What I am struggling with now is segregating clients into VLANs. When I create an access VLAN (22) for my client, I can no longer access the internet. My understanding is that I must create a bridge so that the VLAN22 can access the LAN interface with the gateway IP assigned. Each VLAN client will have a public IP from the single /24 subnet.

When I followed the instructions for TNSR VLAN, nothing seemed to be problematic, but when I created the bridge things went wonky. Not only do the VLANs not work, but I also lose access to the non-VLAN devices.

interface bridge domain 10
flood
uu-flood
forward
learn
exit

int Interface1
bridge domain 10
enable
exit
int Interface1.22
bridge domain 10
enable
exit
interface loopback bridgeloop
instance 1
exit
interface loop1
ip address 10.25.254.1/24
bridge domain 10 bvi
enable
exit

I did try changing the loop1 IP to my gateway IP and removing it from Interface1 but that didn't help. Maybe I am going about this wrong, but I need some guidance if possible.

Thanks,
Shawn

For background:
On TNSR device1:
Interface1 is connected to a switch that carries my upstream BGP using a 10.34.14.0/24 address for now.
Interface2 is the interface that has my gateway IP 23.x.x.x/24 and is also the port connected to the first switch.
Interface3 is connected to a second switch and has no IP address

TNSR device2 :
Interface1 is connected to the switch that carreies the BGP but has no IP address and for all practical purposes is doing nothing

Interface 2 is connected to the 2nd switch and has no IP address

Interface 3 is connected to the first switch and has no IP address

As you can see, the 2nd TNSR device is mostly sitting around doing nothing but eventually should be integrated in via VRRP or whatever I can get working.

• GOAL: Disable any Host Interface RAs from being processed
  • This includes creating IPv6 Addresses and/or Routes
• ISSUE: RAs come in and apply IPv6 Addrs / Routes on host interfaces
  • no configuration options appear present in docs or the CLI to surpress RAs
• NON-PERSISTENT FULL WORKAROUND: applying accept_ra: false to the proper section of /etc/netplan/50-tnsr-host-interfaces.yaml temporarily works to suppress RAs
  • but as expected, any reboots or changes to Host Interface configuration in the TNSR CLI blow this away
• UNACCEPTABLE HACK WORKAROUND: set a more specific route for source client subnets to take a different route versus the default

How can RAs be suppressed in a supported, persistent way? In my situation, they conflict with routes required for SSH connectivity to manage these hosts.

https://www.netgate.com/blog/using-tnsr-software-to-conserve-address-space-and-improve-security

Certainly! Here's a draft email for your request to TNSR community regarding their API:

Subject: Inquiry About API Access for TNSR Models - Integration with Ansible

Dear TNSR Community Team,

I hope this message finds you well. I am reaching out to inquire about the possibility of accessing the TNSR API in a format other than the standard documentation provided. My primary goal is to utilize all available models within the TNSR suite and integrate them with Ansible for streamlined operations.

The current process of copying each module individually is quite time-consuming, and I am seeking a more efficient method. This approach, unfortunately, feels like it could extend indefinitely, perhaps even into the next year, which is not feasible for my project timelines.

I am very interested in exploring whether there exists an alternative way to access and implement the TNSR API that would allow me to use all models in a more consolidated and time-efficient manner. My aim is to automate processes using Ansible, and having a streamlined API access would significantly aid in achieving this.

If there are any existing solutions or suggestions you could offer, it would be immensely helpful. I am open to any recommendations that might assist in making this integration more seamless and efficient.

Thank you for your time and consideration. I look forward to your response and any assistance you can provide.

Best regards