!
!Version ArubaOS-CX GL.10.10.1030
!export-password: default
hostname RSVDC-CORE1-2
user admin group administrators password ciphertext AQBapYZDKbbvMEO+NXNjP/H/Ia4V+B+Q29PqrgMgG1So5U0oYgAAAF4vHfgkrgmR34sZBCfSba3Pn1Lahspp2+4Kcy7+i/tlYZPTIKhupQ01o5XymV6FC8EM/g+PTAJ5Y43qYf95Q1aa1kZAJvNBghQ6+NnEORPgbu5l1gsgH0VYtwiVRgehymzw
clock timezone america/los_angeles
profile leaf
ntp server 10.2.120.98
ntp server 10.2.120.99
ntp server pool.ntp.org minpoll 4 maxpoll 4 iburst
ntp enable
ntp vrf mgmt
!
!
!
!
tacacs-server host 10.2.120.94 key ciphertext AQBapQ+JLuEFz7ytx/sYQnRFZ/6a79uUYfGG6dHxJXID7OphCQAAAJcCb5amta3MUw== vrf mgmt
tacacs-server host 10.2.120.95 key ciphertext AQBapS1VCE5PlB6Q3lKJ0WkSdXY+UbryVvkJ2sQ3ekk8PjV5CQAAABJ7PLk3PPBikQ== vrf mgmt
!
!
ssh server vrf mgmt
access-list ip RSVDC_Border_ACL
    10 comment Allow_All_HTTPS_to_Prod_Web
    10 permit tcp 0.0.0.0/0.0.0.0 10.1.101.0/255.255.255.0 eq https
    20 comment Allow_Supporting_Services
    20 permit any 10.2.120.0/255.255.255.0 10.1.0.0/255.255.0.0
    30 comment Allow_Admins_to_DC_Hosts
    30 permit any 10.254.1.0/255.255.255.0 10.1.0.0/255.255.0.0
    40 comment Allow_Admins_to_DC_loopbacks
    40 permit any 10.254.1.0/255.255.255.0 10.18.0.0/255.255.255.0
    50 comment Allow_ICMP_to_Prod_Web
    50 permit icmp 0.0.0.0/0.0.0.0 10.1.101.0/255.255.255.0
    60 comment Allow_Traceroute_to_Prod_Web
    60 permit udp 0.0.0.0/0.0.0.0 10.1.101.0/255.255.255.0 range 33434 33535
    70 comment Allow_BGP_peering
    70 permit tcp 10.0.0.0/255.255.255.0 10.0.0.0/255.255.255.0 eq bgp
vlan 1
vlan 101
    name PROD-WEB
vlan 102
    name PROD-DB
vlan 4000
    name CORE-ROUTED-TRANSIT
vlan 4001
    name CORE1-1-TO-EXT-FW
vlan 4002
    name CORE1-2-TO-EXT-FW
spanning-tree
spanning-tree priority 0
spanning-tree config-name RSVDC
interface mgmt
    no shutdown
    ip dhcp
interface lag 1 multi-chassis
    description RACK-1
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed all
    lacp mode active
    spanning-tree root-guard
interface lag 2 multi-chassis
    description RACK-2
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed all
    lacp mode active
    spanning-tree root-guard
interface lag 256
    description VSX_ISL_LAG
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed all
    lacp mode active
interface 1/1/1
    description RSVDC-ACCESS1-1
    no shutdown
    mtu 9198
    lag 1
interface 1/1/2
    description RSVDC-ACCESS1-2
    no shutdown
    mtu 9198
    lag 1
interface 1/1/3
    description RSVDC-ACCESS2-1
    no shutdown
    mtu 9198
    lag 2
interface 1/1/4
    description RSVDC-ACCESS2-2
    no shutdown
    mtu 9198
    lag 2
interface 1/1/5
    description EXT-FW-1
    no shutdown
    mtu 9198
    no routing
    vlan access 4002
interface 1/1/6
    description EXT-FW-2
    no shutdown
    mtu 9198
    no routing
    vlan access 4002
interface 1/1/7
    no shutdown
    no routing
    vlan access 1
interface 1/1/8
    no shutdown
    no routing
    vlan access 1
interface 1/1/9
    no shutdown
    no routing
    vlan access 1
interface 1/1/10
    no shutdown
    no routing
    vlan access 1
interface 1/1/11
    no shutdown
    no routing
    vlan access 1
interface 1/1/12
    no shutdown
    no routing
    vlan access 1
interface 1/1/13
    no shutdown
    no routing
    vlan access 1
interface 1/1/14
    no shutdown
    no routing
    vlan access 1
interface 1/1/15
    no shutdown
    no routing
    vlan access 1
interface 1/1/16
    no shutdown
    no routing
    vlan access 1
interface 1/1/17
    no shutdown
    no routing
    vlan access 1
interface 1/1/18
    no shutdown
    no routing
    vlan access 1
interface 1/1/19
    no shutdown
    no routing
    vlan access 1
interface 1/1/20
    no shutdown
    no routing
    vlan access 1
interface 1/1/21
    no shutdown
    no routing
    vlan access 1
interface 1/1/22
    no shutdown
    no routing
    vlan access 1
interface 1/1/23
    no shutdown
    no routing
    vlan access 1
interface 1/1/24
    no shutdown
    no routing
    vlan access 1
interface 1/1/25
    no shutdown
    no routing
    vlan access 1
interface 1/1/26
    no shutdown
    no routing
    vlan access 1
interface 1/1/27
    no shutdown
    no routing
    vlan access 1
interface 1/1/28
    no shutdown
    no routing
    vlan access 1
interface 1/1/29
    no shutdown
    no routing
    vlan access 1
interface 1/1/30
    no routing
    vlan access 1
interface 1/1/31
    no shutdown
    mtu 9198
    lag 256
interface 1/1/32
    no shutdown
    mtu 9198
    lag 256
interface loopback 0
    ip address 10.18.0.2/32
    ip ospf 1 area 0.0.0.0
interface vlan 101
    description PROD-WEB-SVI
    ip mtu 9198
    ip address 10.1.101.3/24
    active-gateway ip mac 02:00:0a:01:65:01
    active-gateway ip 10.1.101.1
interface vlan 102
    description PROD-DB-SVI
    ip mtu 9198
    ip address 10.1.102.3/24
    active-gateway ip mac 02:00:0a:01:66:01
    active-gateway ip 10.1.102.1
interface vlan 4000
    description CORE-ROUTED-TRANSIT-SVI
    ip mtu 9198
    ip address 10.18.0.255/31
    ip ospf 1 area 0.0.0.0
    no ip ospf passive
    ip ospf network point-to-point
interface vlan 4002
    description CORE1-2-FW-SVI
    ip mtu 9198
    ip address 10.0.0.23/31
    apply access-list ip RSVDC_Border_ACL routed-in
snmp-server system-location DC01, Roseville, CA
snmp-server system-contact netadmin@orangetme.local
vsx
    system-mac 02:00:00:00:10:00
    inter-switch-link lag 256
    role secondary
    keepalive peer 172.16.104.21 source 172.16.104.22 vrf mgmt
ip dns server-address 10.2.120.98 vrf mgmt
ip dns server-address 10.2.120.99 vrf mgmt
ip prefix-list PL_DC-Prefixes-In seq 10 permit 0.0.0.0/0
ip prefix-list PL_DC-Prefixes-Out seq 10 permit 10.1.0.0/16 le 24
!
!
!
!
route-map RM_DC-Prefixes-In permit seq 10
     match ip address prefix-list PL_DC-Prefixes-In
route-map RM_DC-Prefixes-In deny seq 20
route-map RM_DC-Prefixes-Out permit seq 10
     match ip address prefix-list PL_DC-Prefixes-Out
route-map RM_DC-Prefixes-Out deny seq 20
!
router ospf 1
    router-id 10.18.0.2
    passive-interface default
    area 0.0.0.0
router bgp 65001
    bgp router-id 10.18.0.2
    neighbor 10.0.0.22 remote-as 65520
    neighbor 10.18.0.1 remote-as 65001
    neighbor 10.18.0.1 update-source loopback 0
    address-family ipv4 unicast
        neighbor 10.0.0.22 activate
        neighbor 10.0.0.22 route-map RM_DC-Prefixes-In in
        neighbor 10.0.0.22 route-map RM_DC-Prefixes-Out out
        neighbor 10.18.0.1 activate
        neighbor 10.18.0.1 next-hop-self
        redistribute connected
    exit-address-family
!
https-server vrf mgmt
configuration-lockout central managed