Add temperature metrics

.sops.yaml

@@ -1,9 +1,18 @@
 keys:
   - &admin_clerie DD2D88B9FCB74C81E6F63AAD5B5D448C88684BC3
   - &admin_n0emis 6E10217E3187069E057DF5ABE0262A773B824745
+  - &host_router age1ghrvqrw92y355qw2m48jxvlu34pxf9c68nkus9lspfm05nes63gqmh5av5
   - &host_nerd age1x69924s94z4k7s50utyuqrwshpt8p8yzwaxny2gle7yeyg4w3spqml95mu
-  - &host_pre_yate_n0emis age1lrujyz4d48yjelmh6eufxjffuvfm9pusen3uxskyhnyf27xyucdqq3jza5
+  - &host_yate age10pxa70g3ekxdrk788l52s93a6ftavdw3r8x6d23gmsluudmwq3asmu6ah9
+  - &host_yate_dialup age14zsha5c5238v6hzchdfkjgjjwzc2qc79tl0ngmqrdquck5f945zs35vps4
 creation_rules:
+  - path_regex: hosts/router/.*
+    key_groups:
+    - pgp:
+      - *admin_clerie
+      - *admin_n0emis
+      age:
+      - *host_router
   - path_regex: hosts/nerd/.*
     key_groups:
     - pgp:
@@ -11,10 +20,17 @@ creation_rules:
       - *admin_n0emis
       age:
       - *host_nerd
-  - path_regex: hosts/pre-yate-n0emis/.*
+  - path_regex: hosts/yate/.*
     key_groups:
     - pgp:
       - *admin_clerie
       - *admin_n0emis
       age:
-      - *host_pre_yate_n0emis
+      - *host_yate
+  - path_regex: hosts/yate-dialup/.*
+    key_groups:
+    - pgp:
+      - *admin_clerie
+      - *admin_n0emis
+      age:
+      - *host_yate_dialup

common/default.nix

@@ -90,4 +90,6 @@
   };
 
   security.sudo.wheelNeedsPassword = false;
+
+  sops.defaultSopsFile = (../. + "/hosts/${config.networking.hostName}/secrets.yaml");
 }

flake.nix

@@ -61,8 +61,8 @@
         };
       };
 
-      pre-yate-n0emis = { config, pkgs, ... }: {
+      radius = { config, pkgs, ... }: {
-        deployment.targetHost = "2001:470:7694::5e5";
+        deployment.targetHost = "radius.bula22.de";
       };
 
       router = { config, pkgs, ... }: {

hosts/dns/configuration.nix

@@ -26,6 +26,7 @@
         }];
       };
   };
+  networking.defaultGateway = { address = "10.42.10.1"; interface = "ens18"; };
   networking.defaultGateway6 = {
     address = "2a01:4f8:1c0c:8221::1";
     interface = "ens18";

hosts/dns/coredns-unbound.patch

@@ -1,13 +0,0 @@
-Index: plugin.cfg
-IDEA additional info:
-Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
-<+>UTF-8
-===================================================================
-diff --git a/plugin.cfg b/plugin.cfg
---- a/plugin.cfg	(revision ddee42c974d89d9beb4ebf7b82019624fbf0c456)
-+++ b/plugin.cfg	(revision 04ba8accb25837d30a16445a1365489fe9509333)
-@@ -69,3 +69,4 @@
- whoami:whoami
- on:github.com/coredns/caddy/onevent
- sign:sign
-+unbound:github.com/coredns/unbound

hosts/dns/dns.nix

@@ -2,31 +2,40 @@
 
 {
   networking.firewall.interfaces.ens18.allowedUDPPorts = [ 53 ];
-  networking.firewall.interfaces.ens18.allowedTCPPorts = [ 9253 9353];
+  networking.firewall.interfaces.ens18.allowedTCPPorts = [ 9253 9353 9453 9553 ];
   services.coredns = {
     enable = true;
     config = ''
       .:53 {
         errors
-        log
+        cache {
-        cache
+          success 1000000
-        prometheus 10.42.10.8:9253
+          denial 50000
-        forward . tls://2620:fe::fe tls://9.9.9.9 tls://2620:fe::9 tls://149.112.112.112 {
+          prefetch 6 10m 10%
-          tls_servername dns.quad9.net
+          serve_stale
-          health_check 5s
         }
+        prometheus 10.42.10.8:9253
+        forward . 2620:fe::fe 9.9.9.9 2620:fe::9 149.112.112.112
       }
       
       bula22.de {
         errors
-        log
         prometheus 10.42.10.8:9353
         file /etc/zones/db.bula22.de 
-        #file /etc/zones/db.42.10.in-addr.arpa. 
-        #file /etc/zones/db.2.4.0.0.0.1.0.0.0.0.d.f.ip6.arpa.
-        #file /etc/zones/db.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa. 
       }
-      
+
+      oncamp.lama.vcp.de {
+        errors
+        prometheus 10.42.10.8:9453
+        file /etc/zones/db.oncamp.lama.vcp.de 
+      }
+
+      oncamp.m2yk8s.de {
+        errors
+        prometheus 10.42.10.8:9553
+        file /etc/zones/db.oncamp.m2yk8s.de 
+      }
+
       42.10.in-addr.arpa {
         file /etc/zones/db.42.10.in-addr.arpa.
       }
@@ -38,12 +47,23 @@
       }
     '';
   };
+  systemd.services.coredns.restartTriggers = [
+    config.environment.etc."zones/db.bula22.de".source
+    config.environment.etc."zones/db.oncamp.lama.vcp.de".source
+    config.environment.etc."zones/db.oncamp.m2yk8s.de".source
+    config.environment.etc."zones/db.42.10.in-addr.arpa.".source
+    config.environment.etc."zones/db.2.4.0.0.0.1.0.0.0.0.d.f.ip6.arpa.".source
+    config.environment.etc."zones/db.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.".source
+  ];
   environment = {
-        etc = {
+    etc = {
-        "zones/db.bula22.de".source = ./zones/db.bula22.de;
+      "zones/db.bula22.de".source = ./zones/db.bula22.de;
-        "zones/db.42.10.in-addr.arpa.".source = ./zones/db.42.10.in-addr.arpa.;
+      "zones/db.oncamp.lama.vcp.de".source = ./zones/db.oncamp.lama.vcp.de;
-        "zones/db.2.4.0.0.0.1.0.0.0.0.d.f.ip6.arpa.".source = ./zones/db.2.4.0.0.0.1.0.0.0.0.d.f.ip6.arpa.;
+      "zones/db.oncamp.m2yk8s.de".source = ./zones/db.oncamp.m2yk8s.de;
-        "zones/db.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.".source = ./zones/db.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.;
+      "zones/db.42.10.in-addr.arpa.".source = ./zones/db.42.10.in-addr.arpa.;
-        };
+      "zones/db.2.4.0.0.0.1.0.0.0.0.d.f.ip6.arpa.".source = ./zones/db.2.4.0.0.0.1.0.0.0.0.d.f.ip6.arpa.;
+      "zones/db.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.".source = ./zones/db.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.;
     };
-}
+  };
+}
+# 

hosts/dns/zones/db.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.

@@ -18,10 +18,11 @@ $TTL 3600
 7.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rmonitoring.bula22.de.
 8.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rdns.bula22.de.
 9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     ryate-dialup.bula22.de.
-0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rlama-1.bula22.de.
+0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rlama-2.bula22.de.
-1.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rlama-2.bula22.de.
+1.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rlama-1.bula22.de.
 2.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rzoll-1.bula22.de.
 3.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rprogramm-1.bula22.de.
 4.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rnerd.bula22.de.
 5.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rpre-router.bula22.de.
+6.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rmap.bula22.de.
 5.4.2.0.0.0.0.0.0.0.0.0.0.0.0.0.1.2.2.8.c.0.c.1.8.f.4.0.1.0.a.2.ip6.arpa.     IN  PTR     rnixdeploy.bula22.de.

hosts/dns/zones/db.42.10.in-addr.arpa.

@@ -18,12 +18,13 @@ $TTL 3600
 10.42.10.7.in-addr.arpa.      IN  PTR     monitoring.bula22.de.
 10.42.10.8.in-addr.arpa.      IN  PTR     dns.bula22.de.
 10.42.10.9.in-addr.arpa.      IN  PTR     yate-dialup.bula22.de.
-10.42.10.20.in-addr.arpa.     IN  PTR     lama-1.bula22.de.
+10.42.10.21.in-addr.arpa.     IN  PTR     lama-1.bula22.de.
-10.42.10.21.in-addr.arpa.     IN  PTR     lama-2.bula22.de.
+10.42.10.20.in-addr.arpa.     IN  PTR     lama-2.bula22.de.
 10.42.10.22.in-addr.arpa.     IN  PTR     zoll-1.bula22.de.
 10.42.10.23.in-addr.arpa.     IN  PTR     programm-1.bula22.de.
 10.42.10.24.in-addr.arpa.     IN  PTR     nerd.bula22.de.
 10.42.10.25.in-addr.arpa.     IN  PTR     pre-router.bula22.de.
+10.42.10.26.in-addr.arpa.     IN  PTR     map.bula22.de.
 10.42.10.245.in-addr.arpa.    IN  PTR     nixdeploy.bula22.de.
 
 ; Management
@@ -34,7 +35,7 @@ $TTL 3600
 10.42.42.14.in-addr.arpa.     IN  PTR     sw-zoll-container.bula22.de.
 10.42.42.15.in-addr.arpa.     IN  PTR     sw-zoll-zelt.bula22.de.
 10.42.42.16.in-addr.arpa.     IN  PTR     sw-programmtresen.bula22.de.
-10.42.42.17.in-addr.arpa.     IN  PTR     sw-international.bula22.de.
+10.42.42.17.in-addr.arpa.     IN  PTR     sw-post.bula22.de.
 10.42.42.18.in-addr.arpa.     IN  PTR     sw-leitstelle.bula22.de.
 10.42.42.19.in-addr.arpa.     IN  PTR     sw-infojurte.bula22.de.
 10.42.42.20.in-addr.arpa.     IN  PTR     sw-technik-zelt.bula22.de.
@@ -44,6 +45,12 @@ $TTL 3600
 10.42.42.24.in-addr.arpa.     IN  PTR     sw-waschhaus.bula22.de.
 10.42.42.25.in-addr.arpa.     IN  PTR     sw-buehne.bula22.de.
 10.42.42.26.in-addr.arpa.     IN  PTR     sw-trabantenstadt.bula22.de.
+10.42.42.27.in-addr.arpa.     IN  PTR     sw-bll.bula22.de.
+10.42.42.28.in-addr.arpa.     IN  PTR     sw-finanzen.bula22.de.
+10.42.42.29.in-addr.arpa.     IN  PTR     sw-finanzen.bula22.de.
+10.42.42.123.in-addr.arpa.    IN  PTR     mooncake.bula22.de.
+10.42.42.124.in-addr.arpa.    IN  PTR     sunbread.bula22.de.
+10.42.42.125.in-addr.arpa.    IN  PTR     pbs.bula22.de.
 
 ; Network Gateways
 10.42.10.1.in-addr.arpa.      IN  PTR     gw.services.net.bula22.de.
@@ -60,3 +67,12 @@ $TTL 3600
 10.42.210.1.in-addr.arpa.     IN  PTR     gw.international.net.bula22.de.
 10.42.211.1.in-addr.arpa.     IN  PTR     gw.programmtresen.net.bula22.de.
 10.42.212.1.in-addr.arpa.     IN  PTR     gw.open-office.net.bula22.de.
+
+
+#other
+10.42.132.2.in-addr.arpa.     IN  PTR     omm.bula22.de.
+10.42.151.2.in-addr.arpa.     IN  PTR     webcam.bula22.de.
+<<<<<<< Updated upstream
+10.42.212.2.in-addr.arpa.     IN  PTR     drucker.bula22.de.
+=======
+>>>>>>> Stashed changes

hosts/dns/zones/db.bula22.de

@@ -2,7 +2,7 @@ $ORIGIN bula22.de.
 $TTL 3600
 
 bula22.de.                          IN  SOA     dns.bula22.de. hostmaster.bula22.de. (
-                                                  2022071501
+                                                  2022080101
                                                   10800
                                                   3600
                                                   604800
@@ -11,6 +11,15 @@ bula22.de.                          IN  SOA     dns.bula22.de. hostmaster.bula22
 
 bula22.de.                          IN NS       dns.bula22.de.
 
+; Interfaces
+bula22.de.                          IN  AAAA    2a01:4f8:c0c:c580::1
+bula22.de.                          IN  A       88.99.187.135
+grafana.bula22.de.                  IN  CNAME   monitoring.bula22.de.
+prometheus.bula22.de.               IN  CNAME   monitoring.bula22.de.
+influxdb.bula22.de.                 IN  CNAME   monitoring.bula22.de.
+lightbuffet.bula22.de.               IN  CNAME   pre-router.bula22.de.
+www.bula22.de.                      IN  CNAME   bula22.de.
+
 ; Services
 router.bula22.de.                   IN A        10.42.10.2
                                     IN AAAA     2a01:4f8:1c0c:8221::2
@@ -24,9 +33,9 @@ dns.bula22.de.                      IN A        10.42.10.8
                                     IN AAAA     2a01:4f8:1c0c:8221::8
 yate-dialup.bula22.de.              IN A        10.42.10.9
                                     IN AAAA     2a01:4f8:1c0c:8221::9
-lama-1.bula22.de.                   IN A        10.42.10.20
+lama-1.bula22.de.                   IN A        10.42.10.21
                                     IN AAAA     2a01:4f8:1c0c:8221::20
-lama-2.bula22.de.                   IN A        10.42.10.21
+lama-2.bula22.de.                   IN A        10.42.10.20
                                     IN AAAA     2a01:4f8:1c0c:8221::21
 zoll-1.bula22.de.                   IN A        10.42.10.22
                                     IN AAAA     2a01:4f8:1c0c:8221::22
@@ -36,8 +45,20 @@ nerd.bula22.de.                     IN A        10.42.10.24
                                     IN AAAA     2a01:4f8:1c0c:8221::24
 pre-router.bula22.de.               IN A        10.42.10.25
                                     IN AAAA     2a01:4f8:1c0c:8221::25
+map.bula22.de.                      IN A        10.42.10.26
+                                    IN AAAA     2a01:4f8:1c0c:8221::26
+karte.bula22.de.                    IN A        10.42.10.26
+                                    IN AAAA     2a01:4f8:1c0c:8221::26
 nixdeploy.bula22.de.                IN A        10.42.10.245
                                     IN AAAA     2a01:4f8:1c0c:8221::245
+omm.bula22.de.                      IN A        10.42.132.2
+webcam.bula22.de.                   IN A        10.42.151.2
+drucker.bula22.de.                  IN A        10.42.212.2
+
+
+; External Services
+vcp-bula-mon.bula22.de.             IN  AAAA    2a01:4f8:c0c:15f1::8105
+vcp-bula-telko.bula22.de.           IN  AAAA    2001:638:904:ffcb::4
 
 ; Management
 wlan-controller.bula22.de.          IN  A       10.42.42.10
@@ -47,7 +68,7 @@ sw-verwaltung.bula22.de.            IN  A       10.42.42.13
 sw-zoll-container.bula22.de.        IN  A       10.42.42.14
 sw-zoll-zelt.bula22.de.             IN  A       10.42.42.15
 sw-programmtresen.bula22.de.        IN  A       10.42.42.16
-sw-international.bula22.de.         IN  A       10.42.42.17
+sw-post.bula22.de. 		              IN  A       10.42.42.17
 sw-leitstelle.bula22.de.            IN  A       10.42.42.18
 sw-infojurte.bula22.de.             IN  A       10.42.42.19
 sw-technik-zelt.bula22.de.          IN  A       10.42.42.20
@@ -57,14 +78,21 @@ sw-fuf.bula22.de.                   IN  A       10.42.42.23
 sw-waschhaus.bula22.de.             IN  A       10.42.42.24
 sw-buehne.bula22.de.                IN  A       10.42.42.25
 sw-trabantenstadt.bula22.de.        IN  A       10.42.42.26
+sw-bll.bula22.de.                   IN  A       10.42.42.27
+sw-finanzen.bula22.de.              IN  A       10.42.42.28
+sw-international.bula22.de.	        IN  A	      10.42.42.29
+mooncake.bula22.de.                 IN  A       10.42.42.123
+sunbread.bula22.de.                 IN  A       10.42.42.124
+pbs.bula22.de.                      IN  A       10.42.42.125
 
 ; Network Gateways
 gw.services.net.bula22.de.          IN  A       10.42.10.1
                                     IN  AAAA    fd00:10:42:10::1
 gw.management.net.bula22.de.        IN  A       10.42.42.1
-                                    IN  AAAA    fd00:10:42:42::1
 gw.technik-iot.net.bula22.de.       IN  A       10.42.151.1
                                     IN  AAAA    fd00:10:42:151::1
+gw.ikt-toys.net.bula22.de.          IN  A       10.42.152.1
+                                    IN  AAAA    fd00:10:42:152::1
 gw.ikt.net.bula22.de.               IN  A       10.42.201.1
                                     IN  AAAA    fd00:10:42:201::1
 gw.technik.net.bula22.de.           IN  A       10.42.202.1
@@ -87,3 +115,15 @@ gw.programmtresen.net.bula22.de.    IN  A       10.42.211.1
                                     IN  AAAA    fd00:10:42:211::1
 gw.open-office.net.bula22.de.       IN  A       10.42.212.1
                                     IN  AAAA    fd00:10:42:212::1
+
+; Programmtresen
+signage-11.bula22.de.               IN  A       10.42.211.11
+signage-12.bula22.de.               IN  A       10.42.211.12
+signage-13.bula22.de.               IN  A       10.42.211.13
+signage-21.bula22.de.               IN  A       10.42.211.21
+signage-22.bula22.de.               IN  A       10.42.211.22
+signage-23.bula22.de.               IN  A       10.42.211.23
+signage-24.bula22.de.               IN  A       10.42.211.24
+signage-25.bula22.de.               IN  A       10.42.211.25
+signage-31.bula22.de.               IN  A       10.42.211.31
+signage-32.bula22.de.               IN  A       10.42.211.32

hosts/dns/zones/db.oncamp.lama.vcp.de

@@ -0,0 +1,20 @@
+$ORIGIN oncamp.lama.vcp.de.
+$TTL 3600
+
+oncamp.lama.vcp.de.                 IN  SOA     dns.bula22.de. hostmaster.bula22.de. (
+                                                  2022072101
+                                                  10800
+                                                  3600
+                                                  604800
+                                                  3600
+                                                )
+
+oncamp.lama.vcp.de.                 IN NS       dns.bula22.de.
+
+oncamp.lama.vcp.de.                 IN  CNAME   lama-2.bula22.de.
+
+id.oncamp.lama.vcp.de.              IN  CNAME   lama-2.bula22.de.
+reports.oncamp.lama.vcp.de.         IN  CNAME   lama-2.bula22.de.
+member.oncamp.lama.vcp.de.          IN  CNAME   lama-2.bula22.de.
+signage.oncamp.lama.vcp.de.         IN  CNAME   lama-2.bula22.de.
+dashboard.oncamp.lama.vcp.de.       IN  CNAME   lama-2.bula22.de.

hosts/dns/zones/db.oncamp.m2yk8s.de

@@ -0,0 +1,20 @@
+$ORIGIN oncamp.m2yk8s.de.
+$TTL 3600
+
+oncamp.m2yk8s.de.                   IN  SOA     dns.bula22.de. hostmaster.bula22.de. (
+                                                  2022072101
+                                                  10800
+                                                  3600
+                                                  604800
+                                                  3600
+                                                )
+
+oncamp.m2yk8s.de.                    IN NS       dns.bula22.de.
+
+rancher.oncamp.m2yk8s.de.            IN  CNAME   lama-2.bula22.de.
+minio.oncamp.m2yk8s.de.              IN  CNAME   lama-2.bula22.de.
+s3.oncamp.m2yk8s.de.                 IN  CNAME   lama-2.bula22.de.
+registry.oncamp.m2yk8s.de.           IN  CNAME   lama-1.bula22.de.
+dashboard.oncamp.m2yk8s.de.          IN  CNAME   lama-2.bula22.de.
+
+_acme-challenge.dashboard.oncamp.m2yk8s.de. TXT ZDba8ibIumMhHmCqGsddGTkjLK-yinWNiSXar38sN8c

hosts/monitoring/blackbox.yml

@@ -1,3 +1,11 @@
 modules:
-  icmp:
+  icmp6:
     prober: icmp
+    icmp:
+      preferred_ip_protocol: ip6
+      ip_protocol_fallback: false
+  icmp4:
+    prober: icmp
+    icmp:
+      preferred_ip_protocol: ip4
+      ip_protocol_fallback: false

hosts/monitoring/configuration.nix

@@ -21,13 +21,53 @@ with lib;
   networking.defaultGateway = { address = "10.42.10.1"; interface = "ens18"; };
   networking.defaultGateway6 = { address = "2a01:4f8:1c0c:8221::1"; interface = "ens18"; };
 
-  services.prometheus.exporters.blackbox = {
+  environment = {
-    enable = true;
+    etc = {
-    listenAddress = "[::1]";
+      "snmp-exporter/snmp.yml".source = ./snmp.yml;
-    port = 9115;
+    };
-    configFile = ./blackbox.yml;
+  };
+
+  services.influxdb2.enable = true;
+
+  services.prometheus.exporters = {
+    blackbox = {
+      enable = true;
+      listenAddress = "[::1]";
+      port = 9115;
+      configFile = ./blackbox.yml;
+    };
+    snmp = {
+      enable = true;
+      port= 9116;
+      listenAddress = "[::1]";
+      configurationPath = "/etc/snmp-exporter/snmp.yml";
+    };
   };
   services.prometheus.exporters.node.enable = true;
+
+  systemd.services.waldbrandgefahrenstufen-exporter = {
+    description = "Waldbrandgefahrenstufen Exporter";
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      DynamicUser = "yes";
+    };
+
+    script = "${pkgs.python3}/bin/python ${./waldbrandgefahrenstufen-exporter.py}";
+  };
+
+  systemd.services.sipgate-balance-exporter = {
+    description = "Sipgate Balance Exporter";
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      DynamicUser = "yes";
+      Environment = "SIPGATE_TOKEN_PATH=/var/src/secrets/sipgate-balance/apitoken";
+    };
+
+    script = "${pkgs.python3}/bin/python ${./sipgate-balance-exporter.py}";
+  };
+
   services.prometheus.alertmanager = {
     enable = true;
     listenAddress = "[::1]";
@@ -46,6 +86,7 @@ with lib;
   };
   services.prometheus = {
     enable = true;
+    retentionTime = "90d";
     listenAddress = "[::1]";
     scrapeConfigs = [
       {
@@ -67,16 +108,82 @@ with lib;
           {
             targets = [
               "[::1]:9100"
+              "radius.bula22.de:9100"
+              "router.bula22.de:9100"
+              "mooncake.bula22.de:9100"
+              "sunbread.bula22.de:9100"
             ];
           }
         ];
       }
       {
-        job_name = "blackbox";
+        job_name = "blackbox_icmp6";
         scrape_interval = "20s";
         metrics_path = "/probe";
         params = {
-          module = [ "icmp" ];
+          module = [ "icmp6" ];
+        };
+        static_configs = [
+          {
+            targets = [
+              # Internet Probes
+              "clerie.de"
+
+              # Vlan Probes
+              "gw.services.net.bula22.de"
+              "gw.technik-iot.net.bula22.de"
+              "gw.technik.net.bula22.de"
+              "gw.hospital.net.bula22.de"
+              "gw.zoll.net.bula22.de"
+              "gw.leitstelle.net.bula22.de"
+              "gw.verwaltung.net.bula22.de"
+              "gw.yolo.net.bula22.de"
+              "gw.infojurte.net.bula22.de"
+              "gw.international.net.bula22.de"
+              "gw.programmtresen.net.bula22.de"
+              "gw.open-office.net.bula22.de"
+
+              # Service Probes
+              "router.bula22.de"
+              "radius.bula22.de"
+              "yate.bula22.de"
+              "monitoring.bula22.de"
+              "dns.bula22.de"
+              "yate-dialup.bula22.de"
+              "nerd.bula22.de"
+              "pre-router.bula22.de"
+              "nixdeploy.bula22.de"
+
+              # External Service Probes
+              "vcp-bula-mon.bula22.de"
+              "vcp-bula-telko.bula22.de"
+            ];
+            labels = {
+              "module" = "icmp6";
+            };
+          }
+        ];
+        relabel_configs = [
+          {
+            source_labels = [ "__address__" ];
+            target_label = "__param_target";
+          }
+          {
+            source_labels = [ "__param_target" ];
+            target_label = "instance";
+          }
+          {
+            target_label = "__address__";
+            replacement = "[::1]:9115";
+          }
+        ];
+      }
+      {
+        job_name = "blackbox_icmp4";
+        scrape_interval = "20s";
+        metrics_path = "/probe";
+        params = {
+          module = [ "icmp4" ];
         };
         static_configs = [
           {
@@ -107,8 +214,9 @@ with lib;
               "sw-zentral-2.bula22.de"
               "sw-verwaltung.bula22.de"
               "sw-zoll-container.bula22.de"
-              "sw-zoll-zelt.bula22.de"
+              # "sw-zoll-zelt.bula22.de" # Wird doch nicht benötigt
               "sw-programmtresen.bula22.de"
+              "sw-post.bula22.de"
               "sw-international.bula22.de"
               "sw-leitstelle.bula22.de"
               "sw-infojurte.bula22.de"
@@ -119,6 +227,8 @@ with lib;
               "sw-waschhaus.bula22.de"
               "sw-buehne.bula22.de"
               "sw-trabantenstadt.bula22.de"
+              "sw-bll.bula22.de"
+              "sw-finanzen.bula22.de"
 
               # Service Probes
               "router.bula22.de"
@@ -130,11 +240,12 @@ with lib;
               "nerd.bula22.de"
               "pre-router.bula22.de"
               "nixdeploy.bula22.de"
-
+              "omm.bula22.de"
-              # External Service Probes
+              "webcam.bula22.de"
-              "vcp-bula-mon.bula22.de"
-              "vcp-bula-telko.bula22.de"
             ];
+            labels = {
+              "module" = "icmp4";
+            };
           }
         ];
         relabel_configs = [
@@ -159,7 +270,168 @@ with lib;
           {
             targets = [
               "dns.bula22.de:9253"
-              "dns.bula22.de:9353"
+            ];
+          }
+        ];
+      }
+      {
+        job_name = "waldbrandgefahrenstufen";
+        scrape_interval = "1h";
+	      scrape_timeout = "60s";
+        static_configs = [
+          {
+            targets = [
+              "[::1]:9242"
+            ];
+          }
+        ];
+      }
+      {
+        job_name = "sipgate-balance";
+        scrape_interval = "120s";
+	      scrape_timeout = "20s";
+        static_configs = [
+          {
+            targets = [
+              "[::1]:9243"
+            ];
+          }
+        ];
+      }
+      {
+        job_name = "snmp";
+        scrape_interval = "120s";
+        scrape_timeout = "40s";
+        metrics_path = "/snmp";
+        params = {
+          module = [
+            "if_mib"
+          ];
+        };
+        static_configs = [
+          {
+            targets = [
+              "sw-zentral-1.bula22.de"
+              "sw-zentral-2.bula22.de"
+              "sw-verwaltung.bula22.de"
+              "sw-zoll-container.bula22.de"
+              # "sw-zoll-zelt.bula22.de" # Wird doch nicht benötigt
+              "sw-programmtresen.bula22.de"
+              "sw-international.bula22.de"
+              "sw-post.bula22.de"
+              "sw-leitstelle.bula22.de"
+              "sw-infojurte.bula22.de"
+              "sw-technik-zelt.bula22.de"
+              "sw-technik-container.bula22.de"
+              "sw-hospital.bula22.de"
+              "sw-fuf.bula22.de"
+              "sw-waschhaus.bula22.de"
+              "sw-buehne.bula22.de"
+              "sw-trabantenstadt.bula22.de"
+              "sw-bll.bula22.de"
+              "sw-finanzen.bula22.de"
+              "wlan-controller.bula22.de"
+            ];
+          }
+        ];
+        relabel_configs = [
+          {
+            source_labels = [ "__address__" ];
+            target_label = "__param_target";
+          }
+          {
+            source_labels = [ "__param_target" ];
+            target_label = "instance";
+          }
+          {
+            target_label = "__address__";
+            replacement = "[::1]:9116";
+          }
+        ];
+      }
+      {
+        job_name = "aruba";
+        scrape_interval = "120s";
+        scrape_timeout = "40s";
+        metrics_path = "/snmp";
+        params = {
+          module = [
+            "aruba"
+          ];
+        };
+        static_configs = [
+          {
+            targets = [
+              "wlan-controller.bula22.de"
+            ];
+          }
+        ];
+        relabel_configs = [
+          {
+            source_labels = [ "__address__" ];
+            target_label = "__param_target";
+          }
+          {
+            source_labels = [ "__param_target" ];
+            target_label = "instance";
+          }
+          {
+            target_label = "__address__";
+            replacement = "[::1]:9116";
+          }
+        ];
+      }
+      {
+        job_name = "yate";
+        scrape_interval = "30s";
+        scrape_timeout = "20s";
+        metrics_path = "/snmp";
+        params = {
+          module = [
+            "yate"
+          ];
+        };
+        static_configs = [
+          {
+            targets = [
+                "10.42.10.6"
+            ];
+	    labels = {
+                instance = "yate.bula22.de";
+	    };
+          }
+          {
+            targets = [
+                "10.42.10.9"
+            ];
+	    labels = {
+                instance = "yate-dialup.bula22.de";
+	    };
+          }
+        ];
+        relabel_configs = [
+          {
+            source_labels = [ "__address__" ];
+            target_label = "__param_target";
+          }
+          {
+            source_labels = [ "__param_target" ];
+            target_label = "instance";
+          }
+          {
+            target_label = "__address__";
+            replacement = "[::1]:9116";
+          }
+        ];
+      }
+      {
+        job_name = "energy";
+        scrape_interval = "1s";
+        scrape_timeout = "1s";
+        static_configs = [
+          {
+            targets = [
+              "pbs.bula22.de:9555"
             ];
           }
         ];
@@ -176,6 +448,11 @@ with lib;
     ];
     rules = [ (readFile ./alertmanager-rules.yml) ];
   };
+
+  systemd.services.prometheus-snmp-exporter.restartTriggers = [
+    config.environment.etc."snmp-exporter/snmp.yml".source
+  ];
+
   services.grafana = {
     enable  = true;
     domain  = "grafana.bula22.de";
@@ -209,6 +486,11 @@ with lib;
         forceSSL   = true;
         locations."/".proxyPass = "http://[::1]:3001/";
       };
+      "influxdb.bula22.de" = {
+        enableACME = true;
+        forceSSL   = true;
+        locations."/".proxyPass = "http://[::1]:8086/";
+      };
     };
   };
   networking.firewall.allowedTCPPorts = [ 80 443 ];

hosts/monitoring/sipgate-balance-exporter.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+from http.server import HTTPServer, BaseHTTPRequestHandler, HTTPStatus
+import os
+import socket
+import json
+from urllib.request import Request, urlopen
+import xml.etree.ElementTree as ET
+from pathlib import Path
+
+class HTTPServerV6(HTTPServer):
+    address_family = socket.AF_INET6
+
+TOKEN = Path(os.environ.get("SIPGATE_TOKEN_PATH", "apitoken")).read_text().strip()
+
+
+class ExporterRequestHandler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path == "/":
+            self.make_response("sipgate Guthaben für den Trunk")
+        elif self.path == "/metrics":
+            self.export()
+        else:
+            self.send_error(HTTPStatus.NOT_FOUND, "File not found")
+            return
+
+    def do_HEAD(self):
+        if self.path == "/":
+            self.make_response("sipgate Guthaben für den Trunk", head_only=True)
+        elif self.path == "/metrics":
+            self.export(head_only=True)
+        else:
+            self.send_error(HTTPStatus.NOT_FOUND, "File not found")
+            return
+
+    def export(self, head_only=False):
+        req = Request("https://api.sipgate.com/v2/balance")
+        req.add_header("accept", "application/json")
+        req.add_header("authorization", "Basic " + TOKEN)
+
+        webURL = urlopen(req)
+        data = webURL.read()
+        encoding = webURL.info().get_content_charset('utf-8')
+        d = json.loads(data.decode(encoding))
+
+        print(d)
+
+        balance = d["amount"] / 10000
+        currency = d["currency"]
+       
+        res = "sipgate_balance{{currency=\"{}\"}} {}".format(currency, balance)
+
+        self.make_response(res, head_only=head_only)
+
+    def make_response(self, content, head_only=False):
+        encoded = content.encode("utf-8")
+        self.send_response(HTTPStatus.OK)
+        self.send_header("Content-Type", "text/plain; charset=utf-8")
+        self.send_header("Conten-Length", str(len(encoded)))
+        self.end_headers()
+        if not head_only:
+            self.wfile.write(encoded)
+
+
+def run():
+    with HTTPServerV6(("::1", 9243), ExporterRequestHandler) as httpd:
+        print("Starting sipgate Balance Exporter on http://[{}]:{}".format(*httpd.socket.getsockname()[:2]))
+        httpd.serve_forever()
+
+if __name__ == "__main__":
+    run()

hosts/monitoring/waldbrandgefahrenstufen-exporter.py

@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+from http.server import HTTPServer, BaseHTTPRequestHandler, HTTPStatus
+import io
+import socket
+import urllib.request
+import xml.etree.ElementTree as ET
+
+class HTTPServerV6(HTTPServer):
+    address_family = socket.AF_INET6
+
+
+class ExporterRequestHandler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path == "/":
+            self.make_response("Waldbrandgefahrenstufen Exporter für Brandenburg")
+        elif self.path == "/metrics":
+            self.export()
+        else:
+            self.send_error(HTTPStatus.NOT_FOUND, "File not found")
+            return
+
+    def do_HEAD(self):
+        if self.path == "/":
+            self.make_response("Waldbrandgefahrenstufen Exporter für Brandenburg", head_only=True)
+        elif self.path == "/metrics":
+            self.export(head_only=True)
+        else:
+            self.send_error(HTTPStatus.NOT_FOUND, "File not found")
+            return
+
+    def export(self, head_only=False):
+        r = []
+        with urllib.request.urlopen("https://mluk.brandenburg.de/mluk/de/wgs.xml") as f:
+            tree = ET.parse(f)
+            root = tree.getroot()
+            for lk in root[0].findall("landkreis"):
+                r.append('waldbrandgefahrenstufe{{landkreis="{landkreis}"}} {value}'.format(landkreis=lk.attrib["name"], value=lk.text))
+        self.make_response("\n".join(r), head_only=head_only)
+
+    def make_response(self, content, head_only=False):
+        encoded = content.encode("utf-8")
+        self.send_response(HTTPStatus.OK)
+        self.send_header("Content-Type", "text/plain; charset=utf-8")
+        self.send_header("Conten-Length", str(len(encoded)))
+        self.end_headers()
+        if not head_only:
+            self.wfile.write(encoded)
+
+
+def run():
+    with HTTPServerV6(("::1", 9242), ExporterRequestHandler) as httpd:
+        print("Starting Waldbrandgefahrenstufen Exporter on http://[{}]:{}".format(*httpd.socket.getsockname()[:2]))
+        httpd.serve_forever()
+
+if __name__ == "__main__":
+    run()

hosts/nerd/nerd.nix

@@ -2,7 +2,6 @@
 
 {
   sops.secrets.nerd_secret = {
-    sopsFile = ./secrets.yaml;
     owner = "nerd";
     restartUnits = [ "nerd.service" ];
   };
@@ -80,8 +79,16 @@
     enable = true;
     virtualHosts."nerd.bula22.de" = {
       extraConfig = ''
+        @disallow_export {
+          not remote_ip 10.42.10.0/24 2a01:4f8:1c0c:8221::/64
+          path /export.json*
+        }
+
         route {
           file_server /static/*
+          respond @disallow_export 403 {
+            close
+          }
           reverse_proxy * http://127.0.0.1:10510
         }
 

hosts/pre-router/configuration.nix

@@ -4,8 +4,6 @@
   imports =
     [ # Include the results of the hardware scan.
       ./hardware-configuration.nix
-      ./router.nix
-      ./ipv6.nix
       ./nginx.nix
    ];
 
@@ -22,6 +20,41 @@
   #networking.interfaces.ens18.useDHCP = false;
   #networking.interfaces.ens19.useDHCP = false;
 
+  environment.systemPackages = with pkgs; [
+    ethtool             # manage NIC settings (offload, NIC feeatures, ...)
+    conntrack-tools     # view network connection states
+    wireguard-tools
+  ];
+
+  networking.nat = {
+    enable = true;
+    externalInterface = "ens18";
+    internalIPs = [
+      "10.42.0.0/16"
+    ];
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv6.conf.all.forwarding" = true;
+    "net.ipv6.conf.default.forwarding" = true;
+  };
+
+  networking.interfaces.ens18.useDHCP = true;
+  networking.interfaces.ens19.useDHCP = false;
+  networking.interfaces.ens19.ipv6.addresses = [
+    { address = "fd00:10:42:10::25"; prefixLength = 64; }
+    { address = "2a01:4f8:1c0c:8221::25"; prefixLength = 64; }
+  ];
+  networking.interfaces.ens19.ipv4.addresses = [
+    { address = "10.42.10.25"; prefixLength = 24; }
+  ];
+  networking.interfaces.ens19.ipv6.routes = [
+    { address = "fd00:10:42::"; prefixLength = 48; via = "fd00:10:42:10::1"; }
+  ];
+  networking.interfaces.ens19.ipv4.routes = [
+    { address = "10.42.0.0"; prefixLength = 16; via = "10.42.10.1"; }
+  ];
+
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave

hosts/pre-router/ipv6.nix

@@ -1,41 +0,0 @@
-{ config, pkgs, ...}:
-
-{
-    environment.systemPackages = with pkgs; [
-        wireguard-tools
-    ];
-
-    networking = {
-        firewall.allowedUDPPorts = [ 51820 ];
-        firewall.trustedInterfaces = [ "ens19"];
-        iproute2.enable = true;
-        iproute2.rttablesExtraConfig = ''
-          100 PUBLIC6
-        '';
-        wireguard.enable = true;
-        wireguard.interfaces = {
-            wg0 = {
-                ips = [ "fe80::42:10:1/64" ];
-                privateKeyFile = "/var/src/secrets/wireguard/wg0";
-                listenPort = 51820;
-                allowedIPsAsRoutes = false;
-                postSetup = ''
-                    ip -6 rule add from 2a01:4f8:1c0c:8221::/64 lookup PUBLIC6
-                    ip -6 route add default via fe80::1 dev wg0 table PUBLIC6
-                '';
-                peers = [{
-                    publicKey = "Y++eB9SfU17zB4mJ/6AaN761tngXAyTNoVaPNKmuvls=";
-                    allowedIPs = [ "::/0"  ];
-                    endpoint = "78.47.183.82:51876";
-                    #endpoint = "gatekeeper.net.clerie.de:51876";
-                    persistentKeepalive = 25;
-                }];
-            };
-        };
-    };
-    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
-    networking.interfaces.ens19.ipv6.addresses = [
-      { address = "fd00:10:42:10::25"; prefixLength = 64; }
-      { address = "2a01:4f8:1c0c:8221::25"; prefixLength = 64; }
-    ];
-}

hosts/pre-router/router.nix

@@ -1,30 +0,0 @@
-{ config, pkgs, ...}:
-
-{
-
-  environment.systemPackages = with pkgs; [
-    ethtool             # manage NIC settings (offload, NIC feeatures, ...)
-    conntrack-tools     # view network connection states
-  ];
-
-  networking.firewall.interfaces.ens19.allowedUDPPorts = [ 67 53 ];
-  networking = {
-    nameservers = [ "10.42.10.8" "2a01:4f8:1c0c:8221::8" ];
-    nat = {
-      enable = true;
-      extraCommands = "iptables -A INPUT -p icmp -j ACCEPT";
-      externalInterface = "ens18";
-      internalInterfaces = [ "ens19" ];
-    };
-    interfaces = {
-      ens19.useDHCP = false;
-      ens18.useDHCP = true;
-      # Handle the VLANs
-      ens19 = {
-        ipv4.addresses = [
-          { address = "10.42.10.25"; prefixLength = 24; }
-        ];
-      };
-    };
-  };
-}

hosts/pre-yate-n0emis/configuration.nix

@@ -1,103 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports =
-    [ # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-    ];
-
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
-  boot.loader.grub.device = "/dev/sda";
-
-  networking.hostName = "pre-yate-n0emis";
-
-  boot.kernel.sysctl = {
-    "net.ipv4.conf.all.forwarding" = true;
-    "net.ipv6.conf.all.forwarding" = true;
-  };
-
-  networking.useNetworkd = true;
-  systemd.network = {
-    links."10-eth0" = {
-      matchConfig.MACAddress = "4a:a6:0d:b9:3b:82";
-      linkConfig.Name = "eth0";
-    };
-    networks."10-eth0" = {
-      matchConfig = {
-        Name = "eth0";
-      };
-      DHCP = "yes";
-    };
-
-    links."20-vlan132" = {
-      matchConfig.MACAddress = "8e:50:2d:73:27:51";
-      linkConfig.Name = "vlan132";
-    };
-    networks."20-vlan132" = {
-      matchConfig = {
-        Name = "vlan132";
-      };
-      address = [ "10.42.132.1/24" ];
-    };
-  };
-
-  services.fieldpoc = {
-    enable = true;
-    dhcp = {
-      enable = true;
-      interface = "vlan132";
-      subnet = "10.42.132.0/24";
-      pool = "10.42.132.200 - 10.42.132.250";
-      router = "10.42.132.1";
-      dnsServers = "1.1.1.1,9.9.9.9";
-      omm = "10.42.132.11";
-      reservations = [
-        {
-          name = "rfp-01";
-          macAddress = "00:30:42:1B:8C:7A";
-          ipAddress = "10.42.132.11";
-        }
-      ];
-    };
-  };
-  services.yate.config = {
-    yate.ygi = {
-      sndpath = "/opt/sounds";
-      sndformats = "slin,gsm,wav";
-    };
-    accfile.dialout = {
-      enabled = "yes";
-      protocol = "sip";
-      username = "iocaste";
-      password = "iocaste";
-      registrar = "172.16.1.1";
-    };
-    regexroute = "[default]
-\${username}^$=-;error=noauth
-^iocaste$=goto dialin
-^99991001$=tone/dial
-^99991002$=tone/busy
-^99991003$=tone/ring
-^99991004$=tone/specdial
-^99991005$=tone/congestion
-^99991006$=tone/outoforder
-^99991007$=tone/milliwatt
-^99991008$=tone/info
-^.*$=line/\\0;line=dialout
-
-[dialin]
-\${sip_x-called}^.*$=lateroute/\\1";
-  };
-
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "22.05"; # Did you read the comment?
-
-}

hosts/radius/configuration.nix

@@ -0,0 +1,39 @@
+{ config, pkgs, lib, ... }:
+with lib;
+
+{
+  imports =
+    [
+      ./hardware-configuration.nix
+    ];
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "radius";
+  networking.useDHCP = false;
+  networking.interfaces.ens18.ipv4.addresses = [
+    {address = "10.42.10.5"; prefixLength = 24; }
+  ];
+  networking.interfaces.ens18.ipv6.addresses = [
+    {address = "2a01:4f8:1c0c:8221::5"; prefixLength = 64; }
+  ];
+  networking.defaultGateway = { address = "10.42.10.1"; interface = "ens18"; };
+  networking.defaultGateway6 = { address = "2a01:4f8:1c0c:8221::1"; interface = "ens18"; };
+
+  services.prometheus.exporters.node = {
+    enable = true;
+    listenAddress = "10.42.10.5";
+    openFirewall = true;
+  };
+
+  services.freeradius.enable = true;
+  services.freeradius.debug = true;
+  users.users.radius.group = "radius";
+  users.groups.radius = {};
+
+  networking.firewall.allowedUDPPorts = [ 1812 ];
+
+  environment.systemPackages = [ pkgs.eapol_test ];
+
+  system.stateVersion = "22.05";
+}

hosts/radius/generate_passwords.py

@@ -0,0 +1,87 @@
+###
+# Hier werden die Passwörter generiert und sie VLANs zugeordnet. Diese Datei
+# kann nach `radius.bula22.de:/etc/raddb/mods-config/files/authorize` geschoben
+# werden.
+# 
+# ACHTUNG! Die Passwörter sind nicht idempotent, sondern werden neu generiert.
+# Das Skript also nur ausführen, solange die User noch nicht online sind.
+# Danach muss wieder manuell gefrickelt werden. Das Passwort für leitstelle01
+# ist bereits publik, darum wird es hier überschrieben.
+# 
+# Anpassbar: 
+#   - Welcher Userprefix kommt in welches VLAN.
+#   - Wie viele User gehen pro Prefix online?
+# 
+# Fragen? Fragen! DECT664 oder über Signal / Matrix / rfc1149.
+###
+
+import secrets
+import string
+
+USERS_PER_PREFIX = 20
+LEITSTELLE01_PW = "Findest du in der existierenden authorize file"
+
+### LEITSTELLE
+# DEFAULT
+#         Tunnel-Private-Group-Id = "205",
+#         Fall-Through = Yes
+#
+# leitstelle01    Cleartext-Password := "oofahcul3aiV4ri8"
+
+prefixes = [
+    (201, "ikt"),
+    (202, "buehne"),
+    (202, "technik"),
+    (203, "hospital"),
+    (204, "zoll"),
+    (205, "leitstelle"),
+    (206, "bll"),
+    (206, "finanzen"),
+    (208, "bayern"),
+    (208, "elydipark"),
+    (208, "hessen"),
+    (208, "trabantenstadt"),
+    (208, "waltara"),
+    (208, "zeche"),
+    (209, "infojurte"),
+    (210, "intfairground"),
+    (210, "intinfocenter"),
+    (211, "programmtre"),
+    (212, "openoffice")
+]
+
+def gen_password():
+    alphabet = string.ascii_letters + string.digits
+    return ''.join(secrets.choice(alphabet) for i in range(10))
+
+
+print("DEFAULT")
+print("\tTunnel-Type = \"VLAN\",")
+print("\tTunnel-Medium-Type = IEEE-802,")
+print("\tFall-Through = Yes")
+print()
+
+csv_file = "Username,password\n"
+
+for (vlan, prefix) in prefixes:
+    print(f"## {prefix.upper()}")
+    print(f"DEFAULT")
+    print(f"\tTunnel-Private-Group-Id := \"{vlan}\",")
+    print(f"\tFall-Through = Yes")
+    print()
+
+    for i in range(1, USERS_PER_PREFIX + 1):
+        username = f"{prefix}{i:02d}"
+        pw = gen_password()
+
+        if username == "leitstelle01":
+            pw = LEITSTELLE01_PW
+
+        print(f"{username}\tCleartext-Password := \"{pw}\"")
+
+        csv_file += username + "," + pw + "\n"
+    print()
+
+f = open("accounts.csv", "w")
+f.write(csv_file)
+f.close()

hosts/radius/hardware-configuration.nix

@@ -10,14 +10,19 @@
 
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/d3e87ae2-fb17-44f0-b113-14b185a2c845";
+    { device = "/dev/disk/by-uuid/009361cd-3a0a-4736-98a9-acbef4d7aaa1";
       fsType = "ext4";
     };
 
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/77DB-3A02";
+      fsType = "vfat";
+    };
+
   swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
@@ -27,5 +32,5 @@
   networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
 
-    hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/router/10-net-services.nix

@@ -6,6 +6,32 @@
     interface = "ens18";
   };
 
+  networking.wireguard = {
+    enable = true;
+    interfaces = {
+      wg-services = {
+        ips = [ "fe80::42:10:1/64" ];
+        privateKeyFile = "/var/src/secrets/wireguard/wg-services";
+        allowedIPsAsRoutes = false;
+        peers = [{
+          publicKey = "Y++eB9SfU17zB4mJ/6AaN761tngXAyTNoVaPNKmuvls=";
+          allowedIPs = [ "::/0"  ];
+          endpoint = "78.47.183.82:51876";
+          #endpoint = "gatekeeper.net.clerie.de:51876";
+          persistentKeepalive = 25;
+        }];
+      };
+    };
+  };
+
+  networking.localCommands = ''
+    ip -6 route add default dev wg-services table 20003
+  '';
+
+  clerie.policyrouting.rules6 = [
+    { rule = "from 2a01:4f8:1c0c:8221::/64 lookup 20003"; prio = 19000; }
+  ];
+
   networking.interfaces.net-services.ipv4.addresses = [
     { address = "10.42.10.1"; prefixLength = 24; }
     { address = "10.42.10.2"; prefixLength = 24; }
@@ -17,11 +43,18 @@
     { address = "2a01:4f8:1c0c:8221::1"; prefixLength = 64; }
     { address = "2a01:4f8:1c0c:8221::2"; prefixLength = 64; }
   ];
+  networking.interfaces.net-services.ipv4.routes = [
+    { address = "10.42.132.0"; prefixLength = 23; via = "10.42.10.6"; }
+  ];
 
   services.radvd.config = ''
     interface net-services {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };

hosts/router/101-net-uplink-a.nix

@@ -5,6 +5,7 @@
     id = 101;
     interface = "ens18";
   };
+  networking.interfaces."net-uplink-a".mtu = 1600;
 
   networking.vlans."net-uplink-a.7" = {
     id = 7;

hosts/router/102-net-uplink-b.nix

@@ -5,6 +5,7 @@
     id = 102;
     interface = "ens18";
   };
+  networking.interfaces."net-uplink-a".mtu = 1600;
 
   networking.vlans."net-uplink-b.7" = {
     id = 7;

hosts/router/151-net-technik-iot.nix

@@ -6,10 +6,27 @@
     interface = "ens18";
   };
 
+  networking.interfaces.net-technik-iot.ipv6.addresses = [
+    { address = "fe80::1"; prefixLength = 64; }
+    { address = "fd00:10:42:151::1"; prefixLength = 64; }
+  ];
   networking.interfaces.net-technik-iot.ipv4.addresses = [
     { address = "10.42.151.1"; prefixLength = 24; }
   ];
 
+  services.radvd.config = ''
+    interface net-technik-iot {
+      AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
+      RDNSS 2a01:4f8:1c0c:8221::8 {};
+      DNSSL bula22.de {};
+    };
+  '';
+
   services.kea.dhcp4 = {
     settings = {
       interfaces-config = {
@@ -30,6 +47,16 @@
               data = "10.42.151.1";
             }
           ];
+          reservations = [
+            { # webcam.bula22.de
+              hw-address = "00:03:c5:01:13:2b";
+              ip-address = "10.42.151.2";
+            }
+            { # siemens logo stechuhr
+              hw-address = "bc:f3:19:30:d2:1b";
+              ip-address = "10.42.151.3";
+            }
+          ];
         }
       ];
     };
@@ -39,6 +66,9 @@
     { incomingInterface = "net-ikt"; }
     # Give technik access to their toys
     { incomingInterface = "net-technik"; }
+    # Allow monitoring
+    { incomingInterface = "net-services"; sourceAddress = "10.42.10.7"; }
+    { incomingInterface = "net-services"; sourceAddress6 = "2a01:4f8:1c0c:8221::7"; }
   ];
 
   clerie.uplink-selector.interfaces.net-technik-iot.uplink = "uplink-b";

hosts/router/152-net-ikt-toys.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, ...}:
+
+{
+  networking.vlans."net-ikt-toys" = {
+    id = 152;
+    interface = "ens18";
+  };
+
+  networking.interfaces.net-ikt-toys.ipv6.addresses = [
+    { address = "fe80::1"; prefixLength = 64; }
+    { address = "fd00:10:42:152::1"; prefixLength = 64; }
+  ];
+  networking.interfaces.net-ikt-toys.ipv4.addresses = [
+    { address = "10.42.152.1"; prefixLength = 24; }
+  ];
+
+  services.radvd.config = ''
+    interface net-ikt-toys {
+      AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
+      RDNSS 2a01:4f8:1c0c:8221::8 {};
+      DNSSL bula22.de {};
+    };
+  '';
+
+  services.kea.dhcp4 = {
+    settings = {
+      interfaces-config = {
+        interfaces = [ "net-ikt-toys" ];
+      };
+      subnet4 = [
+        {
+          id = 152;
+          subnet = "10.42.152.1/24";
+          pools = [
+            {
+              pool = "10.42.152.100 - 10.42.152.240";
+            }
+          ];
+          option-data = [
+            {
+              name = "routers";
+              data = "10.42.152.1";
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  clerie.forward-filter.interfaces.net-ikt-toys.rules = [
+    { incomingInterface = "net-ikt"; }
+  ];
+
+  clerie.uplink-selector.interfaces.net-ikt-toys.uplink = "uplink-b";
+}

hosts/router/201-net-ikt.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-ikt {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };

hosts/router/202-net-technik.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-technik {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };
@@ -43,6 +47,12 @@
               data = "10.42.202.1";
             }
           ];
+          reservations = [
+            { # drucker container
+              hw-address = "20:cd:a7:f2:1b:ad";
+              ip-address = "10.42.202.11";
+            }
+          ];
         }
       ];
     };

hosts/router/203-net-hospital.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-hospital {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };

hosts/router/204-net-zoll.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-zoll {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };

hosts/router/205-net-leitstelle.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-leitstelle {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };

hosts/router/206-net-verwaltung.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-verwaltung {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };
@@ -43,6 +47,12 @@
               data = "10.42.206.1";
             }
           ];
+          reservations = [
+            { # mkay.bula22.de
+              hw-address = "ac:87:a3:0c:70:04";
+              ip-address = "10.42.206.2";
+            }
+          ];
         }
       ];
     };

hosts/router/208-net-yolo.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-yolo {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };

hosts/router/209-net-infojurte.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-infojurte {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };

hosts/router/210-net-internation.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-internation {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };

hosts/router/211-net-programmtre.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-programmtre {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };
@@ -43,6 +47,58 @@
               data = "10.42.211.1";
             }
           ];
+          reservations = [
+            {
+              # signage-11
+              hw-address = "e4:5f:01:91:f7:fe";
+              ip-address = "10.42.211.11";
+            }
+            {
+              # signage-12
+              hw-address = "e4:5f:01:92:08:13";
+              ip-address = "10.42.211.12";
+            }
+            {
+              # signage-13
+              hw-address = "e4:5f:01:91:f5:59";
+              ip-address = "10.42.211.13";
+            }
+            {
+              # signage-21
+              hw-address = "e4:5f:01:93:70:86";
+              ip-address = "10.42.211.21";
+            }
+            {
+              # signage-22
+              hw-address = "e4:5f:01:93:5b:53";
+              ip-address = "10.42.211.22";
+            }
+            {
+              # signage-23
+              hw-address = "e4:5f:01:93:5c:39";
+              ip-address = "10.42.211.23";
+            }
+            {
+              # signage-24
+              hw-address = "e4:5f:01:93:58:ad";
+              ip-address = "10.42.211.24";
+            }
+            {
+              # signage-25
+              hw-address = "e4:5f:01:93:5b:e9";
+              ip-address = "10.42.211.25";
+            }
+            {
+              # signage-31
+              hw-address = "b8:27:eb:cd:f7:ef";
+              ip-address = "10.42.211.31";
+            }
+            {
+              # signage-32
+              hw-address = "b8:27:eb:1b:5c:f1";
+              ip-address = "10.42.211.32";
+            }
+          ];
         }
       ];
     };

hosts/router/212-net-open-office.nix

@@ -17,7 +17,11 @@
   services.radvd.config = ''
     interface net-open-office {
       AdvSendAdvert on;
-      prefix ::/64 {};
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
       RDNSS 2a01:4f8:1c0c:8221::8 {};
       DNSSL bula22.de {};
     };
@@ -43,6 +47,12 @@
               data = "10.42.212.1";
             }
           ];
+          reservations = [
+            { # drucker.bula22.de
+              hw-address = "00:21:b7:87:50:2c";
+              ip-address = "10.42.212.2";
+            }
+          ];
         }
       ];
     };
@@ -50,6 +60,7 @@
 
   clerie.forward-filter.interfaces.net-open-office.rules = [
     { incomingInterface = "net-ikt"; }
+    { destinationAddress = "10.42.212.2/32"; }
   ];
 
   clerie.uplink-selector.interfaces.net-open-office.uplink = "uplink-b";

hosts/router/213-net-fuf.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, ...}:
+
+{
+  networking.vlans."net-fuf" = {
+    id = 213;
+    interface = "ens18";
+  };
+
+  networking.interfaces.net-fuf.ipv6.addresses = [
+    { address = "fe80::1"; prefixLength = 64; }
+    { address = "fd00:10:42:213::1"; prefixLength = 64; }
+  ];
+  networking.interfaces.net-fuf.ipv4.addresses = [
+    { address = "10.42.213.1"; prefixLength = 24; }
+  ];
+
+  services.radvd.config = ''
+    interface net-fuf {
+      AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
+      RDNSS 2a01:4f8:1c0c:8221::8 {};
+      DNSSL bula22.de {};
+    };
+  '';
+
+  services.kea.dhcp4 = {
+    settings = {
+      interfaces-config = {
+        interfaces = [ "net-fuf" ];
+      };
+      subnet4 = [
+        {
+          id = 213;
+          subnet = "10.42.213.1/24";
+          pools = [
+            {
+              pool = "10.42.213.100 - 10.42.213.240";
+            }
+          ];
+          option-data = [
+            {
+              name = "routers";
+              data = "10.42.213.1";
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  clerie.forward-filter.interfaces.net-fuf.rules = [
+    { incomingInterface = "net-ikt"; }
+  ];
+
+  clerie.uplink-selector.interfaces.net-fuf.uplink = "uplink-b";
+}

hosts/router/214-net-mav.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, ...}:
+
+{
+  networking.vlans."net-mav" = {
+    id = 214;
+    interface = "ens18";
+  };
+
+  networking.interfaces.net-mav.ipv6.addresses = [
+    { address = "fe80::1"; prefixLength = 64; }
+    { address = "fd00:10:42:214::1"; prefixLength = 64; }
+  ];
+  networking.interfaces.net-mav.ipv4.addresses = [
+    { address = "10.42.214.1"; prefixLength = 24; }
+  ];
+
+  services.radvd.config = ''
+    interface net-mav {
+      AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
+      RDNSS 2a01:4f8:1c0c:8221::8 {};
+      DNSSL bula22.de {};
+    };
+  '';
+
+  services.kea.dhcp4 = {
+    settings = {
+      interfaces-config = {
+        interfaces = [ "net-mav" ];
+      };
+      subnet4 = [
+        {
+          id = 214;
+          subnet = "10.42.214.1/24";
+          pools = [
+            {
+              pool = "10.42.214.100 - 10.42.214.240";
+            }
+          ];
+          option-data = [
+            {
+              name = "routers";
+              data = "10.42.214.1";
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  clerie.forward-filter.interfaces.net-mav.rules = [
+    { incomingInterface = "net-ikt"; }
+  ];
+
+  clerie.uplink-selector.interfaces.net-mav.uplink = "uplink-b";
+}

hosts/router/215-net-audio.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, ...}:
+
+{
+  networking.vlans."net-audio" = {
+    id = 215;
+    interface = "ens18";
+  };
+
+  networking.interfaces.net-audio.ipv6.addresses = [
+    { address = "fe80::1"; prefixLength = 64; }
+    { address = "fd00:10:42:215::1"; prefixLength = 64; }
+  ];
+  networking.interfaces.net-audio.ipv4.addresses = [
+    { address = "10.42.215.1"; prefixLength = 24; }
+  ];
+
+  services.radvd.config = ''
+    interface net-audio {
+      AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
+      RDNSS 2a01:4f8:1c0c:8221::8 {};
+      DNSSL bula22.de {};
+    };
+  '';
+
+  services.kea.dhcp4 = {
+    settings = {
+      interfaces-config = {
+        interfaces = [ "net-audio" ];
+      };
+      subnet4 = [
+        {
+          id = 215;
+          subnet = "10.42.215.1/24";
+          pools = [
+            {
+              pool = "10.42.215.100 - 10.42.215.240";
+            }
+          ];
+          option-data = [
+            {
+              name = "routers";
+              data = "10.42.215.1";
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  clerie.forward-filter.interfaces.net-audio.rules = [
+    { incomingInterface = "net-ikt"; }
+  ];
+
+  clerie.uplink-selector.interfaces.net-audio.uplink = "uplink-b";
+}

hosts/router/216-net-trabantenst.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, ...}:
+
+{
+  networking.vlans."net-trabantenst" = {
+    id = 216;
+    interface = "ens18";
+  };
+
+  networking.interfaces.net-trabantenst.ipv6.addresses = [
+    { address = "fe80::1"; prefixLength = 64; }
+    { address = "fd00:10:42:216::1"; prefixLength = 64; }
+  ];
+  networking.interfaces.net-trabantenst.ipv4.addresses = [
+    { address = "10.42.216.1"; prefixLength = 24; }
+  ];
+
+  services.radvd.config = ''
+    interface net-trabantenst {
+      AdvSendAdvert on;
+      MaxRtrAdvInterval 30;
+      prefix ::/64 {
+        AdvValidLifetime 60;
+        AdvPreferredLifetime 30;
+      };
+      RDNSS 2a01:4f8:1c0c:8221::8 {};
+      DNSSL bula22.de {};
+    };
+  '';
+
+  services.kea.dhcp4 = {
+    settings = {
+      interfaces-config = {
+        interfaces = [ "net-trabantenst" ];
+      };
+      subnet4 = [
+        {
+          id = 216;
+          subnet = "10.42.216.1/24";
+          pools = [
+            {
+              pool = "10.42.216.100 - 10.42.216.240";
+            }
+          ];
+          option-data = [
+            {
+              name = "routers";
+              data = "10.42.216.1";
+            }
+          ];
+        }
+      ];
+    };
+  };
+
+  clerie.forward-filter.interfaces.net-trabantenst.rules = [
+    { incomingInterface = "net-ikt"; }
+  ];
+
+  clerie.uplink-selector.interfaces.net-trabantenst.uplink = "uplink-b";
+}

hosts/router/configuration.nix

@@ -15,6 +15,7 @@
       ./101-net-uplink-a.nix
       ./102-net-uplink-b.nix
       ./151-net-technik-iot.nix
+      ./152-net-ikt-toys.nix
       ./201-net-ikt.nix
       ./202-net-technik.nix
       ./203-net-hospital.nix
@@ -26,6 +27,10 @@
       ./210-net-internation.nix
       ./211-net-programmtre.nix
       ./212-net-open-office.nix
+      ./213-net-fuf.nix
+      ./214-net-mav.nix
+      ./215-net-audio.nix
+      ./216-net-trabantenst.nix
     ];
 
   boot.loader.systemd-boot.enable = true;
@@ -33,10 +38,13 @@
 
   networking.hostName = "router";
 
-  networking.defaultGateway = { address = "10.42.10.25"; interface = "net-services"; };
+  networking.firewall.checkReversePath = false;
-  networking.defaultGateway6 = { address = "2a01:4f8:1c0c:8221::25"; interface = "net-services"; };
 
-  networking.nameservers = [ "10.42.10.8" "2a01:4f8:1c0c:8221::8" ];
+  services.prometheus.exporters.node = {
+    enable = true;
+    listenAddress = "10.42.10.2";
+    openFirewall = true;
+  };
 
   boot.kernel.sysctl = {
     "net.ipv4.conf.all.forwarding" = true;
@@ -78,6 +86,8 @@
 
   clerie.forward-filter.enable = true;
 
+  networking.interfaces."ens18".mtu = 9000;
+
   services.pppd.enable = true;
 
   # This value determines the NixOS release from which the default

hosts/router/ppp.nix

@@ -1,19 +1,26 @@
 { config, pkgs, ... }:
 
 {
+  sops.secrets.ppp_secrets = {
+    path = "/etc/ppp/pap-secrets";
+    mode = "0440";
+  };
+
   # Setting default routes based on interfaces in different tables
   environment.etc."ppp/ip-up" = {
     text = ''
       #! ${pkgs.runtimeShell} -e
 
-      case $IFNAME in
+      case $1 in
        ppp-uplink-a)
-         ip route flush table 20001 || true
+         ${pkgs.iproute2}/bin/ip route flush table 20001 || true
-         ip route add default dev ppp-uplink-a table 20001
+         ${pkgs.iproute2}/bin/ip route add default dev ppp-uplink-a table 20001
+         ${pkgs.iproute2}/bin/ip route replace default dev ppp-uplink-a metric 2000
          ;;
        ppp-uplink-b)
-         ip route flush table 20002 || true
+         ${pkgs.iproute2}/bin/ip route flush table 20002 || true
-         ip route add default dev ppp-uplink-b table 20002
+         ${pkgs.iproute2}/bin/ip route add default dev ppp-uplink-b table 20002
+         ${pkgs.iproute2}/bin/ip route replace default dev ppp-uplink-b metric 1000
          ;;
       esac
     '';
@@ -23,12 +30,14 @@
     text = ''
       #! ${pkgs.runtimeShell} -e
 
-      case $IFNAME in
+      case $1 in
        ppp-uplink-a)
-         ip route flush table 20001 || true
+         ${pkgs.iproute2}/bin/ip route flush table 20001 || true
+         ${pkgs.iproute2}/bin/ip route delete default dev ppp-uplink-a || true
          ;;
        ppp-uplink-b)
-         ip route flush table 20002 || true
+         ${pkgs.iproute2}/bin/ip route flush table 20002 || true
+         ${pkgs.iproute2}/bin/ip route delete default dev ppp-uplink-b || true
          ;;
       esac
     '';
@@ -38,16 +47,20 @@
     text = ''
       #! ${pkgs.runtimeShell} -e
 
-      case $IFNAME in
+      case $1 in
        ppp-uplink-a)
-         ip -6 route flush table 20001 || true
+         ${pkgs.iproute2}/bin/ip -6 route flush table 20001 || true
-         ip -6 route add default dev ppp-uplink-a table 20001
+         ${pkgs.iproute2}/bin/ip -6 route add default dev ppp-uplink-a table 20001
+         ${pkgs.iproute2}/bin/ip -6 route replace default dev ppp-uplink-a metric 2000
          ;;
        ppp-uplink-b)
-         ip -6 route flush table 20002 || true
+         ${pkgs.iproute2}/bin/ip -6 route flush table 20002 || true
-         ip -6 route add default dev ppp-uplink-b table 20002
+         ${pkgs.iproute2}/bin/ip -6 route add default dev ppp-uplink-b table 20002
+         ${pkgs.iproute2}/bin/ip -6 route replace default dev ppp-uplink-b metric 1000
          ;;
       esac
+
+      ${pkgs.systemd}/bin/systemctl restart dhcpcd.service
     '';
     mode = "555";
   };
@@ -55,12 +68,14 @@
     text = ''
       #! ${pkgs.runtimeShell} -e
 
-      case $IFNAME in
+      case $1 in
        ppp-uplink-a)
-         ip -6 route flush table 20001 || true
+         ${pkgs.iproute2}/bin/ip -6 route flush table 20001 || true
+         ${pkgs.iproute2}/bin/ip -6 route delete default dev ppp-uplink-a || true
          ;;
        ppp-uplink-b)
-         ip -6 route flush table 20002 || true
+         ${pkgs.iproute2}/bin/ip -6 route flush table 20002 || true
+         ${pkgs.iproute2}/bin/ip -6 route delete default dev ppp-uplink-b || true
          ;;
       esac
     '';

hosts/router/prefix-delegation.nix

@@ -28,7 +28,7 @@
         ia_pd 1/::/56 net-hospital/203/64 net-zoll/204/64 net-leitstelle/205/64 net-verwaltung/206/64
       interface ppp-uplink-b
         ipv6rs
-        ia_pd 1/::/56 net-ikt/201/64 net-technik/202/64 net-yolo/208/64 net-infojurte/209/64 net-internation/210/64 net-programmtre/211/64 net-open-office/212/64
+        ia_pd 1/::/56 net-technik-iot/151/64 net-technik-iot/152/64 net-ikt/201/64 net-technik/202/64 net-yolo/208/64 net-infojurte/209/64 net-internation/210/64 net-programmtre/211/64 net-open-office/212/64 net-fuf/213/64 net-mav/214/64 net-audio/215/64 net-trabantenst/216/64
     '';
   };
 }

hosts/router/secrets.yaml

@@ -0,0 +1,52 @@
+ppp_secrets: ENC[AES256_GCM,data:FQQdo1xFu+pW4wshQBVEBFqyhyTpprVZ9QAeasht1p82x5cODiGqnRNxNohnVVVxJmOtcuwIh1vN6dSEN8ju1XyuUn7suURnZ4og4Fk5yqHMFlBptAdViYLONV6dngGskIGug60Kyy8ysgBJSoq3LKy0plivSQ==,iv:RM+aYOP7zVO62h28EQHgvIEw96d7BNK5W0ut2TCfe4g=,tag:ZDAazjUtll+mEDWK8vlyGQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1ghrvqrw92y355qw2m48jxvlu34pxf9c68nkus9lspfm05nes63gqmh5av5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBibE1jbGFjZUdBZjNZY0h4
+            RkdCTElUS0xtMzQ5WHNScDR0dnBZRzBHanlVCi8vTE52Y0V2QW1SbUR0OFNwc0Rt
+            UVU5bWxKc0U3OEloOXFnYldvUjVOSW8KLS0tIDcyeHFWR2d3Q3V0U013QzdvODJi
+            WmdZQ2h3Qi9LWXhBbTNxSlkxaFlBSDgKPSe9TF+kKct2YYL0mmGYK5pAfGpeobUI
+            SsQPevDyZG8qTiBDnzw9uFfCJO9XSwaWms2hfEtNNFMFmgdBdbBrMQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-07-23T14:37:21Z"
+    mac: ENC[AES256_GCM,data:TRGnDcBjfuKa/VyiWJiYB9FVtztUeJAHwSrZHmK3+9Y9Ae6Q+JNUiep+tUY2c5yhTyD8IJ/0IZ/ad+lKi+W5gfPOnmpSGEhqckc8CwM2dAHN5+jFIdu8RYGIxwpevn38ZjNmRFII/FGc08JMtiGTIvDL6WPe0+KdKxnMCn1ps3k=,iv:FFh5Vw8vAl2vwcMGTM/gCKmief8J9C4RlLr4g4aNs2s=,tag:iEdFCwQDWbfDeRKs3nrFOQ==,type:str]
+    pgp:
+        - created_at: "2022-07-23T14:30:56Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA6BIUohpxMXcAQ/9Hl6jRICaP6tNYoAc2STPLgv0s0KL24ef5VtwZb56pAkL
+            p8Rd76UhFSaw5VgEaDpJV/FEtOL7Pc6BO6LkqUZcdINVj53IIBazt2zf6GEcFcL7
+            vu+CahApzlotMC9X3IMoo4zmii9DXoJ+xekqA/WWc0cB6w8IS7xcTjYVid/4JlPh
+            L80gC/+o7fDeDYaNAQKvDq6vhvqkeC6KxogdKlVV6BKragS8GRfhJuTQrT7DLH5+
+            QJhKf0BNVNBvbR+KbDSvih8o9Duv55OTrnN2UiOefHJe/nRK2zy7CPeLmkGG6Ifa
+            spRdq2kyJ/E9wzfsmnTtfP6YSGb0y5MLzG9Y5QhwZjzLfR9MOvZMtBJVTG/4wXqL
+            sJGF2FstSmPaFdFdDnbHOt4vnamHnO1VtYkSuHJZKHPW7gCJvelspHCevl14C2Hs
+            VZCYfWck3wwXtVDyoV/7s3QFyoXdtq5sqksJ3LHZmXR1czB6WpZ2ITdwWTR5IxO1
+            QBBeYjnlec4bHVz9wDx46lNvzK+oUam4tWuB1puderzSFkTcM9VTGhrwqJ2gGiD0
+            nWMjsNW0PtwfmKTO33BPIqwcqxRBlzPoDG2XBVk/+Vp1gwlGJ+VhhRoShMxi72S3
+            CHEHxJLybMGzhJFFe4GwEf1qicj52OiuwrBoYAZKDzwH0rApjLQZwQVGzzDPwhHS
+            XgG70cfHZA9iUVTQ3RH5YLWqYMTj8vsCtAczZoMADdDboZZ3XoKJZzP9mneus2a+
+            5wHBf12QzICj2bdawGeUtwmJ7AdKVOz9orpScPvv0q7wuHt2VTUr/EHwjZuX+ZU=
+            =tuD3
+            -----END PGP MESSAGE-----
+          fp: DD2D88B9FCB74C81E6F63AAD5B5D448C88684BC3
+        - created_at: "2022-07-23T14:30:56Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hE4D6iFd6webPCUSAQdAVZFfxX2qwqqOTdVKP3Gwgr9hGjsMw9LjuOke+MQIzU0g
+            V4ZfuxxGV5jur+KQgzyinpS7OsGlE6+VTHdKzvk0zI3SXgHZlR2Scbu1GayIBd1D
+            Gjw2TzhA5Oglwi0sp19JJscY0YEAiKEN35EefAhIY6ZDPg/rRogY3nMSNcrjMNgW
+            yHe/WT5QsAP97rqDls7dnXmN2nfQtw151T9f1/+hC28=
+            =l5ht
+            -----END PGP MESSAGE-----
+          fp: 6E10217E3187069E057DF5ABE0262A773B824745
+    unencrypted_suffix: _unencrypted
+    version: 3.7.1

hosts/router/uplink-selector.nix

@@ -1,14 +1,7 @@
 { config, pkgs, ... }:
 
 {
-  networking.localCommands = ''
-    ip -6 route add default via 2a01:4f8:1c0c:8221::25 dev net-services table 20003
-  '';
-
   clerie.policyrouting.enable = true;
-  clerie.policyrouting.rules6 = [
-    { rule = "from 2a01:4f8:1c0c:8221::/64 lookup 20003"; prio = 19000; }
-  ];
 
   clerie.uplink-selector.enable = true;
   clerie.uplink-selector.uplinks = {

hosts/yate-dialup/configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
   imports =
@@ -35,6 +35,36 @@
     };
   };
 
+  networking.firewall.enable = false;
+  networking.nftables = {
+    enable = true;
+    ruleset = let
+        tcpPorts = lib.concatStringsSep ", " (map toString config.networking.firewall.allowedTCPPorts);
+        udpPorts = lib.concatStringsSep ", " (map toString config.networking.firewall.allowedUDPPorts);
+    in ''
+      table inet filter {
+        chain input {
+          type filter hook input priority 0; policy drop;
+
+          iifname lo accept
+          ct state {established, related} accept
+          ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
+          ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
+
+          ip6 nexthdr icmpv6 icmpv6 type echo-request accept
+          ip protocol icmp icmp type echo-request accept
+
+          tcp dport 22 accept
+          tcp dport { ${tcpPorts} } accept
+          udp dport { ${udpPorts} } accept
+
+          ip saddr { 10.42.10.6, 217.10.68.150 } accept
+          ip6 saddr { 2a01:4f8:1c0c:8221::6, 2001:ab7::0/64 } accept
+        }
+      }
+    '';
+  };
+
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave

hosts/yate-dialup/secrets.yaml

@@ -0,0 +1,52 @@
+sipgate_password: ENC[AES256_GCM,data:mqqkkCaMYsuEWpjW,iv:JhTKMKdj2gj9uRVBWm/kVmaHgTggdBUWZ7Af73IJa94=,tag:PhPnkrvE7NWkfOpCM39Kkg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age14zsha5c5238v6hzchdfkjgjjwzc2qc79tl0ngmqrdquck5f945zs35vps4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkdzhabG9PclViWTFBbzFk
+            WU1LTDZJaXVxNVVpeGdtOGZhcHlKS3B6SWhNClJrdEJ2NVA5c2VIUCtoajJMSitB
+            NFYwNlNmWTJPZWVnZWxiL1NFUTNzZXcKLS0tIHBETFg0UkNEcW13bEtGOFhBeXM4
+            WWZiOTdRS3pUdi9sb1hraHZ5aFFHUkUKCo+qUjs8zXH4PSIv8ONpkOFM+T4I94E8
+            Cf30aeB7OeViVTfV6+tg76zrbdJ0uyQVJcIfbQPlDflvbrS2/D28xQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-07-24T08:41:00Z"
+    mac: ENC[AES256_GCM,data:w6DF3AY6rRDhef6ZClFe4jvS7NIWADTTp4nP9a0CIE4F7hFQRNeQMG92OgKajaSDZhmo6gVWWm0IO9Bw2WlndLgTISigjHnQUMF0/p8HXhc69Bpnl9RVa1mghs4qLiGys5HIHBnSVnkj9Sq7W9psOwS4sTpFGVj/BMEcB3nfrYw=,iv:HWVDMWAJ5SoCuW34+Bu7iRzr39RassXqKSFsE/OCHaA=,tag:WqGcnCiLRVW6IvQCtXT0dQ==,type:str]
+    pgp:
+        - created_at: "2022-07-18T06:44:35Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA6BIUohpxMXcAQ/8Cocn4DGibz+JByFXxnlGFtyM3jf81CbSK9F883Wfl+pR
+            xFagZjA5oN3lOeGyKQjP2E9ALzfAorwbZWRKiWv9xqapgXlYAmhMgN4oMlY3VJto
+            xkGP8gpEDkO/H5WBoP/MN9CAqmmFWko1BR/yYHCHNg+os+nBQ9SK3Pk/ZEwmTSDy
+            Rk/2+edbBrRbk9Ucc7yTIQlJVcI7c4+uaEuhHOOOQGB/SxO0cz6ods8OYCiSLWQg
+            YJ9THGakZW9ki/Dl22dWZS3qUsyVFyjSULfjUXovPCn0a+EWernsoRlpLNJ5kFTf
+            3FqWPN8w2RpUasukwajuAiCEI0xgP3mNS3ZHovGhnEcSEVdVBh5jZulQEEY2rGfF
+            BOSdjko4uFcGB09EVTKYJWmMjHDWj2z5Fo9syvhKTIV5Rv3aFU9LcQ6lxY8Q3aIg
+            OiTWTJR6zFXJuHua2Aarz5nkL33Nsw6D3nbud72fKfSJnaidWXnYbvy1BLR/e5gt
+            07kjbghV5x1f2oSe0/AtY/vkn8tl0jAbuK0CT9guzdUZbPIve4omGSbjEbwBNSuj
+            mQkKdmYDPwTEUhzvYR/wUfU4ZnbUI5jIUeLek+5adwMIiq53mKuHVA3v1t++00fP
+            ZAeDeuTJ+RajB45xDkXaJP70RLi1KPUPT5e2QIIdOEw1ZYjaMa5zWeQuHPXhalLS
+            XgFvoqAgqVmolft0Au2z2sGCUOHSlcXyB1x4fChiNVMk9muoJtlGq8dKqjnVA7fF
+            10pxfb7rn9zhGxDdPqwqqole+ST13L3ZZ7Uh4PS5uHp9/pq/izAcp7Mm8gDk3ks=
+            =PHaL
+            -----END PGP MESSAGE-----
+          fp: DD2D88B9FCB74C81E6F63AAD5B5D448C88684BC3
+        - created_at: "2022-07-18T06:44:35Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hE4D6iFd6webPCUSAQdAP67Vt9XQLyeHB5dxhTQPke7eKYKb6NPZ3c532BDsgSAg
+            D/6K9eDqbK6cnFnvtZ+Qa0zYS4wIexCgIRgLGA8omBXSXgHCPtGl/gBbdexcXXcL
+            cajDmIIOc7w8tPOg81CDVLT2hRPIWIOkbpFCqyKWqgCvPGHsHaMHdaEQh+E76HsS
+            qbURE+neOiNzKWzJrShPre7wtJyBQuGhXwyx4xmF6bc=
+            =1aA/
+            -----END PGP MESSAGE-----
+          fp: 6E10217E3187069E057DF5ABE0262A773B824745
+    unencrypted_suffix: _unencrypted
+    version: 3.7.1

hosts/yate-dialup/voip.nix

@@ -3,5 +3,51 @@
 {
   services.yate = {
     enable = true;
+    config = {
+      regfile.yate.password = "yate";
+      regexroute = "[default]
+^4933921999799\\(.*\\)$=sip/sip:\\1@10.42.10.6
+
+\${sip_x-dialout-allowed}^1$=goto dialout
+
+[dialout]
+\${username}^$=-;error=noauth
+^.*$=sip/sip:\\0;line=sipgate;osip_P-Preferred-Identity=<sip:4933921999799\${caller}@sipconnect.sipgate.de>;caller=3400888t0;domain=sipconnect.sipgate.de;";
+      ysipchan.general = {
+        ignorevia = "yes";
+      };
+      ysnmpagent = {
+        general.port = 161;
+        snmp_v2.ro_community = "yate";
+      };
+    };
+  };
+
+  networking.firewall.allowedUDPPorts = [ 161 ];
+
+  sops.secrets.sipgate_password = {
+    owner = "yate";
+    restartUnits = [ "yate.service" ];
+  };
+
+  #networking.hosts."2001:ab7::9" = [ "sipconnect.sipgate.de" ];
+
+  systemd.services.yate = {
+    preStart = let
+      accfile = pkgs.writeText "accfile.conf" (lib.generators.toINI { } {
+        sipgate = {
+          enabled = "yes";
+          protocol = "sip";
+          username = "3400888t0";
+          authname = "3400888t0";
+          password = "!!sipgate_password!!";
+          registrar = "sipconnect.sipgate.de";
+          localaddress = "yes";
+        };
+      });
+    in ''
+      ${pkgs.gnused}/bin/sed -e "s/!!sipgate_password!!/$(cat ${config.sops.secrets.sipgate_password.path})/g" ${accfile} > /etc/yate/accfile.conf
+    '';
+    serviceConfig.PermissionsStartOnly = true;
   };
 }

hosts/yate/configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 {
   imports =
@@ -91,6 +91,54 @@
     };
   };
 
+  networking.firewall.enable = false;
+  networking.nftables = {
+    enable = true;
+    ruleset = let
+        tcpPorts = lib.concatStringsSep ", " (map toString config.networking.firewall.allowedTCPPorts);
+        udpPorts = lib.concatStringsSep ", " (map toString config.networking.firewall.allowedUDPPorts);
+    in ''
+      table inet filter {
+        chain input {
+          type filter hook input priority 0; policy drop;
+
+          iifname lo accept
+          ct state {established, related} accept
+
+          ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
+          ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
+
+          ip6 nexthdr icmpv6 icmpv6 type echo-request accept
+          ip protocol icmp icmp type echo-request accept
+
+          tcp dport 22 accept
+          tcp dport { ${tcpPorts} } accept
+          udp dport { ${udpPorts} } accept
+
+          iif {vlan132, vlan133} accept
+
+          ip saddr { 10.42.10.9 } accept
+          ip6 saddr { 2a01:4f8:1c0c:8221::9 } accept
+        }
+
+        chain forward {
+          type filter hook forward priority 0; policy drop;
+
+          ct state {established, related} accept
+          iif {vlan132, vlan133} accept
+
+          ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
+          ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
+
+          ip6 nexthdr icmpv6 icmpv6 type echo-request accept
+          ip protocol icmp icmp type echo-request accept
+
+          ip saddr 10.42.201.0/24 accept
+        }
+      }
+    '';
+  };
+
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave

hosts/yate/dect_claim.py

@@ -0,0 +1,30 @@
+import asyncio
+import os
+import re
+import socket
+
+from yate.ivr import YateIVR
+
+SOUNDS_PATH = "/run/current-system/sw/share/sounds/yate"
+
+
+async def main(ivr: YateIVR):
+    caller_id = ivr.call_params.get("caller", "")
+    caller_id = re.sub("[^\\d]", "", caller_id)
+    called_id = ivr.call_params.get("called", "")
+    called_id = re.sub("[^\\d]", "", called_id)
+
+    await ivr.play_soundfile(
+                             os.path.join(SOUNDS_PATH, "yintro.slin"),
+                             complete=True)
+    await asyncio.sleep(0.5)
+
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.connect(("localhost", 9437))
+        s.recv(1024)
+        s.sendall(f"claim {caller_id} {called_id}".encode('utf-8'))
+        s.recv(1024)
+
+
+app = YateIVR()
+app.run(main)

hosts/yate/secrets.yaml

@@ -0,0 +1,53 @@
+ommpassword: ENC[AES256_GCM,data:OwtsLlRZ5rOE6UY=,iv:vOOVNBX5Rjkf3J/dz1COS2TOgNz3aZFsaqGTIX+Wlyk=,tag:3aqap0tovVMLHx8sfpFfvQ==,type:str]
+sipsecret: ENC[AES256_GCM,data:FGX7yhqrDfWP9IvZi3WdR2ahgsq8DVhhtO+ONoSWhsg=,iv:5+aixENdMFw6B5wywzOFm5PqcwjfsBs9Mxs4wL6x05c=,tag:c6b36/kolZWM1jo0dt9chA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age10pxa70g3ekxdrk788l52s93a6ftavdw3r8x6d23gmsluudmwq3asmu6ah9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBic1NCbjlyWlJzODRqekJL
+            VE9TbFplenQ1SjFXM0M3S2hDTFNnakpOQWxFCmhDcHREN2wxSGt5OHhQYWRaQ1lu
+            K3NvZ2RpaWZPMWVzTkRqZ0xPKzNZem8KLS0tIEoxNVRKQ2ZDTXozV1R2R3JmZDI3
+            WEtWTTN3a2VFVHgxQXNXMmVEbnVZNFEKdP2ewBsZBr/thdqcF7RUF9L4ziy5YPVl
+            FJAMvB7VxUfICBbCwcehp+Lj248T2h7hdGrl3RMcT0NgbFw2XdjDRA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2022-07-21T07:22:05Z"
+    mac: ENC[AES256_GCM,data:zW/hdL7olhsRVy2dnhI+qvTDQmP5vUv+TZDSAW0M8JVbSbqA9PKR2RcKEw16Q1SwXEzGrFuN/zrDxv0BHMSTgwRfJlFFc12wMD4uGCZLkgn2gHklPHr33dwIvxhncQD0QNuo0uQXw41z/Sqme1t+M9UcUZYtXExrnllcFIKnbJQ=,iv:FYLdqGvjerSXVZwEHVcOL/udqcWfa0RSd9+t32KUQpg=,tag:SGswvKi9Q8C+Vm3e7EzxMw==,type:str]
+    pgp:
+        - created_at: "2022-07-20T11:12:30Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA6BIUohpxMXcAQ//SWYM12B8nQ7ngpp2gkFQaLayflfx5GZ/mXg0k45qgPnN
+            U8OftgWxP70XRO/8h/V7GoBS2sE2usZqNzn37VGjdyP2lnFr2DDaldbQntP0td59
+            zwJXdqXECP8JNFUQUd6O923CUvsl1V/QVcwMsN1/FX45dseyoxfHyy9K3JFfQuko
+            THNQAp/c8i5sFETF6JPrFNwRRL5ZBcDcu/m+B9T+64B/O+2BUMtlDqNEc4u26jC/
+            0/+B911lT7CNOqVSdOLmL6hYz7iV+XdkhLmMnwhKkYWDXw+u0A2gTlld6PK04dnq
+            GPJPTPM+aNJD72hTN0a5b0FKgBLY5Ne2EQcf5M5IcQDpmsYDFpAkzBLnZXcM1WTz
+            zhf1WGPYtS5SlpT9eAM+Q3ou5Hzmri1DDq/l9x5sUCBwHG6QIsMR2yokjunqSIEp
+            FoObyWmk2Fiz9YRTkNBcHxxwx5awGapXjnmc+43j9Anj477sdNTpxhuLRibs3Tkr
+            hXUjpIbfKR3+lvZ0ZlQu4UBsckdLFLACi5UzP3WompPPe9y+8PC0uDBgq9oHlPJw
+            z4IpBhYJscBIZe95H6XnLY72BlqeD7po+6P4kSbZFBoCiA8Jw1pUa4rR5+sWkjgN
+            67oIET9M0CO090stSa8d+8llK7cijAB31q3jAvwixTNhxw7Dm0jzkElpszxf5djS
+            XgFPoIjVXX/CV73qcNTsteL0bkr5TdENv6yyGG3ZtAEoo0yv1c1R8m1VOT1Jvk/x
+            Xst4xUWNROR5BhSBSoMHr8EqlOBdpTBUGAZFea5t3pJHC+iqyh9MZa9AeZSttH0=
+            =c6ck
+            -----END PGP MESSAGE-----
+          fp: DD2D88B9FCB74C81E6F63AAD5B5D448C88684BC3
+        - created_at: "2022-07-20T11:12:30Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----
+
+            hE4D6iFd6webPCUSAQdAnNWOc2A1xPEzatTwvDnpyVawW7VrfrpB5ibrXX3Ty2sg
+            ieeBlwSTTTbMkH4qq5z2nb6n0lJRTllK9uoPu7XYtv7SXgGCfQL45J8fARpS2oB3
+            9h7l+oVf9yMu5xNR/pQuDORj8VdVHBm7sYEXqHbmeyoBDybSyNE4BKeVpncHkLvz
+            BC0kdgFBTvtIYqOJLcoIGFh1Qe29HfvkrNmmvyvbMFw=
+            =MZgy
+            -----END PGP MESSAGE-----
+          fp: 6E10217E3187069E057DF5ABE0262A773B824745
+    unencrypted_suffix: _unencrypted
+    version: 3.7.1

hosts/yate/voip.nix

@@ -1,8 +1,15 @@
 { config, pkgs, lib, ... }:
 
 {
+  sops.secrets.ommpassword = {};
+  sops.secrets.sipsecret = {};
+
   services.fieldpoc = {
     enable = true;
+    ommIp = "10.42.132.2";
+    ommUser = "omm";
+    ommPasswordPath = config.sops.secrets.ommpassword.path;
+    sipsecretPath = config.sops.secrets.sipsecret.path;
     dhcp = {
       enable = true;
       interface = "vlan132";
@@ -10,8 +17,13 @@
       pool = "10.42.132.200 - 10.42.132.250";
       router = "10.42.132.1";
       dnsServers = "10.42.10.8";
-      omm = "10.42.132.11";
+      omm = "10.42.132.2";
       reservations = [
+        {
+          name = "omm";
+          macAddress = "AA:C3:A9:26:1F:77";
+          ipAddress = "10.42.132.2";
+        }
         {
           name = "rfp-01";
           macAddress = "00:30:42:1B:8C:7A";
@@ -20,4 +32,76 @@
       ];
     };
   };
+
+  services.yate.config = {
+    accfile.dialout = {
+      enabled = "yes";
+      protocol = "sip";
+      username = "yate";
+      password = "yate";
+      registrar = "yate-dialup.bula22.de";
+    };
+    regexroute = "[default]
+\${username}^$=-;error=noauth
+^yate$=goto dialin
+^.*$=line/\\0;line=dialout
+
+[dialin]
+\${sip_x-called}^.*$=lateroute/\\1";
+    ysipchan = {
+      general = {
+        ignorevia = "yes";
+      };
+      #"listener general".enable = "no";
+      #"listener dect" = {
+      #  type = "udp";
+      #  addr = "10.42.132.1";
+      #  port = "5060";
+      #};
+      #"listener sip" = {
+      #  type = "udp";
+      #  addr = "10.42.133.1";
+      #  port = "5060";
+      #};
+      #"listener voip" = {
+      #  type = "udp";
+      #  addr = "10.42.10.6";
+      #  port = "5060";
+      #  default = "yes";
+      #};
+    };
+    ysnmpagent = {
+      general.port = 161;
+      snmp_v2.ro_community = "yate";
+    };
+  };
+
+  networking.firewall.allowedUDPPorts = [ 161 ];
+
+  environment.systemPackages = with pkgs; [
+    (writers.makePythonWriter python39 python39.pkgs "/bin/dect_claim" { libraries = [ python39.pkgs.python-yate ]; } (builtins.readFile ./dect_claim.py))
+    (runCommand "yintro.slin" {} ''
+      mkdir -p $out/share/sounds/yate
+      ln -s ${./yintro.slin} $out/share/sounds/yate/yintro.slin
+    '')
+  ];
+
+  systemd.services.fieldpoc-nerd = {
+    wantedBy = ["multi-user.target"];
+    startAt = "*-*-* *:*:00";
+    script = let
+      reloadScript = pkgs.writeText "reload" ''
+        spawn ${pkgs.inetutils}/bin/telnet localhost 9437
+        expect "> "
+        send "reload\n"
+        expect "> "
+        send "exit\n"
+        expect "disconnecting"
+      '';
+    in ''
+      ${pkgs.curl}/bin/curl https://nerd.bula22.de/export.json\?event=1 > /etc/fieldpoc/extensions.json
+
+      ${pkgs.expect}/bin/expect ${reloadScript}
+    '';
+  };
 }

modules/fieldpoc/default.nix

@@ -11,21 +11,74 @@ in {
   options = {
     services.fieldpoc = {
       enable = mkEnableOption "fieldpoc";
-      # TODO: config
+      ommIp = mkOption {
-      #config = mkOption {
+        type = types.str;
-      #  type = with types; attrsOf anything;
+      };
-      #  default = { };
+      ommUser = mkOption {
-      #};
+        type = types.str;
+      };
+      ommPasswordPath = mkOption {
+        type = types.path;
+      };
+      sipsecretPath = mkOption {
+        type = types.path;
+      };
     };
   };
 
   config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      python3.pkgs.fieldpoc
+    ];
+
+    systemd.services.fieldpoc = {
+      description = "Simple phone system";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" "yate.service" ];
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.python3.pkgs.fieldpoc}/bin/fieldpoc -c /etc/fieldpoc/config.json -e /etc/fieldpoc/extensions.json --debug";
+        ConfigurationDirectory = "fieldpoc";
+      };
+
+      preStart = let
+        cfgFile = pkgs.writeText "config.json" (lib.generators.toJSON { } {
+          controller = {
+            host = "127.0.0.1";
+            port = 9437;
+          };
+          dect = {
+            host = cfg.ommIp;
+            username = cfg.ommUser;
+            password = "!!OMMPASSWORD!!";
+            sipsecret = "!!SIPSECRET!!";
+          };
+          yate = {
+            host = "127.0.0.1";
+            port = 5039;
+          };
+          database = {
+            hostname = "127.0.0.1";
+            username = "fieldpoc";
+            password = "fieldpoc";
+            database = "fieldpoc";
+          };
+        });
+      in ''
+        ${pkgs.gnused}/bin/sed -e "s/!!OMMPASSWORD!!/$(cat ${cfg.ommPasswordPath})/g" -e "s/!!SIPSECRET!!/$(cat ${cfg.sipsecretPath})/g" ${cfgFile} > /etc/fieldpoc/config.json
+        if [ ! -f "/etc/fieldpoc/extensions.json" ]; then
+          echo '{"extensions": {}}' > /etc/fieldpoc/extensions.json
+        fi
+      '';
+    };
+
     services.postgresql = {
       enable = true;
       initialScript = pkgs.writeText "backend-initScript" ''
-        CREATE ROLE nixcloud WITH LOGIN PASSWORD 'nixcloud' CREATEDB;
+        CREATE ROLE fieldpoc WITH LOGIN PASSWORD 'fieldpoc' CREATEDB;
-        CREATE DATABASE nixcloud;
+        CREATE DATABASE fieldpoc;
-        GRANT ALL PRIVILEGES ON DATABASE nixcloud TO nixcloud;
+        GRANT ALL PRIVILEGES ON DATABASE fieldpoc TO fieldpoc;
       '';
     };
 

modules/yate/default.nix

@@ -34,13 +34,14 @@ in {
       serviceConfig = {
         Type = "forking";
         ExecStart =
-          "${pkgs.yate}/bin/yate -d -p /run/yate/yate.pid -c /etc/yate -F -s -q -DF -r -l /var/lib/yate/yate.log";
+          "${pkgs.yate}/bin/yate -d -p /run/yate/yate.pid -c /etc/yate -F -s -vvv -DF -r -l /var/lib/yate/yate.log";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         User = "yate";
         Group = "yate";
         AmbientCapabilities = "CAP_NET_BIND_SERVICE";
         RuntimeDirectory = "yate";
         RuntimeDirectoryMode = "0755";
+        ConfigurationDirectory = "yate";
         StateDirectory = "yate";
         StateDirectoryMode = "0700";
         PIDFile = "/run/yate/yate.pid";

packages/default.nix

@@ -6,6 +6,8 @@ self: super: {
 
   python3 = let packageOverrides = final: prev: import ./python final prev;
   in super.python3.override { inherit packageOverrides; };
+  python39 = let packageOverrides = final: prev: import ./python final prev;
+  in super.python39.override { inherit packageOverrides; };
 
   yate = super.yate.overrideAttrs (old: {
     configureFlags =
@@ -15,4 +17,20 @@ self: super: {
   t38modem = self.callPackage ./t38modem.nix { };
   ptlib = self.callPackage ./ptlib.nix { };
   opal = self.callPackage ./opal.nix { };
+  eapol_test = super.wpa_supplicant.overrideAttrs (old: rec {
+    name = "eapol_test-${old.version}";
+
+    buildPhase = ''
+      runHook preBuild
+      echo CONFIG_EAPOL_TEST=y >> .config
+      make eapol_test
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      install -D eapol_test $out/bin/eapol_test
+    '';
+
+    NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
+  });
 }

packages/python/fieldpoc/default.nix

@@ -7,7 +7,7 @@ buildPythonApplication rec {
   src = fetchGit {
     url = "https://git.n0emis.eu/n0emis/fieldpoc.git";
     ref = "main";
-    rev = "d6d664b4690189a7ed54be65ceef8cb3d79a6bfb";
+    rev = "2f1347f3415249cb116501af1f5e3282afca24be";
   };
 
   format = "pyproject";

packages/python/nerd/default.nix

@@ -18,8 +18,8 @@ buildPythonApplication rec {
     owner = "dect-e";
     repo = pname;
     #rev = "v${version}";
-    rev = "8b8becaeb9d77c3ff2c5dadb1d5be6d66b6ed5f2";
+    rev = "83a0c73c5232f9bfa63c2898a958d67a2a17caeb";
-    sha256 = "sha256-R2kOECPtfTTnbqjujGR1AeNGyXNswqC7UJtQu+W4pXo=";
+    sha256 = "sha256-7ItooKr2pUMqkpGLJ2NP5vlAs/xRH/Q1n5kTgbTDgWs=";
   };
 
   sourceRoot = "source/src";

switchconfig/deploy.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+scp $1 root@$1.bula22.de:config; ssh root@$1.bula22.de 'cli -c "configure; load override /var/root/config; show|compare" && echo "Is this okay? Ctrl+D to accept, Ctrl+C to abort." && cat && cli -c "configure; commit"'

switchconfig/sw-bll

@@ -0,0 +1,36 @@
+; J9298A Configuration Editor; Created on release #J.15.09.0028
+; Ver #06:04.08.00.01.14.05:1a
+hostname "sw-bll"
+time timezone 60
+ip default-gateway 10.42.42.1
+ip dns domain-name "bula22.de"
+ip dns server-address priority 1 10.42.10.8
+ip ssh filetransfer
+interface 10
+   name "UPLINK sw-verwaltung"
+   exit
+snmp-server community "tellme" operator
+vlan 1
+   name "DEFAULT_VLAN"
+   no untagged 1-9
+   untagged 10
+   no ip address
+   exit
+vlan 42
+   name "VL_MGMT"
+   tagged 10
+   ip address 10.42.42.27 255.255.255.0
+   exit
+vlan 206
+   name "VL_VERWALTUNG"
+   untagged 1-9
+   tagged 10
+   no ip address
+   exit
+management-vlan 42
+no tftp client
+no tftp server
+loop-protect 1-10
+no dhcp config-file-update
+password manager
+

switchconfig/sw-buehne

@@ -0,0 +1,193 @@
+## Last changed: 2016-01-24 12:14:48 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_MAV VL_AUDIO ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-buehne;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members VL_AUDIO;
+                }
+                native-vlan-id VL_WLAN;
+            }
+        }
+    }
+    ge-0/0/1 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_AUDIO;
+                }
+            }
+        }
+    }
+    ge-0/0/23 {
+        description DECT-Buehne;
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_DECT;
+                }
+            }
+        }
+    }
+    ge-0/1/3 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-hospital";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.25/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_AUDIO {
+        description "Buehne Ton";
+        vlan-id 215;
+    }
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}
+poe {
+    interface ge-0/0/0;
+    interface ge-0/0/23;
+}

switchconfig/sw-finanzen

@@ -0,0 +1,36 @@
+; J9298A Configuration Editor; Created on release #J.15.09.0028
+; Ver #06:04.08.00.01.14.05:1a
+hostname "sw-bll"
+time timezone 60
+ip default-gateway 10.42.42.1
+ip dns domain-name "bula22.de"
+ip dns server-address priority 1 10.42.10.8
+ip ssh filetransfer
+interface 10
+   name "UPLINK sw-verwaltung"
+   exit
+snmp-server community "tellme" operator
+vlan 1
+   name "DEFAULT_VLAN"
+   no untagged 1-9
+   untagged 10
+   no ip address
+   exit
+vlan 42
+   name "VL_MGMT"
+   tagged 10
+   ip address 10.42.42.27 255.255.255.0
+   exit
+vlan 206
+   name "VL_VERWALTUNG"
+   untagged 1-9
+   tagged 10
+   no ip address
+   exit
+management-vlan 42
+no tftp client
+no tftp server
+loop-protect 1-10
+no dhcp config-file-update
+password manager
+

switchconfig/sw-fuf

@@ -0,0 +1,440 @@
+## Last changed: 2016-01-20 15:48:15 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_FUF VL_MAV ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-fuf;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-hospital";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/0/1 {
+        description AP;
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_WLAN;
+                }
+            }
+        }
+    }
+    ge-0/0/2 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/3 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/4 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/5 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/6 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/7 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/8 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/9 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/10 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/11 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/12 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/13 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/14 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/15 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/16 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/17 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/18 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/19 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/20 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/21 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/22 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    ge-0/0/23 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_FUF;
+                }
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.23/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    secure-access-port {
+        interface ge-0/0/1.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/2.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/3.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/4.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/5.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/6.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/7.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/8.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/9.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/10.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/11.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/12.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/13.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/14.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/15.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/16.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/17.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/18.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/19.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/20.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/21.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/22.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/23.0 {
+            no-dhcp-trusted;
+        }
+    }
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_FUF {
+        vlan-id 213;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}
+poe {
+    interface ge-0/0/1;
+}

switchconfig/sw-hospital

@@ -0,0 +1,468 @@
+## Last changed: 2022-07-26 20:11:37 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_FUF VL_MAV ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-hospital;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        description "UPLINK sw-fuf";
+        unit 0 {
+            apply-groups backbone_vlans;
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/0/1 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/2 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/3 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/4 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/5 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/6 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/7 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/8 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/9 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/10 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/11 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/12 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/13 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/14 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/15 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/16 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/17 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/18 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/19 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/20 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/21 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_HOSPITAL;
+                }
+            }
+        }
+    }
+    ge-0/0/22 {
+        description AP;
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_WLAN;
+                }
+            }
+        }
+    }
+    ge-0/0/23 {
+        description DECT;
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_DECT;
+                }
+            }
+        }
+    }
+    ge-0/1/1 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-waschhaus";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/2 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-buehne";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/3 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-zentral-1";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.22/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    secure-access-port {
+        interface ge-0/0/1.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/2.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/3.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/4.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/5.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/6.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/7.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/8.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/9.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/10.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/11.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/12.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/13.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/14.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/15.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/16.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/17.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/18.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/19.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/20.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/21.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/22.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/23.0 {
+            no-dhcp-trusted;
+        }
+    }
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_FUF {
+        vlan-id 213;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}
+poe {
+    interface all;
+}

switchconfig/sw-infojurte

@@ -0,0 +1,126 @@
+version 15.1R7-S1;
+system {
+    host-name sw-infojurte;
+    auto-snapshot;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20"; ## SECRET-DATA
+	ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)"; ## SECRET-DATA
+        ssh-ed25519 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcOPtW5FWNIdlMQFoqeyA1vHw+cA8ft8oXSbXPzQNL9 n0emis@n0emis.eu"; ## SECRET-DATA
+    }
+    services {
+        ssh;
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/1/3 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_MGMT VL_WLAN VL_INFOJURTE ];
+                }
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.19/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+}

switchconfig/sw-international

@@ -0,0 +1,127 @@
+version 15.1R7-S1;
+system {
+    host-name sw-international;
+    auto-snapshot;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20"; ## SECRET-DATA
+	ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)"; ## SECRET-DATA
+        ssh-ed25519 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcOPtW5FWNIdlMQFoqeyA1vHw+cA8ft8oXSbXPzQNL9 n0emis@n0emis.eu"; ## SECRET-DATA
+    }
+    services {
+        ssh;
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/1/3 {
+        description "uplink: sw-programmtresen";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_MGMT VL_WLAN VL_SIP VL_INTERNATIONAL ];
+                }
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.17/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+}

switchconfig/sw-leitstelle

@@ -0,0 +1,451 @@
+## Last changed: 2016-01-20 09:15:52 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_FUF VL_MAV ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-leitstelle;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_WLAN;
+                }
+            }
+        }
+    }
+    ge-0/0/1 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/2 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/3 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/4 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/5 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/6 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/7 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/8 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/9 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/10 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/11 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/12 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/13 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/14 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/15 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/16 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/17 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/18 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/19 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/20 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/21 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/22 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/0/23 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_LEITSTELLE;
+                }
+            }
+        }
+    }
+    ge-0/1/3 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-programmtresen";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.18/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    secure-access-port {
+        interface ge-0/0/0.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/1.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/2.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/3.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/4.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/5.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/6.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/7.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/8.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/9.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/10.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/11.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/12.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/13.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/14.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/15.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/16.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/17.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/18.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/19.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/20.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/21.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/22.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/23.0 {
+            no-dhcp-trusted;
+        }
+    }
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_FUF {
+        vlan-id 213;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}
+poe {
+    interface ge-0/0/0;
+}

switchconfig/sw-programmtresen

@@ -0,0 +1,754 @@
+## Last changed: 2016-01-22 09:03:18 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_FUF VL_MAV ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-programmtresen;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/1 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/2 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/3 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/4 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/5 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/6 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/7 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/8 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/9 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/10 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/11 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/12 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/13 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/14 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/15 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/16 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/17 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/18 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/19 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/20 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/21 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/22 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/23 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/24 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/25 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/26 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/27 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/28 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/29 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/30 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/31 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/32 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/33 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/34 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/35 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/36 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/37 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/38 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/39 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/40 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/41 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/42 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/43 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/44 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/45 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/46 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/0/47 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_PROGRAMM;
+                }
+            }
+        }
+    }
+    ge-0/1/0 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-international";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/1 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-leitstelle";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/3 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-zentral-2";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.16/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    secure-access-port {
+        interface ge-0/0/0.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/1.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/2.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/3.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/4.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/5.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/6.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/7.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/8.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/9.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/10.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/11.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/12.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/13.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/14.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/15.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/16.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/17.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/18.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/19.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/20.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/21.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/22.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/23.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/24.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/25.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/26.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/27.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/28.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/29.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/30.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/31.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/32.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/33.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/34.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/35.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/36.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/37.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/38.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/39.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/40.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/41.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/42.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/43.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/44.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/45.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/46.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/47.0 {
+            no-dhcp-trusted;
+        }
+    }
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_FUF {
+        vlan-id 213;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}

switchconfig/sw-technik-container

@@ -0,0 +1,308 @@
+## Last changed: 2022-03-02 21:05:33 UTC
+version 12.3R12-S21;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-technik-container;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+        ssh-ed25519 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcOPtW5FWNIdlMQFoqeyA1vHw+cA8ft8oXSbXPzQNL9 n0emis@n0emis.eu";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_IOT;
+                }
+            }
+        }
+    }
+    ge-0/0/1 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/0/2 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/0/3 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/0/4 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/0/5 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/0/6 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/0/7 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/0/8 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/0/9 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/0/10 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_WLAN;
+                }
+            }
+        }
+    }
+    ge-0/0/11 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TECHNIK;
+                }
+            }
+        }
+    }
+    ge-0/1/0 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-technik-zelt";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/1 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-zentral-1";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.21/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    secure-access-port {
+        interface ge-0/0/0.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/1.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/2.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/3.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/4.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/5.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/6.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/7.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/8.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/9.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/10.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/11.0 {
+            no-dhcp-trusted;
+        }
+    }
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}

switchconfig/sw-technik-zelt

@@ -0,0 +1,348 @@
+## Last changed: 2022-03-03 07:32:51 UTC
+version 12.3R12-S21;
+system {
+    host-name sw-technik-zelt;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+        ssh-ed25519 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcOPtW5FWNIdlMQFoqeyA1vHw+cA8ft8oXSbXPzQNL9 n0emis@n0emis.eu";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/1 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/2 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/3 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/4 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/5 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/8 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_IKT;
+                }
+            }
+        }
+    }
+    ge-0/0/10 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_TECHNIK VL_MGMT ];
+                }
+            }
+        }
+    }
+    ge-0/0/11 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode access;
+            }
+        }
+    }
+    ge-0/0/12 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_DECT;
+                }
+            }
+        }
+    }
+    ge-0/0/13 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_DECT;
+                }
+            }
+        }
+    }
+    ge-0/0/14 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_DECT;
+                }
+            }
+        }
+    }
+    ge-0/0/15 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_DECT;
+                }
+            }
+        }
+    }
+    ge-0/0/16 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_SIP;
+                }
+            }
+        }
+    }
+    ge-0/0/17 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_SIP;
+                }
+            }
+        }
+    }
+    ge-0/0/18 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_SIP;
+                }
+            }
+        }
+    }
+    ge-0/0/19 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_SIP;
+                }
+            }
+        }
+    }
+    ge-0/0/20 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_SIP;
+                }
+            }
+        }
+    }
+    ge-0/0/21 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_SIP;
+                }
+            }
+        }
+    }
+    ge-0/0/22 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members VL_MGMT;
+                }
+                native-vlan-id VL_WLAN;
+            }
+        }
+    }
+    ge-0/0/23 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_MGMT VL_WLAN VL_DECT VL_SIP VL_IOT VL_IKT_TOYS VL_IKT VL_TECHNIK ];
+                }
+            }
+        }
+    }
+    ge-0/1/3 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_MGMT VL_WLAN VL_DECT VL_SIP VL_IOT VL_IKT_TOYS VL_IKT VL_TECHNIK ];
+                }
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.20/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    analyzer hp {
+        input {
+            ingress {
+                interface ge-0/0/10.0;
+            }
+            egress {
+                interface ge-0/0/10.0;
+            }
+        }
+        output {
+            interface {
+                ge-0/0/11.0;
+            }
+        }
+    }
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}
+poe {
+    interface all;
+}

switchconfig/sw-trabantenstadt

@@ -0,0 +1,126 @@
+version 15.1R7-S10;
+system {
+    host-name sw-trabantenstadt;
+    auto-snapshot;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20"; ## SECRET-DATA
+	ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)"; ## SECRET-DATA
+        ssh-ed25519 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcOPtW5FWNIdlMQFoqeyA1vHw+cA8ft8oXSbXPzQNL9 n0emis@n0emis.eu"; ## SECRET-DATA
+    }
+    services {
+        ssh;
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/23 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_MGMT VL_WLAN VL_DECT VL_SIP VL_YOLO ];
+                }
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.26/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+}

switchconfig/sw-verwaltung

@@ -0,0 +1,471 @@
+## Last changed: 2022-07-26 20:48:41 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_MAV ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-verwaltung;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        description BLL;
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_MGMT VL_VERWALTUNG ];
+                }
+                native-vlan-id VL_VERWALTUNG;
+            }
+        }
+    }
+    ge-0/0/1 {
+        description Finanzen;
+        unit 0 {
+            family ethernet-switching {
+                port-mode access;
+                vlan {
+                    members VL_VERWALTUNG;
+                }
+            }
+        }
+    }
+    ge-0/0/2 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/3 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/4 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/5 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/6 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/7 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/8 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/9 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/10 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/11 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/12 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/13 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/14 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/15 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/16 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/17 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_OFFICE;
+                }
+            }
+        }
+    }
+    ge-0/0/18 {
+        description sw-finanzen;
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_OFFICE VL_MGMT ];
+                }
+                native-vlan-id 206;
+            }
+        }
+    }
+    ge-0/0/19 {
+        description "AP BLL";
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_WLAN;
+                }
+            }
+        }
+    }
+    ge-0/0/20 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_SIP;
+                }
+            }
+        }
+    }
+    ge-0/0/21 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_SIP;
+                }
+            }
+        }
+    }
+    ge-0/0/22 {
+        description AP;
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_WLAN;
+                }
+            }
+        }
+    }
+    ge-0/0/23 {
+        description DECT;
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_DECT;
+                }
+            }
+        }
+    }
+    ge-0/1/3 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-zentral-1";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.13/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    secure-access-port {
+        interface ge-0/0/0.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/1.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/2.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/3.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/4.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/5.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/6.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/7.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/8.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/9.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/10.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/11.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/12.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/13.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/14.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/15.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/16.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/17.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/18.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/19.0 {
+            allowed-mac 94:b4:0f:c2:79:f4;
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/20.0 {
+            allowed-mac 00:04:13:34:84:4b;
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/21.0 {
+            allowed-mac c8:9c:1d:6e:49:de;
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/22.0 {
+            allowed-mac 18:64:72:c6:ce:40;
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/23.0 {
+            allowed-mac 00:30:42:1b:8c:7a;
+            no-dhcp-trusted;
+        }
+        interface ge-0/1/3.0 {
+            dhcp-trusted;
+        }
+    }
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}
+poe {
+    interface ge-0/0/22;
+    interface ge-0/0/23;
+    interface ge-0/0/21;
+    interface ge-0/0/20;
+    interface ge-0/0/19;
+}

switchconfig/sw-waschhaus

@@ -0,0 +1,164 @@
+## Last changed: 2016-01-22 09:35:42 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_MAV ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-waschhaus;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/1/3 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-hospital";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.24/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}

switchconfig/sw-zentral-1

@@ -0,0 +1,278 @@
+## Last changed: 2020-02-26 04:52:18 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_SERVICES VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_FUF VL_MAV ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-zentral-1;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/1 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_DECT;
+                }
+            }
+        }
+    }
+    ge-0/0/24 {
+        description mooncake;
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members all;
+                }
+            }
+        }
+    }
+    ge-0/0/26 {
+        description sunbread;
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members all;
+                }
+            }
+        }
+    }
+    ge-0/0/28 {
+        apply-groups backbone_vlans;
+        description "WLAN Controller";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/0/44 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TELEKOM;
+                }
+            }
+        }
+    }
+    ge-0/0/45 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_UPLINK_A;
+                }
+            }
+        }
+    }
+    ge-0/0/47 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-zentral-2";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members VL_UPLINK_B;
+                }
+            }
+        }
+    }
+    ge-0/1/0 {
+        description "T-COM - A";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members VL_TELEKOM;
+                }
+            }
+        }
+    }
+    ge-0/1/1 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-verwaltung";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/2 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-hospital";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/3 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-technik-container";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.11/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_FUF {
+        vlan-id 213;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SERVICES {
+        vlan-id 10;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_TELEKOM {
+        vlan-id 7;
+    }
+    VL_UPLINK_A {
+        vlan-id 101;
+    }
+    VL_UPLINK_B {
+        vlan-id 102;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}

switchconfig/sw-zentral-2

@@ -0,0 +1,253 @@
+## Last changed: 2016-01-22 06:05:26 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_FUF VL_MAV ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-zentral-2;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/34 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members VL_TELEKOM;
+                }
+            }
+        }
+    }
+    ge-0/0/43 {
+        description "Uplink B alt";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members VL_TELEKOM;
+                }
+            }
+        }
+    }
+    ge-0/0/44 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_TELEKOM;
+                }
+            }
+        }
+    }
+    ge-0/0/45 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_UPLINK_B;
+                }
+            }
+        }
+    }
+    ge-0/0/47 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-zentral-1";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members VL_UPLINK_B;
+                }
+            }
+        }
+    }
+    ge-0/1/0 {
+        description "T-COM - B";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members VL_TELEKOM;
+                }
+            }
+        }
+    }
+    ge-0/1/1 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-zoll-container";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/2 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-programmtresen";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/3 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-infojurte";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.12/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_FUF {
+        vlan-id 213;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_TELEKOM {
+        vlan-id 7;
+    }
+    VL_UPLINK_B {
+        vlan-id 102;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}

switchconfig/sw-zoll-container

@@ -0,0 +1,319 @@
+## Last changed: 2016-01-21 06:45:26 UTC
+version 12.3R12.4;
+groups {
+    backbone_vlans {
+        interfaces {
+            <*> {
+                unit 0 {
+                    family ethernet-switching {
+                        vlan {
+                            members [ VL_SIP VL_DECT VL_HOSPITAL VL_IKT VL_IKT_TOYS VL_INFOJURTE VL_INTERNATIONAL VL_IOT VL_LEITSTELLE VL_MGMT VL_OFFICE VL_PROGRAMM VL_TECHNIK VL_VERWALTUNG VL_WLAN VL_YOLO VL_ZENTRAL VL_MAV ];
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+system {
+    host-name sw-zoll-container;
+    auto-snapshot;
+    domain-name bula22.de;
+    domain-search bula22.de;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20";
+        ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)";
+    }
+    name-server {
+        10.42.10.8;
+    }
+    login {
+        user fw {
+            uid 2000;
+            class super-user;
+            authentication {
+                ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMTsFE90WT+fvRnIuIBbjLJA2Hyne6duD306+Yg3z9yVTSCQxpFcolEwRQi5X4hsb3WdlW+YtvShXcFVNi7gtgSyIsgT1+YqpR+qIC+/r2h6NeA92dztigpbznOm9oL8vOP45S9fHedJ57E/UosYW2/du4W+6U+xH1ItyQx6AiJAj/RPpLWJz9FhP99Qwp6YiPAkxujgXtOMwX0xFmiQPv9QzBaD9jOKK0vE26IFX5RYAqontVgWGn6EdceR70vTQBcAsFYMS0sc9311H2wBfOptznyIZNInAsppaGNDMdOx9SdMVDZ6GDlOCsLvHq6+ra1jGdlwtgduVQeEpHmmjD";
+            }
+        }
+    }
+    services {
+        ssh;
+    }
+}
+chassis {
+    alarm {
+        management-ethernet {
+            link-down ignore;
+        }
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        description Webcam;
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_IOT;
+                }
+            }
+        }
+    }
+    ge-0/0/1 {
+        description "AP Zoll Container";
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_WLAN;
+                }
+            }
+        }
+    }
+    ge-0/0/2 {
+        description "DECT Zoll";
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_DECT;
+                }
+            }
+        }
+    }
+    ge-0/0/3 {
+        description "WLAN AP Zoll";
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_WLAN;
+                }
+            }
+        }
+    }
+    ge-0/0/4 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_ZOLL;
+                }
+            }
+        }
+    }
+    ge-0/0/5 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_ZOLL;
+                }
+            }
+        }
+    }
+    ge-0/0/6 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_ZOLL;
+                }
+            }
+        }
+    }
+    ge-0/0/7 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_ZOLL;
+                }
+            }
+        }
+    }
+    ge-0/0/8 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_ZOLL;
+                }
+            }
+        }
+    }
+    ge-0/0/9 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_ZOLL;
+                }
+            }
+        }
+    }
+    ge-0/0/10 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_ZOLL;
+                }
+            }
+        }
+    }
+    ge-0/0/11 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_ZOLL;
+                }
+            }
+        }
+    }
+    ge-0/1/0 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-zentral-2";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    ge-0/1/1 {
+        apply-groups backbone_vlans;
+        description "UPLINK sw-zoll-zelt";
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.14/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    secure-access-port {
+        interface ge-0/0/0.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/1.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/2.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/3.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/4.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/5.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/6.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/7.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/8.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/9.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/10.0 {
+            no-dhcp-trusted;
+        }
+        interface ge-0/0/11.0 {
+            no-dhcp-trusted;
+        }
+    }
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_MAV {
+        vlan-id 214;
+    }
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+}
+poe {
+    interface ge-0/0/1;
+    interface ge-0/0/2;
+    interface ge-0/0/3;
+}

switchconfig/sw-zoll-zelt

@@ -0,0 +1,136 @@
+version 15.1R7-S10
+system {
+    host-name sw-zoll-zelt;
+    auto-snapshot;
+    root-authentication {
+        encrypted-password "$1$DAjLGZX7$sHIjgeZhXhq/IcgRKOWy20"; ## SECRET-DATA
+	ssh-rsa "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8xqVakxJ+AwcIrS/wyL03N++pE09epwMFlIMXWvlpwwEp1J/0H7nygwxk/9LIZdabs/ETWn0s8oHAkc7YR1c6ajSTCDiZEYATAWt7t8t4Gw/80c8u8T50lIqmiDEEVbOVv3Vta/pAN4hAUp9U5DpYCkQbvF+NKKcK3Yp8d9usNC6ohqgTK+IGAEdMhvpbbNppDMXoWHuynBzUX7TS6ST6yEr0tD+CBbCpbfcMuwTI3lNtfywEVpuFaeHqDZx2QDrEX4bg0dRKgQstbXYdqmBfnOiBpUr8Wyl8U1J24rN+E07pBw/8KDGWbVg19/Ex8o4ht/p5voUfKVjD/DwWXTLntBirjfAgQAm4GH/qP4x3zNiTtlYlQFbXSk6VEVrTrxCB5rTWvGnhg31tk5P3YwvagDmGABazY5s/8tlttSc1yWBctWQJCjxSqcCLekxG4D1rVuGKCKOZgflQ9QFdQlKycInPBek3zi0i3GYkE1YnNFye5ggOnxT8qGuKjfdtZI9qvMJQO8lbEDzbYQvNns1V/k4ZobiihYwrG5TJUzZFEpMYetDK6tI8BRU11d+ja0jWzguj5/7wc0nrr/BiZ8FkAr2fZ60j2aI5kG0s3qjbrQbB/RXaGP9hRU0+480+IokNJJIcjv5iwH5ophdrjC8GH4So2kPPt0NXob1yNysdjw== n0emis@noemis.me (OLD)"; ## SECRET-DATA
+        ssh-ed25519 "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcOPtW5FWNIdlMQFoqeyA1vHw+cA8ft8oXSbXPzQNL9 n0emis@n0emis.eu"; ## SECRET-DATA
+    }
+    services {
+        ssh;
+    }
+}
+interfaces {
+    ge-0/0/0 {
+        unit 0 {
+            family ethernet-switching {
+                vlan {
+                    members VL_MGMT;
+                }
+            }
+        }
+    }
+    ge-0/0/23 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_MGMT VL_WLAN VL_DECT VL_SIP VL_ZOLL ];
+                }
+            }
+        }
+    }
+    ge-0/1/3 {
+        unit 0 {
+            family ethernet-switching {
+                port-mode trunk;
+                vlan {
+                    members [ VL_MGMT VL_WLAN VL_DECT VL_SIP VL_ZOLL ];
+                }
+            }
+        }
+    }
+    vlan {
+        unit 42 {
+            family inet {
+                address 10.42.42.15/24;
+            }
+        }
+    }
+}
+snmp {
+    stats-cache-lifetime 15;
+    community tellme {
+        authorization read-only;
+    }
+}
+routing-options {
+    static {
+        route 0.0.0.0/0 next-hop 10.42.42.1;
+    }
+}
+protocols {
+    igmp-snooping {
+        vlan all;
+    }
+    lldp {
+        port-id-subtype locally-assigned;
+        interface all;
+    }
+    lldp-med {
+        interface all;
+    }
+}
+ethernet-switching-options {
+    storm-control {
+        interface all;
+    }
+}
+vlans {
+    VL_MGMT {
+        vlan-id 42;
+        l3-interface vlan.42
+    }
+    VL_WLAN {
+        vlan-id 131;
+    }
+    VL_DECT {
+        vlan-id 132;
+    }
+    VL_SIP {
+        vlan-id 133;
+    }
+    VL_IOT {
+        vlan-id 151;
+    }
+    VL_IKT_TOYS {
+        vlan-id 152;
+    }
+    VL_IKT {
+        vlan-id 201;
+    }
+    VL_TECHNIK {
+        vlan-id 202;
+    }
+    VL_HOSPITAL {
+        vlan-id 203;
+    }
+    VL_ZOLL {
+        vlan-id 204;
+    }
+    VL_LEITSTELLE {
+        vlan-id 205;
+    }
+    VL_VERWALTUNG {
+        vlan-id 206;
+    }
+    VL_ZENTRAL {
+        vlan-id 207;
+    }
+    VL_YOLO {
+        vlan-id 208;
+    }
+    VL_INFOJURTE {
+        vlan-id 209;
+    }
+    VL_INTERNATIONAL {
+        vlan-id 210;
+    }
+    VL_PROGRAMM {
+        vlan-id 211;
+    }
+    VL_OFFICE {
+        vlan-id 212;
+    }
+}

users/default.nix

@@ -6,5 +6,6 @@
     ./garionion
     ./jannik
     ./n0emis
+    ./fw
   ];
 }

users/fw/default.nix

@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+
+{
+  users.users.fw = {
+    isNormalUser = true;
+    shell = pkgs.bash;
+    packages = with pkgs; [ dnsutils git htop jq moreutils nettools nmap tshark tree ];
+    hashedPassword = "$6$034hbg0r8vbwbgg$m8t1HcsnxCruOUqG0EEO1EWHpttMIYSSY2tSeMZEsaQlOY3XgYruC9RftFBfhf9fDPUaNXXmvgdsz.tu1DdKw0";
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAe4BaMl3YEHPgO8Rh04UgNaTKqmdo+2fASty4LggJJe fw"
+    ];
+  };
+}