Site: Cockatoo (PBR-R-CK1) Overview Item Value Site / device Cockatoo — PBR-R-CK1, EdgeRouter PoE 5-port, EdgeOS 3.0.1 (~120 MB free; IPsec HW offload on) Site number / ASN 5 / 65005 WAN eth1 Optus 4G LTE, DHCP with fixed public IP 59.154.241.12/24; inbound IKE confirmed working LAN eth4 VLANs 10.5.10.0/24 (Infra), 10.5.60.0/24 (VoIP), 10.5.80.0/24 (SecOT); legacy 192.168.132.0/24 on switch0 (UniPi, station phone — OT); 10.1.6.0/24 on eth0 (link down) Loopback / OSPF lo 10.100.6.1/32; area 6 (old-scheme number); area 0 = 10.254.0.0/16; router-id 10.100.6.1, abr-type cisco; neighbours Belgrave vti100, KL1 vti800/vti810 Firewall eth1local rules 30/31 accept IKE 500/4500 + ESP any peer; SSH/80/443 dropped (rule 96); NAT masquerade eth1; auto-firewall-nat-exclude on Oddities Stale static default via 192.168.5.1 inactive (default comes from DHCP) — delete when convenient Cato site ID / identifier 1000000007 — 1000000007.23991.catonetworks.com (both rows) Status: ACTIVE — fleet standard. Outstanding: set real LTE last-mile speeds on the Cato page; confirm the BGP distance line (prefix form) is present; delete the stale static default. Built to the EdgeRouter Site Build Standard in this book (Responder Only on Cato, ER initiates, FQDN identifier, ignore_acquire_ts drop-in, route-based VTIs, BGP export of own prefixes only, import allowlist, distance 115). This page records the site-specific values and observations. Cato site configuration Item Value Connection type Responder Only; destinations IPv4 Melbourne 113.30.140.95 / Sydney 202.75.244.10; link OPTUSLTE_WAN Identifier FQDN 1000000007.23991.catonetworks.com on both rows Parameters Init AES-CBC-256 / SHA-256 / PRF SHA-256 / DH14; Auth AES-CBC-256 / SHA-256 / DH14 Private IPs PRIMARY1 Cato 10.254.5.51 / Site 10.254.5.50; SECONDARY1 Cato 10.254.5.53 / Site 10.254.5.52 BGP Cato ASN 64515, Peer ASN 65005, peers 10.254.5.50 and 10.254.5.52, Hold 90 / Keepalive 30, Advertise All routes Last mile / PSK To set: real Optus LTE speeds (page showed 100/100); fresh PSK per tunnel EdgeOS configuration Configuration as applied (PSKs omitted). Prefix list COCKATOO-PREFIXES: 10.5.0.0/16 le 24, 192.168.132.0/24, 10.1.6.0/24, 10.100.6.1/32. # ---- One-time, outside EdgeOS config (survives reboot, NOT firmware upgrade) ---- sudo tee /etc/strongswan.d/zz-pbr-cato.conf >/dev/null <<'EOF' # PBR: suppress acquire-derived traffic selectors so trap-triggered IKEv2 # initiations propose only the configured 0.0.0.0/0 (Cato rejects multi-TS). # Not preserved by EdgeOS firmware upgrade - re-apply after upgrading. charon { ignore_acquire_ts = yes } EOF sudo ipsec restart # hub tunnels bounce ~2 s # ---- EdgeOS configuration (replace <...> values; PSKs in single quotes) ---- configure # IKE / ESP groups set vpn ipsec ike-group IKE-CATO key-exchange ikev2 set vpn ipsec ike-group IKE-CATO ikev2-reauth no set vpn ipsec ike-group IKE-CATO lifetime 19800 set vpn ipsec ike-group IKE-CATO proposal 1 dh-group 14 set vpn ipsec ike-group IKE-CATO proposal 1 encryption aes256 set vpn ipsec ike-group IKE-CATO proposal 1 hash sha256 set vpn ipsec ike-group IKE-CATO dead-peer-detection action restart set vpn ipsec ike-group IKE-CATO dead-peer-detection interval 30 set vpn ipsec ike-group IKE-CATO dead-peer-detection timeout 30 set vpn ipsec esp-group ESP-CATO lifetime 3600 set vpn ipsec esp-group ESP-CATO mode tunnel set vpn ipsec esp-group ESP-CATO pfs dh-group14 set vpn ipsec esp-group ESP-CATO proposal 1 encryption aes256 set vpn ipsec esp-group ESP-CATO proposal 1 hash sha256 # VTIs (site side even, Cato side odd; MUST be /31) set interfaces vti vti500 address 10.254.5.50/31 set interfaces vti vti500 description 'Cato Melbourne (primary)' set interfaces vti vti500 mtu 1400 set interfaces vti vti501 address 10.254.5.52/31 set interfaces vti vti501 description 'Cato Sydney (secondary)' set interfaces vti vti501 mtu 1400 set protocols ospf passive-interface vti500 set protocols ospf passive-interface vti501 set firewall options mss-clamp interface-type vti set firewall options mss-clamp mss 1350 # Peers (route-based VTI, ER initiates, FQDN identifier) set vpn ipsec site-to-site peer 113.30.140.95 authentication mode pre-shared-secret set vpn ipsec site-to-site peer 113.30.140.95 authentication pre-shared-secret '' set vpn ipsec site-to-site peer 113.30.140.95 authentication id @1000000007.23991.catonetworks.com set vpn ipsec site-to-site peer 113.30.140.95 authentication remote-id 113.30.140.95 set vpn ipsec site-to-site peer 113.30.140.95 connection-type initiate set vpn ipsec site-to-site peer 113.30.140.95 description 'Cato Melbourne PoP' set vpn ipsec site-to-site peer 113.30.140.95 ike-group IKE-CATO set vpn ipsec site-to-site peer 113.30.140.95 local-address 59.154.241.12 set vpn ipsec site-to-site peer 113.30.140.95 vti bind vti500 set vpn ipsec site-to-site peer 113.30.140.95 vti esp-group ESP-CATO set vpn ipsec site-to-site peer 202.75.244.10 authentication mode pre-shared-secret set vpn ipsec site-to-site peer 202.75.244.10 authentication pre-shared-secret '' set vpn ipsec site-to-site peer 202.75.244.10 authentication id @1000000007.23991.catonetworks.com set vpn ipsec site-to-site peer 202.75.244.10 authentication remote-id 202.75.244.10 set vpn ipsec site-to-site peer 202.75.244.10 connection-type initiate set vpn ipsec site-to-site peer 202.75.244.10 description 'Cato Sydney PoP' set vpn ipsec site-to-site peer 202.75.244.10 ike-group IKE-CATO set vpn ipsec site-to-site peer 202.75.244.10 local-address 59.154.241.12 set vpn ipsec site-to-site peer 202.75.244.10 vti bind vti501 set vpn ipsec site-to-site peer 202.75.244.10 vti esp-group ESP-CATO # Routing policy set policy prefix-list COCKATOO-PREFIXES rule 10 action permit set policy prefix-list COCKATOO-PREFIXES rule 10 prefix 10.5.0.0/16 set policy prefix-list COCKATOO-PREFIXES rule 10 le 24 set policy prefix-list COCKATOO-PREFIXES rule 20 action permit set policy prefix-list COCKATOO-PREFIXES rule 20 prefix 192.168.132.0/24 set policy prefix-list COCKATOO-PREFIXES rule 30 action permit set policy prefix-list COCKATOO-PREFIXES rule 30 prefix 10.1.6.0/24 set policy prefix-list COCKATOO-PREFIXES rule 90 action permit set policy prefix-list COCKATOO-PREFIXES rule 30 action permit set policy prefix-list COCKATOO-PREFIXES rule 30 prefix 10.1.6.0/24 set policy prefix-list COCKATOO-PREFIXES rule 90 prefix 10.100.6.1/32 set policy prefix-list CATO-ALLOWED-IN rule 10 action permit set policy prefix-list CATO-ALLOWED-IN rule 10 prefix 10.41.0.0/16 set policy prefix-list CATO-ALLOWED-IN rule 10 le 24 set policy prefix-list CATO-ALLOWED-IN rule 20 action permit set policy prefix-list CATO-ALLOWED-IN rule 20 prefix 10.254.254.0/24 set policy prefix-list CATO-ALLOWED-IN rule 20 le 32 set policy route-map CATO-CONNECTED rule 10 action permit set policy route-map CATO-CONNECTED rule 10 match ip address prefix-list COCKATOO-PREFIXES set policy route-map CATO-OUT-PRI rule 10 action permit set policy route-map CATO-OUT-PRI rule 10 match ip address prefix-list COCKATOO-PREFIXES set policy route-map CATO-OUT-SEC rule 10 action permit set policy route-map CATO-OUT-SEC rule 10 match ip address prefix-list COCKATOO-PREFIXES set policy route-map CATO-OUT-SEC rule 10 set as-path-prepend '65005 65005' set policy route-map CATO-IN-PRI rule 10 action permit set policy route-map CATO-IN-PRI rule 10 match ip address prefix-list CATO-ALLOWED-IN set policy route-map CATO-IN-PRI rule 10 set local-preference 200 set policy route-map CATO-IN-SEC rule 10 action permit set policy route-map CATO-IN-SEC rule 10 match ip address prefix-list CATO-ALLOWED-IN set policy route-map CATO-IN-SEC rule 10 set local-preference 100 # BGP set protocols bgp 65005 parameters router-id 10.100.6.1 set protocols bgp 65005 parameters distance prefix 0.0.0.0/0 distance 115 set protocols bgp 65005 redistribute connected route-map CATO-CONNECTED set protocols bgp 65005 neighbor 10.254.5.51 remote-as 64515 set protocols bgp 65005 neighbor 10.254.5.51 description 'Cato Melbourne' set protocols bgp 65005 neighbor 10.254.5.51 timers holdtime 90 set protocols bgp 65005 neighbor 10.254.5.51 timers keepalive 30 set protocols bgp 65005 neighbor 10.254.5.51 soft-reconfiguration inbound set protocols bgp 65005 neighbor 10.254.5.51 route-map import CATO-IN-PRI set protocols bgp 65005 neighbor 10.254.5.51 route-map export CATO-OUT-PRI set protocols bgp 65005 neighbor 10.254.5.53 remote-as 64515 set protocols bgp 65005 neighbor 10.254.5.53 description 'Cato Sydney' set protocols bgp 65005 neighbor 10.254.5.53 timers holdtime 90 set protocols bgp 65005 neighbor 10.254.5.53 timers keepalive 30 set protocols bgp 65005 neighbor 10.254.5.53 soft-reconfiguration inbound set protocols bgp 65005 neighbor 10.254.5.53 route-map import CATO-IN-SEC set protocols bgp 65005 neighbor 10.254.5.53 route-map export CATO-OUT-SEC commit-confirm 10 # ... verify tunnels and BGP, then: confirm save Verified state (26 Oct 2026) First established 16:03 on Bidirectional, then converted to the fleet standard (Cato Responder Only + FQDN identifier; ER drop-in, authentication id @1000000007.23991.catonetworks.com, connection-type initiate). Advertised: 10.5.10/60/80 /24s, 192.168.132.0/24, 10.100.6.1/32 (10.1.6.0/24 absent while eth0 is down). Maintenance notes Update this page whenever the WAN address, prefixes, PSKs (date only — never the secret), Cato site parameters or tunnel layout change. Re-apply the strongSwan drop-in after any firmware upgrade and re-run the unattended re-establish proof.