38 lines
2.1 KiB
Plaintext
38 lines
2.1 KiB
Plaintext
|
# vyos002 — everything that must land before it is trusted on the network.
|
||
|
|
#
|
||
|
|
# Apply order matters only in that this is ONE commit: the eth2 address and the
|
||
|
|
# missing health-check are the two defects that caused the 2026-09-02 outage, and
|
||
|
|
# neither should survive a single reboot window.
|
||
|
|
#
|
||
|
|
# ssh vyos@192.168.1.253 (or 10.0.1.253 — L2-direct, see RECOVERY-CARD)
|
||
|
|
# configure; <paste>; commit; save
|
||
|
|
|
||
|
|
# 1. The ARP poisoner. eth2 is the 1G copper NIC on US24 port 16, native VLAN 2,
|
||
|
|
# and it held 192.168.8.144/23 -- the same subnet as bond0.2. Two interfaces
|
||
|
|
# answering for one subnet is what hijacked 192.168.8.1 and took the cluster
|
||
|
|
# down: eth2's MAC answered while bond0.2's MAC routed.
|
||
|
|
# Origin: eth2 was `address dhcp`, a kea reservation for the ROUTER'S OWN NIC
|
||
|
|
# handed it .144, and a CLI commit froze it static.
|
||
|
|
delete interfaces ethernet eth2 address
|
||
|
|
|
||
|
|
# 2. The health-check. Without it this box can hold every floating IP while
|
||
|
|
# having no WAN at all -- the outage itself. It goes on the SYNC GROUP; VyOS
|
||
|
|
# rejects it per-group.
|
||
|
|
# /config/vrrp-wan-health must be copied over FIRST (from migration/) and be
|
||
|
|
# chmod +x, or the commit succeeds and the check silently never passes.
|
||
|
|
set high-availability vrrp sync-group MAIN health-check script '/config/vrrp-wan-health'
|
||
|
|
set high-availability vrrp sync-group MAIN health-check interval '5'
|
||
|
|
set high-availability vrrp sync-group MAIN health-check failure-count '3'
|
||
|
|
|
||
|
|
# 3. Management onto a tagged sub-interface, matching vyos001 (kea #1117).
|
||
|
|
# Pair this with USW Aggregation port 3 (LAG 3+4) -> Native VLAN = None.
|
||
|
|
# Until that switch change lands, leave these three commented out: vyos002
|
||
|
|
# can run untagged on bond0 while vyos001 runs tagged -- one VLAN is one
|
||
|
|
# broadcast domain, and the coexistence was proven in labsim.
|
||
|
|
# set interfaces bonding bond0 vif 1 address '192.168.1.253/24'
|
||
|
|
# set interfaces bonding bond0 vif 1 description 'management'
|
||
|
|
# delete interfaces bonding bond0 address
|
||
|
|
# set firewall group interface-group LAN interface 'bond0.1'
|
||
|
|
# delete firewall group interface-group LAN interface 'bond0'
|
||
|
|
# set high-availability vrrp group native interface 'bond0.1'
|