Configuration Blueprints

This chapter contains various configuration examples:

• Firewall Examples
  • VRF and firewall example
  • Bridge and firewall example
  • Zone-Policy example
• BGP IPv6 unnumbered with extended nexthop
  • Configuration
  • Results
• OSPF unnumbered with ECMP
  • Configuration
  • Results
• Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
  • Prerequisites
  • Example
  • Vyos configuration
• Route-Based Redundant Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)
  • Prerequisites
  • Example
  • Vyos configuration
• High Availability Walkthrough
  • Design
  • Basic Setup (via console)
  • VRRP Configuration
  • NAT and conntrack-sync
  • OSPF Over WireGuard
  • Advertise connected routes
  • BGP
• WAN Load Balancer examples
  • Example 1: Distributing load evenly
  • Example 2: Failover based on interface weights
  • Example 3: Failover based on rule order
  • Example 4: Failover based on rule order - priority traffic
  • Example 5: Exclude traffic from load balancing
• PPPoE IPv6 Basic Setup for Home Network
  • Network Topology
  • Configurations
• L3VPN for Hub-and-Spoke connectivity with VyOS
  • Topology
  • How does it work?
  • Configuration
• PPPoE over L2TP
  • Network Topology
  • Configurations
• Inter-VRF Routing over VRF Lite
  • Overview
  • Topology
  • Configurations
  • Conclusions
  • Appendix-A
  • Appendix-B
• DMVPN Dual HUB Dual Cloud
  • Network Topology
  • Configurations
  • Monitoring
  • Summary
• QoS example
  • Configuration ‘dcsp’ and shaper using QoS
  • Configuration:
• Segment-routing IS-IS example
  • Configuration
• NMP example
  • Configuration ‘VyOS’
  • Configuration ‘NMP’
• Ansible example
  • Setting up Ansible on a server running the Debian operating system.
  • Install Ansible:
  • Install Paramiko:
  • Check the version:
  • Basic configuration of ansible.cfg:
  • Add all the VyOS hosts:
  • Add general variables:
  • Add a simple playbook with the tasks for each router:
  • Start the playbook:
  • Check the result on the vyos10 router:
  • The simple way without configuration of the hostname (one task for all routers):
• Policy-based Site-to-Site VPN IPsec between VyOS and Cisco
  • Network Topology
  • Prerequirements
  • Configuration
  • Monitoring
• Route-based Site-to-Site VPN IPsec between VyOS and Cisco
  • Network Topology
  • Prerequirements
  • Configuration
  • Monitoring
• Route-based Site-to-Site VPN IPsec between VyOS and Palo Alto
  • Network Topology
  • Prerequirements
  • Configuration
  • Monitoring
• Policy-Based Site-to-Site VPN and Firewall Configuration
  • Network Topology and requirements
  • Configuration
  • Checking through op-mode commands
• Site-to-Site IPSec VPN to Cisco using FlexVPN
  • Configuration
  • Verification

Configuration Blueprints (autotest)

The next pages contain fully automated configuration examples.

Each lab will build and test from an external script. The page content is generated, so changes will not take effect.

A host vyos-oobm will be used as an SSH proxy. This host is just necessary for the lab tests.

The process will do the following steps:

1. create the lab on a eve-ng server

2. configure each host in the lab

3. do some defined tests

4. optional do an upgrade to a higher version and do step 3 again.

5. generate the documentation and include files

6. shutdown and destroy the lab, if there is no error

• DHCP Relay through GRE-Bridge
• Tunnelbroker.net (IPv6)
• L3VPN EVPN with VyOS
• Wireguard
• OpenVPN with LDAP