Site: Cockatoo (PBR-R-CK1)
Overview
| Item | Value |
|---|---|
| Site / device | Cockatoo — PBR-R-CK1, EdgeRouter PoE 5-port, EdgeOS 3.0.1 (~120 MB free; IPsec HW offload on) |
| Site number / ASN | 5 / 65005 |
| WAN | eth1 Optus 4G LTE, DHCP with fixed public IP 59.154.241.12/24; inbound IKE confirmed working |
| LAN | eth4 VLANs 10.5.10.0/24 (Infra), 10.5.60.0/24 (VoIP), 10.5.80.0/24 (SecOT); legacy 192.168.132.0/24 on switch0 (UniPi, station phone — OT); 10.1.6.0/24 on eth0 (link down) |
| Loopback / OSPF | lo 10.100.6.1/32; area 6 (old-scheme number); area 0 = 10.254.0.0/16; router-id 10.100.6.1, abr-type cisco; neighbours Belgrave vti100, KL1 vti800/vti810 |
| Firewall | eth1local rules 30/31 accept IKE 500/4500 + ESP any peer; SSH/80/443 dropped (rule 96); NAT masquerade eth1; auto-firewall-nat-exclude on |
| Oddities | Stale static default via 192.168.5.1 inactive (default comes from DHCP) — delete when convenient |
| Cato site ID / identifier | 1000000007 — 1000000007.23991.catonetworks.com (both rows) |
Status: ACTIVE — fleet standard. Outstanding: set real LTE last-mile speeds on the Cato page; confirm the BGP distance line (prefix form) is present; delete the stale static default.
Built to the EdgeRouter Site Build Standard in this book (Responder Only on Cato, ER initiates, FQDN identifier, ignore_acquire_ts drop-in, route-based VTIs, BGP export of own prefixes only, import allowlist, distance 115). This page records the site-specific values and observations.
Cato site configuration
| Item | Value |
|---|---|
| Connection type | Responder Only; destinations IPv4 Melbourne 113.30.140.95 / Sydney 202.75.244.10; link OPTUSLTE_WAN |
| Identifier | FQDN 1000000007.23991.catonetworks.com on both rows |
| Parameters | Init AES-CBC-256 / SHA-256 / PRF SHA-256 / DH14; Auth AES-CBC-256 / SHA-256 / DH14 |
| Private IPs | PRIMARY1 Cato 10.254.5.51 / Site 10.254.5.50; SECONDARY1 Cato 10.254.5.53 / Site 10.254.5.52 |
| BGP | Cato ASN 64515, Peer ASN 65005, peers 10.254.5.50 and 10.254.5.52, Hold 90 / Keepalive 30, Advertise All routes |
| Last mile / PSK | To set: real Optus LTE speeds (page showed 100/100); fresh PSK per tunnel |
EdgeOS configuration
Configuration as applied (PSKs omitted). Prefix list COCKATOO-PREFIXES: 10.5.0.0/16 le 24, 192.168.132.0/24, 10.1.6.0/24, 10.100.6.1/32.
# ---- One-time, outside EdgeOS config (survives reboot, NOT firmware upgrade) ----
sudo tee /etc/strongswan.d/zz-pbr-cato.conf >/dev/null <<'EOF'
# PBR: suppress acquire-derived traffic selectors so trap-triggered IKEv2
# initiations propose only the configured 0.0.0.0/0 (Cato rejects multi-TS).
# Not preserved by EdgeOS firmware upgrade - re-apply after upgrading.
charon {
ignore_acquire_ts = yes
}
EOF
sudo ipsec restart # hub tunnels bounce ~2 s
# ---- EdgeOS configuration (replace <...> values; PSKs in single quotes) ----
configure
# IKE / ESP groups
set vpn ipsec ike-group IKE-CATO key-exchange ikev2
set vpn ipsec ike-group IKE-CATO ikev2-reauth no
set vpn ipsec ike-group IKE-CATO lifetime 19800
set vpn ipsec ike-group IKE-CATO proposal 1 dh-group 14
set vpn ipsec ike-group IKE-CATO proposal 1 encryption aes256
set vpn ipsec ike-group IKE-CATO proposal 1 hash sha256
set vpn ipsec ike-group IKE-CATO dead-peer-detection action restart
set vpn ipsec ike-group IKE-CATO dead-peer-detection interval 30
set vpn ipsec ike-group IKE-CATO dead-peer-detection timeout 30
set vpn ipsec esp-group ESP-CATO lifetime 3600
set vpn ipsec esp-group ESP-CATO mode tunnel
set vpn ipsec esp-group ESP-CATO pfs dh-group14
set vpn ipsec esp-group ESP-CATO proposal 1 encryption aes256
set vpn ipsec esp-group ESP-CATO proposal 1 hash sha256
# VTIs (site side even, Cato side odd; MUST be /31)
set interfaces vti vti500 address 10.254.5.50/31
set interfaces vti vti500 description 'Cato Melbourne (primary)'
set interfaces vti vti500 mtu 1400
set interfaces vti vti501 address 10.254.5.52/31
set interfaces vti vti501 description 'Cato Sydney (secondary)'
set interfaces vti vti501 mtu 1400
set protocols ospf passive-interface vti500
set protocols ospf passive-interface vti501
set firewall options mss-clamp interface-type vti
set firewall options mss-clamp mss 1350
# Peers (route-based VTI, ER initiates, FQDN identifier)
set vpn ipsec site-to-site peer 113.30.140.95 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 113.30.140.95 authentication pre-shared-secret '<PSK-PRIMARY>'
set vpn ipsec site-to-site peer 113.30.140.95 authentication id @1000000007.23991.catonetworks.com
set vpn ipsec site-to-site peer 113.30.140.95 authentication remote-id 113.30.140.95
set vpn ipsec site-to-site peer 113.30.140.95 connection-type initiate
set vpn ipsec site-to-site peer 113.30.140.95 description 'Cato Melbourne PoP'
set vpn ipsec site-to-site peer 113.30.140.95 ike-group IKE-CATO
set vpn ipsec site-to-site peer 113.30.140.95 local-address 59.154.241.12
set vpn ipsec site-to-site peer 113.30.140.95 vti bind vti500
set vpn ipsec site-to-site peer 113.30.140.95 vti esp-group ESP-CATO
set vpn ipsec site-to-site peer 202.75.244.10 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 202.75.244.10 authentication pre-shared-secret '<PSK-SECONDARY>'
set vpn ipsec site-to-site peer 202.75.244.10 authentication id @1000000007.23991.catonetworks.com
set vpn ipsec site-to-site peer 202.75.244.10 authentication remote-id 202.75.244.10
set vpn ipsec site-to-site peer 202.75.244.10 connection-type initiate
set vpn ipsec site-to-site peer 202.75.244.10 description 'Cato Sydney PoP'
set vpn ipsec site-to-site peer 202.75.244.10 ike-group IKE-CATO
set vpn ipsec site-to-site peer 202.75.244.10 local-address 59.154.241.12
set vpn ipsec site-to-site peer 202.75.244.10 vti bind vti501
set vpn ipsec site-to-site peer 202.75.244.10 vti esp-group ESP-CATO
# Routing policy
set policy prefix-list COCKATOO-PREFIXES rule 10 action permit
set policy prefix-list COCKATOO-PREFIXES rule 10 prefix 10.5.0.0/16
set policy prefix-list COCKATOO-PREFIXES rule 10 le 24
set policy prefix-list COCKATOO-PREFIXES rule 20 action permit
set policy prefix-list COCKATOO-PREFIXES rule 20 prefix 192.168.132.0/24
set policy prefix-list COCKATOO-PREFIXES rule 30 action permit
set policy prefix-list COCKATOO-PREFIXES rule 30 prefix 10.1.6.0/24
set policy prefix-list COCKATOO-PREFIXES rule 90 action permit
set policy prefix-list COCKATOO-PREFIXES rule 30 action permit
set policy prefix-list COCKATOO-PREFIXES rule 30 prefix 10.1.6.0/24
set policy prefix-list COCKATOO-PREFIXES rule 90 prefix 10.100.6.1/32
set policy prefix-list CATO-ALLOWED-IN rule 10 action permit
set policy prefix-list CATO-ALLOWED-IN rule 10 prefix 10.41.0.0/16
set policy prefix-list CATO-ALLOWED-IN rule 10 le 24
set policy prefix-list CATO-ALLOWED-IN rule 20 action permit
set policy prefix-list CATO-ALLOWED-IN rule 20 prefix 10.254.254.0/24
set policy prefix-list CATO-ALLOWED-IN rule 20 le 32
set policy route-map CATO-CONNECTED rule 10 action permit
set policy route-map CATO-CONNECTED rule 10 match ip address prefix-list COCKATOO-PREFIXES
set policy route-map CATO-OUT-PRI rule 10 action permit
set policy route-map CATO-OUT-PRI rule 10 match ip address prefix-list COCKATOO-PREFIXES
set policy route-map CATO-OUT-SEC rule 10 action permit
set policy route-map CATO-OUT-SEC rule 10 match ip address prefix-list COCKATOO-PREFIXES
set policy route-map CATO-OUT-SEC rule 10 set as-path-prepend '65005 65005'
set policy route-map CATO-IN-PRI rule 10 action permit
set policy route-map CATO-IN-PRI rule 10 match ip address prefix-list CATO-ALLOWED-IN
set policy route-map CATO-IN-PRI rule 10 set local-preference 200
set policy route-map CATO-IN-SEC rule 10 action permit
set policy route-map CATO-IN-SEC rule 10 match ip address prefix-list CATO-ALLOWED-IN
set policy route-map CATO-IN-SEC rule 10 set local-preference 100
# BGP
set protocols bgp 65005 parameters router-id 10.100.6.1
set protocols bgp 65005 parameters distance prefix 0.0.0.0/0 distance 115
set protocols bgp 65005 redistribute connected route-map CATO-CONNECTED
set protocols bgp 65005 neighbor 10.254.5.51 remote-as 64515
set protocols bgp 65005 neighbor 10.254.5.51 description 'Cato Melbourne'
set protocols bgp 65005 neighbor 10.254.5.51 timers holdtime 90
set protocols bgp 65005 neighbor 10.254.5.51 timers keepalive 30
set protocols bgp 65005 neighbor 10.254.5.51 soft-reconfiguration inbound
set protocols bgp 65005 neighbor 10.254.5.51 route-map import CATO-IN-PRI
set protocols bgp 65005 neighbor 10.254.5.51 route-map export CATO-OUT-PRI
set protocols bgp 65005 neighbor 10.254.5.53 remote-as 64515
set protocols bgp 65005 neighbor 10.254.5.53 description 'Cato Sydney'
set protocols bgp 65005 neighbor 10.254.5.53 timers holdtime 90
set protocols bgp 65005 neighbor 10.254.5.53 timers keepalive 30
set protocols bgp 65005 neighbor 10.254.5.53 soft-reconfiguration inbound
set protocols bgp 65005 neighbor 10.254.5.53 route-map import CATO-IN-SEC
set protocols bgp 65005 neighbor 10.254.5.53 route-map export CATO-OUT-SEC
commit-confirm 10
# ... verify tunnels and BGP, then:
confirm
saveVerified state (26 Oct 2026)
- First established 16:03 on Bidirectional, then converted to the fleet standard (Cato Responder Only + FQDN identifier; ER drop-in,
authentication id @1000000007.23991.catonetworks.com,connection-type initiate). - Advertised: 10.5.10/60/80 /24s, 192.168.132.0/24, 10.100.6.1/32 (10.1.6.0/24 absent while eth0 is down).
Maintenance notes
Update this page whenever the WAN address, prefixes, PSKs (date only — never the secret), Cato site parameters or tunnel layout change. Re-apply the strongSwan drop-in after any firmware upgrade and re-run the unattended re-establish proof.