!

! Last configuration change at 19:02:04 IST Wed Jul 5 2023 by rjilNCBOTAccess

! NVRAM config last updated at 19:01:48 IST Wed Jul 5 2023 by rjilNCBOTAccess
!
version 17.6
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service internal
service sequence-numbers
! Call-home is enabled by Smart-Licensing.
service call-home
service unsupported-transceiver
no platform punt-keepalive disable-kernel-core
platform bfd-debug-trace 1
platform xconnect load-balance-hash-algo mac-ip-instanceid
platform tcam-parity-error enable
platform tcam-threshold enable ucastv6 70
platform tcam-threshold alarm-frequency 1
!
hostname GOJUGOJUESR017
!
boot-start-marker
boot system bootflash:asr920-universalk9_npe.V176_3_SR692712783_3.SPA.bin
boot-end-marker
!
!
vrf definition Mgmt-intf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
vrf definition RJIL-BEARER-ENB
description *** FOR BEARER LTE SERVICES ***
rd 172.20.96.150:2
route-target export 64730:133
route-target export 64730:131
route-target export 64740:50294
route-target import 64730:13301
route-target import 64740:50294
!
address-family ipv6
exit-address-family
!
vrf definition RJIL-ENT-CPE-MGMT
description *** For CPE management ***
rd 172.20.96.150:59
!
address-family ipv6
route-target export 65532:133
route-target import 65532:13301
exit-address-family
!
vrf definition RJIL-GNB-OAM
 description *** FOR O&M 5G SERVICES ***
rd 172.20.96.150:503
route-target export 84720:133
route-target import 84720:13301
!
address-family ipv6
exit-address-family
!
vrf definition RJIL-GNB-SIGNALING
description *** FOR SIGNALLING 5G SERVICES ***
rd 172.20.96.150:501
route-target export 84710:133
route-target import 84710:13301
!
address-family ipv6
exit-address-family
!
vrf definition RJIL-IME
description *** FOR IME SERVICES ***
rd 172.20.96.150:6
route-target export 64760:133
route-target export 64760:131
route-target import 64760:13301
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
vrf definition RJIL-IP-MGMT
description *** For Out-of-Band management ***
rd 172.20.96.150:29
!
address-family ipv4
route-target export 64820:133
route-target export 64820:131
route-target export 64820:99
route-target import 64820:13301
route-target import 64820:99
exit-address-family
!
address-family ipv6
route-target export 64820:133
route-target export 64820:131
route-target import 64820:13301
exit-address-family
!
vrf definition RJIL-OAM-ENB
description *** FOR O&M LTE SERVICES ***
rd 172.20.96.150:3
route-target export 64720:133
route-target export 64720:131
route-target import 64720:13301
!
address-family ipv6
exit-address-family
!
vrf definition RJIL-SIGNALING-ENB
 description *** FOR SIGNALLING LTE SERVICES ***
rd 172.20.96.150:1
route-target export 64710:133
route-target export 64710:131
route-target import 64710:13301
!
address-family ipv6
exit-address-family
!
vrf definition RJIL-VRF-ENTERPRISE-ILL-SPOKE
description *** ENTERPRISE ILL ***
rd 172.20.96.150:114
route-target export 65562:133
route-target import 65562:13301
!
address-family ipv4
import map RJIL-VRF-ENTERPRISE-ILL-SPOKE-DEFAULT_ONLY_IPv4
exit-address-family
!
address-family ipv6
route-target export 65562:133
route-target import 65562:13301
exit-address-family
!
vrf definition RJIL-WIFI-CISCO
description *** FOR CISCO WIFI SERVICES ***
rd 172.20.96.150:4
route-target export 64750:133
route-target export 64750:131
route-target import 64750:13301
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
logging buffered 65536 informational
no logging console
no logging monitor
enable secret 9 $14$fui7$i71RYNMSTsumAE$Hsnr4lJ5TE2SlCBqMVWO/R1bCHohvQ1eMoEDOJJ/K/U
!
aaa new-model
!
!
aaa group server tacacs+ ACSSERVER
server name TACACS1
server name TACACS2
ip vrf forwarding RJIL-IP-MGMT
ip tacacs source-interface Loopback999
!
aaa authentication banner #Unauthorized acces is prohibited#
aaa authentication login AAA-CONSOLE-LOCAL group ACSSERVER local
aaa authentication login AAA-VTY-ACS group ACSSERVER local
aaa authentication login AAA-LOCAL local
aaa authentication enable default group ACSSERVER enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec AAA-VTY-ACS group ACSSERVER local
aaa authorization commands 1 AAA-VTY-ACS group ACSSERVER local
aaa authorization commands 10 default none
aaa authorization commands 15 AAA-VTY-ACS group ACSSERVER local
aaa accounting update newinfo
aaa accounting exec default start-stop group ACSSERVER
aaa accounting commands 1 default start-stop group ACSSERVER
aaa accounting commands 15 default start-stop group ACSSERVER
aaa accounting connection default start-stop group ACSSERVER
aaa accounting system default start-stop group ACSSERVER
!
!
!
!
!
!
aaa session-id common
aaa password restriction
process cpu threshold type total rising 80 interval 30
process cpu statistics limit entry-percentage 80 size 86400
clock timezone IST 5 30
fhrp version vrrp v3
!
!
!
!
!
!
!
!
!
no ip domain lookup
ip domain name INFRA.JIO.COM
ip multicast route-limit 8000
ip dhcp bootp ignore
!
!
!
login block-for 30 attempts 5 within 30
login delay 2
login quiet-mode access-class MGMT-VTY-IPv6
login on-failure log
login on-success log
ipv6 icmp error-interval 50 20
no ipv6 source-route
ipv6 nd cache interface-limit 50 log 1
ipv6 unicast-routing
ipv6 multicast-routing
!
!
!
!
!
!
!
mpls label protocol ldp
mpls ldp password option 10 for MPLS-LDP-IPv4 7
03360F2C3923257C71394A56055C5923557E
mpls ldp graceful-restart
mpls ldp session protection
mpls ldp igp sync holddown 2000
mpls ldp discovery targeted-hello accept
multilink bundle-name authenticated
!
key chain ISIS-KEY
key 1
key-string 7 1425462C332D390237170366710149442C5002
accept-lifetime 01:00:00 Jan 1 2014 infinite
send-lifetime 01:00:00 Jan 1 2014 infinite
!
crypto pki trustpoint TP-self-signed-2102701246
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2102701246
revocation-check none
rsakeypair TP-self-signed-2102701246
!
crypto pki trustpoint SLA-TrustPoint
enrollment terminal
revocation-check none
!
!
crypto pki certificate chain TP-self-signed-2102701246
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32313032 37303132 3436301E 170D3139 30353331 31343132
32325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 31303237
30313234 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100E948 14C4F70F 7D82BD0D A758590B 17FAE922 BE852CCD 8830F1B9 C28F3AF6
6253D9E9 8DF701C7 5F83360F B630B870 7E1DAB4D 09AFAA3B 1791C360 6CF534C7
BFE57FE8 3DDB755D E206304C 3282C9DB 784AF139 36AFA36B 15FCB7EC BED36B36
70D45A0D 70A739D0 D1D72196 E41742D1 3638FFFB 808C4AF7 17A3C878 48A53AAE
C9630203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 14BB10B1 D4E80D63 D1E62587 74635387 1EC4CF65 CD301D06
03551D0E 04160414 BB10B1D4 E80D63D1 E6258774 6353871E C4CF65CD 300D0609
2A864886 F70D0101 05050003 81810005 A4BB2F35 DF13B276 67E30589 63845A23
2F8053BD 45EA9E0F ED79EF54 9FDABBAE E1AB5C15 5F3BA02F F24883A1 3C395649
76DDDDA2 6F525C8D 3B6D8182 DF5F6C25 12CA3628 0F808D2B 4087E6AF 844438F4
5E685E9A 31130A4F DF8C319D 58FB2189 4209DB58 CDB7F26A 8259FF3C 4435B74D
508025BC 1B20EA40 53475D59 DE0505
quit
crypto pki certificate chain SLA-TrustPoint
certificate ca 01
30820321 30820209 A0030201 02020101 300D0609 2A864886 F70D0101 0B050030
32310E30 0C060355 040A1305 43697363 6F312030 1E060355 04031317 43697363
6F204C69 63656E73 696E6720 526F6F74 20434130 1E170D31 33303533 30313934
3834375A 170D3338 30353330 31393438 34375A30 32310E30 0C060355 040A1305
43697363 6F312030 1E060355 04031317 43697363 6F204C69 63656E73 696E6720
526F6F74 20434130 82012230 0D06092A 864886F7 0D010101 05000382 010F0030
82010A02 82010100 A6BCBD96 131E05F7 145EA72C 2CD686E6 17222EA1 F1EFF64D
CBB4C798 212AA147 C655D8D7 9471380D 8711441E 1AAF071A 9CAE6388 8A38E520
1C394D78 462EF239 C659F715 B98C0A59 5BBB5CBD 0CFEBEA3 700A8BF7 D8F256EE
4AA4E80D DB6FD1C9 60B1FD18 FFC69C96 6FA68957 A2617DE7 104FDC5F EA2956AC
7390A3EB 2B5436AD C847A2C5 DAB553EB 69A9A535 58E9F3E3 C0BD23CF 58BD7188
68E69491 20F320E7 948E71D7 AE3BCC84 F10684C7 4BC8E00F 539BA42B 42C68BB7
C7479096 B4CB2D62 EA2F505D C7B062A4 6811D95B E8250FC4 5D5D5FB8 8F27D191
C55F0D76 61F9A4CD 3D992327 A8BB03BD 4E6D7069 7CBADF8B DF5F4368 95135E44
DFC7C6CF 04DD7FD1 02030100 01A34230 40300E06 03551D0F 0101FF04 04030201
 06300F06 03551D13 0101FF04 05300301 01FF301D 0603551D 0E041604 1449DC85
4B3D31E5 1B3E6A17 606AF333 3D3B4C73 E8300D06 092A8648 86F70D01 010B0500
03820101 00507F24 D3932A66 86025D9F E838AE5C 6D4DF6B0 49631C78 240DA905
604EDCDE FF4FED2B 77FC460E CD636FDB DD44681E 3A5673AB 9093D3B1 6C9E3D8B
D98987BF E40CBD9E 1AECA0C2 2189BB5C 8FA85686 CD98B646 5575B146 8DFC66A8
467A3DF4 4D565700 6ADF0F0D CF835015 3C04FF7C 21E878AC 11BA9CD2 55A9232C
7CA7B7E6 C1AF74F6 152E99B7 B1FCF9BB E973DE7F 5BDDEB86 C71E3B49 1765308B
5FB0DA06 B92AFE7F 494E8A9E 07B85737 F3A58BE1 1A48A229 C37C1E69 39F08678
80DDCD16 D6BACECA EEBC7CF9 8428787B 35202CDC 60E4616A B623CDBD 230E3AFB
418616A9 4093E049 4D10AB75 27E86F73 932E35B5 8862FDAE 0275156F 719BB2F0
D697DF7F 28
quit
!
license feature ptp
license udi pid ASR-920-10SZ-PD sn CAT2338U4G4
license accept end user agreement
license boot level advancedmetroipaccess
license smart enable
license smart transport callhome
archive
log config
logging enable
logging size 200
notify syslog contenttype plaintext
path bootflash:l2parentdelta
maximum 1
time-period 55
memory reserve critical 2000
memory free low-watermark processor 5000
file privilege 10
!
!
spanning-tree extend system-id
sdm prefer scaledipv6
mac-address-table limit bdomain 101 maximum 20
mac-address-table limit bdomain 102 maximum 20
mac-address-table limit bdomain 103 maximum 20
mac-address-table limit bdomain 104 maximum 20
mac-address-table limit bdomain 141 maximum 20
mac-address-table limit bdomain 142 maximum 20
mac-address-table limit bdomain 143 maximum 20
mac-address-table limit bdomain 350 maximum 20
mac-address-table limit bdomain 351 maximum 20
mac-address-table limit bdomain 352 maximum 20
mac-address-table limit bdomain 353 maximum 20
mac-address-table limit bdomain 354 maximum 20
mac-address-table limit bdomain 355 maximum 20
mac-address-table limit bdomain 550 maximum 20
mac-address-table limit bdomain 551 maximum 20
mac-address-table limit bdomain 552 maximum 20
mac-address-table limit bdomain 553 maximum 20
mac-address-table limit bdomain 901 maximum 20
mac-address-table limit bdomain 951 maximum 20
diagnostic bootup level minimal
!
username RjilUserDgD9BSf8 privilege 15 secret 9
$14$5acZ$FxAz0ZstHLTRAU$32u5.9SvOSPFZUDjJqYsF/ZQZ87kK5KZkmKWtUL7HwI
username LocalAuthRdOnly privilege 10 secret 9
$14$pKEB$Gi/Mpq97EoG2sk$KoJriBvfjITQhpo4MABUqRx3EUKOTOesiGeNwFpiI8U
username RjilUserGdwxfMyY privilege 15 secret 9
$9$Sw7c7S3rsYTr1k$qcsj6BVvwj7MP/F7XwRYs2uVHhUYnZRtQSR32js8vpY
username rjil privilege 15 secret 9
$9$vSyiY2AandfHi.$5tYVGdWfmme/KPois.Zf.lkHKfLwhBgEGeHSTB9o4jk
username rjil privilege 15 secret Rjil123
!
redundancy
!
bfd-template single-hop FIBRE
interval microseconds min-tx 50000 min-rx 50000 multiplier 3
!
bridge-domain 101
bridge-domain 102
bridge-domain 103
bridge-domain 104
bridge-domain 581
mac limit maximum addresses 30
bridge-domain 585
mac limit maximum addresses 30
bridge-domain 952
!
!
transceiver type all
monitoring
!
!
!
class-map match-any QOS-SIGNALING-QGRP
match qos-group 7
class-map match-any QOS-OAM-DSCP
match dscp cs2
class-map match-any QOS-CONTROL-DSCP
match dscp cs6
class-map match-any QOS-VOICE-QGRP
match qos-group 5
class-map match-any QOS-SIGNALING-DSCP
match dscp cs5
class-map match-any QOS-HOSTED-AV-SMARTSCHEDULER-EXP
match mpls experimental topmost 3
class-map match-any QOS-OAM-QGRP
match qos-group 2
class-map match-any QOS-IPTV-EXP
match mpls experimental topmost 4
class-map match-any QOS-BRONZE-COS
match cos 0 1
class-map match-any QOS-CONTROL-QGRP
match qos-group 6
class-map match-any QOS-VOICE-DSCP
match dscp ef cs7
class-map match-any RJIL-ENT-IES-9070124070-2311-PARENT
match vlan 2311
class-map match-any QOS-INT-PREMIUM-EXP
match mpls experimental topmost 1
class-map match-any QOS-HOSTED-AV-SMARTSCHEDULER-QGRP
match qos-group 3
class-map match-any QOS-IPTV-QGRP
match qos-group 4
class-map match-any QOS-OAM-EXP
match mpls experimental topmost 2
class-map match-any QOS-CONTROL-EXP
match mpls experimental topmost 6
match ip precedence 6
class-map match-any QOS-SILVER-QGRP
match qos-group 3
class-map match-any QOS-PLATINUM-QGRP
match qos-group 6
class-map match-any QOS-HOSTED-AV-SMARTSCHEDULER-DSCP
match dscp af32
class-map match-any QOS-IPTV-DSCP
match dscp af31 af41
class-map match-all QOS-VOICE-EXP
match mpls experimental topmost 5
class-map match-any QOS-BRONZE-QGRP
match qos-group 1
class-map match-any QOS-GOLD-QGRP
match qos-group 4
class-map match-any QOS-SIGNALING-EXP
match mpls experimental topmost 7
class-map match-any QOS-INT-PREMIUM-DSCP
match dscp af22
class-map match-any QOS-INT-PREMIUM-QGRP
match qos-group 1
!
policy-map RJIL-QOS-NTWK-NNI-OUT-MW-500-CHILD
class QOS-VOICE-QGRP
priority level 1
police cir percent 25
set mpls experimental topmost 5
queue-limit 250000 bytes
class QOS-SIGNALING-QGRP
priority level 2
police cir percent 5
set mpls experimental topmost 7
queue-limit 250000 bytes
class QOS-CONTROL-QGRP
bandwidth percent 1
set mpls experimental topmost 6
queue-limit 500000 bytes
class QOS-IPTV-QGRP
bandwidth percent 20
set mpls experimental topmost 4
queue-limit 250000 bytes
class QOS-HOSTED-AV-SMARTSCHEDULER-QGRP
bandwidth percent 10
set mpls experimental topmost 3
queue-limit 500000 bytes
class QOS-OAM-QGRP
bandwidth percent 5
set mpls experimental topmost 2
queue-limit 500000 bytes
class QOS-INT-PREMIUM-QGRP
bandwidth percent 16
set mpls experimental topmost 1
queue-limit 500000 bytes
class class-default
bandwidth percent 18
set mpls experimental topmost 0
queue-limit 500000 bytes
policy-map RJIL-QOS-NTWK-NNI-OUT-MW-500
class class-default
shape average 450000000
service-policy RJIL-QOS-NTWK-NNI-OUT-MW-500-CHILD
policy-map RJIL-QOS-NTWK-NNI-OUT-MW-250-CHILD
class QOS-VOICE-QGRP
priority level 1
police cir percent 25
set mpls experimental topmost 5
queue-limit 125000 bytes
class QOS-SIGNALING-QGRP
priority level 2
police cir percent 5
set mpls experimental topmost 7
queue-limit 125000 bytes
class QOS-CONTROL-QGRP
bandwidth percent 1
set mpls experimental topmost 6
queue-limit 250000 bytes
class QOS-IPTV-QGRP
bandwidth percent 20
set mpls experimental topmost 4
queue-limit 125000 bytes
class QOS-HOSTED-AV-SMARTSCHEDULER-QGRP
bandwidth percent 10
set mpls experimental topmost 3
queue-limit 250000 bytes
class QOS-OAM-QGRP
bandwidth percent 5
set mpls experimental topmost 2
queue-limit 250000 bytes
class QOS-INT-PREMIUM-QGRP
bandwidth percent 16
set mpls experimental topmost 1
queue-limit 500000 bytes
class class-default
bandwidth percent 18
set mpls experimental topmost 0
queue-limit 500000 bytes
policy-map RJIL-QOS-WAP-UNI-OUT-PARENT
class QOS-VOICE-QGRP
priority level 1
police cir percent 25
class QOS-SIGNALING-QGRP
priority level 2
police cir percent 5
class QOS-CONTROL-QGRP
bandwidth percent 1
class QOS-IPTV-QGRP
bandwidth percent 20
class QOS-HOSTED-AV-SMARTSCHEDULER-QGRP
bandwidth percent 10
class QOS-OAM-QGRP
bandwidth percent 5
class QOS-INT-PREMIUM-QGRP
bandwidth percent 16
class class-default
bandwidth percent 18
policy-map RJIL-QOS-NTWK-NNI-OUT-MW-250
 class class-default
shape average 230000000
service-policy RJIL-QOS-NTWK-NNI-OUT-MW-250-CHILD
policy-map RJIL-QOS-NTWK-NNI-OUT-PARENT
class QOS-VOICE-QGRP
priority level 1
police cir percent 25
set mpls experimental topmost 5
class QOS-SIGNALING-QGRP
priority level 2
police cir percent 5
set mpls experimental topmost 7
class QOS-CONTROL-QGRP
bandwidth percent 1
set mpls experimental topmost 6
class QOS-IPTV-QGRP
bandwidth percent 20
set mpls experimental topmost 4
class QOS-HOSTED-AV-SMARTSCHEDULER-QGRP
bandwidth percent 10
set mpls experimental topmost 3
class QOS-OAM-QGRP
bandwidth percent 5
set mpls experimental topmost 2
class QOS-INT-PREMIUM-QGRP
bandwidth percent 16
set mpls experimental topmost 1
class class-default
bandwidth percent 18
set mpls experimental topmost 0
policy-map RJIL-QOS-IME-UNI-IN-PARENT
class class-default
set qos-group 2
police 1000000
policy-map RJIL-ENT-IES-9070124070-2311-CHILD-OUT
class QOS-BRONZE-QGRP
policy-map RJIL-QOS-ENB-UNI-OUT-PARENT
class QOS-VOICE-QGRP
priority level 1
police cir percent 25
class QOS-SIGNALING-QGRP
priority level 2
police cir percent 5
class QOS-CONTROL-QGRP
bandwidth percent 1
class QOS-IPTV-QGRP
bandwidth percent 20
class QOS-HOSTED-AV-SMARTSCHEDULER-QGRP
bandwidth percent 10
class QOS-OAM-QGRP
bandwidth percent 5
class QOS-INT-PREMIUM-QGRP
bandwidth percent 16
class class-default
bandwidth percent 18
policy-map RJIL-QOS-WAP-UNI-IN-CHILD
class QOS-VOICE-DSCP
set qos-group 5
class QOS-CONTROL-DSCP
 set qos-group 6
class QOS-IPTV-DSCP
set qos-group 4
class QOS-HOSTED-AV-SMARTSCHEDULER-DSCP
set qos-group 3
class QOS-OAM-DSCP
set qos-group 2
class QOS-INT-PREMIUM-DSCP
set qos-group 1
class QOS-SIGNALING-DSCP
set qos-group 7
class class-default
policy-map RJIL-ENT-IES-9070124070-2311-OUT
class class-default
shape average 4613734
service-policy RJIL-ENT-IES-9070124070-2311-CHILD-OUT
policy-map RJIL-QOS-ENB-UNI-IN-CHILD
class QOS-VOICE-DSCP
set qos-group 5
class QOS-CONTROL-DSCP
set qos-group 6
class QOS-IPTV-DSCP
set qos-group 4
class QOS-HOSTED-AV-SMARTSCHEDULER-DSCP
set qos-group 3
class QOS-OAM-DSCP
set qos-group 2
class QOS-INT-PREMIUM-DSCP
set qos-group 1
class QOS-SIGNALING-DSCP
set qos-group 7
class class-default
policy-map RJIL-QOS-ENB-UNI-IN-PARENT
class class-default
police 100000000
service-policy RJIL-QOS-ENB-UNI-IN-CHILD
policy-map RJIL-QOS-WAP-UNI-IN-PARENT
class class-default
police 100000000
service-policy RJIL-QOS-WAP-UNI-IN-CHILD
policy-map RJIL-ENT-IES-9070124070-2311-CHILD-IN
class QOS-BRONZE-COS
set mpls experimental imposition 1
set qos-group 1
policy-map RJIL-ENT-IES-9070124070-2311-IN
class class-default
police 4613500
service-policy RJIL-ENT-IES-9070124070-2311-CHILD-IN
policy-map RJIL-QOS-NTWK-NNI-IN-PARENT
class QOS-VOICE-EXP
set qos-group 5
class QOS-SIGNALING-EXP
set qos-group 7
class QOS-CONTROL-EXP
set qos-group 6
class QOS-IPTV-EXP
set qos-group 4
class QOS-HOSTED-AV-SMARTSCHEDULER-EXP
set qos-group 3
 class QOS-OAM-EXP
set qos-group 2
class QOS-INT-PREMIUM-EXP
set qos-group 1
class class-default
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
description ## GOJUGOJUESR017-CORE-MGMT-LPBK ##
ip address 172.20.96.150 255.255.255.255
no ip redirects
no ip unreachables
no ip proxy-arp
ipv6 address 2405:200:201:3901:172:20:96:150/128
no ipv6 redirects
no ipv6 unreachables
isis tag 10
!
interface Loopback999
description *** Loopback interface for management ***
vrf forwarding RJIL-IP-MGMT
ip address 172.20.96.150 255.255.255.255
no ip redirects
no ip unreachables
no ip proxy-arp
ipv6 address 2405:200:204:139:172:20:96:150/128
no ipv6 redirects
no ipv6 unreachables
!
interface GigabitEthernet0/0/0
description # To- SMPS#
dampening
mtu 9216
ip address 192.168.32.28 255.255.255.0
load-interval 30
media-type rj45
negotiation auto
!
interface GigabitEthernet0/0/1
description # SMPS #
dampening
mtu 9216
no ip address
load-interval 30
media-type rj45
 negotiation auto
service-policy input RJIL-QOS-IME-UNI-IN-PARENT
service instance 952 ethernet
description # IME-Utilities #
encapsulation untagged
bridge-domain 952
!
!
interface GigabitEthernet0/0/2
description # ACCESS CONTROL #
dampening
mtu 9216
no ip address
load-interval 30
media-type sfp
negotiation auto
service-policy input RJIL-QOS-IME-UNI-IN-PARENT
service instance 952 ethernet
description # IME-Utilities #
encapsulation untagged
bridge-domain 952
!
!
interface GigabitEthernet0/0/3
description # TO RIL Customer On UBR #
dampening
mtu 9216
no ip address
load-interval 30
carrier-delay msec 0
media-type sfp
negotiation auto
service-policy input RJIL-ENT-IES-9070124070-2311-IN
service-policy output RJIL-ENT-IES-9070124070-2311-OUT
service instance trunk 30 ethernet
encapsulation dot1q 585,1024
rewrite ingress tag pop 1 symmetric
l2protocol peer lldp
bridge-domain from-encapsulation
!
service instance 2311 ethernet
encapsulation untagged
bridge-domain 2311
!
!
interface GigabitEthernet0/0/4
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0/0/5
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0/0/6
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet0/0/7
description # TO-GOJUGOJUESR031-GigabitEthernet0/0/6-MW # #11561312 ##
dampening
mtu 9216
bandwidth 450000
no ip address
load-interval 30
carrier-delay up 2
carrier-delay down msec 0
negotiation auto
synchronous mode
service-policy input RJIL-QOS-NTWK-NNI-IN-PARENT
service-policy output RJIL-QOS-NTWK-NNI-OUT-MW-500
service instance 353 ethernet
description # Data Traffic #
encapsulation untagged
bridge-domain 353
!
service instance 553 ethernet
description # Microwave Management #
encapsulation dot1q 553
rewrite ingress tag pop 1 symmetric
bridge-domain 553
!
!
interface TenGigabitEthernet0/0/8
description # To eNode-B #
dampening
mtu 9216
no ip address
load-interval 30
negotiation auto
service-policy input RJIL-QOS-ENB-UNI-IN-PARENT
service-policy output RJIL-QOS-ENB-UNI-OUT-PARENT
service instance 101 ethernet
description # To eNode-B - R4G_Bearer #
encapsulation dot1q 101
rewrite ingress tag pop 1 symmetric
bridge-domain 101
!
service instance 102 ethernet
description # To eNode-B - R4G_Signalling #
encapsulation dot1q 102
rewrite ingress tag pop 1 symmetric
bridge-domain 102
!
service instance 103 ethernet
description # To eNode-B - R4G_R4G_o&m #
encapsulation dot1q 103
rewrite ingress tag pop 1 symmetric
bridge-domain 103
!
service instance 104 ethernet
description # Multicast #
encapsulation dot1q 104
rewrite ingress tag pop 1 symmetric
bridge-domain 104
!
!
interface TenGigabitEthernet0/0/9
description # To 5G Ericsson GNB #
mtu 9216
no ip address
load-interval 30
service-policy input RJIL-QOS-ENB-UNI-IN-CHILD
service-policy output RJIL-QOS-ENB-UNI-OUT-PARENT
service instance 141 ethernet
description # To 5G-GNB_Bearer #
encapsulation dot1q 141
rewrite ingress tag pop 1 symmetric
bridge-domain 141
!
service instance 142 ethernet
description # To 5G-GNB_Signalling #
encapsulation dot1q 142
rewrite ingress tag pop 1 symmetric
bridge-domain 142
!
service instance 143 ethernet
description # To 5G-GNB_o&m #
encapsulation dot1q 143
rewrite ingress tag pop 1 symmetric
bridge-domain 143
!
!
interface TenGigabitEthernet0/0/10
description # TO-GOJUGOJUESR025-TenGigabitEthernet0/0/11-Fiber ##15243303 ##
dampening
mtu 9216
no ip address
load-interval 30
carrier-delay up 2
carrier-delay down msec 0
cdp enable
no cdp tlv app
synchronous mode
service-policy input RJIL-QOS-NTWK-NNI-IN-PARENT
service-policy output RJIL-QOS-NTWK-NNI-OUT-PARENT
service instance 354 ethernet
description # Data Traffic #
encapsulation untagged
l2protocol peer cdp
bridge-domain 354
!
!
interface TenGigabitEthernet0/0/11
description # TO-GOJUGOJUESR005-TenGigabitEthernet0/0/12-Fiber ##1900185 ##
dampening
mtu 9216
no ip address
load-interval 30
carrier-delay up 2
carrier-delay down msec 0
cdp enable
synchronous mode
service-policy input RJIL-QOS-NTWK-NNI-IN-PARENT
service-policy output RJIL-QOS-NTWK-NNI-OUT-PARENT
 service instance 355 ethernet
description # Data Traffic #
encapsulation untagged
l2protocol peer cdp
bridge-domain 355
!
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
no ip address
shutdown
negotiation auto
!
interface BDI101
description # To eNode-B - R4G_Bearer #
vrf forwarding RJIL-BEARER-ENB
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
load-interval 30
ipv6 address 2405:200:13B:2A00:3:2:101:81/126
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 traffic-filter INFRA-iACL-IPv6-LTE in
!
interface BDI102
description # To eNode-B - R4G_Signalling #
vrf forwarding RJIL-SIGNALING-ENB
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
load-interval 30
ipv6 address 2405:200:13B:2A00:3:2:102:81/126
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 traffic-filter INFRA-iACL-IPv6-LTE in
!
interface BDI103
description # To eNode-B - R4G_R4G_o&m #
vrf forwarding RJIL-OAM-ENB
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
load-interval 30
ipv6 address 2405:200:13B:2A00:3:2:103:81/126
ipv6 enable
ipv6 mtu 9216
ipv6 nd managed-config-flag
no ipv6 redirects
 no ipv6 unreachables
ipv6 dhcp relay destination 2405:200:80E:732::10
!
interface BDI104
description # Multicast #
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
load-interval 30
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 mld query-timeout 180
ipv6 mld query-interval 60
ipv6 mld access-group MCAST-BDR-IPv6
ipv6 pim hello-interval 10
!
interface BDI141
description # To 5G-GNB_Bearer #
vrf forwarding RJIL-BEARER-ENB
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
load-interval 30
ipv6 address 2405:200:5113:141::1:ACF1/126
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 traffic-filter INFRA-iACL-IPv6-LTE in
!
interface BDI142
description # To 5G-GNB_Signalling #
vrf forwarding RJIL-GNB-SIGNALING
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
load-interval 30
ipv6 address 2405:200:5113:142::1:ACF1/126
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 traffic-filter INFRA-iACL-IPv6-LTE in
!
interface BDI143
description # To 5G-GNB_o&m #
vrf forwarding RJIL-GNB-OAM
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
 ip mtu 9216
load-interval 30
ipv6 address 2405:200:5113:143::1:ACF1/126
ipv6 enable
ipv6 mtu 9216
ipv6 nd managed-config-flag
ipv6 nd ra interval 30
no ipv6 redirects
no ipv6 unreachables
ipv6 dhcp relay destination 2405:200:80E:3931:61::4
ipv6 dhcp relay source-interface BDI143
ipv6 traffic-filter INFRA-iACL-IPv6-LTE in
!
interface BDI353
description # TO-GOJUGOJUESR031-GigabitEthernet0/0/6-MW #
ip address 10.84.226.126 255.255.255.254
ip helper-address 10.70.64.53
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
ip router isis RAN
load-interval 30
ipv6 address 2405:200:13B:0:10:84:226:126/127
ipv6 address 2405:200:13B:0:173:84:226:126/127
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 router isis RAN
mpls ip
mpls mtu 9216
mpls ldp igp sync delay 25
isis circuit-type level-2-only
isis network point-to-point
isis tag 20
!
interface BDI354
description # TO-GOJUGOJUESR025-TenGig0/0/11-Fiber #
ip address 10.87.155.243 255.255.255.254
ip helper-address 10.70.74.21
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
ip router isis RAN
load-interval 30
ipv6 address 2405:200:139:0:10:87:155:243/127
ipv6 address 2405:200:139:0:173:87:155:243/127
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 router isis RAN
mpls ip
mpls mtu 9216
mpls ldp igp sync delay 25
bfd template FIBRE
isis circuit-type level-2-only
 isis network point-to-point
isis tag 20
isis bfd
!
interface BDI355
description # TO-GOJUGOJUESR005-TenGigabitEthernet0/0/12-Fiber #
ip address 10.87.155.244 255.255.255.254
ip helper-address 10.70.74.21
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
ip router isis RAN
load-interval 30
ipv6 address 2405:200:139:0:10:87:155:244/127
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 router isis RAN
mpls ip
mpls mtu 9216
mpls ldp igp sync delay 25
bfd template FIBRE
isis circuit-type level-2-only
isis network point-to-point
isis tag 20
isis bfd
!
interface BDI553
description # Microwave Management #
vrf forwarding RJIL-IME
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
load-interval 30
ipv6 address 2405:200:13B:2A00:3:2:553:F1/125
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
!
interface BDI585
description # TO -SAP ID - UBR mgmt #
vrf forwarding RJIL-IME
no ip address
load-interval 30
ipv6 address 2405:200:13B:2A00:7:2:585:583/122
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 traffic-filter RJIL-SC-INFRA-iACL-IPv6 in
!
interface BDI952
description # IME-Utilities #
vrf forwarding RJIL-IME
 no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
load-interval 30
ipv6 address 2405:200:183B:952::15:9903/120
ipv6 mtu 9216
ipv6 nd managed-config-flag
no ipv6 redirects
no ipv6 unreachables
ipv6 dhcp relay destination 2405:200:806:2886:78::10
ipv6 dhcp relay destination 2405:200:853:2886:78::10
ipv6 dhcp relay source-interface BDI952
mpls mtu 9216
!
interface BDI1024
description # CPE Mgmt #
vrf forwarding RJIL-ENT-CPE-MGMT
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
load-interval 30
ipv6 address 2405:200:1F93:1024:8000:0:1:9F02/120
ipv6 mtu 9216
ipv6 nd cache interface-limit 512
no ipv6 redirects
no ipv6 unreachables
ipv6 dhcp relay destination 2405:200:81C:2820:78::4
ipv6 dhcp relay destination 2405:200:85C:2820:78::4
ipv6 dhcp relay source-interface BDI1024
vrrp 95 address-family ipv6
description # CPE Mgmt #
timers advertise 3000
priority 110
preempt delay minimum 30
address FE80:200:1F93:1024:8000:0:1:9F01 primary
address 2405:200:1F93:1024:8000:0:1:9F01/120
exit-vrrp
!
interface BDI2311
description *** ENTERPRISE ILL 9070124070 Dharam Bhagwati Containers Private Limit
***
vrf forwarding RJIL-VRF-ENTERPRISE-ILL-SPOKE
ip address 115.242.207.129 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 9216
ip access-group RJIL-INTERNET_VRF_INT_SPOKE-INFRA-iACL-IPv4 in
load-interval 30
ipv6 address 2405:203:893::53D/126
ipv6 enable
ipv6 mtu 9216
no ipv6 redirects
no ipv6 unreachables
ipv6 traffic-filter RJIL-INTERNET_VRF_INT_SPOKE-INFRA-iACL-CPE-MANG-IPv6 in
 bfd interval 200 min_rx 200 multiplier 3
!
router isis RAN
net 49.0003.1720.2009.6150.00
is-type level-2-only
router-id Loopback0
authentication mode md5 level-2
authentication key-chain ISIS-KEY level-2
metric-style wide
fast-flood 10
ip route priority high tag 5000
set-overload-bit on-startup 360
max-lsp-lifetime 65535
lsp-refresh-interval 65000
spf-interval 5 50 200
prc-interval 5 50 200
lsp-gen-interval 5 50 200
no hello padding multi-point
no hello padding point-to-point
log-adjacency-changes
fast-reroute per-prefix level-2 all
fast-reroute remote-lfa level-2 mpls-ldp
microloop avoidance disable
passive-interface Loopback0
mpls ldp sync
!
router bgp 55836
bgp router-id 172.20.96.150
bgp log-neighbor-changes
bgp graceful-restart
no bgp default ipv4-unicast
neighbor RJIL-AG1-IBGP-GRP peer-group
neighbor RJIL-AG1-IBGP-GRP remote-as 55836
neighbor RJIL-AG1-IBGP-GRP password 7 08131869363B02271B343C5779396A7A1C6476
neighbor RJIL-AG1-IBGP-GRP update-source Loopback0
neighbor RJIL-AG1-IBGP-GRP-IPv6 peer-group
neighbor RJIL-AG1-IBGP-GRP-IPv6 remote-as 55836
neighbor RJIL-AG1-IBGP-GRP-IPv6 password 7 097E1A2E2627102202333479783666611A7347
neighbor RJIL-AG1-IBGP-GRP-IPv6 update-source Loopback0
neighbor 2405:200:201:3901:172:18:249:248 peer-group RJIL-AG1-IBGP-GRP-IPv6
neighbor 2405:200:201:3901:172:20:96:87 peer-group RJIL-AG1-IBGP-GRP-IPv6
neighbor 172.18.249.248 peer-group RJIL-AG1-IBGP-GRP
neighbor 172.20.96.87 peer-group RJIL-AG1-IBGP-GRP
!
address-family ipv4
bgp nexthop trigger delay 0
network 172.20.96.150 mask 255.255.255.255 route-map CSR-COMM
neighbor RJIL-AG1-IBGP-GRP send-community
neighbor RJIL-AG1-IBGP-GRP send-label
neighbor 172.18.249.248 activate
neighbor 172.20.96.87 activate
exit-address-family
!
address-family vpnv4
bgp additional-paths select backup
bgp additional-paths install
bgp nexthop trigger delay 1
neighbor RJIL-AG1-IBGP-GRP send-community extended
neighbor 172.18.249.248 activate
 neighbor 172.20.96.87 activate
exit-address-family
!
address-family ipv6
bgp nexthop trigger delay 1
network 2405:200:201:3901:172:20:96:150/128 route-map CSR-COMM
neighbor RJIL-AG1-IBGP-GRP send-community
neighbor RJIL-AG1-IBGP-GRP send-label
neighbor 172.18.249.248 activate
neighbor 172.20.96.87 activate
exit-address-family
!
address-family ipv6 multicast
neighbor RJIL-AG1-IBGP-GRP-IPv6 route-map RJIL-DROP-ALL out
neighbor 2405:200:201:3901:172:18:249:248 activate
neighbor 2405:200:201:3901:172:20:96:87 activate
exit-address-family
!
address-family vpnv6
bgp recursion host
bgp nexthop trigger delay 1
neighbor RJIL-AG1-IBGP-GRP send-community extended
neighbor 172.18.249.248 activate
neighbor 172.20.96.87 activate
exit-address-family
!
address-family ipv6 vrf RJIL-BEARER-ENB
redistribute connected
import path selection all
import path limit 4
exit-address-family
!
address-family ipv6 vrf RJIL-ENT-CPE-MGMT
redistribute connected
exit-address-family
!
address-family ipv6 vrf RJIL-GNB-OAM
redistribute connected
import path selection all
import path limit 4
exit-address-family
!
address-family ipv6 vrf RJIL-GNB-SIGNALING
redistribute connected
import path selection all
import path limit 4
exit-address-family
!
address-family ipv4 vrf RJIL-IME
import path selection all
import path limit 4
redistribute connected
exit-address-family
!
address-family ipv6 vrf RJIL-IME
redistribute connected
import path selection all
import path limit 4
exit-address-family
 !
address-family ipv4 vrf RJIL-IP-MGMT
redistribute connected
exit-address-family
!
address-family ipv6 vrf RJIL-IP-MGMT
redistribute connected
exit-address-family
!
address-family ipv6 vrf RJIL-OAM-ENB
redistribute connected
import path selection all
import path limit 4
exit-address-family
!
address-family ipv6 vrf RJIL-SIGNALING-ENB
redistribute connected
import path selection all
import path limit 4
exit-address-family
!
address-family ipv4 vrf RJIL-VRF-ENTERPRISE-ILL-SPOKE
import path selection all
import path limit 4
redistribute connected
redistribute static
exit-address-family
!
address-family ipv6 vrf RJIL-VRF-ENTERPRISE-ILL-SPOKE
redistribute connected
redistribute static
import path selection all
import path limit 4
exit-address-family
!
address-family ipv4 vrf RJIL-WIFI-CISCO
import path selection all
import path limit 4
redistribute connected
exit-address-family
!
address-family ipv6 vrf RJIL-WIFI-CISCO
redistribute connected
import path selection all
import path limit 4
exit-address-family
!
ip forward-protocol nd
ip forward-protocol udp 5246
ip forward-protocol udp 5247
no ip http server
ip http authentication local
ip http secure-server
ip http secure-active-session-modules mylist
ip http timeout-policy idle 600 life 14400 requests 25
ip http session-module-list mylist IOX_Server,DISTRIB
ip http client source-interface Loopback999
!
ip bgp-community new-format
ip ftp source-interface Loopback999
ip tftp source-interface Loopback999
crypto key generate rsa general-keys modulus 1024
ip ssh time-out 60
ip ssh port 2222 rotary 35
ip ssh source-interface Loopback999
ip ssh version 2
ip ssh dscp 18
ip route vrf RJIL-VRF-ENTERPRISE-ILL-SPOKE 115.243.25.40 255.255.255.248
115.242.207.130
!
ip access-list standard MGMT-SNMP-IPv4
10 deny any
ip access-list standard MGMT-VTY-IPv4
10 deny any
ip access-list standard MPLS-LDP-IPv4
10 permit 172.16.0.0 0.15.255.255
20 permit 172.16.32.0 0.0.31.255
30 permit 172.16.64.0 0.0.15.255
40 permit 172.22.0.0 0.1.255.255
50 permit 172.16.96.0 0.0.15.255
60 permit 172.26.128.0 0.0.63.255
70 permit 172.25.128.0 0.0.127.255
80 permit 172.30.0.0 0.0.255.255
ip access-list standard NTP-ACL
10 permit 172.26.199.238
20 permit 172.26.221.226
!
ip access-list extended INFRA-iACL-IPv4-WiFi
10 remark Phase 1 a Anti-spoofing,Fragmentation,Attack Denies
10 remark Deny Fragments
10 deny tcp any 49.44.0.0 0.0.7.255 fragments
20 deny udp any 49.44.0.0 0.0.7.255 fragments
30 deny icmp any 49.44.0.0 0.0.7.255 fragments
40 deny tcp any any eq 5900
50 remark Deny access to RJIL Infrastructure devices
50 deny ip any 49.44.0.0 0.0.7.255
60 remark Deny special-use address sources.
60 remark See RFC 3330 for additional special-use addresses.
60 deny ip host 0.0.0.0 any
70 deny ip any 0.0.0.0 0.255.255.255
80 deny ip 0.0.0.0 0.255.255.255 any
90 deny ip host 255.255.255.255 any
100 deny ip 127.0.0.0 0.255.255.255 any
110 deny ip any 127.0.0.0 0.255.255.255
120 deny ip 169.254.0.0 0.0.255.255 any
130 deny ip 192.0.2.0 0.0.0.255 any
140 deny ip any 192.0.2.0 0.0.0.255
150 deny ip 192.18.0.0 0.1.255.255 any
160 deny ip any 192.18.0.0 0.1.255.255
170 deny ip 192.0.0.0 0.0.0.255 any
180 deny ip any 192.0.0.0 0.0.0.255
190 deny ip 224.0.0.0 31.255.255.255 any
200 remark Deny RFC1918 space from entering AS
200 permit ip any 10.73.1.0 0.0.0.63
210 permit ip any 10.70.120.64 0.0.0.15
220 permit ip any host 172.16.92.209
230 permit ip any host 172.16.92.213
240 permit ip any 10.70.120.80 0.0.0.15
 250 permit ip any 10.70.120.0 0.0.0.15
260 deny ip 192.168.0.0 0.0.255.255 any
270 deny ip any 10.0.0.0 0.255.255.255
280 deny ip any 172.16.0.0 0.15.255.255
290 deny ip any 192.168.0.0 0.0.255.255
300 remark See RFC5737
300 deny ip 198.51.100.0 0.0.0.255 any
310 deny ip any 198.51.100.0 0.0.0.255
320 deny ip 203.0.113.0 0.0.0.255 any
330 deny ip any 203.0.113.0 0.0.0.255
340 remark Deny RIL infrastructure space as a source of external packets
340 deny ip 49.44.0.0 0.0.7.255 any
350 remark Phase 2 a Explicit Permit
350 permit ip any any
ip access-list extended RJIL-INTERNET_VRF_INT_SPOKE-INFRA-iACL-IPv4
10 remark Phase 1 a Anti-spoofing,Fragmentation,Attack Denies
10 remark Deny Fragments
10 deny tcp any 49.44.0.0 0.0.31.255
20 deny udp any 49.44.0.0 0.0.31.255
30 deny icmp any 49.44.0.0 0.0.31.255
40 deny tcp any any eq 5900
50 remark Deny access to RJIL Infrastructure devices
50 deny ip any 49.44.0.0 0.0.31.255
60 remark Deny special-use address sources.
60 remark See RFC 3330 for additional special-use addresses.
60 deny ip host 0.0.0.0 any
70 deny ip 0.0.0.0 0.255.255.255 any
80 deny ip 127.0.0.0 0.255.255.255 any
90 deny ip 169.254.0.0 0.0.255.255 any
100 deny ip 192.0.2.0 0.0.0.255 any
110 deny ip 192.18.0.0 0.1.255.255 any
120 deny ip 224.0.0.0 31.255.255.255 any
130 remark Deny RFC1918 space from entering AS
130 deny ip 10.0.0.0 0.255.255.255 any
140 deny ip 172.16.0.0 0.15.255.255 any
150 deny ip 192.168.0.0 0.0.255.255 any
160 deny ip any 10.0.0.0 0.255.255.255
170 deny ip any 172.16.0.0 0.15.255.255
180 deny ip any 192.168.0.0 0.0.255.255
190 remark Deny RIL infrastructure space as a source of external packets
190 deny ip 49.44.0.0 0.0.31.255 any
200 remark Phase 2 a Explicit Permit
200 permit ip any any
!
!
ip prefix-list RJIL-VRF-ENTERPRISE-ILL-SPOKE-DEFAULT_ONLY_IPv4 seq 5 permit
0.0.0.0/0
ip sla responder
ip sla responder twamp
timeout 2000
ip sla server twamp
timer inactivity 1200
logging alarm informational
logging source-interface Loopback999 vrf RJIL-IP-MGMT
logging host ipv6 2405:200:A80:FD19:5DC:98E5:692C:2012 vrf RJIL-IP-MGMT
logging host ipv6 2405:200:816:651::30 vrf RJIL-IP-MGMT
ipv6 route vrf RJIL-VRF-ENTERPRISE-ILL-SPOKE 2405:203:993:10F::/64
2405:203:893::53E
!
route-map RJIL-DROP-ALL deny 10
!
route-map CSR-COMM permit 10
set community 64600:133
!
route-map RJIL-VRF-ENTERPRISE-ILL-SPOKE-DEFAULT_ONLY_IPv4 permit 10
match ip address prefix-list RJIL-VRF-ENTERPRISE-ILL-SPOKE-DEFAULT_ONLY_IPv4
!
snmp-server community OnM4G@Ge0 RO ipv6 MGMT-SNMP-IPv6 MGMT-SNMP-IPv4
snmp-server trap-source Loopback999
snmp-server source-interface informs Loopback999
snmp-server queue-length 1000
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps tty
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps config-ctid
snmp-server enable traps isis
snmp-server enable traps ipsla
snmp-server enable traps memory bufferpeak
snmp-server enable traps fru-ctrl
snmp-server enable traps entity
snmp-server enable traps cpu threshold
snmp-server enable traps vlancreate
snmp-server enable traps vlandelete
snmp-server enable traps cef resource-failure peer-state-change peer-fib-state-
change inconsistency
snmp-server enable traps netsync
snmp-server enable traps aaa_server
snmp-server enable traps mpls rfc ldp
snmp-server enable traps mpls ldp
snmp-server enable traps alarms informational
snmp-server enable traps bulkstat collection transfer
snmp-server enable traps vrfmib vrf-up vrf-down vnet-trunk-up vnet-trunk-down
snmp-server enable traps transceiver all
snmp-server enable traps mpls vpn
snmp-server enable traps mpls rfc vpn
snmp-server host 2405:200:806:2904:10:70:224:76 vrf RJIL-IP-MGMT version 2c
OnM4G@Ge0
snmp-server host 2405:200:806:2904:10:70:224:97 vrf RJIL-IP-MGMT version 2c
OnM4G@Ge0
snmp ifmib ifalias long
snmp ifmib ifindex persist
mpls ldp router-id Loopback0
!
tacacs server TACACS1
address ipv4 10.70.57.84
key 7 152001050B0A7E71706063
tacacs server TACACS2
address ipv4 10.70.64.116
key 7 152001050B0A7E71706063
!
!
!
ipv6 access-list INFRA-iACL-IPv6-LTE
sequence 10 deny ipv6 any 2405:200::/40 fragments
sequence 20 permit ipv6 2405:200::/40 any
sequence 30 permit ipv6 any 2405:200::/40
sequence 40 deny ipv6 2002:E000::/20 any
 sequence 50 deny ipv6 2002:7F00::/24 any
sequence 60 deny ipv6 2002::/24 any
sequence 70 deny ipv6 2002:FF00::/24 any
sequence 80 deny ipv6 2002:A00::/24 any
sequence 90 deny ipv6 2002:AC10::/28 any
sequence 100 deny ipv6 2002:C0A8::/32 any
sequence 110 deny ipv6 host :: any
sequence 120 deny ipv6 host ::1 any
sequence 130 deny ipv6 ::/96 any
sequence 140 deny ipv6 ::FFFF:0.0.0.0/96 any
sequence 150 deny ipv6 ::/104 any
sequence 160 deny ipv6 3FFE::/16 any
sequence 170 remark Phase 1 a anti-spoofing and Fragmentation Denies
sequence 180 remark Deny Fragments
sequence 190 remark Permit RJIL ILL Customer
sequence 200 remark Deny access to RJIL Infrastructure devices
sequence 210 deny ipv6 any 2405:200:200::/40
sequence 220 remark Deny RIL infrastructure space as a source of external packets
sequence 230 deny ipv6 2405:200:200::/40 any
sequence 240 remark Deny special-use address sources Refer RFC6890
sequence 250 deny ipv6 ::/8 any
sequence 260 deny ipv6 FEC0::/10 any
sequence 270 deny ipv6 FC00::/7 any
sequence 280 deny ipv6 FF00::/8 any
sequence 290 deny ipv6 any 2001:10::/28
sequence 300 deny ipv6 2001:10::/28 any
sequence 310 deny ipv6 any 2001:DB8::/32
sequence 320 deny ipv6 2001:DB8::/32 any
sequence 330 permit ipv6 any 2001:2::/48
sequence 340 permit ipv6 any 2001::/32
sequence 350 deny ipv6 any 2001::/23
sequence 360 deny ipv6 2001::/23 any
sequence 370 remark deny false 6to4 packets
sequence 380 remark deny loopback address
sequence 390 deny ipv6 host 1:: any
sequence 400 remark deny ipv4-compatible addresses
sequence 410 remark ipv4 mapped adresses - obsoleted
sequence 420 remark deny other compatible addresses
sequence 430 deny ipv6 ::224.0.0.0/100 any
sequence 440 deny ipv6 ::127.0.0.0/104 any
sequence 450 deny ipv6 ::255.0.0.0/104 any
sequence 460 remark deny 6bone addresses - depreciated
sequence 470 remark Phase 2 a explicit Permit
sequence 480 permit ipv6 any any
!
ipv6 access-list MCAST-BDR-IPv6
sequence 10 permit ipv6 any FF30::/12
!
ipv6 access-list MGMT-SNMP-IPv6
sequence 10 permit ipv6 2405:200:A10:FC00::/64 any
sequence 20 permit ipv6 2405:200:A10:FC04::/64 any
sequence 30 permit ipv6 2405:200:A10:FC09::/64 any
sequence 40 permit ipv6 2405:200:A10:FCB0::/64 any
sequence 50 permit ipv6 2405:200:A10:FCB1::/64 any
sequence 60 permit ipv6 2405:200:A10:FCBA::/64 any
sequence 70 permit ipv6 2405:200:A10:FCC7::/64 any
sequence 80 permit ipv6 2405:200:A60:FDC0::/64 any
sequence 90 permit ipv6 2405:200:A10:FCC0::/64 any
sequence 100 permit ipv6 2405:200:A10:FCC4::/64 any
 sequence 110 permit ipv6 2405:200:800::/44 any
sequence 120 permit ipv6 2405:200:855:2575::/64 any
sequence 130 permit ipv6 2405:200:A80:FD19:5DC:98E5:692C:0/112 any
sequence 140 permit ipv6 2405:200:A70:F018:10:147:136:0/112 any
!
ipv6 access-list MGMT-VTY-IPv6
sequence 10 permit ipv6 2405:200:100::/40 any
sequence 20 permit ipv6 2405:200:802:679::/64 any
sequence 30 permit ipv6 2405:200:804:651::/64 any
sequence 40 permit ipv6 2405:200:806:651::/64 any
sequence 50 permit ipv6 2405:200:808:651::/64 any
sequence 60 permit ipv6 2405:200:A10:FC80::/64 any
sequence 70 permit ipv6 2405:200:A10:FCB0::/64 any
sequence 80 permit ipv6 2405:200:A10:FCB1::/64 any
sequence 90 permit ipv6 2405:200:A10:FCC0::/64 any
sequence 100 permit ipv6 2405:200:A10:FCC4::/64 any
sequence 110 permit ipv6 2405:200:A60:FDC0::/64 any
sequence 120 permit ipv6 2405:200:A60:F0F0::/60 any
sequence 130 permit ipv6 2405:200:800::/44 any
sequence 140 permit ipv6 2405:200:855:2575::/64 any
sequence 150 permit ipv6 2405:200:A10:FCC7::/64 any
sequence 160 permit ipv6 2405:200:A80:FD19:5DC:98E5:692C:0/112 any
sequence 170 permit ipv6 2405:200:A70:F018:10:147:136:0/112 any
!
ipv6 access-list RJIL-INTERNET_VRF_INT_SPOKE-INFRA-iACL-CPE-MANG-IPv6
sequence 10 remark CPE management
sequence 20 permit tcp 2405:200:1F00::/40 2405:200:81C:1014:51::/120 eq 22
sequence 30 permit tcp 2405:200:1F00::/40 2405:200:81C:1014:51::/120 range 49152
65535
sequence 40 permit udp 2405:200:1F00::/40 2405:200:81C:1014:51::/120 eq snmp
sequence 50 permit udp 2405:200:1F00::/40 2405:200:81C:1014:51::/120 range 49152
65535
sequence 60 permit udp 2405:200:1F00::/40 2405:200:81C:1014:51::/120 eq snmptrap
sequence 70 permit udp 2405:200:1F00::/40 2405:200:81C:1014:51::/120 eq ntp
sequence 80 permit tcp 2405:200:1F00::/40 2405:200:81C:1014:51::/120 eq ftp
sequence 90 permit tcp 2405:200:1F00::/40 2405:200:81C:1014:51::/120 range 21000
21100
sequence 100 permit tcp 2405:200:1F00::/40 host 2405:203:103:1992:78::4 eq tacacs
sequence 110 permit tcp 2405:200:1F00::/40 host 2405:203:107:1992:78::4 eq tacacs
sequence 120 permit udp 2405:200:1F00::/40 host 2405:203:103:1998:78::6 eq syslog
sequence 130 permit udp 2405:200:1F00::/40 any eq 5000
sequence 140 permit tcp 2405:203:300::/40 2405:200:A10:FCB0:10:147::/96 eq 22
sequence 150 permit tcp 2405:203:300::/40 2405:200:A10:FCB0:10:147::/96 eq ftp
sequence 160 permit udp 2405:203:300::/40 2405:200:A10:FCB0:10:147::/96 eq snmp
sequence 170 permit udp 2405:203:300::/40 2405:200:A10:FCB0:10:147::/96 eq
snmptrap
sequence 180 permit tcp 2405:203:300::/40 host 2405:203:103:1992:78::4 eq tacacs
sequence 190 permit tcp 2405:203:300::/40 host 2405:203:107:1992:78::4 eq tacacs
sequence 200 permit udp 2405:203:300::/40 host 2405:203:109:1998:78::6 eq syslog
sequence 210 permit udp 2405:203:300::/40 2405:200:A10:FCB0:10:147::/96 eq 5000
sequence 220 permit udp 2405:203:300::/40 2405:200:A10:FCB0:10:147::/96 eq ntp
sequence 230 permit tcp 2405:203:300::/40 2405:200:204:50::/64 eq 862
sequence 240 permit udp 2405:203:300::/40 2405:200:A10:FCB0:10:147::/96 eq tftp
sequence 250 permit icmp 2405:203:300::/40 2405:200:A10:FCB0:10:147::/96
sequence 260 permit icmp 2405:203:300::/40 host 2405:200:804:651::35
sequence 270 permit icmp 2405:203:300::/40 host 2405:200:806:651::35
sequence 280 permit icmp 2405:203:300::/40 host 2405:200:808:651::35
sequence 290 permit icmp 2405:203:300::/40 host 2405:200:802:679::6
sequence 300 permit icmp 2405:203:300::/40 host 2405:203:109:1998:78::6
 sequence 310 deny ipv6 any 2405:200:81C:1014:51::/120
sequence 320 deny ipv6 any host 2405:203:103:1992:78::4
sequence 330 deny ipv6 any host 2405:203:107:1992:78::4
sequence 340 deny ipv6 any host 2405:203:103:1998:78::6
sequence 350 remark Deny access to RJIL Infrastructure devices
sequence 360 deny ipv6 any 2405:200:200::/40
sequence 370 remark Deny special-use address sources
sequence 380 deny ipv6 ::/8 any
sequence 390 deny ipv6 FEC0::/10 any
sequence 400 deny ipv6 FC00::/7 any
sequence 410 deny ipv6 FF00::/8 any
sequence 420 deny ipv6 2001:DB8::/32 any
sequence 430 remark Deny RJIL Infrastructure device as a source of external
packets
sequence 440 deny ipv6 2405:200:200::/40 any
sequence 450 remark Permit RJIL ILL Customer
sequence 460 permit ipv6 2405:200::/40 any
sequence 470 remark Phase 1 a anti-spoofing and Fragmentation Denies
sequence 480 remark Deny Fragments
sequence 490 deny ipv6 any 2405:200::/32 fragments
sequence 500 remark Deny RIL infrastructure space as a source of external packets
sequence 510 remark Phase 2 a explicit Permit
sequence 520 permit ipv6 any any
sequence 530 permit tcp 2405:203:800::/40 2405:200:81C:1014:51::/120 eq 22
sequence 540 permit tcp 2405:203:800::/40 2405:200:81C:1014:51::/120 range 1024
65535
sequence 550 permit udp 2405:203:800::/40 2405:200:81C:1014:51::/120 eq snmp
sequence 560 permit udp 2405:203:800::/40 2405:200:81C:1014:51::/120 range 1024
65535
sequence 570 permit udp 2405:203:800::/40 2405:200:81C:1014:51::/120 eq snmptrap
sequence 580 permit udp 2405:203:800::/40 2405:200:81C:1014:51::/120 eq ntp
sequence 590 permit tcp 2405:203:800::/40 2405:200:81C:1014:51::/120 eq ftp
sequence 600 permit tcp 2405:203:800::/40 2405:200:81C:1014:51::/120 range 21000
21100
sequence 610 permit tcp 2405:203:800::/40 host 2405:203:107:1992:78::4 eq tacacs
sequence 620 permit tcp 2405:203:800::/40 host 2405:203:103:1992:78::4 eq tacacs
sequence 630 permit udp 2405:203:800::/40 host 2405:203:107:1998:78::6 eq syslog
sequence 640 permit udp 2405:203:800::/40 any eq 5000
sequence 650 deny ipv6 any host 2405:203:107:1998:78::6
sequence 660 remark Deny special-use address sources.
!
ipv6 access-list RJIL-SC-INFRA-iACL-IPv6
sequence 10 remark Phase 1 a anti-spoofing and Fragmentation Denies
sequence 20 remark Deny Fragments
sequence 30 deny ipv6 any 2405:200::/40 fragments
sequence 40 remark Permit RJIL Small Cell
sequence 50 permit ipv6 2405:200:100::/40 any
sequence 60 permit ipv6 any 2405:200:100::/40
sequence 70 remark Deny access to RJIL Infrastructure devices
sequence 80 deny ipv6 any 2405:200:200::/40
sequence 90 remark Deny RIL infrastructure space as a source of external packets
sequence 100 deny ipv6 2405:200:200::/40 any
sequence 110 remark Deny special-use address sources Refer RFC6890
sequence 120 deny ipv6 ::/8 any
sequence 130 deny ipv6 FEC0::/10 any
sequence 140 deny ipv6 FC00::/7 any
sequence 150 deny ipv6 FF00::/8 any
sequence 160 deny ipv6 any 2001:10::/28
sequence 170 deny ipv6 2001:10::/28 any
 sequence 180 deny ipv6 any 2001:DB8::/32
sequence 190 deny ipv6 2001:DB8::/32 any
sequence 200 permit ipv6 any 2001:2::/48
sequence 210 permit ipv6 any 2001::/32
sequence 220 deny ipv6 any 2001::/23
sequence 230 deny ipv6 2001::/23 any
sequence 240 remark deny false 6to4 packets
sequence 250 deny ipv6 2002:E000::/20 any
sequence 260 deny ipv6 2002:7F00::/24 any
sequence 270 deny ipv6 2002::/24 any
sequence 280 deny ipv6 2002:FF00::/24 any
sequence 290 deny ipv6 2002:A00::/24 any
sequence 300 deny ipv6 2002:AC10::/28 any
sequence 310 deny ipv6 2002:C0A8::/32 any
sequence 320 deny ipv6 host :: any
sequence 330 remark deny loopback address
sequence 340 deny ipv6 host ::1 any
sequence 350 deny ipv6 host 1:: any
sequence 360 remark deny ipv4-compatible addresses
sequence 370 deny ipv6 ::/96 any
sequence 380 remark ipv4 mapped adresses - obsoleted
sequence 390 deny ipv6 ::FFFF:0.0.0.0/96 any
sequence 400 remark deny other compatible addresses
sequence 410 deny ipv6 ::224.0.0.0/100 any
sequence 420 deny ipv6 ::127.0.0.0/104 any
sequence 430 deny ipv6 ::/104 any
sequence 440 deny ipv6 ::255.0.0.0/104 any
sequence 450 remark deny 6bone addresses - depreciated
sequence 460 deny ipv6 3FFE::/16 any
sequence 470 remark Phase 2 a explicit Permit
sequence 480 permit ipv6 any any
!
control-plane
!
privilege exec level 10 show running-config view full
privilege exec level 10 show running-config view
privilege exec level 10 show running-config
privilege exec all level 10 show
banner login #
-------------------------------------------------------------------------
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED
You must have explicit, authorized permission to access or configure this
device.
Unauthorized attempts and actions to access or use this system may result
in civil and/or criminal penalties.
All activities performed on this device are logged and monitored.
GCTv20.8
NE-ID INBRGOJUXXXXTW6003ENBESR001
SAP-ID I-BR-GOJU-ENB-A001
FAC-ID INBRGOJUXXXXTW6003
HostName GOJUGOJUESR017
-------------------------------------------------------------------------
#
banner motd #
-------------------------------------------------------------------------
UNAUTHORIZED ACCESS TO THIS DEVICE IS PROHIBITED
You must have explicit, authorized permission to access or configure this
device.
Unauthorized attempts and actions to access or use this system may result
in civil and/or criminal penalties.
All activities performed on this device are logged and monitored.
GCTv20.8
NE-ID INBRGOJUXXXXTW6003ENBESR001
SAP-ID I-BR-GOJU-ENB-A001
FAC-ID INBRGOJUXXXXTW6003
HostName GOJUGOJUESR017
-------------------------------------------------------------------------
#
alias exec show-running-config show running-config view full
!
line con 0
exec-timeout 5 0
privilege level 15
authorization commands 15 AAA-VTY-ACS
logging synchronous
login authentication AAA-CONSOLE-LOCAL
transport output none
stopbits 1
line vty 0 4
access-class MGMT-VTY-IPv4 in vrfname RJIL-IP-MGMT
exec-timeout 5 0
privilege level 15
ipv6 access-class MGMT-VTY-IPv6 in vrfname RJIL-IP-MGMT
authorization commands 15 AAA-VTY-ACS
logging synchronous
login authentication AAA-VTY-ACS
transport preferred none
transport input ssh
transport output ssh
line vty 5 9
access-class MGMT-VTY-IPv4 in
access-class MGMT-VTY-IPv4 in vrfname RJIL-IP-MGMT
exec-timeout 5 0
privilege level 15
ipv6 access-class MGMT-VTY-IPv6 in
ipv6 access-class MGMT-VTY-IPv6 in vrfname RJIL-IP-MGMT
authorization commands 15 AAA-VTY-ACS
logging synchronous
login authentication AAA-VTY-ACS
transport preferred none
transport input ssh
transport output ssh
line vty 10 20
no exec
transport input ssh
line vty 21 25
access-class MGMT-VTY-IPv4 in
access-class MGMT-VTY-IPv4 in vrfname RJIL-IP-MGMT
exec-timeout 5 0
privilege level 10
ipv6 access-class MGMT-VTY-IPv6 in
ipv6 access-class MGMT-VTY-IPv6 in vrfname RJIL-IP-MGMT
logging synchronous
login authentication AAA-LOCAL
rotary 35
transport preferred none
transport input ssh
transport output ssh
!
exception crashinfo file bootflash:crashinfo1
exception crashinfo buffersize 256
ztp disable
esmc process
call-home
! If contact email address in call-home is configured as sch-smart-
licensing@cisco.com
! the email address configured in Cisco Smart License Portal will be used as
contact email address to send SCH notifications.
contact-email-addr sch-smart-licensing@cisco.com
vrf RJIL-IP-MGMT
no http secure server-identity-check
profile "CiscoTAC-1"
active
destination transport-method http
destination address http
https://[2405:200:a80:fdf5::b]/Transportgateway/services/DeviceRequestHandler
no destination address http
https://tools.cisco.com/its/service/oddce/services/DDCEService
ntp access-group peer NTP-ACL
ntp server vrf RJIL-IP-MGMT 172.26.221.226 key 1
ntp server vrf RJIL-IP-MGMT 172.26.199.238 key 1 prefer
!
!

event manager policy Mandatory.dualrate_eem_policy.tcl type system authorization

bypass
!
line vty 0 4
no access-class MGMT-VTY-IPv4 in vrf-also
exec-timeout 5 0
privilege level 15
no ipv6 access-class MGMT-VTY-IPv6 in
!
end