# Site: Emerald (PBR-R-E1) — deferred, via hubs

## Overview

<table id="bkmrk-itemvaluesite-%2F-devi"><thead><tr><th>Item</th><th>Value</th></tr></thead><tbody><tr><td>Site / device</td><td>Emerald — PBR-R-E1, EdgeRouter Pro 8, EdgeOS 3.0.1 (2 GB RAM)</td></tr><tr><td>Site number / ASN</td><td>3 / 65003 (reserved)</td></tr><tr><td>Decision</td><td>26 Oct 2026 — **no Cato tunnel for now**. Emerald is reached through the KL1 and KT1 hub tunnels instead.</td></tr><tr><td>Links</td><td>Fibre to KL1 eth7 10.250.38.1/24 (default \[1/0\] via 10.250.38.2, OSPF nbr 10.100.8.1); PTP to Kings eth2 10.250.39.1/24 (default \[3/0\] via 10.250.39.2, OSPF nbr 10.100.11.1); fibre to Lakeside eth6 10.51.0.25/30 (OSPF nbr 10.100.5.1); NBN VDSL eth1 203.174.186.18/30 was DOWN at audit (hub tunnels CONNECTING)</td></tr><tr><td>Prefixes</td><td>10.3.0.0/16 /24s, legacy 10.1.3.0/24, loopback 10.100.3.1/32</td></tr></tbody></table>

---

## Reaching Emerald via the hubs (to do on the PA-440s)

1. KL1 and KT1 currently export only their own connected prefixes to Cato (Redist\_OSPF-BGP, filter type connect). Add Emerald's OSPF-learned prefixes (10.3.0.0/16 /24s, 10.1.3.0/24, 10.100.3.1/32) to the Cato export on both: KL1 as primary, KT1 as backup (lower local-pref / AS-path prepend), so Cato has two paths that follow the fibre and PTP.
2. Return path: Emerald has no route to 10.41.0.0/16. Preferred: KL1 and KT1 redistribute 10.41.0.0/16 (and 10.254.254.0/24) from BGP into OSPF as externals — this also covers any other non-Cato site. Alternative: static on E1 for 10.41.0.0/16 via 10.250.38.2 with a floating backup via 10.250.39.2.
3. Verify from an Emerald host to a ZTNA client address and from Cato to 10.3.x, then record the KL1/KT1 policy names here.

---

## Retained design if an Emerald tunnel is ever wanted

<table id="bkmrk-itemvalueprimary1-fi"><thead><tr><th>Item</th><th>Value</th></tr></thead><tbody><tr><td>PRIMARY1 FIBRE\_KL1</td><td>→ Melbourne 113.30.140.95 from 10.250.38.1 (NAT-T via KL1); vti300 10.254.3.30/31 (Cato .31); static 113.30.140.95/32 via 10.250.38.2</td></tr><tr><td>SECONDARY PTP\_KINGS</td><td>→ Sydney 202.75.244.10 from 10.250.39.1 (NAT-T via KT1); vti301 10.254.3.32/31 (Cato .33); static 202.75.244.10/32 via 10.250.39.2</td></tr><tr><td>Prefix list</td><td>EMERALD-PREFIXES: 10.3.0.0/16 le 24, 10.1.3.0/24, 10.100.3.1/32</td></tr><tr><td>BGP</td><td>router-id 10.100.3.1, Peer ASN 65003, peers 10.254.3.30 / .32; standard policies</td></tr><tr><td>MSS clamp</td><td>Existing pppoe/1412 clamp → change interface-type to vti, mss 1350 (or add a second clamp) — check before build</td></tr><tr><td>Identifier</td><td>&lt;catoSiteId&gt;.23991.catonetworks.com / .23991.2. — read from the Cato page when the site is created</td></tr></tbody></table>

## Maintenance notes

Revisit if the Emerald NBN service is restored and a direct tunnel becomes worthwhile, or if the hub export/redistribution design changes. Update the Overview page status table when the hub-side work is done.