Site: Emerald (PBR-R-E1) — deferred, via hubs
Overview
| Item | Value |
|---|
| Site / device | Emerald — PBR-R-E1, EdgeRouter Pro 8, EdgeOS 3.0.1 (2 GB RAM) |
| Site number / ASN | 3 / 65003 (reserved) |
| Decision | 26 Oct 2026 — no Cato tunnel for now. Emerald is reached through the KL1 and KT1 hub tunnels instead. |
| Links | Fibre to KL1 eth7 10.250.38.1/24 (default [1/0] via 10.250.38.2, OSPF nbr 10.100.8.1); PTP to Kings eth2 10.250.39.1/24 (default [3/0] via 10.250.39.2, OSPF nbr 10.100.11.1); fibre to Lakeside eth6 10.51.0.25/30 (OSPF nbr 10.100.5.1); NBN VDSL eth1 203.174.186.18/30 was DOWN at audit (hub tunnels CONNECTING) |
| Prefixes | 10.3.0.0/16 /24s, legacy 10.1.3.0/24, loopback 10.100.3.1/32 |
Reaching Emerald via the hubs (to do on the PA-440s)
- KL1 and KT1 currently export only their own connected prefixes to Cato (Redist_OSPF-BGP, filter type connect). Add Emerald's OSPF-learned prefixes (10.3.0.0/16 /24s, 10.1.3.0/24, 10.100.3.1/32) to the Cato export on both: KL1 as primary, KT1 as backup (lower local-pref / AS-path prepend), so Cato has two paths that follow the fibre and PTP.
- Return path: Emerald has no route to 10.41.0.0/16. Preferred: KL1 and KT1 redistribute 10.41.0.0/16 (and 10.254.254.0/24) from BGP into OSPF as externals — this also covers any other non-Cato site. Alternative: static on E1 for 10.41.0.0/16 via 10.250.38.2 with a floating backup via 10.250.39.2.
- Verify from an Emerald host to a ZTNA client address and from Cato to 10.3.x, then record the KL1/KT1 policy names here.
Retained design if an Emerald tunnel is ever wanted
| Item | Value |
|---|
| PRIMARY1 FIBRE_KL1 | → Melbourne 113.30.140.95 from 10.250.38.1 (NAT-T via KL1); vti300 10.254.3.30/31 (Cato .31); static 113.30.140.95/32 via 10.250.38.2 |
| SECONDARY PTP_KINGS | → Sydney 202.75.244.10 from 10.250.39.1 (NAT-T via KT1); vti301 10.254.3.32/31 (Cato .33); static 202.75.244.10/32 via 10.250.39.2 |
| Prefix list | EMERALD-PREFIXES: 10.3.0.0/16 le 24, 10.1.3.0/24, 10.100.3.1/32 |
| BGP | router-id 10.100.3.1, Peer ASN 65003, peers 10.254.3.30 / .32; standard policies |
| MSS clamp | Existing pppoe/1412 clamp → change interface-type to vti, mss 1350 (or add a second clamp) — check before build |
| Identifier | <catoSiteId>.23991.catonetworks.com / .23991.2. — read from the Cato page when the site is created |
Maintenance notes
Revisit if the Emerald NBN service is restored and a direct tunnel becomes worthwhile, or if the hub export/redistribution design changes. Update the Overview page status table when the hub-side work is done.