Site: Emerald (PBR-R-E1) — deferred, via hubs

Overview

Item	Value
Site / device	Emerald — PBR-R-E1, EdgeRouter Pro 8, EdgeOS 3.0.1 (2 GB RAM)
Site number / ASN	3 / 65003 (reserved)
Decision	26 Oct 2026 — no Cato tunnel for now. Emerald is reached through the KL1 and KT1 hub tunnels instead.
Links	Fibre to KL1 eth7 10.250.38.1/24 (default [1/0] via 10.250.38.2, OSPF nbr 10.100.8.1); PTP to Kings eth2 10.250.39.1/24 (default [3/0] via 10.250.39.2, OSPF nbr 10.100.11.1); fibre to Lakeside eth6 10.51.0.25/30 (OSPF nbr 10.100.5.1); NBN VDSL eth1 203.174.186.18/30 was DOWN at audit (hub tunnels CONNECTING)
Prefixes	10.3.0.0/16 /24s, legacy 10.1.3.0/24, loopback 10.100.3.1/32

Reaching Emerald via the hubs (to do on the PA-440s)

KL1 and KT1 currently export only their own connected prefixes to Cato (Redist_OSPF-BGP, filter type connect). Add Emerald's OSPF-learned prefixes (10.3.0.0/16 /24s, 10.1.3.0/24, 10.100.3.1/32) to the Cato export on both: KL1 as primary, KT1 as backup (lower local-pref / AS-path prepend), so Cato has two paths that follow the fibre and PTP.
Return path: Emerald has no route to 10.41.0.0/16. Preferred: KL1 and KT1 redistribute 10.41.0.0/16 (and 10.254.254.0/24) from BGP into OSPF as externals — this also covers any other non-Cato site. Alternative: static on E1 for 10.41.0.0/16 via 10.250.38.2 with a floating backup via 10.250.39.2.
Verify from an Emerald host to a ZTNA client address and from Cato to 10.3.x, then record the KL1/KT1 policy names here.

Retained design if an Emerald tunnel is ever wanted

Item	Value
PRIMARY1 FIBRE_KL1	→ Melbourne 113.30.140.95 from 10.250.38.1 (NAT-T via KL1); vti300 10.254.3.30/31 (Cato .31); static 113.30.140.95/32 via 10.250.38.2
SECONDARY PTP_KINGS	→ Sydney 202.75.244.10 from 10.250.39.1 (NAT-T via KT1); vti301 10.254.3.32/31 (Cato .33); static 202.75.244.10/32 via 10.250.39.2
Prefix list	EMERALD-PREFIXES: 10.3.0.0/16 le 24, 10.1.3.0/24, 10.100.3.1/32
BGP	router-id 10.100.3.1, Peer ASN 65003, peers 10.254.3.30 / .32; standard policies
MSS clamp	Existing pppoe/1412 clamp → change interface-type to vti, mss 1350 (or add a second clamp) — check before build
Identifier	<catoSiteId>.23991.catonetworks.com / .23991.2. — read from the Cato page when the site is created

Maintenance notes

Revisit if the Emerald NBN service is restored and a direct tunnel becomes worthwhile, or if the hub export/redistribution design changes. Update the Overview page status table when the hub-side work is done.