-control { loss-priority low code-points 110; } } inet-precedence TOS { forwarding-class network-control { loss-priority low code-points 110; } forwarding-class assured-forwarding { loss-priority low code-points 100; } forwarding-class expedited-forwarding { loss-priority low code-points 010; } forwarding-class best-effort { loss-priority low code-points 000; } } } drop-profiles { basic { fill-level 100 drop-probability 100; } } interfaces { so-0/1/0 { scheduler-map basic; unit 0 { classifiers { exp MPLS; inet-precedence TOS; } rewrite-rules { exp MPLS; inet-precedence TOS; } } } so-0/0/0 { scheduler-map basic; unit 0 { classifiers { exp MPLS; inet-precedence TOS; } rewrite-rules { exp MPLS; inet-precedence TOS; } } } } rewrite-rules { exp MPLS { forwarding-class assured-forwarding { loss-priority low code-point 100; loss-priority high code-point 100; } forwarding-class best-effort { loss-priority low code-point 000; loss-priority high code-point 000; } forwarding-class expedited-forwarding { loss-priority low code-point 010; loss-priority high code-point 010; } forwarding-class network-control { loss-priority low code-point 110; loss-priority high code-point 110; } } inet-precedence TOS { forwarding-class network-control { loss-priority low code-point 110; loss-priority high code-point 110; } forwarding-class assured-forwarding { loss-priority low code-point 100; loss-priority high code-point 100; } forwarding-class expedited-forwarding { loss-priority low code-point 010; loss-priority high code-point 010; } forwarding-class best-effort { loss-priority low code-point 000; loss-priority high code-point 000; } } } scheduler-maps { basic { forwarding-class best-effort scheduler best-effort; forwarding-class network-control scheduler network-control; forwarding-class assured-forwarding scheduler LSP-L2; forwarding-class expedited-forwarding scheduler expedited-forwarding; } stanislav-map-micro { forwarding-class best-effort scheduler stanislav-scheduler-micro; } stanislav-map-milli { forwarding-class best-effort scheduler stanislav-scheduler-milli; } } schedulers { LSP-L2 { transmit-rate percent 10; buffer-size percent 10; priority high; drop-profile-map loss-priority any protocol any drop-profile basic; } network-control { transmit-rate percent 5; buffer-size percent 5; priority strict-high; drop-profile-map loss-priority any protocol any drop-profile basic; } best-effort { transmit-rate percent 85; buffer-size percent 85; priority low; drop-profile-map loss-priority any protocol any drop-profile basic; } expedited-forwarding { transmit-rate percent 0; buffer-size percent 0; priority low; drop-profile-map loss-priority any protocol any drop-profile basic; } stanislav-scheduler-micro { transmit-rate percent 100; buffer-size temporal 1; } stanislav-scheduler-milli { transmit-rate percent 100; buffer-size temporal 1024; } } } Firewall Stanza Removed removed version 8.4R3.3; groups { INTERFACE-BACKBONE { interfaces { <so-*> { mtu 9192; encapsulation cisco-hdlc; sonet-options { fcs 32; } unit <*> { family inet { mtu 9180; filter { input backbone-in; output interface-out; } } family iso { mtu 1497; } family inet6 { mtu 9180; filter { input v6filter; output v6filter; } } family mpls { mtu 9180; } } } <ge-*> { mtu 9192; unit <*> { family inet { mtu 9174; filter { input backbone-in; output interface-out; } } family iso { mtu 1497; } family inet6 { mtu 9174; filter { input v6filter; output v6filter; } } family mpls { mtu 9174; } } } } } re0 { system { host-name CHIC-re0; } } re1 { system { host-name CHIC-re1; } } INTERFACE-CONNECTOR { interfaces { <so-*> { mtu 9192; encapsulation cisco-hdlc; sonet-options { fcs 32; rfc-2615; } unit <*> { family inet { mtu 9180; filter { input connector-in; output interface-out; } } family inet6 { mtu 9180; filter { input v6filter; output v6filter; } } } } <at-*> { unit <*> { family inet { filter { input connector-in; output interface-out; } } family inet6 { filter { input v6filter; output v6filter; } } } } <ge-*> { mtu 9192; unit <*> { family inet { mtu 9000; filter { input connector-in; output interface-out; } } family inet6 { mtu 9000; filter { input v6filter; output v6filter; } } } } } } MSDP-SA-Limit-per-peer-group { protocols { msdp { group <*> { peer <*> { active-source-limit { maximum 100000; threshold 90000; } } } } } } } apply-groups [ re0 re1 ]; system { domain-name net.internet2.edu; time-zone UTC; dump-on-panic; authentication-order [ radius password ]; location country-code US; root-authentication { Authentication Data Removed } radius-server { 134.68.107.17 { timeout 5; source-address 64.57.28.241; } 129.79.216.162 { timeout 5; source-address 64.57.28.241; } } Login Stanza Removed services { ssh { connection-limit 30; } } syslog { archive files 100; user * { any critical; } /* brent's pine.ucs.indiana.edu */ host 129.79.9.1 { change-log any; interactive-commands info; facility-override local6; } /* syslog.grnoc.iu.edu */ host 134.68.107.9 { any info; authorization info; interactive-commands info; facility-override local6; } file messages { any notice; authorization info; archive size 1m files 100; } console { user critical; } } ntp { server 129.79.5.100; server 134.68.1.9 prefer; } } chassis { no-source-route; dump-on-panic; redundancy { failover { on-loss-of-keepalives; on-disk-failure; } keepalive-time 5; } routing-engine { on-disk-failure reboot; } } interfaces { ge-0/0/0 { description "AVAILABLE 10GigE (was HOPI)"; disable; } ge-0/1/0 { inactive: apply-groups INTERFACE-CONNECTOR; description "HP 5406 10GigE"; vlan-tagging; mtu 9180; unit 10 { description "Racklan #2"; vlan-id 10; family inet { mtu 9000; filter { output racklan-access; } address 64.57.25.254/24; } family iso { mtu 1497; } } unit 11 { description "Observatory 10 gig uplink"; vlan-id 11; family inet { mtu 9000; address 64.57.17.1/28; address 198.32.10.201/30; } family inet6 { mtu 9000; address 2001:0468:0002:0011::1/64; address 2001:0468:0002:0011::17:1/64; } } unit 12 { description "Observatory 1 gig uplink"; vlan-id 12; family inet { mtu 9000; address 64.57.17.33/28; } family inet6 { mtu 9000; address 2001:0468:0002:0012::1/64; address 2001:0468:0002:0012::17:33/64; } } unit 20 { description "VINI Mgmt"; vlan-id 20; family inet { mtu 9000; address 64.57.18.193/29; } family inet6 { mtu 9000; address 2001:0468:0002:0020::1/64; address 2001:0468:0002:0020::18:193/64; } } unit 21 { description "VINI Data"; vlan-id 21; family inet { mtu 9000; address 64.57.18.17/29; } family inet6 { mtu 9000; address 2001:0468:0002:0021::1/64; address 2001:0468:0002:0021::18:17/64; } } unit 50 { description "ISIS collector"; vlan-id 50; family iso { mtu 1497; } } } so-0/2/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: CHIC-WASH OC-192 | I2-CHIC-WASH-O192-03915"; family inet { address 64.57.28.12/31; } family inet6 { address 2001:468:ff:0209::2/64; } } } gr-0/3/0 { unit 1 { description "V6 Tunnel to OARnet"; tunnel { source 64.57.28.241; destination 192.88.191.249; } family inet6 { address 2001:468:FF:1D4B::1/64; } } inactive: unit 5 { description "V6 Tunnel to Workshop/Tradeshow [NO-MONITOR]"; tunnel { source 64.57.28.241; destination 134.68.11.59; } family inet { address 10.0.33.33/24; } family inet6 { address 2001:468:FF:1B1D::2/64; } } } ip-0/3/0 { unit 2 { description "SINET v6 Tunnel [NO-MONITOR]"; tunnel { source 64.57.28.241; destination 150.99.111.244; } family inet { address 10.0.12.12/24; } family inet6 { address 2001:2F8:0:FF::2/126; } } unit 4 { description "Singaren v6 Tunnel"; tunnel { source 64.57.28.241; destination 202.8.95.253; } family inet6 { address 2001:208:1:FD05::2/64; } } } ge-1/0/0 { apply-groups INTERFACE-CONNECTOR; description "MREN via Internet2 Chicago Metro Infinera Ring"; vlan-tagging; mtu 9192; unit 107 { description "MREN via Chicago Metro Infinera Ring"; vlan-id 107; family inet { mtu 9000; address 198.32.11.97/30; } family iso { mtu 2447; } family inet6 { mtu 9000; address 2001:468:ff:fc3::1/64; } } unit 443 { description "[CPS] MREN via Chicago Metro Infinera Ring"; vlan-id 443; family inet { address 206.220.240.86/30; } } unit 444 { description "[CPS] Customer6 MREN via Chicago Metro Infinera Ring"; vlan-id 444; family inet6 { address 2001:468:ffff:fc3::1/64; } } unit 2043 { description "[CPS] MERIT via MREN from CIC"; vlan-id 2043; family inet { address 207.72.112.34/30; } family inet6 { address 2001:468:ffff:254::1/64; } } unit 2059 { description "MERIT via MREN from CIC"; vlan-id 2059; family inet { address 192.122.183.30/30; } family inet6 { address 2001:468:ff:254::1/64; } } } ge-1/1/0 { apply-groups INTERFACE-CONNECTOR; unit 0 { description "Nysernet via Internet2 DWS | I2-BUFF-CHIC-10GE-04190"; family inet { address 199.109.11.2/30; } family inet6 { address 2001:468:900:1101::2/64; } } } so-1/2/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: CHIC-KANS OC-192 #2 | I2-CHIC-KANS-O192-03919"; family inet { address 64.57.28.37/31; } family inet6 { address 2001:468:ff:0204:8000::1/65; } } } so-1/3/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: CHIC-NEWY OC-192 | I2-CHIC-NEWY-O192-03913"; family inet { address 64.57.28.14/31; } family inet6 { address 2001:468:ff:206::1/64; } } } ge-2/0/0 { apply-groups INTERFACE-CONNECTOR; description "CIC via Internet2 Chicago Metro Infinera Ring"; vlan-tagging; unit 2036 { description "[CPS IPv6] WiscREN via CIC backup"; vlan-id 2036; family inet6 { address 2001:468:ffff:24f::1/64; } } unit 2037 { description "[CPS IPv6] Primary WiscREN via CIC"; vlan-id 2037; family inet6 { address 2001:468:ffff:2c1::1/64; } } unit 2038 { description "[CPS] UMN IPv6 via CIC"; vlan-id 2038; family inet6 { address 2001:468:ffff:259::1/64; } } unit 2039 { description "[CPS] WiscREN via CIC Backup"; vlan-id 2039; family inet { address 205.213.119.14/30; } } unit 2040 { description "[CPS] UMN via CIC;"; vlan-id 2040; family inet { mtu 1500; address 192.35.86.9/30; } } unit 2041 { description "[CPS] Wisconsin-Milwaukee via CIC"; vlan-id 2041; family inet { address 205.213.118.10/30; } } unit 2042 { description "[CPS] UIUC via CIC"; vlan-id 2042; family inet { address 72.36.127.138/30; } } unit 2044 { description "[CPS] University of Iowa via CIC"; vlan-id 2044; family inet { address 198.49.182.7/31; } family inet6 { address 2001:468:ffff:2c2::1/64; } } unit 2045 { description "[CPS] Indiana Gigapop via CIC"; vlan-id 2045; family inet { address 149.165.254.7/31; } } unit 2046 { description "Wiscren via CIC 1G"; vlan-id 2046; family inet { address 205.213.118.6/30; } family inet6 { address 2001:468:ff:24f::1/64; } } unit 2047 { description "Wiscren via their CIC 10G"; vlan-id 2047; family inet { mtu 9000; address 205.213.119.10/30; } family inet6 { mtu 9000; address 2001:468:ff:2c1::1/64; } } unit 2048 { description "Indiana GigaPoP CPS-IPv6 via CIC"; vlan-id 2048; family inet6 { address 2001:468:ffff:244::1/64; } } unit 2054 { description "Northern Lights via CIC"; vlan-id 2054; family inet { address 192.35.86.174/30; } family inet6 { address 2001:468:ff:259::1/64; } } unit 2061 { description "University of Iowa via CIC"; vlan-id 2061; family inet { address 198.49.182.5/31; } family inet6 { address 2001:468:ff:2c2::1/64; } } unit 2063 { description "Indiana Gigapop via CIC"; vlan-id 2063; family inet { address 149.165.254.3/31; } family inet6 { address 2001:468:ff:244::1/64; } } unit 2065 { description "UIUC via CIC"; vlan-id 2065; family inet { mtu 9000; /* regular i2 internet service */ address 192.17.10.46/30; } } unit 2299 { description "CIC OmniPOP Testpoint PC"; vlan-id 2299; family inet { mtu 9000; address 64.57.17.25/30; } } } ge-2/1/0 { description "Starlight via Internet2 Chicago Metro Infinera Ring"; vlan-tagging; mtu 9192; encapsulation vlan-ccc; unit 103 { apply-groups INTERFACE-CONNECTOR; description "StarLight M10 via StarLight | AS:10764"; vlan-id 103; family inet { mtu 9174; address 198.32.11.101/30; } family iso; family inet6 { mtu 9174; address 2001:468:ff:fc2::1/64; } } unit 121 { apply-groups INTERFACE-CONNECTOR; description "CERN (1Gbs, primary v4 link) via Starlight | AS513"; vlan-id 121; family inet { mtu 9174; address 192.91.246.125/30; } } unit 135 { apply-groups INTERFACE-CONNECTOR; description "CA*net-Winnepeg via StarLight | AS6509"; vlan-id 135; family inet { mtu 9174; address 198.32.11.29/30; } family iso; family inet6 { mtu 9174; address 2001:410:101:20::2/64; } } unit 144 { apply-groups INTERFACE-CONNECTOR; description "CA*net-Toronto via Starlight | AS6509"; vlan-id 144; family inet { mtu 9174; address 205.189.32.97/30; } family inet6 { mtu 9174; address 2001:410:101:21::2/64; } family mpls { mtu 9174; } } inactive: unit 152 { apply-groups INTERFACE-CONNECTOR; description "DTF (James) via StarLight | AS75"; vlan-id 152; family inet { mtu 9174; address 192.5.175.134/20; } family inet6 { mtu 9174; address 2001:468:ff:fc1::1/64; } family mpls { mtu 9174; } } unit 159 { description "ASNet (Taiwan) via StarLight | AS:9264"; vlan-id 159; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 117.103.111.153/30; } inactive: family inet6 { mtu 9000; filter { input v6filter; output v6filter; } address 2001:288:3B0:1::1A/127; } } unit 178 { apply-groups INTERFACE-CONNECTOR; description "HARNET | AS3662"; vlan-id 178; family inet { mtu 4470; address 192.245.196.110/30; } family inet6 { mtu 4470; address 2001:468:ff:12c3::1/64; } } unit 179 { description "DREN via StarLight | AS668"; vlan-id 179; family inet { mtu 9000; address 138.18.155.34/30; } family inet6 { mtu 9000; address 2001:468:ff:fc7::1/64; } } unit 188 { description "CERN DataTAG (v6 only) | AS:513"; vlan-id 188; family inet { filter { input connector-in; output interface-out; } address 10.254.254.4/31; } family inet6 { mtu 9000; filter { input v6filter; output v6filter; } address 2001:1458:E100:1000::0005:0012/126; } } unit 191 { description "6Tap via Starlight | AS3425"; vlan-id 191; family inet { mtu 1482; address 10.254.254.6/31; } family inet6 { mtu 1482; address 3FFE:3900:A7::2/64; address 2001:400:2005:7::3/64 { preferred; } } } unit 205 { apply-groups INTERFACE-CONNECTOR; description "FranceTelecom, multicast-only | AS5511"; vlan-id 205; family inet { mtu 9000; /* For DATATAG Demo. remove after 3/18 */ filter { input connector-in; output interface-out; } address 198.32.11.13/30; } family inet6 { address 2001:0688:0000:0004::0019/127; } } unit 212 { description "NISN via Starlight | AS:297"; vlan-id 212; family inet { mtu 9000; address 192.150.29.6/30; } } unit 250 { description "KREOnet2 via Starlight"; vlan-id 250; family inet { mtu 9000; filter { input connector-in; output interface-out; } address 134.75.108.46/30; } family inet6 { filter { input v6filter; output v6filter; } address 2001:468:FF:12C2::1/64; } } unit 258 { description "CERN production IPv6 via STARLIGHT | AS:513"; vlan-id 258; family inet6 { mtu 9000; address 2001:1458:E100:1000::0005:0002/126; } } unit 281 { description "TANET2 | AS:7539"; vlan-id 281; family inet { filter { input connector-in; output interface-out; } address 211.79.48.178/30; } family inet6 { filter { input v6filter; output v6filter; } address 2001:E10:FFFF:304::2/64; } } unit 345 { apply-groups INTERFACE-CONNECTOR; description "HOPI Management VLAN (default gw)"; vlan-id 345; family inet { mtu 1500; address 198.32.14.65/27; } } unit 348 { apply-groups INTERFACE-CONNECTOR; description "Ultralight Project via Starlight"; vlan-id 348; family inet { mtu 9000; address 198.32.11.45/30; } family inet6 { mtu 9000; address 2001:468:0e9c:0084::2/126; } } unit 356 { apply-groups INTERFACE-CONNECTOR; description "APAN via JGN2 Hitachi via Starlight | AS7660"; vlan-id 356; family inet { mtu 9000; address 203.181.248.141/30; } family iso; family inet6 { mtu 9000; address 2001:468:ff:0fc6::1/64; } } unit 397 { description "USGS M7i via Starlight | AS1842"; vlan-id 397; family inet { mtu 9000; address 192.41.213.113/30; } } unit 402 { description "GLORIAD-new | AS20388"; vlan-id 402; family inet { mtu 9174; address 192.31.99.134/30; } } unit 423 { description "ESNET via Starlight | AS293"; vlan-id 423; family inet { mtu 9000; address 198.125.140.230/30; } } unit 432 { vlan-id 432; family inet { mtu 9000; address 64.57.18.26/30; } } inactive: unit 601 { description "DREN ipv6 only | AS668"; vlan-id 601; family inet { mtu 1500; address 10.254.254.8/31; } family inet6 { mtu 1500; address 2001:468:ff:fc4::1/64; } } } ge-2/2/0 { description "Equnix Chicago via Internet2 Chicago Metro Infinera Ring"; vlan-tagging; mtu 9192; unit 10 { description "EQCH Management Subnet"; vlan-id 10; family inet { mtu 1500; address 198.32.10.190/28; } } unit 11 { description "[CPS] Equinix Chicago Public Switch"; vlan-id 11; family inet { mtu 1500; filter { input connector-in; } address 206.223.119.120/25; } } unit 12 { description "[CPS] Global Crossing Private Peering"; vlan-id 12; family inet { mtu 1500; filter { input connector-in; } address 64.208.110.198/30; } } unit 13 { description "[CPS] NLayer Private Peering"; vlan-id 13; family inet { mtu 1500; filter { input connector-in; } address 69.31.111.90/30; } } unit 14 { description "[CPS] Peer Yahoo Private Peering"; vlan-id 14; family inet { mtu 1500; filter { input connector-in; } address 64.57.29.17/30; } } unit 15 { description "[CPS] Google Private Peering"; vlan-id 15; family inet { mtu 1500; filter { input connector-in; } address 74.125.48.106/30; } } unit 16 { description "[CPS] Global Crossing Private Peering Link2"; vlan-id 16; family inet { mtu 1500; filter { input connector-in; } address 64.208.110.190/30; } } unit 17 { description "[CPS] BitGravity Private Peering"; vlan-id 17; family inet { mtu 1500; filter { input connector-in; } address 209.131.107.142/30; } } } so-2/3/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: ATLA-CHIC OC-192 | I2-ATLA-CHIC-O192-03917"; family inet { address 64.57.28.5/31; } family inet6 { address 2001:468:ff:102::2/64; } } } ge-4/0/0 { description "HP mgmt 1G interface"; mtu 9180; unit 0 { family inet { mtu 9000; } } } ge-4/0/1 { mtu 9180; unit 0 { description "nms-rthr1 p2p connection"; family inet { mtu 9000; address 64.57.17.17/30; } family inet6 { mtu 9000; address 2001:468:2:101::1/64; address 2001:468:2:101::17:17/64; } } } ge-4/0/2 { mtu 9180; unit 0 { description "nms-rthr2 p2p connection"; family inet { mtu 9000; address 64.57.17.21/30; } family inet6 { mtu 9000; address 2001:468:2:100::1/64; address 2001:468:2:100::17:21/64; } } } so-5/0/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: CHIC-KANS OC-192 #1 | I2-CHIC-KANS-O192-03918"; family inet { address 64.57.28.17/31; } family inet6 { address 2001:468:ff:0204::1/65; } } } fxp0 { description "Management Ethernet - Unused"; disable; } lo0 { unit 0 { description "Internal Peering Point"; family inet { filter { input loopback-strict-in; } address 64.57.28.241/32 { preferred; } address 198.32.8.238/32; } family iso { address 49.0000.0000.0000.0050.00; } family inet6 { filter { input loopback-strict-in6; } address 2001:468:2::1/128; } } unit 1 { description "Loopback for CPS VRF"; family inet { filter { input loopback-strict-in; } address 64.57.29.241/32; } family inet6 { filter { input loopback-strict-in6; } address 2001:468:ff02::1/128; } } } } forwarding-options { sampling { input { family inet { rate 100; max-packets-per-second 7000; } } output { inactive: file filename flowdata files 2 size 500000 world-readable; cflowd 64.57.17.7 { port 4194; version 5; no-local-dump; autonomous-system-type origin; } } } } routing-options { interface-routes { rib-group { inet if-rg; inet6 if6-rg; } } rib inet6.0 { static { rib-group static6-rg; route 2001:468::/32 { reject; install; readvertise; community 11537:950; } } aggregate { route 2001:468:ff:0f00::/56; route 2001:468:000f::/48; } } rib inet.2 { martians { 0.0.0.0/8 orlonger; 1.0.0.0/8 orlonger; 2.0.0.0/8 orlonger; 5.0.0.0/8 orlonger; 10.0.0.0/8 orlonger; 23.0.0.0/8 orlonger; 27.0.0.0/8 orlonger; 31.0.0.0/8 orlonger; 36.0.0.0/8 orlonger; 37.0.0.0/8 orlonger; 39.0.0.0/8 orlonger; 42.0.0.0/8 orlonger; 46.0.0.0/8 orlonger; 49.0.0.0/8 orlonger; 50.0.0.0/8 orlonger; 100.0.0.0/8 orlonger; 101.0.0.0/8 orlonger; 102.0.0.0/8 orlonger; 103.0.0.0/8 orlonger; 104.0.0.0/8 orlonger; 105.0.0.0/8 orlonger; 106.0.0.0/8 orlonger; 107.0.0.0/8 orlonger; 108.0.0.0/8 orlonger; 109.0.0.0/8 orlonger; 110.0.0.0/8 orlonger; 111.0.0.0/8 orlonger; 112.0.0.0/8 orlonger; 113.0.0.0/8 orlonger; 127.0.0.0/8 orlonger; 169.254.0.0/16 orlonger; 172.16.0.0/12 orlonger; 173.0.0.0/8 orlonger; 174.0.0.0/8 orlonger; 175.0.0.0/8 orlonger; 176.0.0.0/8 orlonger; 177.0.0.0/8 orlonger; 178.0.0.0/8 orlonger; 179.0.0.0/8 orlonger; 180.0.0.0/8 orlonger; 181.0.0.0/8 orlonger; 182.0.0.0/8 orlonger; 183.0.0.0/8 orlonger; 184.0.0.0/8 orlonger; 185.0.0.0/8 orlonger; 192.0.2.0/24 orlonger; 192.168.0.0/16 orlonger; 197.0.0.0/8 orlonger; 198.18.0.0/15 orlonger; 240.0.0.0/4 orlonger; } } static { rib-group static-rg; defaults { active; } route 198.32.8.0/22 { discard; community 11537:950; } route 198.32.154.0/24 { discard; community 11537:950; } route 64.57.16.0/20 { discard; community 11537:950; } /* to FranceTelecom mcast-only msdp peer */ route 193.251.128.23/32 next-hop 198.32.11.14; /* to FranceTelecom mcast-only msdp peer */ route 193.251.128.3/32 next-hop 198.32.11.14; /* WiscEdu free-iperf.wiscnet.net */ route 216.56.4.19/32 next-hop 205.213.118.5; route 198.32.12.0/22 { discard; community 11537:950; } /* to CzechLight for VINI connectivity [10278:45] */ route 195.113.222.88/29 next-hop 64.57.18.25; /* Global Crossing loopback used for Multihop peering */ route 64.215.195.157/32 next-hop 64.208.110.189; } martians { 0.0.0.0/8 orlonger; 1.0.0.0/8 orlonger; 2.0.0.0/8 orlonger; 5.0.0.0/8 orlonger; 10.0.0.0/8 orlonger; 23.0.0.0/8 orlonger; 27.0.0.0/8 orlonger; 31.0.0.0/8 orlonger; 36.0.0.0/8 orlonger; 37.0.0.0/8 orlonger; 39.0.0.0/8 orlonger; 42.0.0.0/8 orlonger; 46.0.0.0/8 orlonger; 49.0.0.0/8 orlonger; 50.0.0.0/8 orlonger; 100.0.0.0/8 orlonger; 101.0.0.0/8 orlonger; 102.0.0.0/8 orlonger; 103.0.0.0/8 orlonger; 104.0.0.0/8 orlonger; 105.0.0.0/8 orlonger; 106.0.0.0/8 orlonger; 107.0.0.0/8 orlonger; 108.0.0.0/8 orlonger; 109.0.0.0/8 orlonger; 110.0.0.0/8 orlonger; 111.0.0.0/8 orlonger; 112.0.0.0/8 orlonger; 113.0.0.0/8 orlonger; 127.0.0.0/8 orlonger; 169.254.0.0/16 orlonger; 172.16.0.0/12 orlonger; 173.0.0.0/8 orlonger; 174.0.0.0/8 orlonger; 175.0.0.0/8 orlonger; 176.0.0.0/8 orlonger; 177.0.0.0/8 orlonger; 178.0.0.0/8 orlonger; 179.0.0.0/8 orlonger; 180.0.0.0/8 orlonger; 181.0.0.0/8 orlonger; 182.0.0.0/8 orlonger; 183.0.0.0/8 orlonger; 184.0.0.0/8 orlonger; 185.0.0.0/8 orlonger; 192.0.2.0/24 orlonger; 192.168.0.0/16 orlonger; 197.0.0.0/8 orlonger; 198.18.0.0/15 orlonger; 223.0.0.0/8 orlonger; } aggregate { defaults { community 11537:950; discard; } route 64.57.16.0/21; route 64.57.24.0/22; route 64.57.28.0/22; } rib-groups { if-rg { import-rib [ inet.0 inet.2 ]; } if6-rg { import-rib [ inet6.0 inet6.2 ]; } mcast-rpf-rg { import-rib inet.2; } mcast-rpf6-rg { import-rib inet6.2; } isis-rg { import-rib [ inet.0 inet.2 ]; } isis6-rg { import-rib [ inet6.0 inet6.2 ]; } static-rg { import-rib [ inet.0 inet.2 ]; } static6-rg { import-rib [ inet6.0 inet6.2 ]; } } router-id 64.57.28.241; autonomous-system 11537; multicast { scope SGI-Dogfight { prefix 224.0.1.2/32; interface all; } scope 224.0.1.3/32 { prefix 224.0.1.3/32; interface all; } scope SUN-NIS { prefix 224.0.1.8/32; interface all; } scope SVRLOC { prefix 224.0.1.22/32; interface all; } scope MS-DS { prefix 224.0.1.24/32; interface all; } scope NBC-PRO { prefix 224.0.1.25/32; interface all; } scope SVRLOC-DA { prefix 224.0.1.35/32; interface all; } scope AutoRP-Announce { prefix 224.0.1.39/32; interface all; } scope AutoRP-Discovery { prefix 224.0.1.40/32; interface all; } scope HP-DEVICE-DISC { prefix 224.0.2.1/32; interface all; } scope SUN-RPC { prefix 224.0.2.2/32; interface all; } scope Norton-Ghost-1 { prefix 224.77.0.0/16; interface all; } scope Altiris { prefix 225.1.2.3/32; interface all; } scope Norton-Ghost-2 { prefix 226.77.0.0/16; interface all; } scope Norton-Ghost-3 { prefix 229.55.150.208/32; interface all; } scope ImageCast-1 { prefix 234.42.42.40/30; interface all; } scope ImageCast-2 { prefix 234.142.142.42/31; interface all; } scope ImageCast-3 { prefix 234.142.142.44/30; interface all; } scope ImageCast-4 { prefix 234.142.142.48/28; interface all; } scope ImageCast-5 { prefix 234.142.142.64/26; interface all; } scope ImageCast-6 { prefix 234.142.142.128/29; interface all; } scope ImageCast-7 { prefix 234.142.142.136/30; interface all; } scope ImageCast-8 { prefix 234.142.142.140/31; interface all; } scope ImageCast-9 { prefix 234.142.142.142/32; interface all; } ssm-groups 232.0.0.0/8; forwarding-cache { threshold { suppress 50000; reuse 25000; } } } } protocols { igmp { interface all { version 3; } interface ge-2/2/0.11 { disable; } } rsvp { /* BACKBONE to WASH */ interface so-0/2/0.0; /* BACKBONE to ATLA */ interface so-2/3/0.0; /* BACKBONE to NEWY */ interface so-1/3/0.0; /* BACKBONE to KANS */ interface so-5/0/0.0; } mpls { statistics { file mpls-stat; interval 60; } ipv6-tunneling; optimize-timer 360; preference 200; label-switched-path CHIC->ATLA { to 64.57.28.243; fast-reroute; } label-switched-path CHIC->KANS { to 64.57.28.245; fast-reroute; } label-switched-path CHIC->NEWY { to 64.57.28.242; fast-reroute; } label-switched-path CHIC->STTL { to 198.32.8.200; fast-reroute; } label-switched-path CHIC->WASH { to 64.57.28.249; fast-reroute; } label-switched-path CHIC->SALT { to 64.57.28.246; fast-reroute; } label-switched-path CHIC->LOSA-I2 { to 64.57.28.248; fast-reroute; } label-switched-path CHIC->HOUS { to 64.57.28.244; fast-reroute; } /* BACKBONE to WASH */ interface so-0/2/0.0; /* BACKBONE to ATLA */ interface so-2/3/0.0; /* BACKBONE to NEWY */ interface so-1/3/0.0; /* BACKBONE to KANS */ interface so-5/0/0.0; } bgp { log-updown; group INTERNET2 { type internal; local-address 64.57.28.241; family inet { any; } family inet-vpn { unicast; } family inet6-vpn { unicast; } Authentication Data Removed export NEXT-HOP-SELF; peer-as 11537; neighbor 198.32.8.200 { description STTLng; } neighbor 64.57.28.243 { description ATLA; } neighbor 64.57.28.242 { description NEWY; } neighbor 64.57.28.244 { description HOUS; } neighbor 64.57.28.245 { description KANS; } neighbor 64.57.28.248 { description LOSA; } neighbor 64.57.28.246 { description SALT; } inactive: neighbor 64.57.28.247 { description SEAT; } neighbor 64.57.28.249 { description WASH; } } group INTERNET2-IPv6 { type internal; local-address 2001:468:2::1; family inet6 { any; } Authentication Data Removed export NEXT-HOP-SELF; peer-as 11537; neighbor 2001:468:16::1 { description "STTLng;"; } neighbor 2001:468:1::1 { description ATLA; } neighbor 2001:468:3::1 { description HOUS; } neighbor 2001:468:4::1 { description KANS; } neighbor 2001:468:5::1 { description LOSA; } neighbor 2001:468:6::1 { description NEWY; } neighbor 2001:468:7::1 { description SALT; } inactive: neighbor 2001:468:8::1 { description SEAT; } neighbor 2001:468:9::1 { description WASH; } } group ITN { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER ITN-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ITN-OUT ]; remove-private; neighbor 198.32.11.102 { description STARLIGHT; family inet { any { prefix-limit { maximum 8000; teardown 90 idle-timeout 1; } } } peer-as 10764; } neighbor 198.32.11.30 { description "CA*net - Winnipeg"; Authentication Data Removed peer-as 6509; } neighbor 205.189.32.98 { description "CA*net - Toronto"; Authentication Data Removed peer-as 6509; } neighbor 192.245.196.109 { description HARnet; Authentication Data Removed peer-as 3662; } neighbor 134.75.108.45 { description KREONet2; Authentication Data Removed peer-as 17579; } neighbor 211.79.48.177 { description TANET2; Authentication Data Removed peer-as 7539; } neighbor 192.31.99.133 { description "GLORIAD-new via Starlight"; peer-as 20388; } /* ASNet and TANET2 back each other up */ neighbor 117.103.111.154 { description "ASNet (Taiwan)"; Authentication Data Removed peer-as 24167; } neighbor 203.181.248.142 { description "APAN via JGN2 Hitachi switch (via Starlight)"; import [ FROM-APAN-SPECIAL SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER IFTN-IN ]; Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 IFTN-OUT ]; peer-as 7660; } } group ITN6 { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER ITN-IN6 ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ITN-OUT6 ]; remove-private; neighbor 2001:468:ff:fc2::2 { description STARLIGHT; peer-as 10764; } inactive: neighbor 2001:288:3B0:1::1B { description "ASNet (Taiwan)"; family inet6 { unicast; } Authentication Data Removed peer-as 9264; } neighbor 2001:468:ff:12c3::2 { description HARnet; family inet6 { unicast; } Authentication Data Removed peer-as 3662; } inactive: neighbor 2001:798:2022:10AA::d { description "GEANT (Amsterdam) via Eurolink Circuit - contact SURFnet"; Authentication Data Removed peer-as 20965; } neighbor 2001:468:FF:12C2::2 { description "Kreonet2 via Starlight"; Authentication Data Removed peer-as 17579; } neighbor 2001:468:FF:fc6::2 { description "APAN via JGN2 Hitachi via Starlight"; Authentication Data Removed peer-as 7660; } inactive: neighbor 2001:400:2005:7::1 { description "6TAP @ Starlight [no-monitor]"; family inet6 { unicast; } Authentication Data Removed peer-as 3425; } neighbor 2001:410:101:20::1 { description "CA*net - Winnipeg"; Authentication Data Removed peer-as 6509; } neighbor 2001:410:101:21::1 { description "CA*net - Toronto"; Authentication Data Removed peer-as 6509; } neighbor 2001:E10:FFFF:304::1 { description TANET2; Authentication Data Removed peer-as 7539; } neighbor 2001:208:1:FD05::1 { description "Singaren v6 tunnel [NO-MONITOR]"; Authentication Data Removed peer-as 7610; } neighbor 2001:2F8:0:FF::1 { description "SINET v6 Moved from ipls v6 tunnel router"; peer-as 2907; } } group CONNECTOR { type external; metric-out igp; /* Multihop needs to be enabled to support discard routing */ multihop { ttl 1; } family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ]; remove-private; neighbor 192.91.246.126 { description "CERN (1Gbps)"; import [ SANITY-IN SET-PREF CERN-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 513; } neighbor 198.32.11.46 { description "Ultralight Project via Starlight"; import [ SANITY-IN SET-PREF ULTRALIGHT-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 32361; } neighbor 198.32.11.98 { description MREN; import [ SANITY-IN SET-PREF MREN-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 22335; } neighbor 199.109.11.1 { description "Nysernet via Buffalo"; import [ SANITY-IN SET-PREF NYSERNET-IN CONNECTOR-IN ]; Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 LEAK-NMS1 ]; peer-as 3754; } neighbor 149.165.254.2 { description "Indiana Gigapop via CIC"; import [ SANITY-IN SET-PREF INTERNET2-MOSS INDIANAGIGAPOP-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 19782; } neighbor 205.213.118.5 { description WiscREN; import [ SANITY-IN SET-PREF WISCREN-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 2381; } neighbor 192.35.86.173 { description "NorthernLights GigaPoP"; import [ SANITY-IN SET-PREF NORTHERNLIGHTS-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 57; } neighbor 192.122.183.29 { description "MERIT through MREN from CIC"; import [ SANITY-IN SET-PREF MERIT-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 237; } neighbor 198.49.182.4 { description "U Iowa via CIC"; import [ SANITY-IN SET-PREF IOWA-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 3676; } neighbor 192.17.10.45 { description "UIUC via CIC"; import [ SANITY-IN SET-PREF UIUC-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 38; } neighbor 205.213.119.9 { description "WiscREN-EQCH 10G via CIC [NO-MONITOR]"; import [ SANITY-IN SET-PREF WISCREN-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 2381; } } group CONNECTOR6 { type external; metric-out igp; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ]; remove-private; /* CERN will sometimes advertise subsets of their larger, production v6 /32 here */ neighbor 2001:1458:E100:1000::0005:0011 { description "CERN DataTAG"; import [ SANITY6 SET-PREF CERN-IN6 ]; Authentication Data Removed peer-as 513; } neighbor 2001:1458:E100:1000::0005:0001 { description "CERN Primary IPv6"; import [ SANITY6 SET-PREF CERN-IN6 ]; Authentication Data Removed peer-as 513; } neighbor 2001:468:0e9c:0084::1 { description "Ultralight via Starlight v6"; import [ SANITY6 SET-PREF ULTRALIGHT-IN6 ]; Authentication Data Removed peer-as 32361; } neighbor 2001:468:ff:fc3::2 { description MREN; import [ SANITY6 SET-PREF MREN-IN6 ]; family inet6 { any; } Authentication Data Removed peer-as 22335; } neighbor 2001:468:900:1101::1 { description "Nysernet via Buffalo"; import [ SANITY6 SET-PREF NYSERNET-IN6 ]; Authentication Data Removed export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6-WITH-SPECIFICS ]; peer-as 3754; } neighbor 2001:468:FF:1D4B::2 { description "OARnet v6 - Moved from v6 ipls tunnel router [NO-MONITOR]"; import [ SANITY6 SET-PREF OARNET-IN6 ]; family inet6 { any; } Authentication Data Removed peer-as 3112; } neighbor 2001:468:ff:244::2 { description "Indiana Gigapop via CIC"; import [ SANITY6 SET-PREF INDIANAGIGAPOP-IN6 ]; Authentication Data Removed peer-as 19782; } neighbor 2001:468:ff:24f::2 { description "Wiscren-1G via CIC"; import [ SANITY6 SET-PREF WISCREN-IN6 ]; Authentication Data Removed peer-as 2381; } neighbor 2001:468:ff:0259::2 { description "NorthernLights GigaPoP"; import [ SANITY6 SET-PREF NORTHERNLIGHTS-IN6 ]; Authentication Data Removed peer-as 57; } neighbor 2001:468:ff:254::2 { description "MERIT through MREN from CIC"; import [ SANITY6 SET-PREF MERIT-IN6 ]; Authentication Data Removed peer-as 237; } neighbor 2001:468:ff:2c1::2 { description "Wiscren-10G via CIC [NO-MONITOR]"; import [ SANITY6 SET-PREF WISCREN-IN6 ]; Authentication Data Removed peer-as 2381; } neighbor 2001:468:ff:2c2::2 { description "UIowa-10G via CIC [NO-MONITOR]"; import [ SANITY6 SET-PREF UIOWA-IN6 ]; Authentication Data Removed peer-as 3676; } } group OTHER { metric-out igp; remove-private; neighbor 128.223.51.102 { description "RouteViews #1 - help@routeviews.org"; multihop { ttl 15; } local-address 64.57.28.241; import REJECT-ALL; peer-as 6447; } neighbor 128.223.51.108 { description "RouteViews #2 - help@routeviews.org"; multihop { ttl 15; } local-address 64.57.28.241; import REJECT-ALL; peer-as 6447; } } group FEDNET { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER FEDNET-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 FEDNET-OUT ]; remove-private; neighbor 138.18.155.33 { description DREN; Authentication Data Removed peer-as 668; } neighbor 192.150.29.5 { description "NISN - Chicago"; Authentication Data Removed peer-as 297; } neighbor 192.41.213.114 { description "USGS M7i via StarLight"; Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 REDCLARA-TO-USGS FEDNET-OUT ]; peer-as 1842; } neighbor 198.125.140.229 { description "ESNET via Starlight"; Authentication Data Removed export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 AMPATH-TO-ESNET GEANT-TO-ESNET FEDNET-OUT ]; peer-as 293; } } group FEDNET6 { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER FEDNET-IN6 ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 FEDNET-OUT6 ]; remove-private; neighbor 2001:468:ff:fc7::2 { description DREN-new; family inet6 { any; } Authentication Data Removed peer-as 668; } } group ISP-MCAST { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER ISP-MCAST-IN ]; family inet { multicast { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ISP-MCAST-OUT ]; remove-private; neighbor 198.32.11.14 { description "France Telecom, multicast-only"; Authentication Data Removed peer-as 5511; } } group ISP-V6 { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER ISP-V6-IN ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ISP-V6-OUT ]; remove-private; neighbor 2001:0688:0000:0004::0018 { description "France Telecom"; family inet6 { unicast; } Authentication Data Removed peer-as 5511; } } group OTHER-INTERNAL { type internal; import REJECT-ALL; peer-as 11537; neighbor 134.68.246.49 { description "arbor11.ren-isac.net -- Arbor Peakflow [NO-MONITOR]"; local-address 64.57.28.241; family inet { unicast; } cluster 134.68.246.49; } neighbor 134.68.246.51 { description "arbor21.ren-isac.net -- Arbor Peakflow [NO-MONITOR]"; local-address 64.57.28.241; family inet { unicast; } cluster 134.68.246.51; } neighbor 64.57.17.7 { description "nms-rpsv.chic.net.internet2.edu zebra bgpd [NO-MONITOR]"; local-address 64.57.17.1; family inet { unicast; multicast; } cluster 64.57.17.1; } neighbor 2001:0468:0002:0011::17:7 { description "nms-rpsv.chic.net.internet2.edu zebra bgpd [NO-MONITOR]"; family inet6 { unicast; multicast; } } neighbor 156.56.103.99 { description "IU ANML monitor--contact Ripley"; multihop { ttl 10; } local-address 64.57.28.241; hold-time 65535; family inet { unicast; } } } group OTHER6 { type external; metric-out igp; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ]; neighbor 2001:468:FF:1B1D::1 { description "WORKSHOP V6 peer moved from ipls v6 tunnel router [NO-MONITOR]"; import [ SANITY6 SET-PREF WORKSHOP-IN6 ]; peer-as 65501; } neighbor 2001:838:1:1:210:DCFF:FE20:7C7C { description "GHOST Router Hunter - Moved from ipls v6 tunnel router"; multihop { ttl 25; } import REJECT-ALL; peer-as 8298; } } } isis { export V6-IGP-AGG; spf-delay 200; no-authentication-check; rib-group { inet isis-rg; inet6 isis6-rg; } level 2 wide-metrics-only; interface ge-0/1/0.50 { level 1 disable; level 2 metric 9999; } /* BACKBONE to WASH */ interface so-0/2/0.0 { level 1 disable; level 2 metric 905; } /* OC-192 #2 to KANS - R/E Traffic only */ interface so-1/2/0.0 { level 1 disable; level 2 metric 689; } /* BACKBONE to NEWY */ interface so-1/3/0.0 { level 1 disable; level 2 metric 1400; } /* BACKBONE to ATLA */ interface so-2/3/0.0 { level 1 disable; level 2 metric 1045; } /* OC-192 #1 to KANS - CPS and R/E failover */ interface so-5/0/0.0 { level 1 disable; level 2 metric 690; } /* Run IS-IS Passively on All Interfaces */ interface all { level 1 disable; level 2 passive; } } msdp { rib-group mcast-rpf-rg; inactive: traceoptions { file msdp-debug size 256k files 5; flag state; flag general; } source 0.0.0.0/0 { active-source-limit { maximum 1000; threshold 800; } } group INTERNET2 { mode mesh-group; local-address 64.57.28.241; /* STTLng */ peer 198.32.8.200; /* NEWY */ peer 64.57.28.242; /* ATLA */ peer 64.57.28.243; /* HOUS */ peer 64.57.28.244; /* KANS */ peer 64.57.28.245; /* SALT */ peer 64.57.28.246; /* SEAT */ inactive: peer 64.57.28.247; /* LOSA */ peer 64.57.28.248; /* WASH */ peer 64.57.28.249; } group CONNECTOR { export MSDP-FILTER; import MSDP-FILTER; /* Nysernet via Buffalo */ peer 199.109.11.1 { local-address 199.109.11.2; } /* WISCREN */ peer 205.213.118.5 { local-address 205.213.118.6; } /* Indiana Gigapop */ peer 149.165.254.2 { local-address 149.165.254.3; } /* MERIT */ peer 192.122.183.29 { local-address 192.122.183.30; } /* Iowa via CIC */ peer 198.49.182.4 { local-address 198.49.182.5; } /* MREN */ peer 198.32.11.98 { local-address 198.32.11.97; } /* UIUC */ peer 130.126.0.145 { local-address 192.17.10.45; } peer 205.213.119.9 { local-address 205.213.119.10; } /* UltraLight */ peer 198.32.11.46 { local-address 198.32.11.45; } /* NorthernLights */ peer 192.35.86.173 { local-address 192.35.86.174; inactive: traceoptions { file debug-msdp-umn size 256k files 5; flag all; } } } group ITN { export MSDP-FILTER; import MSDP-FILTER; /* DTF */ inactive: peer 192.5.175.5 { local-address 192.5.175.6; } /* STARLIGHT */ inactive: peer 206.220.240.220 { local-address 198.32.8.193; } /* CANET Winnepeg */ peer 198.32.11.30 { local-address 198.32.11.29; } /* CANET Toronto */ peer 205.189.32.98 { local-address 205.189.32.97; } /* GLORIAD */ peer 195.209.4.253 { local-address 195.209.4.254; } /* HARnet */ peer 192.245.196.109 { local-address 192.245.196.110; } /* FranceTelecom NYKAR1 node--see also accompanying static route to make this reachable */ peer 193.251.128.23 { local-address 198.32.11.13; } /* FranceTelecom PASBB1 node--see also accompanying static route to make this reachable */ peer 193.251.128.3 { local-address 198.32.11.13; } /* CERNET (multihopviaSTARLIGHT) */ inactive: peer 202.38.117.128 { local-address 198.32.8.193; } /* KREONet2 via StarLight */ peer 134.75.108.45 { local-address 134.75.108.46; } /* TANET2 */ peer 211.79.48.177 { local-address 211.79.48.178; } /* APAN via JGN2 Hitachi */ peer 198.32.11.49 { local-address 198.32.11.48; } /* GLORIAD */ peer 192.31.99.253 { local-address 192.31.99.134; } /* ASNnet (Tiawan) */ peer 117.103.111.154 { local-address 117.103.111.153; } } group FEDNET { export MSDP-FILTER; import MSDP-FILTER; /* DREN - AS668. loopback to loopback */ peer 138.18.11.253 { local-address 64.57.28.241; } /* NISN */ peer 192.150.29.5 { local-address 192.150.29.6; } /* USGS m7i at starlight */ peer 192.41.213.114 { local-address 192.41.213.113; } /* ESNET via Starlight */ peer 198.125.140.229 { local-address 198.125.140.230; } } } pim { rib-group { inet mcast-rpf-rg; inet6 mcast-rpf6-rg; } import pim-join-filter; rp { bootstrap-import REJECT-ALL; bootstrap-export REJECT-ALL; local { family inet { address 198.32.8.238; group-ranges { 224.0.0.0/4; } } } embedded-rp; static { address 2001:468::1 { group-ranges { ff05::/16; } } address 2001:660:3007:300:1:: { group-ranges { ff0e::/16; ff1e::/16; } } address 2001:700:e000:501::2 { group-ranges { ff3e:30:2001:700::/64; } } } } interface all { mode sparse; version 2; } interface fxp0.0 { disable; } } } policy-options { prefix-list ALLOW-ALL { 0.0.0.0/0; } prefix-list MATCH-ALL { 0.0.0.0/0; } prefix-list BGP-PEERS { apply-path "protocols bgp group <*> neighbor <*>"; } prefix-list MSDP-PEERS { apply-path "protocols msdp group <*> peer <*>"; } Prefix Stanza Removed prefix-list BGP-PEERS6 { apply-path "protocols bgp group <*> neighbor <*:*>"; } /* List of prefixes which Abilene originates */ prefix-list INTERNAL { /* Internet2 Backbone */ 64.57.16.0/20; /* Abilene Backbone */ 198.32.8.0/22; /* Abilene Observatory */ 198.32.12.0/22; /* MANLAN */ 198.32.154.0/24; } /* List of IPv6 prefixes Abilene originates */ prefix-list INTERNAL6 { 2001:468::/32; } Prefix Stanza Removed prefix-list QUERY-HOSTS-INTERNAL { /* nocmon.net.internet2.edu -- temp monitoring host */ 64.57.25.18/32; /* winger.uits.iu.edu -- snapp */ 129.79.6.137/32; /* pine.ucs.indiana.edu -- sweeny */ 129.79.9.1/32; /* alertmon-dev.grnoc.iu.edu */ 129.79.216.72/32; /* dc-snmp.wcc.grnoc.iu.edu */ 129.79.216.79/32; /* dc-1.grnoc.iu.edu -- SNMP Data Collector */ 134.68.107.22/32; /* snmp.grnoc.iu.edu -- SNMP Data Collection */ 134.68.107.23/32; 134.68.107.113/32; /* mon-dev.grnoc.iu.edu */ 134.68.107.123/32; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; } prefix-list QUERY-HOSTS-EXTERNAL { /* Boston University--ticket#11647 */ 128.197.10.4/32; /* Boston University--ticket#11647 */ 128.197.11.51/32; /* Boston University--ticket#11647 */ 128.197.11.223/32; /* Boston University--ticket#11647 */ 128.197.11.224/32; /* added ndb2-blmt to QUERY-HOSTS-EXTERNAL */ 129.79.5.18/32; /* arbor11.ren-isac.net -- Arbor Peakflow1 */ 134.68.246.49/32; /* arbor21.ren-isac.net -- Arbor Peakflow2 */ 134.68.246.51/32; /* ANML - ArborNetworks */ 156.56.103.9/32; /* ANML - ArborNetworks */ 156.56.103.10/32; /* ANML - ArborNetworks */ 156.56.103.11/32; /* ANML - ArborNetworks */ 156.56.103.12/32; /* ANML - ArborNetworks */ 156.56.103.53/32; /* Ohio ITEC - nf6.itec.oar.net */ 192.148.251.26/32; /* Ohio ITEC - nf7.itec.oar.net */ 192.148.251.27/32; /* netflow2.internet2.edu -- I2 Netflow Collector */ 198.108.90.142/32; /* discvenue.internet2.edu */ 207.75.164.82/32; /* Internet2 - thunderbird.internet2.edu - ticket# 5679 */ 207.75.164.95/32; /* netflow2.internet2.edu -- I2 Netflow Collector */ 207.75.165.99/32; } prefix-list TACACS-SERVERS { /* tacacs2.grnoc.iu.edu */ 129.79.216.162/32; /* tacacs.grnoc.iu.edu */ 134.68.107.17/32; } Prefix Stanza Removed prefix-list DNS-SERVERS { 129.79.5.100/32; 134.68.1.9/32; } prefix-list NTP-SERVERS { /* ntp.indiana.edu */ 129.79.5.100/32; /* ntp-1.gw.uiuc.edu */ 130.126.24.24/32; 134.68.1.9/32; /* ntp-e.abilene.ucaid.edu */ 198.32.10.254/32; /* ntp-w.abilene.ucaid.edu */ 198.32.11.141/32; } prefix-list NMS1-SPECIFICS { /* SNVA */ 198.32.8.108/30; /* WASH */ 198.32.8.112/30; /* ATLA */ 198.32.8.156/30; /* CHIN */ 198.32.8.160/30; /* DNVR */ 198.32.8.164/30; /* HSTN */ 198.32.8.168/30; /* IPLS */ 198.32.8.172/30; /* KSCY */ 198.32.8.176/30; /* LOSA */ 198.32.8.180/30; /* NYCM */ 198.32.8.184/30; /* STTL */ 198.32.8.188/30; } prefix-list CERN-PARTICIPANT { 128.141.0.0/16; 128.142.0.0/16; 137.138.0.0/16; 192.16.155.0/24; 192.16.164.0/23; 192.16.166.0/24; 192.65.184.0/21; 192.91.236.0/22; 192.91.240.0/22; 192.91.244.0/23; 192.91.246.0/24; 194.12.128.0/21; } prefix-list CERN-IN6 { 2001:1458::/32; } prefix-list ULTRALIGHT-PARTICIPANT { 192.41.230.0/23; 192.84.86.0/24; 198.32.43.0/24; 198.32.44.0/24; } prefix-list ULTRALIGHT-PARTICIPANT6 { 2001:468:0e9c::/48; } prefix-list MREN-CORPORATE { 165.215.0.0/16; 192.195.245.0/24; } prefix-list MREN-SPONSORED { 65.79.120.0/22; 192.41.245.0/24; 192.42.83.0/24; 192.94.173.0/24; 192.206.213.0/24; 192.206.214.0/24; 192.206.215.0/24; 198.37.16.0/21; 198.37.24.0/22; 198.108.237.0/24; 198.110.167.0/24; 198.111.56.0/23; 207.74.57.0/24; 207.75.32.0/21; 216.47.128.0/19; } prefix-list MREN-SEGP { 63.175.128.0/23; 64.107.0.0/16; 65.79.0.0/17; 65.174.34.0/23; 66.99.211.0/25; 69.58.32.0/19; 131.210.0.0/16; 134.161.0.0/16; 137.28.0.0/16; 137.81.0.0/16; 137.104.0.0/16; 138.49.0.0/16; 138.74.0.0/16; 139.135.0.0/16; 139.225.0.0/16; 140.104.0.0/16; 140.146.0.0/16; 140.189.0.0/16; 141.106.0.0/16; 141.233.0.0/16; 143.44.0.0/16; 143.109.0.0/16; 143.200.0.0/16; 143.207.0.0/16; 143.235.0.0/16; 143.236.0.0/16; 144.13.0.0/16; 144.62.0.0/16; 144.89.0.0/16; 147.92.0.0/18; 147.92.240.0/20; 147.124.0.0/16; 148.8.0.0/16; 153.106.0.0/16; 158.80.0.0/16; 160.32.0.0/16; 161.210.0.0/16; 165.128.0.0/16; 165.206.0.0/16; 192.35.81.0/24; 192.88.242.0/24; 192.122.181.0/24; 192.133.95.0/24; 192.138.137.0/24; 192.149.231.0/24; 192.203.196.0/24; 192.206.48.0/24; 192.227.32.0/19; 192.231.219.0/24; 192.234.16.0/24; 192.236.16.0/21; 192.236.24.0/23; 192.245.252.0/24; 192.245.254.0/24; 192.251.94.0/24; 192.251.163.0/24; 198.40.16.0/20; 198.51.130.0/24; 198.101.32.0/21; 198.101.40.0/21; 198.102.147.0/24; 198.108.20.0/24; 198.108.48.0/23; 198.108.50.0/24; 198.108.80.0/21; 198.108.97.0/24; 198.108.158.0/24; 198.108.176.0/20; 198.108.192.0/24; 198.108.196.0/22; 198.108.208.0/23; 198.108.212.0/23; 198.108.218.0/24; 198.108.228.0/22; 198.108.234.0/24; 198.109.72.0/22; 198.109.208.0/24; 198.109.220.0/22; 198.110.0.0/21; 198.110.11.0/24; 198.110.12.0/22; 198.110.24.0/21; 198.110.72.0/21; 198.110.83.0/24; 198.110.88.0/23; 198.110.92.0/24; 198.110.163.0/24; 198.110.164.0/24; 198.110.168.0/21; 198.110.176.0/21; 198.110.224.0/21; 198.111.36.0/22; 198.111.64.0/21; 198.111.72.0/22; 198.111.76.0/23; 198.111.79.0/24; 198.111.171.0/24; 198.111.176.0/23; 198.111.182.0/24; 198.111.208.0/24; 198.111.214.0/23; 198.133.77.0/24; 198.133.187.0/24; 198.133.188.0/23; 199.197.64.0/18; 199.201.203.0/24; 199.242.176.0/24; 204.8.36.0/22; 204.38.33.0/24; 204.38.36.0/23; 204.38.38.0/24; 204.38.46.0/23; 204.38.128.0/20; 204.38.208.0/20; 204.39.194.0/24; 204.144.106.0/24; 205.221.0.0/16; 205.221.30.0/24; 205.221.206.0/23; 207.28.0.0/16; 207.28.96.0/20; 207.28.112.0/22; 207.28.116.0/23; 207.28.128.0/21; 207.28.136.0/22; 207.28.209.0/24; 207.28.210.0/24; 207.72.2.0/23; 207.72.4.0/23; 207.72.34.0/23; 207.72.36.0/22; 207.72.40.0/23; 207.72.72.0/24; 207.73.64.0/23; 207.73.68.0/23; 207.73.96.0/20; 207.73.116.0/22; 207.73.120.0/21; 207.73.152.0/22; 207.73.156.0/23; 207.73.158.0/24; 207.73.159.0/24; 207.73.160.0/21; 207.73.174.0/23; 207.73.180.0/22; 207.73.184.0/21; 207.73.240.0/21; 207.73.248.0/22; 207.73.252.0/22; 207.74.0.0/24; 207.74.4.0/22; 207.74.8.0/21; 207.74.22.0/23; 207.74.24.0/21; 207.74.24.0/22; 207.74.29.0/24; 207.74.30.0/23; 207.74.104.0/22; 207.74.115.0/24; 207.74.118.0/23; 207.74.138.0/23; 207.74.140.0/22; 207.74.149.0/24; 207.74.168.0/24; 207.74.189.0/24; 207.74.224.0/22; 207.74.232.0/21; 207.75.112.0/24; 207.75.132.0/22; 207.75.136.0/24; 207.75.226.0/23; 207.75.228.0/23; 207.165.0.0/16; 207.165.40.0/21; 207.165.48.0/21; 209.56.0.0/16; 209.56.53.0/24; 209.56.96.0/21; 209.56.144.0/21; 209.56.253.0/24; 216.11.0.0/16; 216.56.0.0/16; 216.159.0.0/17; 216.159.85.0/24; 216.159.128.0/18; 216.159.180.0/24; 216.159.184.0/23; 216.159.192.0/19; 216.159.223.0/24; } prefix-list MREN-PARTICIPANT { 35.0.0.0/8; 63.85.181.0/24; 64.113.64.0/19; 65.110.224.0/19; 66.99.0.0/16; 66.158.0.0/17; 66.205.160.0/20; 66.254.224.0/19; 66.254.232.0/21; 66.254.240.0/21; 66.254.248.0/21; 72.33.0.0/16; 128.104.0.0/16; 128.105.0.0/16; 128.135.0.0/16; 128.174.0.0/16; 128.231.0.0/16; 128.248.0.0/16; 128.255.0.0/16; 129.43.0.0/16; 129.74.0.0/16; 129.89.0.0/16; 129.105.0.0/16; 129.186.0.0/16; 129.229.0.0/16; 129.255.0.0/16; 130.126.0.0/16; 130.202.0.0/16; 131.156.0.0/16; 131.193.0.0/16; 131.230.0.0/16; 134.48.0.0/16; 136.1.0.0/16; 136.2.0.0/16; 136.8.32.0/22; 136.176.0.0/16; 137.187.0.0/16; 138.87.0.0/16; 139.67.0.0/16; 140.192.0.0/16; 140.221.0.0/16; 141.142.0.0/16; 141.209.0.0/16; 141.210.0.0/16; 141.211.0.0/16; 141.212.0.0/16; 141.213.0.0/16; 141.214.0.0/16; 141.215.0.0/16; 141.216.0.0/16; 141.217.0.0/16; 141.218.0.0/16; 141.219.0.0/16; 141.221.0.0/16; 143.43.0.0/16; 143.195.0.0/16; 143.226.0.0/16; 144.74.0.0/16; 144.92.0.0/16; 146.9.0.0/16; 146.137.0.0/16; 146.139.0.0/16; 146.151.0.0/16; 146.163.0.0/16; 147.126.0.0/19; 147.126.32.0/19; 147.126.64.0/19; 147.155.0.0/16; 148.61.0.0/16; 155.138.0.0/16; 155.139.0.0/16; 156.40.0.0/16; 157.98.0.0/16; 157.178.0.0/16; 161.57.0.0/16; 162.99.224.0/19; 164.54.0.0/16; 164.68.0.0/16; 164.76.0.0/16; 164.122.37.0/24; 165.112.0.0/16; 165.124.0.0/16; 167.165.0.0/16; 170.27.0.0/16; 192.5.84.0/22; 192.5.143.0/24; 192.5.170.0/23; 192.5.172.0/22; 192.5.176.0/20; 192.5.192.0/21; 192.5.200.0/23; 192.17.0.0/16; 192.26.85.0/24; 192.26.87.0/24; 192.77.125.0/24; 192.101.250.0/24; 192.102.230.0/24; 192.107.47.0/24; 192.107.164.0/24; 192.122.182.0/23; 192.122.200.0/24; 192.131.121.0/24; 192.160.134.0/24; 192.172.224.0/24; 192.188.159.0/24; 192.188.160.0/22; 192.190.47.0/24; 192.203.136.0/23; 192.231.145.0/24; 192.231.146.0/24; 192.231.147.0/24; 192.231.253.0/24; 192.234.14.0/23; 192.245.179.0/24; 198.31.12.0/24; 198.40.16.0/21; 198.49.182.0/24; 198.51.254.0/24; 198.77.76.0/24; 198.108.0.0/24; 198.108.1.0/24; 198.108.2.0/24; 198.108.7.0/24; 198.108.18.0/23; 198.108.26.0/23; 198.108.60.0/22; 198.108.95.0/24; 198.108.96.0/24; 198.108.101.0/24; 198.108.102.0/23; 198.108.182.0/24; 198.108.184.0/24; 198.108.232.0/24; 198.109.229.0/24; 198.109.230.0/23; 198.109.232.0/21; 198.109.240.0/20; 198.110.132.0/22; 198.110.136.0/21; 198.110.149.0/24; 198.110.150.0/24; 198.110.151.0/24; 198.110.152.0/24; 198.110.156.0/22; 198.110.192.0/20; 198.110.216.0/21; 198.111.224.0/23; 198.133.224.0/24; 198.150.0.0/16; 198.247.48.0/24; 198.247.64.0/19; 199.74.64.0/18; 199.104.137.0/24; 199.184.120.0/24; 199.189.8.0/21; 199.249.169.0/24; 204.38.0.0/22; 204.38.16.0/21; 204.38.56.0/21; 204.38.160.0/23; 204.38.166.0/23; 204.38.168.0/22; 204.38.172.0/23; 204.38.174.0/24; 204.38.181.0/24; 204.38.182.0/23; 204.38.184.0/21; 204.38.192.0/20; 204.39.0.0/17; 204.39.128.0/18; 204.75.208.0/20; 205.128.154.0/23; 205.213.0.0/16; 205.221.176.0/21; 205.221.208.0/21; 206.166.0.0/17; 206.220.240.0/24; 206.220.241.0/24; 207.63.0.0/16; 207.73.32.0/19; 207.73.208.0/24; 207.73.212.0/23; 207.75.144.0/20; 207.75.164.0/23; 207.75.166.0/23; 207.246.160.0/19; 209.7.0.0/16; 209.174.0.0/15; 216.47.128.0/19; 216.124.0.0/16; 216.125.0.0/16; 216.125.56.0/21; 216.240.208.0/20; } /* GPN (KANS) also backups up Northern Lights; update prefix list on KANS router */ prefix-list NORTHERNLIGHTS-PARTICIPANT { 128.101.0.0/16; 129.176.0.0/16; 131.212.0.0/16; 134.84.0.0/16; 134.129.48.0/20; 134.129.64.0/18; 134.129.128.0/18; 134.129.192.0/19; 137.216.0.0/16; 146.57.0.0/16; 151.159.0.0/16; 160.94.0.0/16; 192.41.204.0/24; 192.55.228.0/24; 192.189.227.0/24; 192.236.32.0/19; 198.190.250.0/23; 198.190.252.0/24; 204.73.80.0/22; 204.221.228.0/22; 206.8.98.0/23; 206.144.192.0/20; 206.145.208.0/20; 206.176.0.0/20; 206.176.18.0/24; 206.176.38.0/24; 206.176.57.0/24; 206.176.58.0/24; 206.209.0.0/20; 209.32.16.0/20; } /* GPN (KANS) also backups up Northern Lights; update prefix list on KANS router */ prefix-list NORTHERNLIGHTS-SPONSORED { 138.247.0.0/16; 198.177.154.0/24; 206.176.20.0/24; 206.176.21.0/24; 206.176.39.0/24; 206.176.40.0/24; 206.176.41.0/24; 206.176.42.0/24; 206.176.44.0/24; 206.176.54.0/24; } prefix-list MERIT-SEGP { 63.175.128.0/23; /* Kent Intermediate School District */ 64.49.112.0/20; 64.90.128.0/20; 65.174.34.0/23; /* Hillsdale College MichNet SEGP */ 69.58.32.0/19; 136.181.0.0/16; 141.209.0.0/16; 141.210.0.0/16; /* Andrews University as part of the MichNET SEGP */ 143.207.0.0/16; 147.124.0.0/16; 148.61.0.0/16; 148.149.0.0/16; 153.106.0.0/16; 155.138.0.0/16; 158.80.0.0/16; 161.57.0.0/16; 162.108.0.0/16; 164.76.0.0/16; 167.240.0.0/16; 192.65.215.0/24; /* Northwestern Michigan College */ 192.88.242.0/24; /* Grand Rapids Community College */ 192.122.181.0/24; 192.138.137.0/24; 192.245.252.0/24; 192.245.254.0/24; /* Ohio SEGP */ 198.30.112.0/24; 198.108.20.0/24; 198.108.25.0/24; 198.108.26.0/23; 198.108.28.0/22; /* Washtenaw Community College */ 198.108.48.0/23; /* Washtenaw Community College */ 198.108.50.0/24; 198.108.52.0/22; 198.108.64.0/20; /* Adrian College as part of MichNET SEGP */ 198.108.80.0/21; /* Washtenaw Community College */ 198.108.97.0/24; 198.108.101.0/24; /* Kalamazoo Regional Educational Service Agency */ 198.108.158.0/24; /* Calhoun ISD */ 198.108.176.0/20; 198.108.192.0/24; /* Northwestern Michigan College */ 198.108.196.0/22; 198.108.208.0/23; /* Northwestern Michigan College */ 198.108.212.0/23; /* Northwestern Michigan College */ 198.108.218.0/24; /* Alpena Community College */ 198.108.228.0/22; /* Saginaw ISD */ 198.108.234.0/24; /* Madonna University */ 198.109.72.0/22; 198.109.172.0/23; /* Hillsdale College MichNet SEGP */ 198.109.208.0/24; 198.109.220.0/22; 198.109.229.0/24; 198.109.230.0/23; 198.109.232.0/21; 198.110.0.0/21; 198.110.11.0/24; 198.110.12.0/22; 198.110.24.0/21; /* Grand Rapids Community College */ 198.110.72.0/21; /* Grand Rapids Community College */ 198.110.83.0/24; /* Grand Rapids Community College */ 198.110.88.0/23; 198.110.92.0/24; /* Hope College */ 198.110.96.0/20; 198.110.132.0/22; 198.110.136.0/21; 198.110.149.0/24; 198.110.150.0/23; 198.110.152.0/24; 198.110.156.0/22; /* Saginaw ISD */ 198.110.163.0/24; /* Saginaw ISD */ 198.110.164.0/24; 198.110.168.0/21; 198.110.176.0/21; /* Saginaw ISD */ 198.110.224.0/21; 198.111.36.0/22; 198.111.64.0/21; 198.111.72.0/22; 198.111.76.0/23; 198.111.79.0/24; /* MMNET */ 198.111.152.0/21; /* Washtenaw Community College */ 198.111.171.0/24; /* Washtenaw Community College */ 198.111.176.0/23; 198.111.180.0/24; /* Alpena Community College */ 198.111.182.0/24; 198.111.196.0/22; /* Saginaw ISD */ 198.111.208.0/24; /* Saginaw ISD */ 198.111.214.0/23; 198.111.240.0/21; 198.111.250.0/23; 198.111.252.0/22; 198.151.162.0/24; 199.33.196.0/24; 204.22.0.0/15; 204.24.0.0/15; /* Saginaw ISD */ 204.38.33.0/24; 204.38.36.0/23; 204.38.38.0/24; /* Saginaw ISD */ 204.38.46.0/23; /* Northwestern Michigan College */ 204.38.128.0/20; /* Kalamazoo Regional Educational Service Agency */ 204.38.208.0/20; 204.39.0.0/17; 204.39.128.0/18; 204.39.194.0/24; 204.75.208.0/20; /* Washtenaw Community College */ 207.72.2.0/23; /* Washtenaw Community College */ 207.72.4.0/23; 207.72.6.0/24; 207.72.34.0/23; 207.72.36.0/22; 207.72.40.0/23; 207.72.64.0/22; 207.72.68.0/24; 207.72.72.0/24; 207.73.32.0/19; 207.73.64.0/23; 207.73.68.0/23; /* Calhoun ISD */ 207.73.96.0/20; /* Kalamazoo Regional Educational Service Agency */ 207.73.116.0/22; /* Kalamazoo Regional Educational Service Agency */ 207.73.120.0/21; 207.73.128.0/21; 207.73.136.0/24; 207.73.138.0/23; 207.73.140.0/22; /* MMNET */ 207.73.144.0/23; /* Calhoun ISD */ 207.73.152.0/22; /* Calhoun ISD */ 207.73.156.0/23; /* Calhoun ISD */ 207.73.158.0/24; /* Calhoun ISD */ 207.73.159.0/24; 207.73.160.0/21; 207.73.174.0/23; 207.73.180.0/22; 207.73.184.0/21; 207.73.219.0/24; 207.73.240.0/21; 207.73.248.0/22; 207.73.252.0/22; 207.74.0.0/24; 207.74.4.0/22; 207.74.8.0/21; 207.74.22.0/23; /* Grand Rapids Community College */ 207.74.24.0/21; 207.74.24.0/22; /* Grand Rapids Community College */ 207.74.29.0/24; /* Grand Rapids Community College */ 207.74.30.0/23; 207.74.67.0/24; 207.74.69.0/24; 207.74.84.0/22; /* MMNET */ 207.74.84.0/23; 207.74.88.0/23; 207.74.94.0/23; 207.74.104.0/22; 207.74.115.0/24; 207.74.118.0/23; 207.74.138.0/23; 207.74.140.0/22; /* Oakland University */ 207.74.149.0/24; /* Madonna University */ 207.74.168.0/24; 207.74.189.0/24; /* Northwestern Michigan College */ 207.74.224.0/22; /* Northwestern Michigan College */ 207.74.232.0/21; 207.75.55.0/24; 207.75.112.0/24; /* Washtenaw Community College */ 207.75.132.0/22; /* Washtenaw Community College */ 207.75.136.0/24; 207.75.208.0/20; 207.75.226.0/23; 207.75.228.0/23; 208.68.24.0/22; 216.11.0.0/16; } prefix-list MREN-PARTICIPANT6 { 2001:468:1200::/40; } prefix-list NYSERNET-PARTICIPANT { 67.99.160.0/21; 67.99.160.0/22; 128.59.0.0/16; 128.84.0.0/16; 128.113.0.0/16; 128.113.11.0/24; 128.122.0.0/16; 128.151.0.0/16; 128.205.0.0/16; 128.213.0.0/16; 128.226.0.0/16; 128.228.0.0/16; 128.230.0.0/16; 128.253.0.0/16; 129.5.0.0/16; 129.21.0.0/16; 129.49.0.0/16; 129.161.0.0/16; 129.236.0.0/16; 130.245.0.0/16; 132.236.0.0/16; 134.74.0.0/16; 140.251.0.0/16; 146.95.0.0/16; 146.96.0.0/16; 146.111.0.0/16; 146.245.0.0/16; 148.84.0.0/16; 149.4.0.0/16; 149.125.0.0/16; 150.210.0.0/16; 156.111.0.0/16; 156.145.0.0/16; 157.139.0.0/16; 160.39.0.0/16; 163.238.0.0/16; 169.226.0.0/16; 192.5.43.0/24; 192.5.53.0/24; 192.12.82.0/24; 192.12.89.0/24; 192.12.90.0/24; 192.35.82.0/24; 192.35.210.0/24; 192.42.55.0/24; 192.76.177.0/24; 192.77.9.0/24; 192.77.173.0/24; 192.86.139.0/24; 198.61.16.0/20; 198.83.28.0/22; 198.83.112.0/20; 198.180.141.0/24; 199.89.214.0/24; 199.109.0.0/16; 199.109.2.0/24; 199.109.4.0/24; 199.109.5.0/24; 199.109.6.0/30; 199.109.8.0/22; 199.109.12.0/22; 199.109.16.0/22; 199.109.20.0/22; 199.109.24.0/22; 199.109.28.0/22; 199.109.32.0/22; 199.109.40.0/22; 199.109.44.0/22; 199.109.100.0/24; 199.109.200.0/21; 199.219.128.0/18; 199.219.192.0/20; 199.219.208.0/21; 199.219.216.0/24; 204.9.168.0/22; 204.168.181.0/24; 204.168.182.0/23; 204.168.184.0/21; 205.232.16.0/21; 207.10.4.0/24; 207.10.5.0/24; 207.10.6.0/24; 207.10.7.0/24; 207.10.196.0/24; 207.10.197.0/24; 207.10.198.0/24; 207.10.199.0/24; 207.127.120.0/21; 207.127.224.0/22; 207.159.192.0/18; 209.2.48.0/22; 209.2.54.0/23; 216.165.0.0/17; } prefix-list NYSERNET-CORPORATE { 129.34.0.0/16; 198.81.209.0/24; 198.83.46.0/24; 198.180.207.0/24; 198.182.248.0/24; 199.164.149.0/24; 199.181.149.0/24; 199.222.58.0/24; 199.222.59.0/24; 199.222.71.0/24; 204.107.83.0/24; } prefix-list NYSERNET-SPONSORED { 205.232.8.0/21; 209.2.160.0/21; 216.73.240.0/20; } prefix-list NYSERNET-SEGP { 38.96.188.0/24; 63.144.174.0/24; 63.144.175.0/24; 65.88.72.0/22; 65.88.88.0/23; 67.99.185.0/24; 128.153.0.0/16; 129.85.0.0/16; 129.98.0.0/16; 137.143.0.0/16; 137.238.0.0/16; 138.92.0.0/16; 139.127.0.0/16; 146.203.0.0/16; 147.4.0.0/16; 148.100.0.0/16; 149.31.0.0/16; 149.123.0.0/16; 168.169.0.0/16; 170.161.0.0/16; 192.31.156.0/24; 192.33.253.0/24; 192.231.122.0/23; 192.231.124.0/23; 192.246.178.0/24; 192.246.224.0/22; 192.246.228.0/23; 192.246.231.0/24; 192.246.232.0/22; 192.246.235.0/24; 192.246.239.0/24; 192.246.253.0/24; 198.22.176.0/24; 198.105.32.0/20; 198.180.129.0/24; 198.199.181.0/24; 199.190.222.0/23; 199.190.224.0/23; 204.97.72.0/24; 204.168.248.0/21; 205.232.96.0/20; 207.10.8.0/21; 207.127.176.0/21; 216.182.132.0/24; 216.182.136.0/22; 216.226.96.0/19; } prefix-list NYSERNET-PARTICIPANT6 { 2001:468:900::/40; 2001:468:1100::/40; 2001:18d8::/32; } prefix-list INDIANAGIGAPOP-PARTICIPANT { 65.254.96.0/20; 66.205.160.0/20; 66.254.224.0/19; 72.12.215.0/24; 128.10.0.0/16; 128.46.0.0/16; 128.210.0.0/16; 128.211.0.0/16; 128.252.0.0/16; 129.74.0.0/16; 129.79.0.0/16; 134.68.0.0/16; /* University of Louisville */ 136.165.0.0/16; 140.182.0.0/16; 149.159.0.0/16; 149.160.0.0/16; 149.161.0.0/16; 149.162.0.0/16; 149.163.0.0/16; 149.164.0.0/16; 149.165.0.0/16; 149.166.0.0/16; 156.56.0.0/16; 157.91.0.0/16; 165.134.0.0/16; 192.12.206.0/24; 192.88.99.0/24; 192.245.116.0/24; /* University of Louisville */ 199.120.154.0/24; 204.52.32.0/20; 205.137.32.0/20; } prefix-list INDIANAGIGAPOP-SEGP { 12.159.195.0/24; 12.159.206.0/23; 12.159.209.0/24; 69.51.160.0/19; 131.93.0.0/16; 137.112.0.0/16; 139.102.0.0/16; 147.53.0.0/16; 147.226.0.0/16; 152.228.0.0/16; 157.91.0.0/19; 157.91.48.0/20; 157.91.64.0/18; 157.91.128.0/17; 159.28.0.0/16; 159.218.0.0/16; 159.242.0.0/16; 161.32.0.0/16; 163.120.0.0/16; 163.245.0.0/16; 165.138.0.0/16; 165.139.0.0/16; 167.217.0.0/16; 168.91.0.0/16; 168.102.0.0/16; 192.146.191.0/24; 192.146.192.0/24; 192.189.3.0/24; 192.195.225.0/24; 192.195.226.0/23; 192.195.228.0/23; 192.195.230.0/24; 192.200.128.0/21; 192.206.9.0/24; 192.206.10.0/23; 192.207.174.0/23; 192.207.176.0/23; 192.207.178.0/24; 198.51.243.0/24; 198.51.244.0/24; 198.62.84.0/24; 198.62.98.0/24; 199.8.0.0/16; 204.52.48.0/20; 205.215.64.0/18; 208.119.0.0/16; } prefix-list INDIANAGIGAPOP-SPONSORED { 149.165.251.0/24; 216.88.164.0/24; } prefix-list INDIANAGIGAPOP-PARTICIPANTS6 { 2001:468:400::/40; 2001:18e8::/32; 2002::/16; } prefix-list CPS-BGP-PEERS { apply-path "routing-instances cps protocols bgp group <*> neighbor <*>"; } /* GPN (KANS) also backups up Northern Lights; update prefix list on KANS router */ prefix-list NORTHERNLIGHTS-PARTICIPANTS6 { 2001:468:1900::/40; 2001:4930::/32; } prefix-list RADIUS-SERVERS { 129.79.216.162/32; 134.68.107.17/32; } prefix-list BGP-PEERS-CPS { apply-path "routing-instances cps protocols bgp group <*> neighbor <*>"; } prefix-list MERIT-PARTICIPANT { 35.0.0.0/8; 65.174.34.0/23; 141.211.0.0/16; 141.212.0.0/16; 141.213.0.0/16; 141.214.0.0/16; 141.215.0.0/16; 141.216.0.0/16; 141.217.0.0/16; 141.218.0.0/16; 141.219.0.0/16; 146.9.0.0/16; 153.106.0.0/16; 155.139.0.0/16; 192.12.80.0/24; 192.31.238.0/24; /* Merit prefix for MM - to be removed after 12/09/2006 */ 192.35.164.0/22; /* Merit prefix for MM - to be removed after 12/09/2006 */ 192.35.169.0/24; 192.41.229.0/24; 192.41.230.0/23; 192.41.232.0/22; 192.41.236.0/23; /* Alma College */ 192.101.250.0/24; 192.122.182.0/23; 192.122.200.0/24; 192.203.195.0/24; 192.231.253.0/24; 198.30.180.0/23; 198.108.0.0/24; 198.108.1.0/24; 198.108.2.0/24; 198.108.5.0/24; 198.108.18.0/23; /* Michigan Information Technology Center Foundation (MICT) */ 198.108.26.0/23; /* UMichigan */ 198.108.60.0/22; 198.108.62.0/24; 198.108.95.0/24; 198.108.96.0/24; 198.108.182.0/24; 198.108.184.0/24; /* Alma College */ 198.108.232.0/24; 198.109.65.0/24; 198.109.240.0/20; 198.110.192.0/20; 198.110.216.0/21; 198.111.172.0/24; 198.111.212.0/23; 198.111.224.0/23; 204.38.0.0/22; 204.38.16.0/21; 204.38.56.0/21; 204.38.160.0/23; 204.38.166.0/23; 204.38.168.0/22; 204.38.172.0/23; 204.38.174.0/24; 204.38.181.0/24; 204.38.182.0/23; 204.38.184.0/21; 204.38.192.0/20; 207.73.208.0/24; 207.73.212.0/23; 207.74.72.0/22; 207.75.140.0/24; 207.75.144.0/20; 207.75.164.0/23; 207.75.166.0/23; } prefix-list MERIT-CORPORATE { 136.1.0.0/16; 136.2.0.0/16; 136.8.32.0/22; 165.215.0.0/16; 192.195.245.0/24; } prefix-list MERIT-SPONSORED { /* NOAA/GLERL */ 192.94.173.0/24; 198.108.7.0/24; 198.108.102.0/23; /* MERIT - NOAA Thunder Bay National Marine Sanctuary */ 198.108.237.0/24; /* Van Andel Institute */ 198.110.167.0/24; /* Macomb Community College MICH-858 */ 198.111.56.0/23; /* NOAA/GLERL */ 207.74.57.0/24; 207.75.32.0/21; } prefix-list MERIT-PARTICIPANT6 { 2001:468:1400::/40; 2001:468:1f09::/48; 2001:48A8::/32; 2607:f388::/32; } /* GPN (KANS) also backups up Northern Lights; update prefix list on KANS router */ prefix-list NORTHERNLIGHTS-SEGP { 64.8.128.0/18; /* St. Olaf College */ 130.71.0.0/16; 134.29.0.0/16; 134.129.0.0/16; /* Carleton College */ 137.22.0.0/16; 138.129.0.0/16; 138.192.0.0/16; /* Gustavus Adolphus College */ 138.236.0.0/16; /* Bethel College */ 140.88.0.0/16; /* University of St. Thomas */ 140.209.0.0/16; /* College of St. Catherine */ 140.225.0.0/16; /* Macalester College */ 141.140.0.0/16; 141.224.0.0/16; 156.98.26.0/23; 156.98.60.0/22; 156.98.64.0/21; 165.234.0.0/20; 165.234.7.0/24; 165.234.8.0/22; 165.234.12.0/23; 165.234.14.0/24; /* North Dakota K12 Schools */ 165.234.32.0/21; /* North Dakota K12 Schools */ 165.234.40.0/22; /* North Dakota K12 Schools */ 165.234.44.0/23; 165.234.48.0/20; 165.234.65.0/24; /* North Dakota K12 Schools */ 165.234.71.0/24; /* North Dakota K12 Schools */ 165.234.98.0/23; /* North Dakota K12 Schools */ 165.234.100.0/22; /* North Dakota K12 Schools */ 165.234.104.0/21; /* North Dakota K12 Schools */ 165.234.112.0/21; /* North Dakota K12 Schools */ 165.234.120.0/23; /* North Dakota K12 Schools */ 165.234.123.0/24; /* North Dakota K12 Schools */ 165.234.124.0/23; 165.234.126.0/24; /* North Dakota K12 Schools */ 165.234.127.0/24; 165.234.128.0/21; /* North Dakota K12 Schools */ 165.234.146.0/23; /* North Dakota K12 Schools */ 165.234.160.0/24; /* North Dakota K12 Schools */ 165.234.164.0/22; 165.234.165.0/24; /* North Dakota K12 Schools */ 165.234.168.0/22; 165.234.172.0/22; 165.234.176.0/22; /* North Dakota K12 Schools */ 165.234.180.0/22; /* North Dakota K12 Schools */ 165.234.184.0/21; /* North Dakota K12 Schools */ 165.234.192.0/20; 165.234.206.0/24; 165.234.208.0/20; /* Minnesota SEGP-Concordia College */ 192.231.160.0/24; 198.22.19.0/24; 198.52.0.0/22; /* Northwestern College */ 198.174.0.0/24; 198.174.16.0/20; 198.174.217.0/24; 198.174.218.0/23; 198.174.220.0/22; 198.174.224.0/21; 198.174.232.0/24; 198.176.160.0/24; 199.17.0.0/16; /* Northwestern College nwc.edu */ 199.86.72.0/21; 204.72.0.0/17; 204.72.192.0/19; 204.72.224.0/21; 204.72.232.0/22; 204.72.246.0/23; 204.72.248.0/21; 204.73.20.0/22; /* Northwestern College */ 204.73.112.0/20; 204.77.32.0/19; /* St. Paul Public Schools */ 204.147.94.0/24; 204.169.0.0/16; 204.220.192.0/19; 204.220.224.0/20; 205.178.192.0/18; /* St. Paul Public Schools */ 205.215.222.0/24; 206.8.192.0/19; 206.8.224.0/23; 206.8.238.0/24; 206.9.147.0/24; 206.9.148.0/22; 206.11.192.0/20; 206.131.0.0/17; 206.131.128.0/19; } prefix-list IOWA-PARTICIPANT { 128.255.0.0/16; 129.255.0.0/16; 198.49.182.0/24; 205.237.112.0/20; } prefix-list IOWA-SEGP { 64.113.64.0/19; 65.110.224.0/19; 67.43.16.0/20; 129.186.0.0/16; 134.161.0.0/16; 144.62.0.0/16; 147.92.0.0/18; 147.92.240.0/20; 147.155.0.0/16; 152.131.100.0/22; 152.131.104.0/24; 152.131.110.0/23; 152.131.112.0/23; 152.131.114.0/24; 161.210.0.0/16; 165.206.0.0/16; 192.149.231.0/24; 192.152.29.0/24; 192.188.159.0/24; 192.188.160.0/22; 192.189.247.0/24; 192.203.196.0/24; 192.231.201.0/24; 192.245.179.0/24; 192.251.94.0/24; 198.101.32.0/20; 198.102.147.0/24; 198.133.77.0/24; 198.147.162.0/24; 198.176.250.0/24; 198.178.167.0/24; 198.183.227.0/24; 198.247.48.0/20; 198.247.96.0/19; 198.247.128.0/19; 199.201.203.0/24; 199.250.70.0/23; 204.8.36.0/22; 204.144.106.0/24; 204.238.255.0/24; 205.221.0.0/16; 205.221.30.0/24; 205.221.176.0/21; 205.221.206.0/23; 205.221.208.0/21; 207.28.0.0/16; 207.28.96.0/20; 207.28.112.0/22; 207.28.116.0/23; 207.28.128.0/21; 207.28.136.0/22; 207.28.209.0/24; 207.28.210.0/24; 207.165.0.0/16; 207.165.40.0/21; 207.165.48.0/21; 209.56.0.0/16; 209.56.51.0/24; 209.56.63.0/24; 209.56.96.0/21; 209.56.144.0/21; 209.56.253.0/24; 216.159.0.0/17; 216.159.85.0/24; 216.159.128.0/18; 216.159.180.0/24; 216.159.184.0/23; 216.159.192.0/19; } prefix-list IOWA-CORPORATE; prefix-list IOWA-SPONSORED; prefix-list UIUC-PARTICIPANT { 72.36.64.0/18; 72.36.126.0/23; 128.174.0.0/16; 130.126.0.0/16; 141.142.0.0/16; 192.17.0.0/16; } prefix-list CPS-MERIT { 35.0.0.0/8; 64.109.158.0/23; 65.174.34.0/23; 66.202.192.0/19; 66.202.224.0/19; 69.176.128.0/19; 72.14.226.0/24; 141.209.0.0/16; 141.210.0.0/16; 141.211.0.0/16; 141.212.0.0/16; 141.213.0.0/16; 141.214.0.0/16; 141.215.0.0/16; 141.216.0.0/16; 141.217.0.0/16; 141.218.0.0/16; 141.219.0.0/16; 143.207.0.0/16; 146.9.0.0/16; 147.124.0.0/16; 148.61.0.0/16; 155.139.0.0/16; 158.80.0.0/16; 158.80.0.0/21; 158.80.64.0/21; 161.57.0.0/16; 164.76.0.0/16; 192.35.161.0/24; 192.35.162.0/23; 192.35.170.0/24; 192.41.229.0/24; 192.41.232.0/22; 192.41.236.0/23; 192.41.238.0/24; 192.86.159.0/24; 192.88.242.0/24; 192.94.173.0/24; 192.101.250.0/24; 192.108.188.0/24; 192.108.189.0/24; 192.108.190.0/24; 192.108.191.0/24; 192.122.181.0/24; 192.122.183.0/24; 192.122.184.0/24; 192.122.186.0/24; 192.122.200.0/24; 192.138.137.0/24; 192.153.163.0/24; 192.153.192.0/24; 192.188.100.0/24; 192.188.118.0/24; 192.203.195.0/24; 192.231.113.0/24; 192.231.253.0/24; 192.245.252.0/24; 192.245.254.0/24; 198.17.130.0/23; 198.17.132.0/23; 198.17.134.0/24; 198.49.116.0/23; 198.49.118.0/24; 198.108.0.0/14; 198.108.140.0/23; 198.111.209.0/24; 198.111.220.0/24; 204.38.0.0/15; 204.106.17.0/24; 207.72.0.0/14; 207.74.92.0/24; 207.74.239.0/24; 208.68.24.0/22; 216.182.144.0/20; } prefix-list CPS-UIUC { 64.22.176.0/20; 64.22.176.0/21; } prefix-list WISCREN-PARTICIPANT { 65.110.224.0/19; /* University of Wisconsin Madison */ 72.33.0.0/16; 128.104.0.0/16; 128.105.0.0/16; 129.89.0.0/16; /* Marquette University */ 134.48.0.0/16; 138.49.0.0/16; 144.92.0.0/16; 146.151.0.0/16; 192.107.47.0/24; 192.107.164.0/24; 192.160.134.0/24; 192.172.224.0/24; 198.51.254.0/24; 198.133.224.0/24; 198.150.0.0/16; 205.213.0.0/16; } prefix-list WISCREN-SEGP { 131.210.0.0/16; 137.28.0.0/16; 137.81.0.0/16; 137.104.0.0/16; 138.49.0.0/16; 138.74.0.0/16; 139.135.0.0/16; 139.225.0.0/16; 140.104.0.0/16; 140.146.0.0/16; 140.189.0.0/16; 141.106.0.0/16; 141.233.0.0/16; 143.44.0.0/16; 143.109.0.0/16; 143.200.0.0/16; 143.235.0.0/16; 143.236.0.0/16; 144.13.0.0/16; 144.89.0.0/16; 148.8.0.0/16; 160.32.0.0/16; 165.128.0.0/16; 169.227.0.0/16; 192.35.81.0/24; 192.133.95.0/24; /* Aurora University */ 192.203.224.0/24; 192.206.48.0/24; 192.227.32.0/19; 192.231.219.0/24; 192.236.16.0/21; 192.236.24.0/23; 192.251.163.0/24; 198.51.130.0/24; 198.133.187.0/24; 198.133.188.0/23; 199.197.64.0/18; 199.242.176.0/24; 216.56.0.0/16; } prefix-list WISCREN-CORPORATE; prefix-list WISCREN-SPONSORED; prefix-list UIOWA-PARTICIPANTS6 { 2001:468:2101::/48; } prefix-list UIOWA-SEGP6 { 2610:130::/32; } prefix-list CPS-UMN { 64.8.128.0/18; 128.101.0.0/16; 131.212.0.0/16; 134.29.0.0/16; 134.84.0.0/16; 136.234.0.0/16; 138.129.0.0/16; 138.192.0.0/16; 141.224.0.0/16; 146.57.0.0/16; 151.111.0.0/16; 156.98.0.0/15; 156.142.0.0/16; 160.94.0.0/16; 192.133.60.0/24; 192.156.191.0/24; 192.234.247.0/24; 199.17.0.0/16; 204.77.32.0/19; 207.171.64.0/18; } prefix-list BGP-PEERS6-CPS { apply-path "routing-instances cps protocols bgp group CONNECTORS6 neighbor <*>"; } prefix-list RACKLAN-ACCESS { /* ARIN Allocation */ 64.57.16.0/20; /* ISI East */ 65.114.168.0/24; /* ndb2-blmt.abilene.ucaid.edu */ 129.79.5.18/32; /* DNS Server */ 129.79.5.100/32; /* ndb1-blmt.abilene.ucaid.edu */ 129.79.5.225/32; /* IUB */ 129.79.9.0/24; 129.79.216.64/27; 129.79.216.160/27; /* IUPUI */ 134.68.11.0/24; 134.68.107.0/24; 134.68.142.0/24; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; /* VPN Groups */ 156.56.175.0/27; /* jump.grnoc.iu.edu */ 192.12.206.196/32; /* sd-pc.grnoc.iu.edu */ 192.12.206.228/32; /* Internet2 Ann Arbor */ 207.75.164.0/23; } prefix-list NORTHERNLIGHTS-IN; prefix-list OBSERVATORY-SSH { /* sysmon.grnoc.iu.edu */ 134.68.107.4/32; /* login.net.internet2.edu */ 134.68.107.10/32; /* nms-base */ 134.68.107.34/32; /* nms-login */ 134.68.107.36/32; /* skip */ 134.68.142.50/32; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; /* jump */ 192.12.206.196/32; } prefix-list OBSERVATORY-SSH6 { 0::0/0; } prefix-list WISCREN-PARTICIPANTS6 { 2001:468:F00::/40; 2001:4E0::/32; 2001:4E0::/35; 2607:f388::/32; } policy-statement AMPATH-TO-ESNET { term FROM-REACCIUN { from as-path REACCIUN; then { as-path-prepend 11537; accept; } } term FROM-ANSP { from as-path ANSP; then { as-path-prepend 11537; accept; } } term FROM-RETINA { from as-path RETINA; then { as-path-prepend 11537; accept; } } } policy-statement CERN-IN { term participant { from { protocol bgp; prefix-list-filter CERN-PARTICIPANT orlonger; } then next policy; } term reject-unicast { to rib inet.0; then reject; } } policy-statement CERN-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter CERN-IN6 orlonger; } then { community add PARTICIPANT; next policy; } } term reject { to rib inet.6; then reject; } } policy-statement CONNECTOR-IN { /* remove BGP communities which connectors should not announce */ term remove-comms { then { community delete LOW-PEERS; community delete HIGH-PEERS; next term; } } term discard { from { community DISCARD; /* only allow /24-/32 masks for discard routes */ route-filter 0.0.0.0/0 prefix-length-range /24-/32; } to rib inet.0; then { /* add no-export so these are leaked outside of Abilene */ community add NO-EXPORT; /* set next-hop to the destination-address on the dsc.0 interface */ next-hop 198.32.11.7; accept; } } /* allow unicast routes upto /27; note: routes have already passed the individual connector policy */ term allow-unicast { from { route-filter 0.0.0.0/0 upto /27; } to rib inet.0; then { community add PARTICIPANT; accept; } } term allow-multicast { from { route-filter 0.0.0.0/0 upto /27; } to rib inet.2; then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement CPS-AS10310-OUT { term match { from community CPS-AS10310-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS13645-OUT { term match { from community CPS-AS13645-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS13768-OUT { term match { from community CPS-AS13768-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS14361-OUT { term match { from community CPS-AS14361-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS15169-OUT { term match { from community CPS-AS15169-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS15290-OUT { term match { from community CPS-AS15290-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS1784-OUT { term match { from community CPS-AS1784-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS19029-OUT { term match { from community CPS-AS19029-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS19151-OUT { term match { from community CPS-AS19151-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS22212-OUT { term match { from community CPS-AS22212-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS22773-OUT { term match { from community CPS-AS22773-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS22822-OUT { term match { from community CPS-AS22822-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS23342-OUT { term match { from community CPS-AS23342-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS23352-OUT { term match { from community CPS-AS23352-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS23504-OUT { term match { from community CPS-AS23504-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS25973-OUT { term match { from community CPS-AS25973-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS27524-OUT { term match { from community CPS-AS27524-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS29791-OUT { term match { from community CPS-AS29791-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS3303-OUT { term match { from community CPS-AS3303-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS33739-OUT { term match { from community CPS-AS33739-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS3549-OUT { term match { from community CPS-AS3549-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS36561-OUT { term match { from community CPS-AS36561-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS36617-OUT { term match { from community CPS-AS36617-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS40009-OUT { term match { from community CPS-AS40009-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS4181-OUT { term match { from community CPS-AS4181-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS4436-OUT { term match { from community CPS-AS4436-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS4513-OUT { term match { from community CPS-AS4513-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS6079-OUT { term match { from community CPS-AS6079-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS6327-OUT { term match { from community CPS-AS6327-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS6432-OUT { term match { from community CPS-AS6432-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS6539-OUT { term match { from community CPS-AS6539-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS6939-OUT { term match { from community CPS-AS6939-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS7228-OUT { term match { from community CPS-AS7228-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS812-OUT { term match { from community CPS-AS812-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-AS9505-OUT { term match { from community CPS-AS9505-OUT; then next policy; } term accept { then accept; } } policy-statement CPS-CONNECTOR-IN { term discard { from { community DISCARD; /* only allow /24-/32 masks for discard routes */ route-filter 0.0.0.0/0 prefix-length-range /24-/32; } then { /* add no-export so these are leaked outside of Abilene */ community add NO-EXPORT; /* set next-hop to the destination-address on the dsc.0 interface */ next-hop discard; accept; } } /* allow unicast routes upto /27; note: routes have already passed the individual connector policy */ term allow-unicast { from { route-filter 0.0.0.0/0 upto /24; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-CONNECTOR-OUT { /* announce routes from CPS peer networks */ term announce-peers { from { protocol bgp; community CPS-PEERS; } then accept; } term announce-internal { from { protocol static; route-filter 198.32.9.0/24 exact; } then accept; } term reject { then reject; } } policy-statement CPS-CONNECTOR-OUT6 { term announce-peers { from { protocol bgp; community CPS-PEERS; family inet6; } then accept; } term announce-internal { from { protocol static; family inet6; route-filter 2001:468:ff00::/40 exact; } then accept; } term reject { then reject; } } policy-statement CPS-EXPORT { term direct { from protocol direct; then { community add CPS; accept; } } term bgp { from protocol bgp; then { community add CPS; accept; } } term reject { then reject; } } policy-statement CPS-IMPORT { term bgp { from community CPS; then accept; } term reject { then reject; } } policy-statement CPS-INDIANAGIGAPOP-IN { term accept { from { protocol bgp; prefix-list-filter INDIANAGIGAPOP-PARTICIPANT orlonger; prefix-list-filter INDIANAGIGAPOP-SPONSORED orlonger; prefix-list-filter INDIANAGIGAPOP-SEGP orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-INDIANAGIGAPOP-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter INDIANAGIGAPOP-PARTICIPANTS6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-IOWA-IN { term accept { from { protocol bgp; prefix-list-filter IOWA-PARTICIPANT orlonger; prefix-list-filter IOWA-SEGP orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-MERIT-IN { term accept { from { protocol bgp; prefix-list-filter CPS-MERIT orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-MERIT-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter MERIT-PARTICIPANT6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-MREN-IN { term accept { from { protocol bgp; prefix-list-filter MREN-PARTICIPANT orlonger; prefix-list-filter MREN-SEGP orlonger; prefix-list-filter MREN-SPONSORED orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-MREN-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter MREN-PARTICIPANT6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-PEER-OUT { /* Don't annouce any route with a private AS in the path */ term block-private-asn { from as-path PRIVATE; then reject; } /* Don't announce reserved and special prefixes */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } /* Announce Connector prefixes >= /24 */ term announce { from { protocol bgp; community CPS-CONNECTOR; route-filter 0.0.0.0/0 upto /24; } then next policy; } /* Originate a BGP for our Lookback Addresses */ term originate { from { protocol static; route-filter 198.32.9.0/24 exact; route-filter 64.57.29.0/24 exact; } then accept; } term reject { then reject; } } policy-statement CPS-PEERCONTROLS-OUT { term block { from community CPS-BLOCK; then reject; } term prepend1 { from community CPS-PREPEND1; then { as-path-prepend 11537; accept; } } term prepend2 { from community CPS-PREPEND2; then { as-path-prepend "11537 11537"; accept; } } term prepend3 { from community CPS-PREPEND3; then { as-path-prepend "11537 11537 11537"; accept; } } term reject { then reject; } } policy-statement CPS-PEERS-IN { /* Reject any BGP prefix if a private AS is in the path */ term reject-private-asn { from as-path PRIVATE; then reject; } /* Reject BGP prefixes that should never appear in the routing table */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } /* Reject BGP prefixes which Abilene originates */ term block-internal { from { prefix-list INTERNAL; } then reject; } term accept { from { protocol bgp; route-filter 0.0.0.0/0 upto /24; } then { community add CPS-PEERS; accept; } } term reject { then reject; } } /* Remove certain BGP communities on export - applied to connectors and peers */ policy-statement CPS-REMOVE-COMMS { term remove { then { community delete HIGH-PEERS; community delete LOW-PEERS; community delete LOW; community delete HIGH; community delete DISCARD; community delete CPS; } } } policy-statement CPS-UIOWA-IN6 { term accept-part { from { protocol bgp; family inet6; prefix-list-filter UIOWA-PARTICIPANTS6 exact; } then { community add CPS-CONNECTOR; accept; } } term accept-segp { from { protocol bgp; family inet6; prefix-list-filter UIOWA-SEGP6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-UIUC-IN { term accept { from { protocol bgp; prefix-list-filter UIUC-PARTICIPANT orlonger; prefix-list-filter CPS-UIUC orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-UMN-IN { term accept { from { protocol bgp; prefix-list-filter CPS-UMN orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-UMN-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter NORTHERNLIGHTS-PARTICIPANTS6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-WISCREN-IN { term accept { from { protocol bgp; prefix-list-filter WISCREN-PARTICIPANT orlonger; prefix-list-filter WISCREN-SEGP orlonger; inactive: prefix-list-filter WISCREN-SPONSORED orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-WISCREN-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter WISCREN-PARTICIPANTS6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } /* import policy for FEDNET peers */ policy-statement FEDNET-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term set-community { from protocol bgp; then { community add FEDNET; accept; } } } policy-statement FEDNET-IN6 { term set-community { from protocol bgp; then { community add FEDNET; accept; } } } /* export policy from FEDNET peers */ policy-statement FEDNET-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce ITN routes from peers w/exception to reach FEDNETs (ie IFTNs) */ term allow-iftn { from { protocol bgp; community IFTN; } then accept; } /* don't announce nlri=unicast routes from fednet or international peers */ term block-fednet-itn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET ITN NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement FEDNET-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement FROM-APAN-SPECIAL { term accept-test-machines { from { route-filter 203.181.249.192/28 exact; route-filter 203.181.248.68/30 exact; /* JGN2 experimental machines to UIC [442:4] */ route-filter 202.180.40.0/28 exact; } then { community add ITN; accept; } } then next policy; } policy-statement GEANT-TO-ESNET { term FROM-GEANT { from as-path GEANT; then { as-path-prepend 11537; accept; } } } policy-statement IFTN-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term block-as112 { from { route-filter 192.175.48.0/24 orlonger; } then reject; } term set-community { from protocol bgp; then { community add ITN; community add IFTN; accept; } } } policy-statement IFTN-OUT { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term allow-multicast { from { protocol bgp; rib inet.2; } then accept; } term block { from { protocol bgp; community [ NONITN CONNECTOR-ONLY ]; } then reject; } term accept { from protocol bgp; then accept; } } policy-statement INDIANAGIGAPOP-IN { term participant { from { protocol bgp; prefix-list-filter INDIANAGIGAPOP-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter INDIANAGIGAPOP-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter INDIANAGIGAPOP-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term reject { then reject; } } policy-statement INDIANAGIGAPOP-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter INDIANAGIGAPOP-PARTICIPANTS6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement INTERNET2-MOSS { term accept-MOSS-routes { from community INTERNET2-INFINERA; then accept; } then next policy; } policy-statement IOWA-IN { term participant { from { protocol bgp; prefix-list-filter IOWA-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter IOWA-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter IOWA-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term corporate { from { protocol bgp; prefix-list-filter IOWA-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term reject-unicast { then reject; } } /* import policy for mcast-only peerings with commercial ISPs */ policy-statement ISP-MCAST-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term allow { from protocol bgp; to rib inet.2; then { community add COMMERCIAL-PEER; accept; } } term reject { then reject; } } policy-statement ISP-MCAST-OUT { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term no-export { from community BLOCK-TO-COMMERCIAL; then reject; } /* only advertise participant routes */ term allow { from { protocol bgp; rib inet.2; community PARTICIPANT; } then accept; } term reject { then reject; } } policy-statement ISP-V6-IN { term allow { from protocol bgp; to rib inet6.0; then { community add COMMERCIAL-PEER; accept; } } term reject { then reject; } } policy-statement ISP-V6-OUT { term no-export { from community BLOCK-TO-COMMERCIAL; then reject; } /* only advertise participant routes */ term accept { from { protocol bgp; community PARTICIPANT; family inet6; } then accept; } term reject { then reject; } } policy-statement ITN-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term block-as112 { from { route-filter 192.175.48.0/24 orlonger; } then reject; } term set-community { from protocol bgp; then { community add ITN; accept; } } } policy-statement ITN-IN6 { term set-community { from protocol bgp; then { community add ITN; accept; } } } policy-statement ITN-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* don't announce nlri=unicast routes from fednet or nonitn peers */ term block-fednet-nonitn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement ITN-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement LEAK-NMS1 { term leak { from { protocol isis; prefix-list NMS1-SPECIFICS; } then accept; } then next policy; } policy-statement MERIT-IN { term participant { from { protocol bgp; prefix-list-filter MERIT-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter MERIT-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter MERIT-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term corporate { from { protocol bgp; prefix-list-filter MERIT-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term reject-unicast { then reject; } } policy-statement MERIT-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter MERIT-PARTICIPANT6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement MREN-IN { term participant { from { protocol bgp; prefix-list-filter MREN-PARTICIPANT orlonger; prefix-list-filter NORTHERNLIGHTS-PARTICIPANT orlonger; } then next policy; } term corporate { from { protocol bgp; prefix-list-filter MREN-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term segp { from { protocol bgp; prefix-list-filter MREN-SEGP orlonger; prefix-list-filter NORTHERNLIGHTS-SEGP orlonger; prefix-list-filter MERIT-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter MREN-SPONSORED orlonger; prefix-list-filter NORTHERNLIGHTS-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term exception_participant { from { /* owned by Interop,loaned to WAIL lab at UW-Mad (Wiscren). Interop will use more-specifics when they're in session. */ route-filter 45.0.0.0/8 exact; /* Loyola (TEMP|JPH) */ route-filter 147.126.95.88/29 exact; } then accept; } term reject-unicast { then reject; } } policy-statement MREN-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter MREN-PARTICIPANT6 exact; prefix-list-filter NORTHERNLIGHTS-PARTICIPANTS6 exact; } then { community add PARTICIPANT; accept; } } term exception_participant { from { protocol bgp; family inet6; route-filter 2001:4930::/32 orlonger; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement MSDP-FILTER { term bad-groups { from { route-filter 224.0.1.2/32 exact; route-filter 224.0.1.3/32 exact; route-filter 224.0.1.8/32 exact; route-filter 224.0.1.22/32 exact; route-filter 224.0.1.24/32 exact; route-filter 224.0.1.25/32 exact; route-filter 224.0.1.35/32 exact; route-filter 224.0.1.39/32 exact; route-filter 224.0.1.40/32 exact; route-filter 224.0.1.60/32 exact; route-filter 224.0.2.1/32 exact; route-filter 224.0.2.2/32 exact; route-filter 224.77.0.0/16 orlonger; route-filter 225.1.2.3/32 exact; route-filter 226.77.0.0/16 orlonger; route-filter 229.55.150.208/32 exact; route-filter 234.42.42.40/30 orlonger; route-filter 234.142.142.42/31 orlonger; route-filter 234.142.142.44/30 orlonger; route-filter 234.142.142.48/28 orlonger; route-filter 234.142.142.64/26 orlonger; route-filter 234.142.142.128/29 orlonger; route-filter 234.142.142.136/30 orlonger; route-filter 234.142.142.140/31 orlonger; route-filter 234.142.142.142/32 exact; route-filter 232.0.0.0/8 orlonger; route-filter 239.0.0.0/8 orlonger; route-filter 224.0.1.76/32 exact; } then reject; } term bad-sources { from { source-address-filter 10.0.0.0/8 orlonger; source-address-filter 127.0.0.0/8 orlonger; source-address-filter 172.16.0.0/12 orlonger; source-address-filter 192.168.0.0/16 orlonger; } then reject; } term bad-planetlab { from { source-address-filter 198.32.154.179/32 exact; source-address-filter 198.32.154.187/32 exact; source-address-filter 198.32.154.195/32 exact; source-address-filter 198.32.154.202/32 exact; source-address-filter 198.32.154.210/32 exact; source-address-filter 198.32.154.218/32 exact; source-address-filter 198.32.154.226/32 exact; source-address-filter 198.32.154.235/32 exact; source-address-filter 198.32.154.243/32 exact; source-address-filter 198.32.154.250/32 exact; } then reject; } term allow { then accept; } } policy-statement NEXT-HOP-SELF { from protocol bgp; then { next-hop self; } } policy-statement NEXT-v4-v6-self { from protocol bgp; then { next-hop 198.32.9.193; } } policy-statement NONITN-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term set-community { from protocol bgp; then { community add NONITN; accept; } } } policy-statement NONITN-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* don't announce nlri=unicast routes from fednet or international peers */ term block-fednet-itn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET ITN NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement NONITN-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement NORTHERNLIGHTS-IN { term participant { from { protocol bgp; prefix-list-filter NORTHERNLIGHTS-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter NORTHERNLIGHTS-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter NORTHERNLIGHTS-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term reject-unicast { then reject; } } policy-statement NORTHERNLIGHTS-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter NORTHERNLIGHTS-PARTICIPANTS6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement NYSERNET-IN { term participant { from { protocol bgp; prefix-list-filter NYSERNET-PARTICIPANT orlonger; } then next policy; } term corporate { from { protocol bgp; prefix-list-filter NYSERNET-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter NYSERNET-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term segp { from { protocol bgp; prefix-list-filter NYSERNET-SEGP orlonger; } then { community add SEGP; next policy; } } term reject-unicast { to rib inet.0; then reject; } } policy-statement NYSERNET-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter NYSERNET-PARTICIPANT6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement OARNET-IN6 { term participant { from { protocol bgp; family inet6; route-filter 2001:468:B00::/40 exact; route-filter 2001:468:B06::/48 exact; } then accept; } term reject { then reject; } } policy-statement ORIGINATE4 { term internal-addresses { from { protocol static; prefix-list INTERNAL; } then accept; } } /* Redistribute aggregates from static into BGP & block more specifics */ policy-statement ORIGINATE6 { term announce-aggregates { from { protocol static; prefix-list INTERNAL6; } then accept; } term block-more-specifics { from { route-filter 2001:468::/32 longer; } then reject; } } /* Redistribute aggregates from static into BGP - do not block more specifics */ policy-statement ORIGINATE6-WITH-SPECIFICS { term announce-aggregates { from { protocol static; prefix-list INTERNAL6; } then accept; } } policy-statement PORTLANDSTATE-IN6 { term participant { from { protocol bgp; family inet6; route-filter 2001:468:1F04::/48 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement REDCLARA-TO-USGS { term FROM-REDCLARA { from as-path REDCLARA; then { as-path-prepend 11537; accept; } } } policy-statement REJECT-ALL { then reject; } /* Remove certain BGP communities on import - only applied to peers */ policy-statement REMOVE-COMMS-IN { term remove { then { /* remove connector local-pref communities */ community delete HIGH; community delete LOW; /* remove discard community */ community delete DISCARD; } } } /* Remove certain BGP communities on export - applied to connectors and peers */ policy-statement REMOVE-COMMS-OUT { term remove { then { /* remove connector and peer local-pref communities */ community delete HIGH-PEERS; community delete LOW-PEERS; community delete LOW; community delete HIGH; /* remove discard community */ community delete DISCARD; } } } /* reject routes we should never accept */ policy-statement SANITY-IN { /* Reject any BGP prefix if a private AS is in the path */ term block-private-asn { from as-path PRIVATE; then reject; } /* Reject any BGP NLRI=Unicast prefix if a commercial ISP's AS is in the path */ term block-commercial-asn { from as-path COMMERCIAL; to rib inet.0; then reject; } term block-nlr-transit { from as-path NLR; then reject; } /* Reject BGP prefixes that should never appear in the routing table */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } /* Reject BGP prefixes which Abilene originates */ term block-internal { from { prefix-list INTERNAL; } then reject; } } /* Block announcements for prefixes we should never announce */ policy-statement SANITY-OUT { /* Don't annouce any route with a private AS in the path */ term block-private-asn { from as-path PRIVATE; then reject; } /* Don't announce NLRI=Unicast routes if a commercial ISP's AS is in the path */ term block-commercial-asn { from { rib inet.0; as-path COMMERCIAL; } then reject; } /* Don't announce reserved and special prefixes */ term block-martians { from { /* default */ route-filter 0.0.0.0/0 exact; /* rfc 1918 */ route-filter 10.0.0.0/8 orlonger; /* rfc 3330 - loopback */ route-filter 127.0.0.0/8 orlonger; /* rfc 3330 - link-local */ route-filter 169.254.0.0/16 orlonger; /* rfc 1918 */ route-filter 172.16.0.0/12 orlonger; /* iana reserved */ route-filter 192.0.2.0/24 orlonger; /* 6to4 relay */ route-filter 192.88.99.1/32 exact; /* rfc 1918 */ route-filter 192.168.0.0/16 orlonger; /* rfc 2544 - network device benchmarking */ route-filter 198.18.0.0/15 orlonger; /* rfc 3171 - multicast group addresses */ route-filter 224.0.0.0/4 orlonger; /* rfc 3330 */ route-filter 240.0.0.0/4 orlonger; } then reject; } } policy-statement SANITY6 { /* Block routes with a private AS in the path */ term block-private-asns { from { as-path PRIVATE; family inet6; } then reject; } /* Only accept routes within certain allocated blocks */ term accept { /* see http://www.iana.org/assignments/ipv6-unicast-address-assignments */ from { route-filter 2001::/16 upto /49; route-filter 2002::/16 exact; route-filter 2003::/16 upto /49; route-filter 2400::/12 upto /49; route-filter 2600::/12 upto /49; route-filter 2a00::/12 upto /49; route-filter 2800::/12 upto /49; route-filter 2001:b000::/20 upto /49; route-filter 2c00::/12 upto /49; route-filter 2610::/12 upto /49; route-filter 2620::/12 upto /49; } then next policy; } term reject { then reject; } } /* set local-pref on connector routes based on communities */ policy-statement SET-PREF { term high { from community HIGH; then { local-preference 260; next policy; } } term low { from community LOW; then { local-preference 140; next policy; } } term normal { then { local-preference 200; } } } /* set local-pref on peer routes based on communities */ policy-statement SET-PREF-PEER { term high { from community HIGH-PEERS; then { local-preference 160; next policy; } } term low { from community LOW-PEERS; then { local-preference 40; next policy; } } term normal { then { local-preference 100; } } } policy-statement UIOWA-IN6 { term participant { from { protocol bgp; prefix-list-filter UIOWA-PARTICIPANTS6 exact; } then next policy; } term segp { from { protocol bgp; prefix-list-filter UIOWA-SEGP6 orlonger; } then { community add SEGP; next policy; } } term reject-unicast { then reject; } } policy-statement UIUC-IN { term participant { from { protocol bgp; prefix-list-filter UIUC-PARTICIPANT orlonger; } then next policy; } inactive: term segp { from { protocol bgp; prefix-list-filter UIUC-SEGP orlonger; } then { community add SEGP; next policy; } } inactive: term sponsored { from { protocol bgp; prefix-list-filter UIUC-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } inactive: term corporate { from { protocol bgp; prefix-list-filter UIUC-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term reject-unicast { then reject; } } policy-statement ULTRALIGHT-IN { term participant { from { protocol bgp; prefix-list-filter ULTRALIGHT-PARTICIPANT orlonger; } then next policy; } term reject-unicast { to rib inet.0; then reject; } } policy-statement ULTRALIGHT-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter ULTRALIGHT-PARTICIPANT6 exact; } then next policy; } term reject { to rib inet6.0; then reject; } } policy-statement V6-IGP-AGG { term allow-aggregate { from { protocol aggregate; family inet6; } then accept; } term deny-more-specifics { from { family inet6; route-filter 2001:468:ff:0f00::/56 longer; route-filter 2001:468:000f::/48 longer; } then reject; } term accept-all-other-v6 { from { protocol [ isis direct ]; family inet6; } then accept; } } policy-statement WISCREN-IN { term participant { from { protocol bgp; prefix-list-filter WISCREN-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter WISCREN-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter WISCREN-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term corporate { from { protocol bgp; prefix-list-filter WISCREN-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term reject-unicast { then reject; } } policy-statement WISCREN-IN-old { term participant { from { route-filter 65.110.224.0/19 orlonger; route-filter 128.104.0.0/16 orlonger; route-filter 128.105.0.0/16 orlonger; route-filter 129.89.0.0/16 orlonger; /* Marquette University */ route-filter 134.48.0.0/16 orlonger; route-filter 138.49.0.0/16 orlonger; route-filter 144.92.0.0/16 orlonger; route-filter 146.151.0.0/16 orlonger; route-filter 192.107.47.0/24 orlonger; route-filter 192.107.164.0/24 orlonger; route-filter 192.160.134.0/24 orlonger; route-filter 192.172.224.0/24 orlonger; route-filter 198.51.254.0/24 orlonger; route-filter 198.133.224.0/24 orlonger; route-filter 198.150.0.0/16 orlonger; route-filter 205.213.0.0/16 orlonger; /* University of Wisconsin Madison */ route-filter 72.33.0.0/16 orlonger; } then next policy; } term corporate { from { route-filter 0.0.0.0/0 orlonger next term; } then { community add CORPORATE; next policy; } } term sponsored { from { route-filter 0.0.0.0/0 orlonger next term; } then { community add SPONSORED; next policy; } } term segp { from { route-filter 131.210.0.0/16 orlonger; route-filter 137.28.0.0/16 orlonger; route-filter 137.81.0.0/16 orlonger; route-filter 137.104.0.0/16 orlonger; route-filter 138.49.0.0/16 orlonger; route-filter 138.74.0.0/16 orlonger; route-filter 139.135.0.0/16 orlonger; route-filter 139.225.0.0/16 orlonger; route-filter 140.104.0.0/16 orlonger; route-filter 140.146.0.0/16 orlonger; route-filter 140.189.0.0/16 orlonger; route-filter 141.106.0.0/16 orlonger; route-filter 141.233.0.0/16 orlonger; route-filter 143.44.0.0/16 orlonger; route-filter 143.109.0.0/16 orlonger; route-filter 143.200.0.0/16 orlonger; route-filter 143.235.0.0/16 orlonger; route-filter 143.236.0.0/16 orlonger; route-filter 144.13.0.0/16 orlonger; route-filter 144.89.0.0/16 orlonger; route-filter 148.8.0.0/16 orlonger; route-filter 160.32.0.0/16 orlonger; route-filter 165.128.0.0/16 orlonger; route-filter 169.227.0.0/16 orlonger; route-filter 192.133.95.0/24 orlonger; /* Aurora University */ route-filter 192.203.224.0/24 orlonger; route-filter 192.206.48.0/24 orlonger; route-filter 192.227.32.0/19 orlonger; route-filter 192.231.219.0/24 orlonger; route-filter 192.236.16.0/21 orlonger; route-filter 192.236.24.0/23 orlonger; route-filter 192.251.163.0/24 orlonger; route-filter 198.51.130.0/24 orlonger; route-filter 198.133.187.0/24 orlonger; route-filter 198.133.188.0/23 orlonger; route-filter 199.197.64.0/18 orlonger; route-filter 199.242.176.0/24 orlonger; route-filter 216.56.0.0/16 orlonger; route-filter 192.35.81.0/24 orlonger; } then { community add SEGP; next policy; } } term reject-unicast { to rib inet.0; then reject; } } policy-statement WISCREN-IN6 { term accept { from { family inet6; prefix-list-filter WISCREN-PARTICIPANTS6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement WORKSHOP-IN6 { term participant { from { protocol bgp; family inet6; route-filter 2001:468:1100::/40 upto /64; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement pim-join-filter { term internal-links { from { interface [ so-0/2/0.0 so-1/2/0.0 so-2/3/0.0 so-1/3/0.0 so-5/0/0.0 ]; route-filter 239.0.0.0/8 orlonger; } then accept; } term external-links { from { route-filter 239.0.0.0/8 orlonger; } then reject; } term all-links { then accept; } } community BLOCK-TO-COMMERCIAL members 11537:2002; community COMMERCIAL-PEER members 11537:2001; community CONNECTOR-ONLY members 11537:3500; community CORE members 11537:900; community CORPORATE members 11537:2000; community CPS members target:11537:1; community CPS-AS10310-OUT members *:10310; community CPS-AS13645-OUT members *:13645; community CPS-AS13768-OUT members *:13768; community CPS-AS14361-OUT members *:14361; community CPS-AS15169-OUT members *:15169; community CPS-AS15290-OUT members *:15290; community CPS-AS1784-OUT members *:1784; community CPS-AS19029-OUT members *:19029; community CPS-AS19151-OUT members *:19151; community CPS-AS22212-OUT members *:22212; community CPS-AS22773-OUT members *:22773; community CPS-AS22822-OUT members *:22822; community CPS-AS23342-OUT members *:23342; community CPS-AS23352-OUT members *:23352; community CPS-AS23504-OUT members *:23504; community CPS-AS25973-OUT members *:25973; community CPS-AS27524-OUT members *:27524; community CPS-AS29791-OUT members *:29791; community CPS-AS3303-OUT members *:3303; community CPS-AS33739-OUT members *:33739; community CPS-AS3549-OUT members *:3549; community CPS-AS36561-OUT members *:36561; community CPS-AS36617-OUT members *:36617; community CPS-AS40009-OUT members *:40009; community CPS-AS4181-OUT members *:4181; community CPS-AS4436-OUT members *:4436; community CPS-AS4513-OUT members *:4513; community CPS-AS6079-OUT members *:6079; community CPS-AS6327-OUT members *:6327; community CPS-AS6432-OUT members *:6432; community CPS-AS6539-OUT members *:6539; community CPS-AS6939-OUT members *:6939; community CPS-AS7228-OUT members *:7228; community CPS-AS812-OUT members *:812; community CPS-AS9505-OUT members *:9505; community CPS-BLOCK members 65000:*; community CPS-CONNECTOR members 11537:25100; community CPS-PEERS members 11537:25200; community CPS-PREPEND1 members 65001:*; community CPS-PREPEND2 members 65002:*; community CPS-PREPEND3 members 65003:*; community DISCARD members 11537:911; community FEDNET members 11537:3000; community HIGH members 11537:260; community HIGH-PEERS members 11537:160; community IFTN members 11537:2502; community INTERNET2-INFINERA members 19782:65533; community ITN members 11537:2501; community LOW members 11537:140; community LOW-PEERS members 11537:40; community NO-EXPORT members no-export; community NOAGG6 members 11537:6; community NONITN members 11537:2500; community PARTICIPANT members 11537:950; community SEGP members 11537:910; community SPONSORED members 11537:902; as-path COMMERCIAL ".* (1|174|701|1239|1673|1740|1800|1833|2551|2548|2685|2914|3549|3561|3847|3951|3967|4183|4200|5683|6113|6172|6461|7018) .*"; as-path PRIVATE ".* (64512-65535) .*"; as-path ABILENE ".* 11537 .*"; as-path ESNET "293 .*"; as-path GEANT "20965 .*"; as-path REACCIUN "20312 .*"; as-path ANSP "1251 .*"; as-path RETINA "3597 .*"; as-path REDCLARA "27750 .*"; as-path NLR ".* 19401 .*"; } Firewall Stanza Removed removed version 8.4R3.3; groups { INTERFACE-BACKBONE { interfaces { <*> { mtu 9192; encapsulation cisco-hdlc; sonet-options { fcs 32; } unit 0 { family inet { mtu 9180; filter { input backbone-in; output interface-out; } } family iso { mtu 1497; } family inet6 { mtu 9180; filter { input v6filter; output v6filter; } } family mpls { mtu 9180; } } } } } re0 { system { host-name ATLA-re0; } } re1 { system { host-name ATLA-re1; } } INTERFACE-CONNECTOR { interfaces { <so-*> { mtu 9192; encapsulation cisco-hdlc; sonet-options { fcs 32; rfc-2615; } unit <*> { family inet { mtu 9180; filter { input connector-in; output interface-out; } } family inet6 { mtu 9180; filter { input v6filter; output v6filter; } } } } <at-*> { unit <*> { family inet { filter { input connector-in; output interface-out; } } family inet6 { filter { input v6filter; output v6filter; } } } } <ge-*> { unit <*> { family inet { filter { input connector-in; output interface-out; } } family inet6 { filter { input v6filter; output v6filter; } } } } } } } apply-groups [ re0 re1 ]; system { domain-name net.internet2.edu; time-zone UTC; dump-on-panic; authentication-order [ radius password ]; location country-code US; root-authentication { Authentication Data Removed } name-server { 134.68.1.9; 129.79.5.100; } radius-server { 134.68.107.17 { timeout 5; source-address 64.57.28.243; } 129.79.216.162 { timeout 5; source-address 64.57.28.243; } } Login Stanza Removed services { ssh { connection-limit 30; } } syslog { archive files 100; user * { any critical; } /* brent's pine.ucs.indiana.edu */ host 129.79.9.1 { change-log any; interactive-commands info; facility-override local6; } /* syslog.grnoc.iu.edu */ host 134.68.107.9 { any info; authorization info; interactive-commands info; facility-override local6; } file messages { any notice; authorization info; archive size 1m files 100; } console { user critical; } } ntp { server 129.79.5.100; server 134.68.1.9 prefer; } } chassis { no-source-route; dump-on-panic; redundancy { failover { on-loss-of-keepalives; on-disk-failure; } keepalive-time 5; } routing-engine { on-disk-failure reboot; } } interfaces { so-0/0/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: ATLA-WASH OC-192 | I2-ATLA-WASH-O192-03916"; family inet { address 64.57.28.6/31; } family inet6 { address 2001:468:ff:109::1/64; } } } ge-0/1/0 { apply-groups INTERFACE-CONNECTOR; description "Indiana Gigapop via Internet2 DWS | I2-INDI-ATLA-10GE-04182"; vlan-tagging; mtu 9192; unit 110 { description "Indiana Gigapop R&E VLAN"; vlan-id 110; family inet { mtu 9000; address 149.165.254.21/31; } family inet6 { mtu 9000; address 2001:468:ff:144::1/64; } } unit 111 { description "[CPS] Indiana Gigapop"; vlan-id 111; family inet { mtu 9000; address 149.165.254.23/31; } } unit 112 { description "Indiana GigaPoP CPS-IPv6"; vlan-id 112; family inet6 { address 2001:468:ffff:144::1/64; } } } ge-0/2/0 { apply-groups INTERFACE-CONNECTOR; description "SOX via Internet2-owned metro fiber"; vlan-tagging; mtu 9192; unit 193 { description SOX; vlan-id 193; family inet { mtu 9000; policer { input 1G-drop; output 1G-drop; } address 143.215.193.10/30; } family inet6 { policer { input 1G-drop; output 1G-drop; } address 2001:468:FF:e43::1/64; } } unit 194 { description "Southern Crossroads (SOX) CPS IPv6"; vlan-id 194; family inet6 { address 2001:468:ffff:e43::1/64; } } inactive: unit 1800 { description "Florida LambdaRail (TREAT AS A PARTICIPANT!!!)"; vlan-id 1800; family inet { mtu 9000; address 198.32.155.194/30; } family inet6 { mtu 9000; address 2001:468:ff:e5e::1/64; } } unit 1801 { description "AMPATH via SOX"; vlan-id 1801; family inet { mtu 9000; address 198.32.252.238/30 { primary; } address 198.32.252.254/30; } family inet6 { mtu 9000; address 2001:468:ff:e47::1/64; } } } so-1/0/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: ATLA-CHIC OC-192 | I2-ATLA-CHIC-O192-03917"; family inet { address 64.57.28.4/31; } family inet6 { address 2001:468:ff:102::1/64; } } } ge-1/1/0 { apply-groups INTERFACE-CONNECTOR; description "KyRON via Internet2 DWS | I2-LOUS-ATLA-10GE-04183"; vlan-tagging; mtu 9192; unit 501 { description "KyRON R&E VLAN"; vlan-id 501; family inet { mtu 9000; address 216.249.136.198/30; } family inet6 { mtu 9000; address 2610:01E0:1000:6010::2/64; } } unit 503 { description "[CPS] KyRON"; vlan-id 503; family inet { mtu 9000; address 216.249.136.134/30; } family inet6 { mtu 9000; address 2610:01E0:1000:4010::2/64; } } } ge-1/3/0 { description "Observatory HP5406"; vlan-tagging; mtu 9180; inactive: unit 10 { description "Racklan #2"; vlan-id 10; family inet { address 64.57.25.254/24; } } unit 11 { description "ATLA Observatory vlan"; vlan-id 11; family inet { mtu 9000; address 64.57.16.65/28; } family inet6 { mtu 9000; address 2001:468:1:11::1/64; } } unit 12 { description "Observatory 1 Gig (temp)"; vlan-id 12; family inet { mtu 9000; address 64.57.16.97/28; } family inet6 { mtu 9000; address 2001:468:1:12::1/64; address 2001:468:1:12::16:97/64; } } unit 13 { description "test ISIS feed to nms-rpsv"; vlan-id 13; family inet { mtu 9000; address 64.57.16.89/30; } family iso; } unit 20 { description "ATLA VINI Mgmt"; vlan-id 20; family inet { mtu 9000; address 64.57.18.185/29; } } unit 21 { description "ATLA VINI Data"; vlan-id 21; family inet { mtu 9000; address 64.57.18.1/28; } } unit 50 { description "ISIS collector"; vlan-id 50; family iso { mtu 1497; } } } so-2/0/0 { apply-groups INTERFACE-CONNECTOR; description "University of South Florida via Internet2 DCS | USF:STS-48c:JACK:ATLA:0001"; dce; encapsulation frame-relay; unit 116 { description "University of South Florida R&E DLCI"; dlci 116; family inet { mtu 9000; address 131.247.47.213/30; } family inet6 { mtu 9000; address 2001:468:ff:0116::1/64; } } unit 117 { description "[CPS] University of South Florida"; dlci 117; family inet { mtu 9000; address 131.247.47.225/30; } family inet6 { mtu 9000; address 2001:468:ffff:0116::1/64; } } } so-2/1/0 { apply-groups INTERFACE-CONNECTOR; mtu 9192; unit 0 { description "University of Memphis OC-48 via Internet2 Ciena | I2-ATLA-NASH-OC48-04192"; family inet { mtu 9000; address 141.225.250.26/30; } family inet6 { mtu 9000; address 2001:468:FF:15B::1/64; } } } ge-2/3/0 { description "Unused 4xGE [NO-MONITOR]"; } ge-3/0/0 { vlan-tagging; mtu 9192; } ge-3/0/1 { description "to nms-rtr1"; mtu 9192; unit 0 { family inet { mtu 9000; address 64.57.16.81/30; } family inet6 { mtu 9000; address 2001:468:1:101::1/64; address 2001:468:1:101::16:81/64; } } } ge-3/0/2 { description "to nms-rtr2"; mtu 9192; unit 0 { family inet { mtu 9000; address 64.57.16.85/30; } family inet6 { mtu 9000; address 2001:468:1:100::1/64; address 2001:468:1:100::16:85/64; } } } so-3/1/0 { description "Unused 4xOC12 [NO-MONITOR]"; } so-4/0/0 { apply-groups INTERFACE-BACKBONE; unit 0 { description "BACKBONE: ATLA-HOUS OC-192 | I2-ATLA-HOUS-O192-03922"; family inet { address 64.57.28.42/31; } family inet6 { address 2001:468:ff:0103::2/64; } } } ge-4/1/0 { apply-groups INTERFACE-CONNECTOR; description "LONI via Internet2 DWS | I2-ATLA-BATO-10GE-04186"; vlan-tagging; mtu 9192; unit 600 { description "LONI R&E"; vlan-id 600; family inet { mtu 9000; address 208.100.127.33/30; } } unit 610 { description "[CPS] LONI"; vlan-id 610; family inet { mtu 9000; address 208.100.127.37/30; } } } ge-4/2/0 { apply-groups INTERFACE-CONNECTOR; description MCNC; vlan-tagging; mtu 9192; unit 10 { description "MCNC via Internet2 DWS | I2-ATLA-RALE-10GE-04187"; vlan-id 10; family inet { mtu 9000; address 198.86.17.66/30; } family inet6 { mtu 9000; address 2610:28:10E:1::2/64; } } unit 580 { description "[CPS] MCNC via Internet2 DWS"; vlan-id 580; family inet { mtu 9000; address 198.86.53.2/30; } } unit 582 { description "[CPS] MCNC/Duke | [NO-MONITOR]"; vlan-id 582; family inet { mtu 1500; inactive: address 64.57.28.0/31; address 152.3.167.9/30; } } unit 585 { description "[CPS] IPv6 Peering MCNC"; vlan-id 585; family inet6 { address 2001:468:ffff:155::1/64; } } } dsc { unit 0 { description "Discard Interface"; family inet { address 198.32.11.6/32 { destination 198.32.11.7; } } } } fxp0 { description "Management Ethernet - Unused"; disable; } lo0 { unit 0 { description "Internal Peering Point"; family inet { filter { input loopback-strict-in; } address 198.32.8.238/32; address 64.57.28.243/32 { preferred; } } family iso { address 49.0000.0000.0000.0001.00; } family inet6 { filter { input loopback-strict-in6; } address 2001:468:1::1/128; } } unit 1 { description "Loopback for CPS VRF;"; family inet { filter { input loopback-strict-in; } address 64.57.29.243/32; } family inet6 { filter { input loopback-strict-in6; } address 2001:468:ff01::1/128; } } } } forwarding-options { sampling { input { family inet { rate 100; max-packets-per-second 7000; } } output { inactive: file filename flowdata files 2 size 500000 world-readable; cflowd 64.57.16.68 { port 4193; version 5; no-local-dump; autonomous-system-type origin; } } } } routing-options { interface-routes { rib-group { inet if-rg; inet6 if6-rg; } } rib inet6.0 { static { rib-group static6-rg; route 2001:468::/32 { reject; install; readvertise; community 11537:950; } } } rib inet.2 { martians { 0.0.0.0/8 orlonger; 1.0.0.0/8 orlonger; 2.0.0.0/8 orlonger; 5.0.0.0/8 orlonger; 10.0.0.0/8 orlonger; 23.0.0.0/8 orlonger; 27.0.0.0/8 orlonger; 31.0.0.0/8 orlonger; 36.0.0.0/8 orlonger; 37.0.0.0/8 orlonger; 39.0.0.0/8 orlonger; 42.0.0.0/8 orlonger; 46.0.0.0/8 orlonger; 49.0.0.0/8 orlonger; 50.0.0.0/8 orlonger; 100.0.0.0/8 orlonger; 101.0.0.0/8 orlonger; 102.0.0.0/8 orlonger; 103.0.0.0/8 orlonger; 104.0.0.0/8 orlonger; 105.0.0.0/8 orlonger; 106.0.0.0/8 orlonger; 107.0.0.0/8 orlonger; 108.0.0.0/8 orlonger; 109.0.0.0/8 orlonger; 110.0.0.0/8 orlonger; 111.0.0.0/8 orlonger; 112.0.0.0/8 orlonger; 113.0.0.0/8 orlonger; 127.0.0.0/8 orlonger; 169.254.0.0/16 orlonger; 172.16.0.0/12 orlonger; 173.0.0.0/8 orlonger; 174.0.0.0/8 orlonger; 175.0.0.0/8 orlonger; 176.0.0.0/8 orlonger; 177.0.0.0/8 orlonger; 178.0.0.0/8 orlonger; 179.0.0.0/8 orlonger; 180.0.0.0/8 orlonger; 181.0.0.0/8 orlonger; 182.0.0.0/8 orlonger; 183.0.0.0/8 orlonger; 184.0.0.0/8 orlonger; 185.0.0.0/8 orlonger; 192.0.2.0/24 orlonger; 192.168.0.0/16 orlonger; 197.0.0.0/8 orlonger; 198.18.0.0/15 orlonger; 240.0.0.0/4 orlonger; } } static { rib-group static-rg; defaults { active; } /* Abilene Backbone */ route 198.32.8.0/22 { discard; community 11537:950; } /* MANLAN */ route 198.32.154.0/24 { discard; community 11537:950; } /* Abilene Observatory */ route 198.32.12.0/22 { discard; community 11537:950; } /* Internet2 Backbone */ route 64.57.16.0/20 { discard; community 11537:950; } } martians { 0.0.0.0/8 orlonger; 1.0.0.0/8 orlonger; 2.0.0.0/8 orlonger; 5.0.0.0/8 orlonger; 10.0.0.0/8 orlonger; 23.0.0.0/8 orlonger; 27.0.0.0/8 orlonger; 31.0.0.0/8 orlonger; 36.0.0.0/8 orlonger; 37.0.0.0/8 orlonger; 39.0.0.0/8 orlonger; 42.0.0.0/8 orlonger; 46.0.0.0/8 orlonger; 49.0.0.0/8 orlonger; 50.0.0.0/8 orlonger; 100.0.0.0/8 orlonger; 101.0.0.0/8 orlonger; 102.0.0.0/8 orlonger; 103.0.0.0/8 orlonger; 104.0.0.0/8 orlonger; 105.0.0.0/8 orlonger; 106.0.0.0/8 orlonger; 107.0.0.0/8 orlonger; 108.0.0.0/8 orlonger; 109.0.0.0/8 orlonger; 110.0.0.0/8 orlonger; 111.0.0.0/8 orlonger; 112.0.0.0/8 orlonger; 113.0.0.0/8 orlonger; 127.0.0.0/8 orlonger; 169.254.0.0/16 orlonger; 172.16.0.0/12 orlonger; 173.0.0.0/8 orlonger; 174.0.0.0/8 orlonger; 175.0.0.0/8 orlonger; 176.0.0.0/8 orlonger; 177.0.0.0/8 orlonger; 178.0.0.0/8 orlonger; 179.0.0.0/8 orlonger; 180.0.0.0/8 orlonger; 181.0.0.0/8 orlonger; 182.0.0.0/8 orlonger; 183.0.0.0/8 orlonger; 184.0.0.0/8 orlonger; 185.0.0.0/8 orlonger; 192.0.2.0/24 orlonger; 192.168.0.0/16 orlonger; 197.0.0.0/8 orlonger; 198.18.0.0/15 orlonger; 223.0.0.0/8 orlonger; } aggregate { defaults { community 11537:950; discard; } route 64.57.16.0/21; route 64.57.24.0/22; route 64.57.28.0/22; } rib-groups { if-rg { import-rib [ inet.0 inet.2 ]; } if6-rg { import-rib [ inet6.0 inet6.2 ]; } mcast-rpf-rg { import-rib inet.2; } mcast-rpf6-rg { import-rib inet6.2; } isis-rg { import-rib [ inet.0 inet.2 ]; } isis6-rg { import-rib [ inet6.0 inet6.2 ]; } static-rg { import-rib [ inet.0 inet.2 ]; } static6-rg { import-rib [ inet6.0 inet6.2 ]; } } router-id 64.57.28.243; autonomous-system 11537; multicast { scope SGI-Dogfight { prefix 224.0.1.2/32; interface all; } scope 224.0.1.3/32 { prefix 224.0.1.3/32; interface all; } scope SUN-NIS { prefix 224.0.1.8/32; interface all; } scope SVRLOC { prefix 224.0.1.22/32; interface all; } scope MS-DS { prefix 224.0.1.24/32; interface all; } scope NBC-PRO { prefix 224.0.1.25/32; interface all; } scope SVRLOC-DA { prefix 224.0.1.35/32; interface all; } scope AutoRP-Announce { prefix 224.0.1.39/32; interface all; } scope AutoRP-Discovery { prefix 224.0.1.40/32; interface all; } scope HP-DEVICE-DISC { prefix 224.0.2.1/32; interface all; } scope SUN-RPC { prefix 224.0.2.2/32; interface all; } scope Norton-Ghost-1 { prefix 224.77.0.0/16; interface all; } scope Altiris { prefix 225.1.2.3/32; interface all; } scope Norton-Ghost-2 { prefix 226.77.0.0/16; interface all; } scope Norton-Ghost-3 { prefix 229.55.150.208/32; interface all; } scope ImageCast-1 { prefix 234.42.42.40/30; interface all; } scope ImageCast-2 { prefix 234.142.142.42/31; interface all; } scope ImageCast-3 { prefix 234.142.142.44/30; interface all; } scope ImageCast-4 { prefix 234.142.142.48/28; interface all; } scope ImageCast-5 { prefix 234.142.142.64/26; interface all; } scope ImageCast-6 { prefix 234.142.142.128/29; interface all; } scope ImageCast-7 { prefix 234.142.142.136/30; interface all; } scope ImageCast-8 { prefix 234.142.142.140/31; interface all; } scope ImageCast-9 { prefix 234.142.142.142/32; interface all; } ssm-groups 232.0.0.0/8; forwarding-cache { threshold { suppress 50000; reuse 25000; } } } } protocols { igmp { interface all { version 2; } } mld { interface all; } rsvp { /* BACKBONE to WASH */ interface so-0/0/0.0; /* BACKBONE to CHIC */ interface so-1/0/0.0; /* BACKBONE to ATLA-M5 */ interface ge-2/3/1.0; /* BACKBONE to HOUS */ interface so-4/0/0.0; } mpls { statistics { file mpls-stat; interval 60; } ipv6-tunneling; optimize-timer 360; preference 200; label-switched-path ATLA->STTL { to 198.32.8.200; fast-reroute; } label-switched-path ATLA->CHIC { to 64.57.28.241; fast-reroute; } label-switched-path ATLA->KANS { to 64.57.28.245; fast-reroute; } label-switched-path ATLA->NEWY { to 64.57.28.242; fast-reroute; } label-switched-path ATLA->WASH { to 64.57.28.249; fast-reroute; } label-switched-path ATLA->SALT { to 64.57.28.246; fast-reroute; } label-switched-path ATLA->LOSA-I2 { to 64.57.28.248; fast-reroute; } label-switched-path ATLA->HOUS { to 64.57.28.244; fast-reroute; } /* BACKBONE to WASH */ interface so-0/0/0.0; /* BACKBONE to CHIC */ interface so-1/0/0.0; /* BACKBONE to ATLA-M5 */ interface ge-2/3/1.0; /* BACKBONE to HOUS */ interface so-4/0/0.0; /* Internet2 connection back to Memphis */ interface so-2/1/0.513; /* UMemphis HSIP from Level3 */ interface so-2/2/0.512; } bgp { log-updown; group INTERNET2 { type internal; local-address 64.57.28.243; family inet { any; } family inet-vpn { unicast; } family inet6-vpn { unicast; } Authentication Data Removed export NEXT-HOP-SELF; peer-as 11537; neighbor 198.32.8.200 { description STTLng; } neighbor 64.57.28.241 { description CHIC; } neighbor 64.57.28.242 { description NEWY; } neighbor 64.57.28.244 { description HOUS; } neighbor 64.57.28.245 { description KANS; } neighbor 64.57.28.246 { description SALT; } inactive: neighbor 64.57.28.247 { description SEAT; } neighbor 64.57.28.248 { description LOSA; } neighbor 64.57.28.249 { description WASH; } } group INTERNET2-IPv6 { type internal; local-address 2001:468:1::1; family inet6 { any; } Authentication Data Removed export NEXT-HOP-SELF; peer-as 11537; neighbor 2001:468:16::1 { description "STTLng;"; } neighbor 2001:468:2::1 { description CHIC; } neighbor 2001:468:3::1 { description HOUS; } neighbor 2001:468:4::1 { description KANS; } neighbor 2001:468:5::1 { description LOSA; } neighbor 2001:468:6::1 { description NEWY; } neighbor 2001:468:7::1 { description SALT; } inactive: neighbor 2001:468:8::1 { description SEAT; } neighbor 2001:468:9::1 { description WASH; } } /* Use OTHER group for sessions to route-servers, monitoring hosts, etc */ inactive: group OTHER { metric-out igp; import REJECT-ALL; remove-private; } group OTHER-INTERNAL { type internal; import REJECT-ALL; peer-as 11537; neighbor 134.68.246.49 { description "arbor11.ren-isac.net -- Arbor Peakflow [NO-MONITOR]"; local-address 64.57.28.243; family inet { unicast; } cluster 134.68.246.49; } neighbor 134.68.246.51 { description "arbor21.ren-isac.net -- Arbor Peakflow [NO-MONITOR]"; local-address 64.57.28.243; family inet { unicast; } cluster 134.68.246.51; } neighbor 156.56.103.99 { description "IU ANML monitor--contact Ripley"; multihop { ttl 10; } local-address 64.57.28.243; hold-time 65535; family inet { unicast; } } neighbor 2001:18e8:2:403:202:b3ff:fe23:715a { description "IU ANML monitor6"; multihop { ttl 10; } local-address 2001:468:1::1; family inet6 { unicast; } } neighbor 64.57.16.68 { description "nms-rpsv.atla zebra bgpd [NO-MONITOR]"; local-address 64.57.16.65; family inet { unicast; multicast; } cluster 64.57.16.65; } neighbor 2001:468:1:11::16:68 { description "nms-rpsv.atla zebra bgpd [NO-MONITOR]"; local-address 2001:468:1:11::1; family inet6 { unicast; multicast; } } } group CONNECTOR { type external; metric-out igp; /* Multihop needs to be enabled to support discard routing */ multihop { ttl 1; } family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ]; remove-private; neighbor 149.165.254.20 { description "Indiana Gigapop"; import [ SANITY-IN SET-PREF INTERNET2-MOSS INDIANAGIGAPOP-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 19782; } neighbor 198.32.252.237 { description "AMPATH primary via SOX"; import [ SANITY-IN SET-PREF SFGP-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 20080; } neighbor 143.215.193.9 { description SoX; import [ SANITY-IN SET-PREF SOX-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 10490; } neighbor 141.225.250.25 { description "University of Memphis"; import [ SANITY-IN SET-PREF MEMPHIS-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 14048; } neighbor 208.100.127.34 { description LONI; import [ SANITY-IN SET-PREF LONI-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 32440; } neighbor 131.247.47.214 { description "University of South Florida"; import [ SANITY-IN SET-PREF USF-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 5661; } neighbor 198.86.17.65 { description "MCNC via Internet2 DWS I2-ATLA-RALE-I2-00126 [NO-MONITOR]"; import [ SANITY-IN SET-PREF MCNC-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 81; } neighbor 216.249.136.197 { description "KyRON NEW [NO-MONITOR]"; local-address 216.249.136.198; import [ SANITY-IN SET-PREF KyRON-IN CONNECTOR-IN ]; Authentication Data Removed peer-as 30700; } } group CONNECTOR6 { type external; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ]; remove-private; neighbor 2001:468:ff:144::2 { description "Indiana Gigapop"; import [ SANITY6 SET-PREF INDIANAGIGAPOP-IN6 ]; Authentication Data Removed peer-as 19782; } neighbor 2001:468:FF:e43::2 { description SOXv6; import [ SANITY6 SET-PREF SOX-IN6 ]; Authentication Data Removed peer-as 10490; } neighbor 2001:468:FF:E47::2 { description "South Florida Gigapop"; import [ SANITY6 SET-PREF SFGP-IN6 ]; Authentication Data Removed peer-as 20080; } neighbor 2001:468:FF:15B::2 { description "University of Memphis"; import [ SANITY6 SET-PREF MEMPHIS-IN6 ]; Authentication Data Removed peer-as 14048; } neighbor 2001:468:ff:0116::2 { description "University of South Florida"; import [ SANITY6 SET-PREF USF-IN6 ]; Authentication Data Removed peer-as 5661; } neighbor 2610:28:10E:1::1 { description "MCNC via Internet2 DWS | ATLA-RALE-I2-00126 [NO-MONITOR]"; import [ SANITY6 SET-PREF MCNC-IN6 ]; Authentication Data Removed peer-as 81; } neighbor 2610:01E0:1000:6010::1 { description "KyRON NEW [NO-MONITOR]"; local-address 2610:01E0:1000:6010::2; import [ SANITY6 SET-PREF KyRON-IN6 ]; Authentication Data Removed peer-as 30700; } } inactive: group FEDNET { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER FEDNET-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ESNET-MEDS ORIGINATE4 FEDNET-OUT ]; remove-private; } inactive: group NONITN { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER NONITN-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 NONITN-OUT ]; remove-private; } inactive: group NONITN6-NEW { type external; metric-out igp; import [ SANITY6 REMOVE-COMMS-IN SET-PREF-PEER ]; family inet6 { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY6 REMOVE-COMMS-OUT ORIGINATE6 ]; remove-private; } group ITN { type external; metric-out igp; import [ SANITY-IN REMOVE-COMMS-IN SET-PREF-PEER ITN-IN ]; family inet { any { prefix-limit { maximum 3000; teardown 90; } } } export [ SANITY-OUT REMOVE-COMMS-OUT ORIGINATE4 ESNET-TO-AMPATH ITN-OUT ]; remove-private; neighbor 198.32.252.242 { description "REACCIUN Venezuela (via AMPATH)"; multihop { ttl 2; } Authentication Data Removed peer-as 27807; } neighbor 198.32.252.230 { description "ANSP (Brazil) (via AMPATH)"; multihop { ttl 2; } Authentication Data Removed peer-as 1251; } inactive: neighbor 198.32.252.222 { description "RNP (Brazil) (via AMPATH)"; multihop { ttl 3; } Authentication Data Removed peer-as 1916; } } } isis { export V6-IGP-AGG; spf-delay 200; rib-group { inet isis-rg; inet6 isis6-rg; } level 2 wide-metrics-only; /* BACKBONE to WASH */ interface so-0/0/0.0 { level 1 disable; level 2 metric 700; } /* BACKBONE to CHIC */ interface so-1/0/0.0 { level 2 metric 1045; } interface ge-1/3/0.11 { level 1 disable; level 2 passive; } interface ge-1/3/0.12 { level 1 disable; level 2 passive; } interface ge-1/3/0.13 { level 1 disable; } interface ge-1/3/0.50 { level 1 disable; level 2 metric 9999; } interface ge-3/0/1.0 { level 1 disable; level 2 passive; } interface ge-3/0/2.0 { level 1 disable; level 2 passive; } /* BACKBONE to HOUS */ interface so-4/0/0.0 { level 1 disable; level 2 metric 1385; } interface all { level 1 disable; level 2 passive; } } msdp { rib-group mcast-rpf-rg; active-source-limit { maximum 200000; threshold 190000; } group INTERNET2 { mode mesh-group; local-address 64.57.28.243; /* STTLng */ peer 198.32.8.200; /* SNVAng */ peer 198.32.8.201; /* CHIC */ peer 64.57.28.241; /* NEWY */ peer 64.57.28.242; /* HOUS */ peer 64.57.28.244; /* KANS */ peer 64.57.28.245; /* SALT */ peer 64.57.28.246; /* SEAT */ inactive: peer 64.57.28.247; /* LOSA */ peer 64.57.28.248; /* WASH */ peer 64.57.28.249; } group CONNECTOR { export MSDP-FILTER; import MSDP-FILTER; peer 149.165.254.20 { local-address 149.165.254.21; } inactive: peer 198.32.252.253 { local-address 198.32.252.254; } /* AMPATH via SOX/FLR */ peer 198.32.252.237 { local-address 198.32.252.238; } /* SoX */ peer 143.215.194.253 { local-address 64.57.28.243; } /* University of Memphis */ peer 141.225.250.25 { local-address 141.225.250.26; } /* Louisiana GiagPoP via LONI */ peer 208.100.124.21 { local-address 208.100.127.33; } /* University of South Florida */ peer 131.247.47.214 { local-address 131.247.47.213; } /* MCNC */ peer 198.86.17.65 { local-address 198.86.17.66; } peer 216.249.136.197 { local-address 216.249.136.198; } } inactive: group FEDNET { export MSDP-FILTER; import MSDP-FILTER; } group ITN { export MSDP-FILTER; import MSDP-FILTER; /* Retina via Ampath */ peer 198.32.252.234 { local-address 198.32.252.254; } /* RNP (Brazil,AS1916); multihop through AMPATH */ inactive: peer 198.32.252.238 { local-address 198.32.252.254; } /* ANSP (Brazil), multihopped via AMPATH, AS1251 */ peer 198.32.252.230 { local-address 198.32.252.254; } /* RNP; multihop through AMPATH */ inactive: peer 200.143.254.9 { local-address 198.32.252.254; } /* REACCIUN via AMPATH */ peer 198.32.252.242 { local-address 198.32.252.238; } } group NONITN { export MSDP-FILTER; import MSDP-FILTER; } /* Use OTHER group for sessions to route-servers, monitoring hosts, etc */ inactive: group OTHER { export MSDP-FILTER; import REJECT-ALL; } } pim { rib-group { inet mcast-rpf-rg; inet6 mcast-rpf6-rg; } import pim-join-filter; rp { bootstrap-import REJECT-ALL; bootstrap-export REJECT-ALL; local { family inet { address 198.32.8.238; group-ranges { 224.0.0.0/4; } } } embedded-rp; static { address 2001:468::1 { group-ranges { ff05::/16; } } address 2001:660:3007:300:1:: { group-ranges { ff0e::/16; ff1e::/16; } } address 2001:700:e000:501::2 { group-ranges { ff3e:30:2001:700::/64; } } } } interface all { mode sparse; version 2; } interface fxp0.0 { disable; } } connections { interface-switch "UNIV OF MEMPHIS LEVEL3 HSIP SERVICE" { interface so-2/1/0.513; interface so-2/2/0.512; } } } policy-options { prefix-list ALLOW-ALL { 0.0.0.0/0; } prefix-list MATCH-ALL { 0.0.0.0/0; } prefix-list BGP-PEERS { apply-path "protocols bgp group <*> neighbor <*>"; } prefix-list MSDP-PEERS { apply-path "protocols msdp group <*> peer <*>"; } Prefix Stanza Removed prefix-list BGP-PEERS6 { apply-path "protocols bgp group <*> neighbor <*:*>"; } /* List of prefixes which Abilene originates */ prefix-list INTERNAL { /* Internet2 Backbone */ 64.57.16.0/20; /* Abilene Backbone */ 198.32.8.0/22; /* Abilene Observatory */ 198.32.12.0/22; /* MANLAN */ 198.32.154.0/24; } /* List of IPv6 prefixes Abilene originates */ prefix-list INTERNAL6 { 2001:468::/32; } Prefix Stanza Removed prefix-list QUERY-HOSTS-INTERNAL { /* nocmon.net.internet2.edu -- temp monitoring host */ 64.57.25.18/32; /* winger.uits.iu.edu -- snapp */ 129.79.6.137/32; /* pine.ucs.indiana.edu -- sweeny */ 129.79.9.1/32; /* alertmon-dev.grnoc.iu.edu */ 129.79.216.72/32; /* dc-snmp.wcc.grnoc.iu.edu */ 129.79.216.79/32; /* dc-1.grnoc.iu.edu -- SNMP Data Collector */ 134.68.107.22/32; /* snmp.grnoc.iu.edu -- SNMP Data Collection */ 134.68.107.23/32; 134.68.107.113/32; /* mon-dev.grnoc.iu.edu */ 134.68.107.123/32; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; } prefix-list QUERY-HOSTS-EXTERNAL { /* Boston University--ticket#11647 */ 128.197.10.4/32; /* Boston University--ticket#11647 */ 128.197.11.51/32; /* Boston University--ticket#11647 */ 128.197.11.223/32; /* Boston University--ticket#11647 */ 128.197.11.224/32; /* ndb2-blmt for PerfSONAR link status */ 129.79.5.18/32; /* arbor11.ren-isac.net -- Arbor Peakflow1 */ 134.68.246.49/32; /* arbor21.ren-isac.net -- Arbor Peakflow2 */ 134.68.246.51/32; /* ANML - ArborNetworks */ 156.56.103.9/32; /* ANML - ArborNetworks */ 156.56.103.10/32; /* ANML - ArborNetworks */ 156.56.103.11/32; /* ANML - ArborNetworks */ 156.56.103.12/32; /* ANML - ArborNetworks */ 156.56.103.53/32; /* Ohio ITEC - nf6.itec.oar.net */ 192.148.251.26/32; /* Ohio ITEC - nf7.itec.oar.net */ 192.148.251.27/32; /* netflow2.internet2.edu -- I2 Netflow Collector */ 198.108.90.142/32; /* discvenue.internet2.edu */ 207.75.164.82/32; /* Internet2 - thunderbird.internet2.edu - ticket# 5679 */ 207.75.164.95/32; /* netflow2.internet2.edu -- I2 Netflow Collector */ 207.75.165.99/32; } prefix-list TACACS-SERVERS { /* tacacs2.grnoc.iu.edu */ 129.79.216.162/32; /* tacacs.grnoc.iu.edu */ 134.68.107.17/32; } Prefix Stanza Removed prefix-list DNS-SERVERS { 129.79.5.100/32; 134.68.1.9/32; } prefix-list NTP-SERVERS { /* ntp.indiana.edu */ 129.79.5.100/32; /* ntp-1.gw.uiuc.edu */ 130.126.24.24/32; 134.68.1.9/32; /* ntp-e.abilene.ucaid.edu */ 198.32.10.254/32; /* ntp-w.abilene.ucaid.edu */ 198.32.11.141/32; } prefix-list NMS1-SPECIFICS { /* SNVA */ 198.32.8.108/30; /* WASH */ 198.32.8.112/30; /* ATLA */ 198.32.8.156/30; /* CHIN */ 198.32.8.160/30; /* DNVR */ 198.32.8.164/30; /* HSTN */ 198.32.8.168/30; /* IPLS */ 198.32.8.172/30; /* KSCY */ 198.32.8.176/30; /* LOSA */ 198.32.8.180/30; /* NYCM */ 198.32.8.184/30; /* STTL */ 198.32.8.188/30; } prefix-list CPS-BGP-PEERS { apply-path "routing-instances cps protocols bgp group <*> neighbor <*>"; } prefix-list RADIUS-SERVERS { 129.79.216.162/32; 134.68.107.17/32; } prefix-list BGP-PEERS-CPS { apply-path "routing-instances cps protocols bgp group <*> neighbor <*>"; } prefix-list INDIANAGIGAPOP-PARTICIPANT { 65.254.96.0/20; 66.205.160.0/20; 66.254.224.0/19; 72.12.215.0/24; 128.10.0.0/16; 128.46.0.0/16; 128.210.0.0/16; 128.211.0.0/16; 128.252.0.0/16; 129.74.0.0/16; 129.79.0.0/16; 134.68.0.0/16; /* University of Louisville */ 136.165.0.0/16; 140.182.0.0/16; 149.159.0.0/16; 149.160.0.0/16; 149.161.0.0/16; 149.162.0.0/16; 149.163.0.0/16; 149.164.0.0/16; 149.165.0.0/16; 149.166.0.0/16; 156.56.0.0/16; 157.91.0.0/16; 165.134.0.0/16; 192.12.206.0/24; 192.88.99.0/24; 192.245.116.0/24; /* University of Louisville */ 199.120.154.0/24; 204.52.32.0/20; 205.137.32.0/20; } prefix-list INDIANAGIGAPOP-SEGP { 12.159.195.0/24; 12.159.206.0/23; 12.159.209.0/24; 69.51.160.0/19; 131.93.0.0/16; 137.112.0.0/16; 139.102.0.0/16; 147.53.0.0/16; 147.226.0.0/16; 152.228.0.0/16; 157.91.0.0/19; 157.91.48.0/20; 157.91.64.0/18; 157.91.128.0/17; 159.28.0.0/16; 159.218.0.0/16; 159.242.0.0/16; 161.32.0.0/16; 163.120.0.0/16; 163.245.0.0/16; 165.138.0.0/16; 165.139.0.0/16; 167.217.0.0/16; 168.91.0.0/16; 168.102.0.0/16; 192.146.191.0/24; 192.146.192.0/24; 192.189.3.0/24; 192.195.225.0/24; 192.195.226.0/23; 192.195.228.0/23; 192.195.230.0/24; 192.200.128.0/21; 192.206.9.0/24; 192.206.10.0/23; 192.207.174.0/23; 192.207.176.0/23; 192.207.178.0/24; 198.51.243.0/24; 198.51.244.0/24; 198.62.84.0/24; 198.62.98.0/24; 199.8.0.0/16; 204.52.48.0/20; 205.215.64.0/18; 208.119.0.0/16; } prefix-list INDIANAGIGAPOP-SPONSORED { 149.165.251.0/24; 216.88.164.0/24; } prefix-list INDIANAGIGAPOP-PARTICIPANTS6 { 2001:468:400::/40; 2001:18e8::/32; 2002::/16; } prefix-list FLR-PARTICIPANT { 8.6.244.0/23; 64.56.85.0/24; 65.118.160.0/20; 128.186.0.0/16; 128.227.0.0/16; 131.91.0.0/16; 132.170.0.0/16; 144.174.0.0/16; 146.201.0.0/17; 146.201.192.0/18; 147.70.0.0/16; 159.178.0.0/16; 168.223.0.0/16; 168.223.13.0/24; 192.5.2.0/24; 192.26.251.0/24; 192.31.89.0/24; 192.70.171.0/24; 192.80.53.0/24; 192.88.124.0/24; 192.111.123.0/24; 198.32.155.0/24; 198.32.166.0/24; 198.32.173.0/24; 199.242.231.0/24; 199.242.232.0/24; 199.242.233.0/24; 204.68.64.0/19; 204.145.157.0/24; 209.149.48.0/20; } prefix-list FLR-SPONSORED { 137.52.0.0/16; 139.62.0.0/16; 139.229.0.0/16; 163.118.0.0/16; } prefix-list FLR-SEGP { 6.4.0.0/15; 64.56.81.0/24; 64.56.90.0/24; 66.195.118.0/23; 96.4.0.0/15; 143.88.0.0/16; 150.104.0.0/16; 150.176.0.0/16; 165.138.0.0/15; 165.161.0.0/16; 167.93.0.0/16; 167.217.0.0/16; 168.102.0.0/17; 168.184.0.0/16; 168.213.0.0/16; 168.221.0.0/16; 168.254.0.0/16; 169.139.0.0/16; 192.42.92.0/24; 192.225.128.0/20; 192.225.144.0/21; 192.225.152.0/24; 199.44.72.0/24; 199.164.64.0/18; 204.63.240.0/21; 204.78.64.0/18; 204.86.168.0/21; 204.86.176.0/21; 204.109.64.0/18; 204.122.128.0/17; 204.128.64.0/18; 204.145.32.0/24; 204.193.0.0/19; 205.137.32.0/20; 205.137.240.0/20; 205.152.72.0/24; 205.152.126.0/24; 205.152.168.0/21; 205.172.40.0/23; 205.172.42.0/24; 205.223.144.0/20; 205.223.160.0/19; 205.223.192.0/19; /* College ctr for Lib Automation, Tallahassee */ 206.224.192.0/19; 207.191.176.0/20; 207.203.12.0/24; 207.203.56.0/22; 207.203.212.0/22; 207.203.240.0/22; 207.203.244.0/23; 207.203.246.0/24; 208.60.168.0/22; 208.60.172.0/23; 208.182.0.0/15; 216.114.80.0/20; } prefix-list SFGP-PARTICIPANT { 67.17.206.0/24; 129.171.0.0/16; 131.91.0.0/16; 131.94.0.0/16; 134.202.0.0/16; 136.145.0.0/16; 192.31.89.0/24; 192.65.176.0/24; 192.70.171.0/24; 192.160.174.0/23; 192.160.176.0/24; 192.231.92.0/22; 192.239.208.0/24; 198.32.252.0/24; 199.4.250.0/23; 199.4.250.0/24; 199.4.251.0/24; 199.242.231.0/24; 199.242.232.0/24; 199.242.233.0/24; 204.68.64.0/19; 204.89.132.0/23; 204.89.132.0/24; 204.89.133.0/24; 206.240.22.0/24; 208.222.241.0/24; 209.42.43.0/24; 216.79.60.0/23; } prefix-list SFGP-SPONSORED { 139.229.0.0/16; 160.111.132.0/22; 160.111.230.0/24; 160.111.232.0/21; 192.231.93.0/24; 192.231.95.0/24; } prefix-list SFGP-EXCEPTION { 129.171.0.0/28; 129.171.32.0/28; 129.171.64.0/28; 129.171.128.0/28; 129.171.160.0/28; 129.171.192.0/28; 129.171.224.0/28; 192.80.53.0/30; } prefix-list SOX-PARTICIPANT { 64.156.8.128/25; 64.156.216.128/25; 65.115.176.0/24; 67.159.64.0/26; 128.23.0.0/16; 128.61.0.0/16; 128.163.0.0/16; 128.163.11.0/24; 128.186.0.0/16; 128.192.0.0/16; 128.227.0.0/16; 129.59.0.0/16; 129.171.0.0/16; 129.171.0.0/19; 129.171.32.0/19; 129.171.64.0/19; 129.171.96.0/19; 129.171.128.0/19; 129.171.160.0/19; 129.171.192.0/19; 129.171.224.0/19; 129.252.0.0/16; 130.127.0.0/16; 130.160.0.0/16; 130.207.0.0/16; 131.91.0.0/16; 131.96.0.0/16; 131.144.128.0/20; 131.204.0.0/16; 131.247.0.0/16; 132.170.0.0/16; 138.26.0.0/16; 139.62.0.0/16; 143.215.0.0/16; 144.174.0.0/16; 146.201.0.0/16; 146.229.0.0/16; 149.168.0.0/16; 152.2.0.0/16; 152.3.0.0/16; 152.7.0.0/16; 152.11.0.0/16; 152.14.0.0/16; 152.16.0.0/16; 152.17.0.0/16; 152.19.0.0/16; 159.178.0.0/16; 160.36.0.0/16; 160.129.0.0/16; 163.246.0.0/16; 164.111.0.0/16; 165.6.5.0/24; 165.6.6.0/24; 165.6.7.0/24; 165.6.15.0/24; 165.6.24.0/24; 168.223.0.0/16; 170.140.0.0/16; 192.31.89.0/24; 192.70.171.0/24; 192.73.4.0/24; 192.80.53.0/24; 192.88.124.0/24; 192.111.108.0/24; 192.111.109.0/24; 192.111.110.0/24; 192.111.123.0/24; 192.188.181.0/24; 192.249.1.0/24; 192.249.2.0/23; 192.249.4.0/22; 192.249.8.0/21; 192.249.11.0/24; 198.78.192.0/19; 198.137.16.0/20; 199.4.250.0/23; 199.4.250.0/24; 199.4.251.0/24; 199.76.32.0/20; 199.76.144.0/20; 199.76.160.0/19; 199.76.192.0/24; 199.77.128.0/17; 199.78.112.0/22; 199.90.0.0/16; 199.201.155.0/24; 199.242.231.0/24; 199.242.232.0/24; 199.242.233.0/24; 204.29.106.0/23; 204.68.64.0/19; 204.85.191.0/24; 204.85.192.0/18; 204.89.132.0/23; 204.89.132.0/24; 204.89.133.0/24; 204.145.157.0/24; 204.145.215.0/24; 204.198.72.0/22; 204.198.76.0/23; 204.211.0.0/16; 204.238.30.0/24; 206.57.72.0/21; 206.240.24.0/22; 206.240.192.0/19; 206.240.216.0/24; 206.240.220.0/24; 206.240.221.0/24; 207.4.0.0/16; 207.192.0.0/18; 209.149.48.0/20; /* U Tenn Knoxville */ 216.96.128.0/17; } prefix-list SOX-CORPORATE { 12.107.208.0/23; 66.187.224.0/20; 204.85.14.0/24; } prefix-list SOX-SPONSORED { /* Georgia Aquarium */ 66.20.220.0/24; 66.187.234.0/24; 74.255.42.0/24; 143.88.0.0/16; 147.70.0.0/16; 150.182.128.0/18; 152.97.0.0/16; /* College of Charleston */ 153.9.0.0/16; 155.31.0.0/16; 161.45.0.0/16; 163.118.0.0/16; 192.30.208.0/24; 192.67.134.0/24; 192.83.232.0/24; 192.153.129.0/24; 204.62.251.0/24; 204.152.130.0/24; 204.152.131.0/24; 204.246.192.0/21; 205.167.24.0/24; 205.167.25.0/24; 216.64.76.0/24; } /* SOX provides backup to MCNC. Their routes are mixed in with these */ prefix-list SOX-SEGP { 64.56.80.0/24; 64.147.208.0/20; 64.214.127.128/27; 66.4.0.0/15; 66.194.104.0/23; 66.195.118.0/23; 72.158.165.0/24; 72.250.224.0/20; 72.250.230.0/24; 72.250.245.0/24; 74.254.70.0/24; 96.4.0.0/15; 98.17.253.0/24; 128.109.0.0/16; 128.192.0.0/16; 129.66.0.0/16; 129.66.20.0/24; 130.218.0.0/16; 130.254.0.0/16; 131.144.0.0/16; 134.224.0.0/16; 137.220.0.0/16; 141.165.0.0/16; 147.133.0.0/16; 149.149.0.0/16; 150.216.0.0/16; 152.1.0.0/16; 152.2.0.0/15; 152.4.0.0/14; 152.8.0.0/13; 152.16.0.0/12; 152.32.0.0/12; 152.36.0.0/16; 152.43.0.0/16; 152.48.0.0/14; 152.53.0.0/19; 152.54.0.0/20; 153.9.0.0/16; 157.89.0.0/16; 157.149.0.0/16; 158.93.0.0/16; 160.10.0.0/16; 161.6.0.0/16; 162.114.37.0/24; 167.7.38.0/24; 167.7.39.0/24; 167.7.210.0/27; 167.7.241.0/24; 167.7.248.64/27; 167.7.251.0/27; 168.8.0.0/15; 168.12.0.0/14; 168.16.0.0/15; 168.18.0.0/15; 168.20.0.0/15; 168.22.0.0/15; 168.24.0.0/15; 168.26.0.0/15; 168.28.0.0/15; 168.30.0.0/15; 169.150.0.0/16; 170.180.0.0/14; 170.185.0.0/16; 192.48.117.0/24; 192.88.111.0/24; 192.101.21.0/24; 192.101.22.0/23; 192.101.24.0/24; 192.103.126.0/24; 192.107.44.0/24; 192.111.112.0/24; 192.122.237.0/24; 192.137.210.0/24; 192.147.30.0/24; 192.152.249.0/24; 192.154.33.0/24; 192.154.38.0/24; 192.154.41.0/24; 192.154.43.0/24; 192.154.45.0/24; 192.154.46.0/23; 192.154.54.0/24; 192.154.55.0/24; 192.154.61.0/24; 192.154.62.0/24; 192.154.64.0/24; 192.154.67.0/24; 192.154.78.0/24; 192.189.244.0/24; 192.203.127.0/24; 192.211.32.0/21; 192.211.40.0/22; 192.211.44.0/24; 192.211.45.0/24; 192.245.165.0/24; 192.245.221.0/24; 192.245.222.0/24; 192.245.223.0/24; 192.245.224.0/24; 198.49.31.0/24; 198.62.72.0/24; 198.72.72.0/22; 198.85.0.0/16; 198.86.0.0/16; 198.135.235.0/24; 198.137.22.0/24; 198.179.130.0/24; 198.180.132.0/22; 198.190.216.0/24; 198.200.158.0/24; 198.204.92.0/24; 198.232.64.0/18; 198.232.96.0/21; 199.5.154.0/23; 199.20.16.0/20; 199.33.130.0/24; 199.33.131.0/24; 199.33.132.0/24; 199.33.133.0/24; 199.33.134.0/24; 199.80.8.0/21; 199.88.16.0/20; 199.190.174.0/24; 199.248.173.0/24; 199.248.174.0/24; 199.248.175.0/24; 199.248.176.0/24; 199.248.177.0/24; 199.248.178.0/24; 204.27.217.0/24; 204.29.64.0/18; 204.84.0.0/15; 205.137.240.0/20; 205.174.48.0/20; 205.204.238.0/24; 205.204.242.0/24; 206.57.72.0/21; 206.197.240.0/24; 206.219.128.0/18; 207.157.0.0/17; 207.191.176.0/20; 207.232.128.0/18; 208.182.0.0/15; 209.133.128.0/17; 216.69.0.0/18; 216.109.0.0/18; 216.249.132.0/22; 216.249.144.0/20; 216.249.160.0/20; 216.249.176.0/20; } prefix-list SOX-EXCEPTION-SPONSORED { 146.82.167.176/29; 199.77.192.16/29; } prefix-list SOX-EXCEPTION-SEGP { 167.7.127.176/29; 167.7.248.112/29; 167.7.248.120/29; 167.7.248.208/29; 167.7.251.32/29; 167.7.251.64/29; 167.7.251.80/29; 167.7.251.96/29; 167.7.251.128/28; 167.7.251.144/28; 167.7.251.160/28; 167.7.251.192/29; } prefix-list SOX-ORNL { 128.219.0.0/16; 134.167.0.0/16; 160.91.0.0/16; 192.31.96.0/24; 192.103.127.0/24; 192.188.177.0/24; 192.188.182.0/24; 198.124.41.0/24; 198.136.139.0/24; 198.148.251.0/24; 198.203.246.0/24; 198.207.237.0/24; 198.207.238.0/23; 198.207.240.0/24; 199.201.153.0/24; 199.201.154.0/24; 199.201.156.0/23; 199.201.158.0/24; } prefix-list SOX-PARTICIPANT6 { 2001:468:300::/40; 2610:0148::/32; } prefix-list NCREN-PARTICIPANT6 { 2001:468:1500::/40; 2610:28::/32; } prefix-list SFGP-PARTICIPANT6 { 2001:468:700::/40; } prefix-list FLR-PARTICIPANT6 { 2001:468:1e00::/40; } prefix-list MEMPHIS-PARTICIPANT { 65.127.62.0/24; 132.192.0.0/16; 141.225.0.0/16; 199.164.138.0/24; } prefix-list MEMPHIS-SPONSORED { 128.169.0.0/16; 149.149.0.0/16; 192.55.208.0/24; } prefix-list MEMPHIS-SEGP { 66.4.0.0/15; 96.4.0.0/15; 151.141.0.0/16; 198.146.0.0/16; 205.137.240.0/20; 206.23.0.0/16; 207.191.176.0/20; 208.182.0.0/15; } prefix-list MEMPHIS-PARTICIPANT6 { 2001:468:1b00::/40; } prefix-list LONI-PARTICIPANT4 { 76.165.24.0/22; 76.165.28.0/22; 76.165.240.0/20; 130.39.0.0/16; 155.58.0.0/16; 192.195.100.0/24; 192.203.199.0/24; 192.203.200.0/24; 198.62.89.0/24; 198.182.205.0/24; 199.190.249.0/24; 199.190.250.0/24; 199.190.251.0/24; 199.190.252.0/24; 199.233.131.0/24; 204.90.32.0/20; 204.90.48.0/22; 204.196.106.0/23; 204.196.160.0/21; 205.166.221.0/24; 206.176.160.0/19; 208.100.64.0/18; } prefix-list LONI-SPONSORED { 138.47.0.0/16; 208.69.128.0/22; } prefix-list LONI-SEGP { 130.70.0.0/16; 137.30.0.0/16; 147.174.0.0/16; 162.75.0.0/24; 192.102.223.0/24; 192.135.131.0/24; 192.207.173.0/24; 198.62.88.0/24; 198.99.190.0/24; 198.135.204.0/24; 198.176.252.192/26; 198.202.242.0/24; 198.232.231.0/24; 199.181.176.0/24; 199.190.250.0/23; 204.196.60.0/24; 204.196.69.0/24; 204.196.81.0/24; 204.196.86.0/23; 204.196.180.0/22; 204.196.184.0/22; 204.196.204.0/22; 204.196.208.0/23; 204.196.252.0/27; 208.100.64.0/22; 208.100.68.0/22; 208.100.72.0/22; 208.100.76.0/22; 208.100.80.0/22; 208.100.84.0/22; } prefix-list LONI-PARTICIPANT4-EXCEPTION { 162.75.0.4/30; } prefix-list MISSISSIPPI-PARTICIPANT4 { 130.18.0.0/16; 130.74.0.0/16; 131.95.0.0/16; 143.132.0.0/16; 192.208.128.0/20; 192.208.139.0/24; 192.208.144.0/21; 192.208.152.0/22; 192.208.156.0/23; 198.49.215.0/24; } prefix-list TULANE-PARTICIPANT4 { 129.81.0.0/16; } prefix-list USF-PARTICIPANT { 131.247.0.0/16; } prefix-list USF-SPONSORED { 12.174.210.0/23; 66.194.104.0/23; 155.31.0.0/16; } prefix-list USF-PARTICIPANT6 { 2001:468:1600::/40; 2620:0000:0c30::0/48; } prefix-list show; prefix-list MCNC-PARTICIPANT { 67.159.64.0/18; 150.216.0.0/16; 152.1.0.0/16; 152.2.0.0/16; 152.3.0.0/16; 152.7.0.0/16; 152.11.0.0/16; 152.14.0.0/16; 152.16.0.0/12; 152.16.0.0/16; 152.17.0.0/16; 152.19.0.0/16; 204.211.0.0/16; } prefix-list MCNC-CORPORATE { 12.107.208.0/23; 66.187.224.0/20; 204.85.14.0/24; } prefix-list MCNC-SPONSORED { 192.67.134.0/24; 192.153.129.0/24; 204.62.251.0/24; 205.167.24.0/24; 205.167.25.0/24; } prefix-list MCNC-SEGP { 64.147.208.0/20; 72.250.224.0/20; 72.250.230.0/24; 72.250.245.0/24; 128.109.0.0/16; 149.168.0.0/16; 152.1.0.0/16; 152.2.0.0/15; 152.4.0.0/14; 152.8.0.0/13; 152.16.0.0/12; 152.32.0.0/12; 152.36.0.0/16; 152.53.0.0/19; 152.54.0.0/20; 192.73.4.0/24; 192.101.21.0/24; 192.101.22.0/23; 192.101.24.0/24; 192.137.210.0/24; 192.147.30.0/24; 192.154.33.0/24; 192.154.41.0/24; 192.154.43.0/24; 192.154.46.0/23; 192.154.54.0/24; 192.154.55.0/24; 192.154.62.0/24; 192.154.64.0/24; 192.154.78.0/24; 192.189.244.0/24; 198.62.72.0/24; 198.85.0.0/16; 198.86.0.0/16; 198.135.235.0/24; 198.232.64.0/18; 198.232.96.0/21; 199.90.0.0/16; 199.190.174.0/24; 204.84.0.0/15; 204.85.191.0/24; 204.85.192.0/18; 204.238.30.0/24; 207.4.0.0/16; 207.192.0.0/18; } prefix-list MCNC-PARTICIPANT6 { 2001:468:1500::/40; 2610:28::/32; } prefix-list BGP-PEERS6-CPS { apply-path "routing-instances cps protocols bgp group CONNECTORS6 neighbor <*>"; } prefix-list CPS-MCNC-CPS-ONLY { 72.250.240.0/20; 152.48.0.0/14; 152.48.0.0/16; 156.143.0.0/16; 192.154.40.0/24; 192.154.95.0/24; 199.120.166.0/23; 204.69.248.0/24; 204.152.2.0/23; 206.219.96.0/19; 209.95.64.0/19; 216.105.128.0/19; } prefix-list CPS-DUKE-CPS-ONLY { 67.159.64.0/18; 152.3.0.0/16; 152.16.0.0/16; } prefix-list OBSERVATORY-SSH { /* sysmon.grnoc.iu.edu */ 134.68.107.4/32; /* login.net.internet2.edu */ 134.68.107.10/32; /* nms-base */ 134.68.107.34/32; /* nms-login */ 134.68.107.36/32; /* skip */ 134.68.142.50/32; /* nocmon.grnoc.iu.edu */ 149.165.129.24/32; /* jump */ 192.12.206.196/32; } prefix-list OBSERVATORY-SSH6 { 2001:468:43f:4:211:43ff:fece:c930/128; 2001:18e8:3:142:212:3fff:feec:e02a/128; } prefix-list OBSERVATORY-SSH-BLOCK { 0.0.0.0/0; } prefix-list KyRON { 136.165.0.0/16; 199.120.154.0/24; 216.249.128.0/22; 216.249.136.0/23; 216.249.140.0/22; } prefix-list KyRON-PARTICIPANT6 { 2610:01E0::/32; } prefix-list KyRON-SPONSORED { 216.249.128.0/24; 216.249.129.0/24; 216.249.130.0/23; 216.249.130.0/24; 216.249.131.0/24; 216.249.141.0/27; 216.249.142.0/24; 216.249.143.0/24; } prefix-list CPS-LONI-CPS-ONLY { 198.62.88.0/24; } policy-statement CONNECTOR-IN { /* remove BGP communities which connectors should not announce */ term remove-comms { then { community delete LOW-PEERS; community delete HIGH-PEERS; next term; } } term discard { from { community DISCARD; /* only allow /24-/32 masks for discard routes */ route-filter 0.0.0.0/0 prefix-length-range /24-/32; } to rib inet.0; then { /* add no-export so these are leaked outside of Abilene */ community add NO-EXPORT; /* set next-hop to the destination-address on the dsc.0 interface */ next-hop 198.32.11.7; accept; } } /* allow unicast routes upto /27; note: routes have already passed the individual connector policy */ term allow-unicast { from { route-filter 0.0.0.0/0 upto /27; } to rib inet.0; then { community add PARTICIPANT; accept; } } term allow-multicast { from { route-filter 0.0.0.0/0 upto /27; } to rib inet.2; then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement CPS-CONNECTOR-IN { term discard { from { community DISCARD; /* only allow /24-/32 masks for discard routes */ route-filter 0.0.0.0/0 prefix-length-range /24-/32; } then { /* add no-export so these are leaked outside of Abilene */ community add NO-EXPORT; /* set next-hop to the destination-address on the dsc.0 interface */ next-hop discard; accept; } } /* allow unicast routes upto /27; note: routes have already passed the individual connector policy */ term allow-unicast { from { route-filter 0.0.0.0/0 upto /24; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-CONNECTOR-OUT { /* announce routes from CPS peer networks */ term announce-peers { from { protocol bgp; community CPS-PEERS; } then accept; } term announce-internal { from { protocol static; route-filter 198.32.9.0/24 exact; } then accept; } term reject { then reject; } } policy-statement CPS-CONNECTOR-OUT6 { term announce-peers { from { protocol bgp; community CPS-PEERS; family inet6; } then accept; } term announce-internal { from { protocol static; family inet6; route-filter 2001:468:ff00::/40 exact; } then accept; } term reject { then reject; } } policy-statement CPS-DUKE-IN { term accept { from { protocol bgp; prefix-list-filter CPS-DUKE-CPS-ONLY orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-EXPORT { term direct { from protocol direct; then { community add CPS; accept; } } term bgp { from protocol bgp; then { community add CPS; accept; } } term reject { then reject; } } policy-statement CPS-IMPORT { term bgp { from community CPS; then accept; } term reject { then reject; } } policy-statement CPS-INDIANAGIGAPOP-IN { term accept { from { protocol bgp; prefix-list-filter INDIANAGIGAPOP-PARTICIPANT orlonger; prefix-list-filter INDIANAGIGAPOP-SPONSORED orlonger; prefix-list-filter INDIANAGIGAPOP-SEGP orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-INDIANAGIGAPOP-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter INDIANAGIGAPOP-PARTICIPANTS6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-KyRON-IN { term accept { from { protocol bgp; prefix-list-filter KyRON orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-KyRON-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter KyRON-PARTICIPANT6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-LONI-IN { term accept { from { protocol bgp; prefix-list-filter LONI-PARTICIPANT4 orlonger; prefix-list-filter MISSISSIPPI-PARTICIPANT4 orlonger; prefix-list-filter TULANE-PARTICIPANT4 orlonger; prefix-list-filter LONI-SPONSORED orlonger; prefix-list-filter LONI-SEGP orlonger; prefix-list-filter LONI-PARTICIPANT4-EXCEPTION exact; prefix-list-filter CPS-LONI-CPS-ONLY exact; } then next policy; } term reject { then reject; } } policy-statement CPS-MCNC-IN { term accept { from { protocol bgp; prefix-list-filter MCNC-PARTICIPANT orlonger; prefix-list-filter MCNC-SEGP orlonger; prefix-list-filter MCNC-SPONSORED orlonger; prefix-list-filter MCNC-CORPORATE orlonger; prefix-list-filter CPS-MCNC-CPS-ONLY orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-MCNC-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter MCNC-PARTICIPANT6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-SFGP-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter SFGP-PARTICIPANT6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-SOX-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter SOX-PARTICIPANT6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement CPS-USF-IN { term accept { from { protocol bgp; prefix-list-filter USF-PARTICIPANT orlonger; prefix-list-filter USF-SPONSORED orlonger; } then next policy; } term reject { then reject; } } policy-statement CPS-USF-IN6 { term accept { from { protocol bgp; family inet6; prefix-list-filter USF-PARTICIPANT6 exact; } then { community add CPS-CONNECTOR; accept; } } term reject { then reject; } } policy-statement ESNET-TO-AMPATH { term FROM-ESNET { from as-path ESNET; then { as-path-prepend 11537; accept; } } } /* import policy for FEDNET peers */ policy-statement FEDNET-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term set-community { from protocol bgp; then { community add FEDNET; accept; } } } policy-statement FEDNET-IN6 { term set-community { from protocol bgp; then { community add FEDNET; accept; } } } /* export policy from FEDNET peers */ policy-statement FEDNET-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce ITN routes from peers w/exception to reach FEDNETs (ie IFTNs) */ term allow-iftn { from { protocol bgp; community IFTN; } then accept; } /* don't announce nlri=unicast routes from fednet or international peers */ term block-fednet-itn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET ITN NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement FEDNET-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement INDIANAGIGAPOP-IN { term participant { from { protocol bgp; prefix-list-filter INDIANAGIGAPOP-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter INDIANAGIGAPOP-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter INDIANAGIGAPOP-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term reject { then reject; } } policy-statement INDIANAGIGAPOP-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter INDIANAGIGAPOP-PARTICIPANTS6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement INTERNET2-MOSS { term accept-MOSS-routes { from community INTERNET2-INFINERA; then accept; } then next policy; } /* import policy for mcast-only peerings with commercial ISPs */ policy-statement ISP-MCAST-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term allow { from protocol bgp; to rib inet.2; then { community add COMMERCIAL-PEER; accept; } } term reject { then reject; } } policy-statement ISP-MCAST-OUT { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term no-export { from community BLOCK-TO-COMMERCIAL; then reject; } /* only advertise participant routes */ term allow { from { protocol bgp; rib inet.2; community PARTICIPANT; } then accept; } term reject { then reject; } } policy-statement ISP-V6-IN { term allow { from protocol bgp; to rib inet6.0; then { community add COMMERCIAL-PEER; accept; } } term reject { then reject; } } policy-statement ISP-V6-OUT { term no-export { from community BLOCK-TO-COMMERCIAL; then reject; } /* only advertise participant routes */ term accept { from { protocol bgp; community PARTICIPANT; family inet6; } then accept; } term reject { then reject; } } policy-statement ITN-IN { term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } term block-as112 { from { route-filter 192.175.48.0/24 orlonger; } then reject; } term set-community { from protocol bgp; then { community add ITN; accept; } } } policy-statement ITN-IN6 { term set-community { from protocol bgp; then { community add ITN; accept; } } } policy-statement ITN-OUT { /* don't announce small prefixes */ term block-long-prefixes { from { route-filter 0.0.0.0/0 prefix-length-range /28-/32; } then reject; } /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* don't announce nlri=unicast routes from fednet or nonitn peers */ term block-fednet-nonitn-unicast { from { protocol bgp; rib inet.0; /* note: community match is a logical OR */ community [ FEDNET NONITN ]; } then reject; } /* announce all other unicast and multicast routes */ term accept { from protocol bgp; then accept; } } policy-statement ITN-OUT6 { /* don't announce these routes via nlri=unicast or multicast */ term block-unicast-multicast { from { protocol bgp; community [ CONNECTOR-ONLY COMMERCIAL-PEER ]; } then reject; } /* announce all other routes via nlri=unicast and multicast */ term allow { from protocol bgp; then accept; } } policy-statement KyRON-IN { term PARTICIPANT { from { prefix-list-filter KyRON orlonger; } then accept; } term SPONSORED { from { prefix-list-filter KyRON-SPONSORED orlonger; } then accept; } term REJECT { then reject; } } policy-statement KyRON-IN6 { term participant { from { prefix-list-filter KyRON-PARTICIPANT6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } term accept { from family inet6; } } policy-statement LEAK-NMS1 { term leak { from { protocol isis; prefix-list NMS1-SPECIFICS; } then accept; } then next policy; } policy-statement LONI-IN { term participant { from { prefix-list-filter LONI-PARTICIPANT4 orlonger; prefix-list-filter MISSISSIPPI-PARTICIPANT4 orlonger; prefix-list-filter TULANE-PARTICIPANT4 orlonger; } then next policy; } term sponsored { from { prefix-list-filter LONI-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term segp { from { prefix-list-filter LONI-SEGP orlonger; } then { community add SEGP; next policy; } } term exception { from { prefix-list-filter LONI-PARTICIPANT4-EXCEPTION exact; } then { community add PARTICIPANT; accept; } } } policy-statement MCNC-IN { term participant { from { prefix-list-filter MCNC-PARTICIPANT orlonger; } then next policy; } term corporate { from { prefix-list-filter MCNC-CORPORATE orlonger; } then { community add CORPORATE; next policy; } } term sponsored { from { prefix-list-filter MCNC-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term segp { from { prefix-list-filter MCNC-SEGP orlonger; } then { community add SEGP; next policy; } } term reject-unicast { to rib inet.0; then reject; } } policy-statement MCNC-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter MCNC-PARTICIPANT6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement MEMPHIS-IN { term participant { from { protocol bgp; prefix-list-filter MEMPHIS-PARTICIPANT orlonger; } then next policy; } term segp { from { protocol bgp; prefix-list-filter MEMPHIS-SEGP orlonger; } then { community add SEGP; next policy; } } term sponsored { from { protocol bgp; prefix-list-filter MEMPHIS-SPONSORED orlonger; } then { community add SPONSORED; next policy; } } term reject-unicast { to rib inet.0; then reject; } } policy-statement MEMPHIS-IN6 { term participant { from { protocol bgp; family inet6; prefix-list-filter MEMPHIS-PARTICIPANT6 exact; } then { community add PARTICIPANT; accept; } } term reject { then reject; } } policy-statement MSDP-FILTER { term bad-groups { from { route-filter 224.0.1.2/32 exact; route-filter 224.0.1.3/32 exact; route-filter 224.0.1.8/32 exact; route-filter 224.0.1.22/32 exact; route-filter 224.0.1.24/32 exact; route-filter 224.0.1.25/32 exact; route-filter 224.0.1.35/32 exact; route-filter 224.0.1.39/32 exact; route-filter 224.0.1.40/32 exact; route-filter 224.0.1.60/32 exact; route-filter 224.0.2.1/32 exact; route-filter 224.0.2.2/32 exact; route-filter 224.77.0.0/16 orlonger; route-filter 225.1.2.3/32 exact; route-filter 226.77.0.0/16 orlonger; route-filter 229.55.150.208/32 exact; route-filter 234.42.42.40/30 orlonger; route-filter 234.142.142.42/31 orlonger; route-filter 234.142.142.44/30 orlonger; route-filter 234.142.142.48/28 orlonger; route-filter 234.142.142.64/26 orlonger; route-filter 234.142.142.128/29 orlonger; route-filter 234.142.142.136/30 orlonger; route-filter 234.142.142.140/31 orlonger; route-filter 234.142.142.142/32 exact; route-filter 232.0.0.0/8 orlonger; route-filter 239.0.0.0/8 orlonger; } then reject; } term bad-sources { from { source-address-filter 10.0.0.0/8 orlonger; source-address-filter 127.0.0.0/8 orlonger; source-address-filter 172.16.0.0/12 orlonger; source-address-filter 192.168.0.0/16 orlonger; } then reject; } term bad-planetlab { from { source-address-filter 198.32.154.179/32 exact; source-address-filter 198.32.154.187/32 exact; source-address-filter 198.32.154.195/32 exact; source-address-filter 198.32.154.202/32 exact; source-address-filter 198.32.154.210/32 exact; source-address-filter 1