CBR GPS Lab Network Configuration

Source of truth for lab edge routing and segmentation — Canberra (CBR) GPS Lab (gpslab.cbr.redhat.com).

RouterOS 7 configs are intended to be imported on the target devices.

Resource	Path
Router config	devices/router-165e/config.rsc
Diagrams (source)	docs/diagrams/lab.drawio
Overview PNG	docs/diagrams/lab-overview.png
Connections PNG	docs/diagrams/lab-connections.png

Core device

Device	Role	Identity	OS
router-165e	L3 gateway, DHCP, DNS, NTP, webproxy, VLAN edge	router-165e.gpslab.cbr.redhat.com	RouterOS 7.23.2

---

Network architecture

Edge path

Internet
   │
Corporate Switch  (Red Hat corp / lab uplink)
   │  ether1-wan  ·  10.76.23.0/24  ·  untagged → VLAN 23
   ▼
MikroTik router  (bridge-core, VLAN filtering)
   │  bond1-trunk (LACP) · all lab VLANs + corp VLAN 23
   ▼
Fabric switches  →  blades / hypervisors / shared infra

• Corp path: ether1-wan is a bridge access port PVID 23 (untagged from corp switch). L3 is on vlan23-redhat (10.76.23.1/24). VLAN 23 is tagged on bond1-trunk for hypervisors.
• Default route: 0.0.0.0/0 via 10.76.23.254 (via vlan23 connected route).
• Security: guests on VLAN 23 share corp L2 and bypass the zone filter for pure L2 traffic.

VLANs (router authoritative)

VLAN	Zone	Interface	Prefix	Direct internet	Egress method
10	SHARED	vlan10-shared	172.16.10.0/24	Yes	Routed + SNAT
11	CEPH-PUBLIC	vlan11-ceph-public	172.16.11.0/24	No	HTTP webproxy :8080
12	CEPH-PRIVATE	vlan12-ceph-private	172.16.12.0/24	No	HTTP webproxy :8080
13	LAB	vlan13-lab	172.16.13.0/24	No	HTTP webproxy :8080
23	WAN (corp)	vlan23-redhat	10.76.23.0/24	.100–.200 (+ .220–.230 HTTPClient)	Untagged on ether1; tagged on fabric trunk

Diagram prefixes (10.0.x, 192.168.x) may differ; map by role. Internal Alpha/Gamma (OCP-Virt) are not on this router.

---

Internet policy (SHARED only)

From zone	To WAN (internet/corp IP)	Notes
SHARED	Allow	Only zone with direct internet; masquerade SHARED-NET → WAN
LAB	Reject	Disconnected; configure clients to use webproxy
CEPH-PUBLIC	Reject	Same
CEPH-PRIVATE	Reject	Same
WAN → SHARED	Allow	Corp can reach shared services
WAN → LAB/CEPH	Reject	Lab/storage not exposed from WAN

Web proxy (disconnected zones)

Router runs explicit HTTP proxy on TCP 8080 (/ip proxy).

• Allowed from all LAN zones to LOCAL (with DNS/NTP/ICMP).
• Point clients at any zone gateway, e.g.:
  • Lab: http://172.16.13.1:8080
  • Ceph public: http://172.16.11.1:8080
  • Or shared SVI: http://172.16.10.1:8080
• HTTPS typically needs CONNECT via the same proxy (browser/system proxy settings).
• This is not transparent redirect; apps must be configured (or use a PAC/WPAD later).

Proxy outbound uses the router’s own WAN path (LOCAL → WAN allowed). Non-HTTP protocols from disconnected zones have no general internet path.

---

Physical / LACP & pending SFP hardware

              │   MikroTik Router
              │   bond1-trunk (802.3ad LACP)
              │     INTERIM: ether3 + ether4
              │     TARGET:  sfp1 + sfp2  (waiting on SFP modules)
              └────────────┬────────────┘
                           │
                    Fabric (switches)

Item	Status
SFP modules	Not installed yet — waiting on hardware
Interim bond slaves	ether3-trunk + ether4-trunk
Target (diagrams)	SFP ports as bond members once modules arrive
Bond settings	mode=802.3ad, lacp-rate=1sec, transmit-hash-policy=layer-2-and-3, mtu=9000 (L2MTU from slaves)
Peer requirement	One LACP domain (same switch, stack, or MLAG). Dual independent switches without MLAG will not work with 802.3ad

When SFPs arrive: rename/configure SFP ports, set slaves= on bond1-trunk to the SFP interfaces, free ether3/4, match LAG on the fabric switches.

---

Address lists

List	Members	Use
SHARED-NET	172.16.10.0/24	SNAT to WAN; shared policy
CEPH-PUBLIC-NET	172.16.11.0/24	Future rules
CEPH-PRIVATE-NET	172.16.12.0/24	Future rules
LAB-NET	172.16.13.0/24	Future rules
WAN-NET	10.76.23.0/24	Corp prefix
LAN-NET	all 172.16.10–13.0/24	Aggregate
DISCONNECTED-NET	172.16.11–13.0/24	Zones without direct internet

---

Zone firewall (summary)

Structure (RouterOS sequential filter):

1. Connection tracking (accept established/related, fasttrack, drop invalid)
2. Policy chains zone-<FROM>-to-<TO>-v4 / *-to-LOCAL / LOCAL-to-*
3. Jump table on input / output / forward by interface-list
4. Default reject on input/forward (log=no); accept residual output

Zone → LOCAL	Policy
SHARED	DNS, NTP, DHCP, proxy, ICMP, SSH, WinBox, WebFig + accept remainder
LAB / CEPH-*	DNS, NTP, DHCP, proxy :8080, ICMP only; then reject
WAN (corp, trusted)	DHCP 67, WinBox 8291, WebFig 80/443, ICMP; else reject

Managed objects use comment prefix cbr- for cleanup.

---

Config organization

Section	Contents
SYSTEM	Identity, clock, DNS, NTP, /ip service (telnet/ftp/api off)
L2	Ethernet (SFP interim), bond, bridge, lists, ports, VLANs
L3	SVIs, zone membership
ADDRESSING & ROUTING	IPs, default route
SERVICES & DHCP	Webproxy, pools (incl. HTTPClient), servers, matcher
FIREWALL PREP	Address lists
FIREWALL	Zone filter (log=no defaults)
NAT	SHARED-only masquerade

---

Deployment

Prefer serial/OOB access. Objects are not fully idempotent — clean cbr- tags before re-import if needed:

/ip/firewall/filter/remove [find comment~"cbr-"]
/ip/firewall/nat/remove [find comment~"cbr-"]
/ip/firewall/address-list/remove [find comment~"cbr-"]
/import file-name=config.rsc

---

Known gaps

• Diagram address plan vs 172.16.x still needs reconciliation
• Internal Alpha/Gamma VLANs not on router
• /ip service has no address= CIDR lock yet (zone filter is primary)
• SFP modules pending — bond is interim copper
• Fabric switch LAG/MLAG config not in this repo
• No WPAD/PAC auto-proxy yet (clients must be configured manually)
• IPv6 firewall not configured
• HTTPClient DHCP matcher may need exact option-60 string from clients