ee070371a8
A cutover attempt failed on the WAN and nothing had tested it. The reason the sim could not have caught it: labsim modelled every LAN VLAN faithfully and omitted the WAN entirely -- vlans.conf had 1, 2, 3, 9, 10 and 200, never 51 or 53. Worse, the switch script's WAN health checks are conditional on the delta configuring PPPoE, so in the sim they printed "this delta configures no WAN -- skipping all WAN health checks" and passed. The sim proved the delta commits; it never proved the WAN works, and could not have. Adds VLANs 51 (Vodafone/PPPoE) and 53 (10gig/DHCP) to the fabric so a fake ISP can live on each and those checks actually execute. VyOS has service pppoe-server (accel-ppp) natively -- authentication local-users, client-ip-pool, gateway-address -- so a VyOS VM can play the concentrator, and dhcp-server can play the other ISP. vlans.conf gains host_octet 0, meaning "no host leg". A host address on a WAN transport VLAN would misrepresent the segment: the point is that VyOS reaches an ISP, not the host. Also fixes a real gap in ovs_bond_router: it returned early when the bond already existed, so adding a VLAN to vlans.conf never reached an existing bond. Re-runs now reconcile the trunk and say so. That gap is the same SHAPE as the production failure -- interface present, VLAN missing from the trunk, frames silently dropped -- which is precisely the class of bug the sim needs to be able to reproduce rather than embody. Both bonds updated: [2,3,9,10,200] -> [2,3,9,10,51,53,200]. Note on the production diagnosis, which is NOT settled: a passive RX test showed zero frames on 51/53 at the firewall, and an active DHCP DISCOVER (verified to have transmitted, tx +2) drew no reply. That is consistent with the VLANs not being trunked, but equally with the ISP only answering its registered CPE MAC -- which is exactly why the delta clones f0:9f:c2:12:9b:4f, and why it cannot be settled from production while the USG holds that MAC. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DMVzWZgiKW2wquf5z8S1yH
44 lines
2.0 KiB
Plaintext
44 lines
2.0 KiB
Plaintext
# Lab network simulation — VLAN map.
|
|
#
|
|
# Mirrors the real UniFi topology (same VLAN IDs, same roles) but with
|
|
# deliberately DIFFERENT IP ranges so nothing here can collide with, or be
|
|
# confused for, production. The sim subnet always encodes the VLAN id:
|
|
#
|
|
# 172.31.<vlan-id>.0/24
|
|
#
|
|
# Per-subnet address plan (same shape on every VLAN):
|
|
# .1 gateway under test (VyOS/router VM — not created by default)
|
|
# .2 host bridge (how you SSH in from this workstation)
|
|
# .10 the micro VM for this VLAN
|
|
# .254 VRRP VIP (reserved, mirrors production)
|
|
#
|
|
# Format: vlan_id:name:sim_subnet_prefix:real_subnet:[masklen]:[host_octet]
|
|
#
|
|
# masklen defaults to 24 and host_octet to 2. Both exist for VLAN 10, which is
|
|
# the one VLAN that has to be a /23 here: every UniFi DHCP reservation lives in
|
|
# LoT, and LoT spans 10.0.0.x AND 10.0.1.x, which a /24 cannot represent. With
|
|
# /23 the mapping stays readable — 10.0.0.46 -> 172.31.10.46 and
|
|
# 10.0.1.67 -> 172.31.11.67.
|
|
#
|
|
# LoT's host leg is .3 rather than .2 because 10.0.0.2 is a real reservation
|
|
# (Hubitat) and would map straight onto the host's own address. .3 is free in
|
|
# production and sits below the DHCP pool (which starts at .11), so it can
|
|
# never be handed out.
|
|
1:management:172.31.1:192.168.1.0/24
|
|
2:k8s:172.31.2:192.168.8.0/23
|
|
3:kvm:172.31.3:192.168.3.0/24
|
|
9:private:172.31.9:10.0.9.0/23
|
|
10:lot:172.31.10:10.0.0.0/23:23:3
|
|
200:roomates:172.31.200:192.168.2.0/24
|
|
|
|
# WAN transport VLANs, mirroring production. These exist so the sim can run a
|
|
# fake ISP on each and the switch script's WAN health checks actually execute
|
|
# instead of printing "this delta configures no WAN -- skipping". A cutover
|
|
# attempt failed on the WAN with nothing having tested it, because the sim
|
|
# modelled every LAN VLAN faithfully and omitted the WAN entirely.
|
|
#
|
|
# No host leg is wanted here (host_octet 0 means "skip"): the ISP VMs own these
|
|
# segments, and a host address on a WAN transport VLAN would be a lie.
|
|
51:wan1:172.31.51:vodafone-pppoe(VLAN 51):24:0
|
|
53:wan3:172.31.53:10gig-dhcp(VLAN 53):24:0
|