19:21 < Yousra> Dereckson router-003: IP= 178.32.70.111/30, en fait .111 c'est la broadcast

A new bloc IPV4 was added in NetBox : The 172.27.27.0/28 subnet was fully allocated and currently used by VMs on Hyper-1, so I expand it to a larger prefix by combining 172.27.27.0/28 and 172.27.27.16/28 into a single 172.27.27.0/27 subnet to allow better address utilization in the future.

The additional public IPv4 address has been received and is ready to be used for the CARP setup : IP=51.68.252.230/32

We chose to go with strongswan as it is native to FreeBSD and the most complete solution in terms of supported protocols. Strongswan has already been installed and tested on router-002 and router-003.

GRE tunnel and IPsec configurations work as intended between router-002 and router-003, GRE is reachable on both sides and traffic is encrypted in IPsec with an ESP header

I can then proceed with the CARP configuration, and if new things are discovered, I will document them on the wiki :)

This task should be clarified.

Yousra asked on #nasqueron-ops

22:24:01 < yousra> Dereckson Je me disais que, dans la configuration actuelle, router-004 ne serait utilisé qu’en cas de panne. En fonctionnement normal, une des deux
machines resterait donc presque inactive. Je trouvais que se serait plutôt bien que les deux routeurs travaillent en permanence tout en gardant la redondance.
22:24:02 < yousra> Mais comme on n’a pas vraiment plusieurs VLAN ou réseaux distincts, je ne suis pas sûr que la topologie actuelle permette cette répartition. Est-ce qu’on > pourrait quand même optimiser ça d’une certaine manière ?

A tunnel has been created between router-002 and router-003 using standard interface to avoid recursion and have a stable connection

It was a nice work and comprehensive: NetBox, Salt, deployed.

Just a small note we should still reboot WindRiver:

• to validate "second chance route for Drake service" (D3897)
• to fix pam_nologin issue

@Duranzed Actually, dmesg(8) gave a pretty confirmation of the encapsulation GRE-in-GRE issue:

The on-wiki page doesn't currently give a clear overview of what it would be like to run against each solution.

21:30:03 < yousra> [ERROR] Source file salt://roles/core/motd/files/router-002 not found in salt env 'base'