YAMAHA NVR700W: Hawaii経由でOracle Cloud Tokyo と Phoenix RegionをIPSec VPN接続してみてみた

今回Hawaiiに来ました。
Hawaiiへ住んでみてみたい。
ということで、YAMAHA NVR700Wを持ってきました。
<img width="425" alt="07のコピー.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/2c399a05-4a0b-d10b-5f64-fdee976670c8.png">
ハワイはちょうど日本とアメリカの中間あたりにありますので、ハワイ経由で日本とアメリカをIPSec VPNでつなぐハワイ中継出張所を構築してみてみます。

#■構成
<img width="1337" alt="構成図2.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/15293069-337e-7169-2b4c-14777e673738.png">
あらかじめ、Transit RoutingなどVCN Network, Instance等の設定を以前の記事を参考に構築しておきます。ここでは、YAMAHA NVR700Wの設定メインに記載していきます。
・参考: [Transit Routing + IPSec VPN / FastConnectで Object Storage, Autonomous Databaseへ接続してみてみた](https://qiita.com/shirok/items/ec0e5a09346422346fd4)


#■ハワイでSIMカード取得
NVR700WはSIMカードでInternetにつながります。
ハワイの空港ではSIMカード売ってないので、買いに行きます。
今回は、Pokeで有名なMaguro Brothersの隣のほうにあるここで書いました。
<img width="638" alt="02.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/518f8b32-66b2-14b7-31b7-384a270d9ccd.png">

一ヶ月 $50でUnlimited Dataなのでこれにしときます。
IPhoneへのInstall設定もしてくれて、親切なお店でした。
<img width="201" alt="01.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/acf3026e-62f7-979a-1235-6f5ef862589a.png">


そしてついでに、Pokeも買っときます。
・Maguro Brothers: https://www.yelp.com/biz/maguro-brothers-hawaii-honolulu-6

購入したSIMカードは LycaMobileです。
<img width="554" alt="05.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/37006959-e32f-6096-c704-9c5f32eeb7ba.png">


APN設定は以下な感じです。
・参考: 
　- [LycaMobile APN Settings](https://bestmvno.com/apn-settings/lycamobile-apn-settings/)
　- [AT&T APN Settings](https://apn-settings.com/us/att-apn-settings/)

ただ、、このSIMはNVR700wで設定すると海外SIMだからか「圏外」状態になり、AT&TのSIMでも疎通する事ができなかったため、、SIM接続は今回断念します。
Internet接続はHotelのルーターからLANケーブルを差してInternet接続することにしました。



#■ハワイの電圧
ハワイの電圧は110/120V、日本は100Vなので、変圧されないアダプターのNVR700Wは電源をつけることができません。
ですので、変圧器が必要です。しかしながら、日本から持ってきてないので、、まずは買いに行きます。
ハワイには電気店がないので、ABC Store, Don Quijote, Walmartなど回りましたが売っていないので、ちょっと遠い Best Buyへ買いに行きました。
<img width="901" alt="03.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/5e143e51-55fa-d625-fb07-4c4557b9e80f.png">

・[Best Buy Honolulu](https://stores.bestbuy.com/hi/honolulu/478-alakawa-st-763.html)
・[Don Quijote Hawaii](http://donquijotehawaii.com/)
・[Walmart Honoklulu](https://www.walmart.com/store/3478/honolulu-hi)

ついでに、変圧器の他にLANケーブルと MACに接続するためのUSB-C to Gigabit Ethernet Adapterとかも買っときます。
<img width="1037" alt="06.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/7731dc84-5b6d-0047-cacc-23cbd03b355f.png">


そして、近くにPokeで有名なNico’s Pier 38 があるので歩いて食べに行ってみてみます。
・Nico’s Pier 38: https://nicospier38.com/

#■Yamaha NVR700Wセットアップ
準備も整いましたので、設定していきます。
![IMG_6660.jpg](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/86fb200f-4b46-533d-4f84-47549dd9ae00.jpeg)

##●初期化
まずは初期化します

シリアルコンソールケーブルはちゃんともってきているので、コマンドラインで設定していきます。

① cold start 実行
cold startコマンドで初期化がされます

```shell-session
# cold start
    Password:
    RTFS formatting... Done.
    Restarting ...


    NVR700W BootROM Ver. 1.00
    Copyright (c) 2016 Yamaha Corporation. All Rights Reserved.

    Press 'Enter' or 'Return' to select a firmware and a configuration.
    Default settings :  exec0 and config0

    Starting with default settings.
    Starting with exec0 and config0 ...

    NVR700W Rev.15.00.16 (Thu Jun 20 19:48:42 2019)
    Copyright (c) 1994-2019 Yamaha Corporation. All Rights Reserved.
    To display the software copyright statement, use 'show copyright' command.
    00:a0:cd:a2:c1, 00:a0:cd:a2:c2
    Memory 256Mbytes, 2LAN, 1ONU, 1WWAN
```


##●初期化コンフィグ確認

①ユーザー名無し でLogin
初期状態はユーザー名無し でLoginしてユーザーをつくっていきます。

```shell-session
# Password:

    NVR700W Rev.15.00.16 (Thu Jun 20 19:48:42 2019)
    Copyright (c) 1994-2019 Yamaha Corporation. All Rights Reserved.
    To display the software copyright statement, use 'show copyright' command.
    00:a0:cd:a2:c1, 00:a0:cd:a2:c2
    Memory 256Mbytes, 2LAN, 1ONU, 1WWAN

    The login password is factory default setting. Please request an administrator to change the password by the 'login password' command.
```


② 管理ユーザーへ移行

```shell-session
> administrator
    Password:
    The administrator password is factory default setting. Please change the password by the 'administrator password' command.
#
```


③ 初期コンフィグ確認

```shell-session
# show config
    # NVR700W Rev.15.00.16 (Thu Jun 20 19:48:42 2019)
    # MAC Address : 00:a0:cd:a2:c1, 00:a0:cd:a2:c2
    # Memory 256Mbytes, 2LAN, 1ONU, 1WWAN
    # main:  NVR700W ver=00 serial=TESTSERIAL MAC-Address=00:a0:cd:a2:c1 MAC-Address=00:a0:cd:a2:c2
    # Reporting Date: Mar 11 14:09:42 2020
    ip lan1 address 192.168.100.1/24
    telnetd host lan
    dhcp service server
    dhcp server rfc2131 compliant except remain-silent
    dhcp scope 1 192.168.100.2-192.168.100.191/24
    dns private name setup.netvolante.jp
    analog supplementary-service pseudo call-waiting
    analog extension dial prefix sip prefix="9#"
```


##●Internet接続
Internet接続はWebコンソールから設定してみてみます


① 簡単接続画面
デフォルトIP 192.168.100.1 へHTTPブラウザ接続して、[かんたん設定]タブから[プロバイダい接続]を選択し、[新規]をクリック
<img width="1200" alt="02.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/a233a46c-1410-8c4e-4d3c-800e3f8e57b5.png">


②インターフェースの選択画面
接続インターフェース: WANを選択し、[次へ]をクリック
<img width="1198" alt="03.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/ab5881d2-4e16-c8a1-1a2b-b355842cc20b.png">


③回線自動判別画面
[次へ]をクリック
<img width="1194" alt="04.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/e2eca89b-c839-c7d4-59b9-9380c9ce7219.png">

④接続種別の選択画面
「DHCP、又は固定IPアドレスによる接続」をクリック
<img width="1198" alt="05.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/81fd202d-399f-0d3c-b386-288ec8eeb39b.png">


⑤プロバイダ情報の設定画面
ここでは、HotelのLANに接続するので、DHCPで変動されないように固定とするため「IPアドレスを選択」し以下を入力し[次へ]をクリック

    WAN側IPアドレス: 任意のアドレス
    ネットマスク:  任意のネットマスク
    デフォルトゲートウェイ： 任意のデフォルトゲートウェイ

<img width="1204" alt="06.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/ce0b8e84-71d4-321c-69f7-d6a0f04e6b89.png">


⑥DNSサーバーの設定画面
任意の設定を行い、[次へ]をクリック
<img width="1198" alt="07.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/88f76782-32c8-3383-929a-3345673f97c4.png">

⑦IPフィルタの設定
ここでは、IPSec通信できなくならないように、「設定しない」を選択し、[次へ]をクリック
<img width="1198" alt="08.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/6892e44a-3d50-49c1-0f3f-1c8c65f299ce.png">

⑧設定内容の確認画面
設定内容を確認し、[次へ]をクリック
<img width="797" alt="09.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/be12c67e-70ce-409f-69c8-fe9bc5b89fb7.png">

⑨プロバイダー接続画面
[接続状態]の項目から接続が確立されていることを確認
<img width="1091" alt="10.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/44df8f01-9086-7dee-ba6f-9f0da2c1cfa7.png">

⑩ Config確認

```shell-session
# show config
    # NVR700W Rev.15.00.16 (Thu Jun 20 19:48:42 2019)
    # MAC Address : 00:a0:cd:a2:c1, 00:a0:cd:a2:c2
    # Memory 256Mbytes, 2LAN, 1ONU, 1WWAN
    # main:  NVR700W ver=00 serial=TESTSERIAL MAC-Address=00:a0:cd:a2:c1 MAC-Address=00:a0:cd:a2:c2
    # Reporting Date: Mar 11 14:34:26 2020
    ip route default gateway 192.168.1.1
    ip keepalive 1 icmp-echo 10 5 192.168.1.1
    ip lan1 address 192.168.100.1/24
    description lan2 Hawaii-Hotel01
    ip lan2 address 192.168.1.254/24
    ip lan2 nat descriptor 200
    ip filter 500000 restrict * * * * *
    nat descriptor type 200 masquerade
    nat descriptor address outer 200 primary
    telnetd host lan
    dhcp service server
    dhcp server rfc2131 compliant except remain-silent
    dhcp scope 1 192.168.100.2-192.168.100.191/24
    dns host lan1
    dns server 192.168.1.1
    dns server select 500201 192.168.1.1 any .
    dns private address spoof on
    dns private name setup.netvolante.jp
    httpd host lan1
    analog supplementary-service pseudo call-waiting
    analog extension dial prefix sip prefix="9#"
    statistics traffic on
```

#●Global IP確認
https://www.myglobalip.com/ へアクセスしてIntanetにアクセスできることと、OCIのCPEリソース作成時に必要なGlobal IPを確認しておきます

<img width="984" alt="0001.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/73917f7b-16a4-588d-a6b2-279a58c7d8f9.png">



#■OCI TokyoとのIPSec接続

●OCI IPSec接続設定
 以前の記事を参考にIPSec作成を行い、以下画面から、OracleからIPSec接続用に払い出された2つのVPN IP Adressをメモして、NCR700WのConfigを作成します
<img width="946" alt="14.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/c2dd26b3-0aca-401a-be7b-156bc155ef2a.png">



##●IPSec接続設定
以下Configを流し込みます

```shell-session
tunnel select 1
 description tunnel OCI-VPN1
 ipsec tunnel 1
  ipsec sa policy 1 1 esp aes256-cbc sha-hmac
  ipsec ike duration ipsec-sa 1 3600
  ipsec ike duration isakmp-sa 1 28800
  ipsec ike encryption 1 aes256-cbc
  ipsec ike group 1 modp1536
  ipsec ike hash 1 sha256
  ipsec ike keepalive log 1 off
  ipsec ike keepalive use 1 on dpd 5 4
  ipsec ike local address 1 192.168.1.254
  ipsec ike local id 1 0.0.0.0/0
  ipsec ike nat-traversal 1 on
  ipsec ike pfs 1 on
  ipsec ike pre-shared-key 1 text IPSecSharedSecret01
  ipsec ike remote address 1 140.204.100.101
  ipsec ike remote id 1 0.0.0.0/0
 ip tunnel address 192.168.255.201/30
 ip tunnel tcp mss limit auto
 tunnel enable 1
tunnel select 2
 description tunnel OCI-VPN2
 ipsec tunnel 2
  ipsec sa policy 2 2 esp aes256-cbc sha-hmac
  ipsec ike duration ipsec-sa 2 3600
  ipsec ike duration isakmp-sa 2 28800
  ipsec ike encryption 2 aes256-cbc
  ipsec ike group 2 modp1536
  ipsec ike hash 2 sha256
  ipsec ike keepalive log 2 off
  ipsec ike keepalive use 2 on dpd 5 4
  ipsec ike local address 2 192.168.1.254
  ipsec ike local id 2 0.0.0.0/0
  ipsec ike nat-traversal 2 on
  ipsec ike pfs 2 on
  ipsec ike pre-shared-key 2 text IPSecSharedSecret02
  ipsec ike remote address 2 140.204.100.102
  ipsec ike remote id 2 0.0.0.0/0
 ip tunnel address 192.168.255.205/30
 ip tunnel tcp mss limit auto
 tunnel enable 2
```

●IPSec SA確立確認

```shell-session
# show ipsec sa
    Total: isakmp:2 send:2 recv:3

    sa    sgw isakmp connection    dir  life[s] remote-id
    ----------------------------------------------------------------------------
    1     1    -     isakmp        -    28769   140.204.100.101
    2     2    -     isakmp        -    28729   140.204.100.102
    3     1    1     tun[0001]esp  send 3571    140.204.100.101
    4     1    -     tun[0001]esp  recv 3530    140.204.100.101
    5     2    2     tun[0002]esp  send 3531    140.204.100.102
    6     2    2     tun[0002]esp  recv 3531    140.204.100.102
    7     1    1     tun[0001]esp  recv 3571    140.204.100.101
```



##●BGP設定
以下Configを流し込みます

```shell-session
    tunnel select 1
    　ip tunnel address 192.168.255.201/30
    　ip tunnel remote address 192.168.255.202
    tunnel select 2
    　ip tunnel address 192.168.255.205/30
    　ip tunnel remote address 192.168.255.206
    bgp use on
    　bgp autonomous-system 65000
    　bgp log neighbor
    　bgp neighbor 1 31898 192.168.255.202 hold-time=180 local-address=192.168.255.201
    　bgp neighbor 2 31898 192.168.255.206 hold-time=180 local-address=192.168.255.205
    　bgp import filter 1 equal 0.0.0.0/0
    　bgp import 31898 static filter 1
```

##●OCI　IPSec接続ステータス確認
IPSec、BGP共にUPしてグリーンになっていることを確認
<img width="946" alt="15.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/f653378b-7a2e-ff4e-9d74-16f7db207725.png">



#■OCI PhoenixとのIPSec接続
上記 OCI TokyoとのIPSec接続同様に設定します。

##●OCI IPSec接続設定
Tokyo Region同様以下画面から、OracleからIPSec接続用に払い出された2つのVPN IP Adressをメモして、NCR700WのConfigを作成します
<img width="873" alt="08.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/4dd69c65-a277-f4e0-b095-aa119d75c7ac.png">




##●IPSec接続設定

以下Configを流し込みます

```shell-session
tunnel select 11
 description tunnel OCI-VPN11
 ipsec tunnel 11
  ipsec sa policy 11 11 esp aes256-cbc sha-hmac
  ipsec ike duration ipsec-sa 11 3600
  ipsec ike duration isakmp-sa 11 28800
  ipsec ike encryption 11 aes256-cbc
  ipsec ike group 11 modp1536
  ipsec ike hash 11 sha256
  ipsec ike keepalive log 11 off
  ipsec ike keepalive use 11 on dpd 5 4
  ipsec ike local address 11 192.168.1.254
  ipsec ike local id 11 0.0.0.0/0
  ipsec ike nat-traversal 11 on
  ipsec ike pfs 11 on
  ipsec ike pre-shared-key 11 text IPSecSharedSecret01
  ipsec ike remote address 11 129.146.200.201
  ipsec ike remote id 11 0.0.0.0/0
 ip tunnel address 192.168.255.213/30
 ip tunnel tcp mss limit auto
 tunnel enable 11
tunnel select 12
 description tunnel OCI-VPN12
 ipsec tunnel 12
  ipsec sa policy 12 12 esp aes256-cbc sha-hmac
  ipsec ike duration ipsec-sa 12 3600
  ipsec ike duration isakmp-sa 12 28800
  ipsec ike encryption 12 aes256-cbc
  ipsec ike group 12 modp1536
  ipsec ike hash 12 sha256
  ipsec ike keepalive log 12 off
  ipsec ike keepalive use 12 on dpd 5 4
  ipsec ike local address 12 192.168.1.254
  ipsec ike local id 12 0.0.0.0/0
  ipsec ike nat-traversal 12 on
  ipsec ike pfs 12 on
  ipsec ike pre-shared-key 12 text IPSecSharedSecret02
  ipsec ike remote address 12 129.146.200.202
  ipsec ike remote id 12 0.0.0.0/0
 ip tunnel address 192.168.255.217/30
 ip tunnel tcp mss limit auto
 tunnel enable 12
```


##●IPSec SA確立確認

```shell-session
# ipsec auto refresh on
# show ipsec sa
    Total: isakmp:4 send:6 recv:7

    sa    sgw isakmp connection    dir  life[s] remote-id
    ----------------------------------------------------------------------------
    1     1    -     isakmp        -    25300   140.204.100.101
    2     2    -     isakmp        -    25260   140.204.100.102
    3     1    1     tun[0001]esp  send 101     140.204.100.101
    4     1    -     tun[0001]esp  recv 60      140.204.100.101
    5     2    2     tun[0002]esp  send 61      140.204.100.102
    6     2    2     tun[0002]esp  recv 61      140.204.100.102
    7     1    1     tun[0001]esp  recv 101     140.204.100.101
    8     2    2     tun[0002]esp  send 2769    140.204.100.102
    9     2    2     tun[0002]esp  recv 2769    140.204.100.102
    10    1    1     tun[0001]esp  send 2809    140.204.100.101
    11    1    1     tun[0001]esp  recv 2809    140.204.100.101
    12    12   16    tun[0012]esp  send 3482    129.146.200.202
    13    11   -     isakmp        -    28605   129.146.200.201
    14    11   13    tun[0011]esp  send 3410    129.146.200.201
    15    11   13    tun[0011]esp  recv 3410    129.146.200.201
    16    12   -     isakmp        -    28677   129.146.200.202
    17    12   16    tun[0012]esp  recv 3482    129.146.200.202
```



#●BGP設定

```shell-session
    tunnel select 11
    　ip tunnel address 192.168.255.213/30
    　ip tunnel remote address 192.168.255.214

    tunnel select 12
    　ip tunnel address 192.168.255.217/30
    　ip tunnel remote address 192.168.255.218

    bgp use on
    　bgp autonomous-system 65000
    　bgp log neighbor
    　bgp neighbor 11 31898 192.168.255.214 hold-time=180 local-address=192.168.255.213
    　bgp neighbor 12 31898 192.168.255.218 hold-time=180 local-address=192.168.255.217
    　bgp import filter 1 equal 0.0.0.0/0
    　bgp import 31898 static filter 1
```


#●BGP伝搬確認
① BGP設定反映

```shell-session
# bgp configure refresh
```


②neighbor確認

```shell-session
# show status bgp neighbor
    BGP neighbor is 192.168.255.202, remote AS 31898, local AS 65000, external link
    BGP version 4, remote router ID 192.168.255.202
    BGP state = Established, up for 00:07:01
    Last read 00:00:34, hold time is 180, keepalive interval is 60 seconds
    Received 9 messages, 0 notifications, 0 in queue
    Sent 12 messages, 0 notifications, 0 in queue
    Connection established 1; dropped 0
    Last reset never
    Local host: 192.168.255.201, Local port: 179
    Foreign host: 192.168.255.202, Foreign port: 52226

    BGP neighbor is 192.168.255.206, remote AS 31898, local AS 65000, external link
    BGP version 4, remote router ID 192.168.255.206
    BGP state = Established, up for 00:06:55
    Last read 00:00:20, hold time is 180, keepalive interval is 60 seconds
    Received 8 messages, 0 notifications, 0 in queue
    Sent 10 messages, 0 notifications, 0 in queue
    Connection established 1; dropped 0
    Last reset never
    Local host: 192.168.255.205, Local port: 1024
    Foreign host: 192.168.255.206, Foreign port: 179

    BGP neighbor is 192.168.255.214, remote AS 31898, local AS 65000, external link
    BGP version 4, remote router ID 192.168.255.214
    BGP state = Established, up for 00:06:52
    Last read 00:00:16, hold time is 180, keepalive interval is 60 seconds
    Received 9 messages, 0 notifications, 0 in queue
    Sent 11 messages, 0 notifications, 0 in queue
    Connection established 1; dropped 0
    Last reset never
    Local host: 192.168.255.213, Local port: 179
    Foreign host: 192.168.255.214, Foreign port: 56551

    BGP neighbor is 192.168.255.218, remote AS 31898, local AS 65000, external link
    BGP version 4, remote router ID 192.168.255.218
    BGP state = Established, up for 00:06:48
    Last read 00:00:10, hold time is 180, keepalive interval is 60 seconds
    Received 8 messages, 0 notifications, 0 in queue
    Sent 10 messages, 0 notifications, 0 in queue
    Connection established 1; dropped 0
    Last reset never
    Local host: 192.168.255.217, Local port: 1026
    Foreign host: 192.168.255.218, Foreign port: 179
```

##●OCI　IPSec接続ステータス確認
IPSec、BGP共にUPしてグリーンになっていることを確認
<img width="946" alt="15.png" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/109087/36e90e0c-83f0-b8cc-aae3-84576b247931.png">




#■Route確認

下記のように OCI TokyoとPhoenixの VCN内Subnetと Object Storage Autonomous DBのある Oracle Services Network(OSN)のアドレスが伝搬されていれば接続完了です！

```shell-session
# show ip route
    Destination         Gateway          Interface       Kind  Additional Info.
    default             192.168.1.1            LAN2    static
    10.0.0.0/24         192.168.255.202   TUNNEL[1]       BGP  path=31898
    10.20.0.0/24        192.168.255.214  TUNNEL[11]       BGP  path=31898
    129.146.12.128/25   192.168.255.214  TUNNEL[11]       BGP  path=31898
    129.146.13.128/25   192.168.255.214  TUNNEL[11]       BGP  path=31898
    129.146.14.128/25   192.168.255.214  TUNNEL[11]       BGP  path=31898
    130.35.0.0/22       192.168.255.214  TUNNEL[11]       BGP  path=31898
    130.35.128.0/22     192.168.255.214  TUNNEL[11]       BGP  path=31898
    134.70.8.0/21       192.168.255.214  TUNNEL[11]       BGP  path=31898
    134.70.16.0/22      192.168.255.214  TUNNEL[11]       BGP  path=31898
    134.70.80.0/23      192.168.255.202   TUNNEL[1]       BGP  path=31898
    134.70.82.0/23      192.168.255.202   TUNNEL[1]       BGP  path=31898
    138.1.32.0/21       192.168.255.214  TUNNEL[11]       BGP  path=31898
    140.91.4.0/22       192.168.255.214  TUNNEL[11]       BGP  path=31898
    140.91.8.0/23       192.168.255.214  TUNNEL[11]       BGP  path=31898
    140.91.32.0/23      192.168.255.202   TUNNEL[1]       BGP  path=31898
    140.204.8.128/25    192.168.255.202   TUNNEL[1]       BGP  path=31898
    147.154.96.0/20     192.168.255.214  TUNNEL[11]       BGP  path=31898
    192.29.36.0/22      192.168.255.202   TUNNEL[1]       BGP  path=31898
    192.29.40.0/22      192.168.255.202   TUNNEL[1]       BGP  path=31898
    192.29.44.0/25      192.168.255.202   TUNNEL[1]       BGP  path=31898
    192.29.96.0/21      192.168.255.214  TUNNEL[11]       BGP  path=31898
    192.168.1.0/24      192.168.1.254          LAN2  implicit
    192.168.100.0/24    192.168.100.1          LAN1  implicit
    192.168.255.200/30  -                 TUNNEL[1]  implicit
    192.168.255.204/30  -                 TUNNEL[2]  implicit
    192.168.255.212/30  -                TUNNEL[11]  implicit
    192.168.255.216/30  -                TUNNEL[12]  implicit
```

※OCIからBGPで伝搬されるOCNのCIDRはPublic IP Address RangesのJSONに記載ある"OSN"と"OBJECT_STORAGE"項目部分のCIDRです。
・参考：VCNおよびOracle Services Network用のパブリックIPアドレス
　https://docs.cloud.oracle.com/ja-jp/iaas/Content/General/Concepts/addressranges.htm#osn-ranges



#■疎通確認テスト
##●Tokyo -> Phoenix
①ping確認

```shell-session
[opc@tokyo-inst01 ~]$ ping 10.20.0.2 -c 3
    PING 10.20.0.2 (10.20.0.2) 56(84) bytes of data.
    64 bytes from 10.20.0.2: icmp_seq=1 ttl=61 time=238 ms
    64 bytes from 10.20.0.2: icmp_seq=2 ttl=61 time=249 ms
    64 bytes from 10.20.0.2: icmp_seq=3 ttl=61 time=242 ms

    --- 10.20.0.2 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2002ms
    rtt min/a
```


② traceroute確認

```shell-session
[opc@tokyo-inst01 ~]$ traceroute 10.20.0.2
    traceroute to 10.20.0.2 (10.20.0.2), 30 hops max, 60 byte packets
    1  140.91.206.7 (140.91.206.7)  0.096 ms  0.062 ms 140.91.206.1 (140.91.206.1)  0.062 ms
    2  192.168.255.201 (192.168.255.201)  167.812 ms  173.649 ms  167.697 ms
    3  * * *
    4  10.20.0.2 (10.20.0.2)  240.176 ms !X  245.285 ms !X  239.150 ms !X
```


③ iperf３確認

```shell-session
[root@tokyo-inst01 opc]# iperf3 -c 10.20.0.2
    Connecting to host 10.20.0.2, port 5201
    [  4] local 10.0.0.2 port 50752 connected to 10.20.0.2 port 5201
    [ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
    [  4]   0.00-1.00   sec   275 KBytes  2.25 Mbits/sec    0   76.8 KBytes
    [  4]   1.00-2.00   sec   583 KBytes  4.77 Mbits/sec    0    193 KBytes
    [  4]   2.00-3.00   sec   699 KBytes  5.73 Mbits/sec    0    223 KBytes
    [  4]   3.00-4.00   sec  1017 KBytes  8.33 Mbits/sec    0    258 KBytes
    [  4]   4.00-5.00   sec   826 KBytes  6.77 Mbits/sec    0    299 KBytes
    [  4]   5.00-6.00   sec   890 KBytes  7.29 Mbits/sec    0    344 KBytes
    [  4]   6.00-7.00   sec  1017 KBytes  8.33 Mbits/sec    2    241 KBytes
    [  4]   7.00-8.00   sec   445 KBytes  3.64 Mbits/sec    0    285 KBytes
    [  4]   8.00-9.00   sec  1017 KBytes  8.33 Mbits/sec    0    319 KBytes
    [  4]   9.00-10.00  sec   445 KBytes  3.64 Mbits/sec    0    332 KBytes
    - - - - - - - - - - - - - - - - - - - - - - - - -
    [ ID] Interval           Transfer     Bandwidth       Retr
    [  4]   0.00-10.00  sec  7.04 MBytes  5.91 Mbits/sec    2             sender
    [  4]   0.00-10.00  sec  6.61 MBytes  5.54 Mbits/sec                  receiver

    iperf Done.
```

##●Phoenix -> Tokyo

① ping確認

```shell-session
[opc@phoeinx-inst01 ~]$ ping 10.0.0.2 -c 3
    PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
    64 bytes from 10.0.0.2: icmp_seq=1 ttl=61 time=240 ms
    64 bytes from 10.0.0.2: icmp_seq=2 ttl=61 time=237 ms
    64 bytes from 10.0.0.2: icmp_seq=3 ttl=61 time=237 ms

    --- 10.0.0.2 ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2002ms
    rtt min/avg/max/mdev = 237.468/238.691/240.616/1.488 ms
```


② traceroute確認

```shell-session
[opc@phoeinx-inst01 ~]$ traceroute 10.0.0.2
    traceroute to 10.0.0.2 (10.0.0.2), 30 hops max, 60 byte packets
    1  140.91.194.7 (140.91.194.7)  0.078 ms 140.91.194.6 (140.91.194.6)  0.058 ms 140.91.194.5 (140.91.194.5)  0.057 ms
    2  192.168.255.213 (192.168.255.213)  75.008 ms  74.983 ms *
    3  * * *
    4  10.0.0.2 (10.0.0.2)  243.052 ms !X  247.195 ms !X  239.075 ms !X
```


③ iperf3確認

```shell-session
[root@phoeinx-inst01 opc]# iperf3 -c 10.0.0.2
    Connecting to host 10.0.0.2, port 5201
    [  4] local 10.20.0.2 port 35834 connected to 10.0.0.2 port 5201
    [ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
    [  4]   0.00-1.00   sec   321 KBytes  2.63 Mbits/sec    0   95.9 KBytes
    [  4]   1.00-2.00   sec  1.30 MBytes  10.9 Mbits/sec    0    433 KBytes
    [  4]   2.00-3.00   sec  1.37 MBytes  11.5 Mbits/sec    5    332 KBytes
    [  4]   3.00-4.00   sec  1.12 MBytes  9.37 Mbits/sec    0    373 KBytes
    [  4]   4.00-5.00   sec  1.18 MBytes  9.89 Mbits/sec    7    191 KBytes
    [  4]   5.00-6.00   sec  1.12 MBytes  9.37 Mbits/sec    1    142 KBytes
    [  4]   6.00-7.00   sec   636 KBytes  5.21 Mbits/sec    1    106 KBytes
    [  4]   7.00-8.00   sec  0.00 Bytes  0.00 bits/sec    0    120 KBytes
    [  4]   8.00-9.00   sec   572 KBytes  4.69 Mbits/sec    0    126 KBytes
    [  4]   9.00-10.00  sec   572 KBytes  4.69 Mbits/sec    0    127 KBytes
    - - - - - - - - - - - - - - - - - - - - - - - - -
    [ ID] Interval           Transfer     Bandwidth       Retr
    [  4]   0.00-10.00  sec  8.13 MBytes  6.82 Mbits/sec   14             sender
    [  4]   0.00-10.00  sec  7.04 MBytes  5.90 Mbits/sec                  receiver

    iperf Done.
```


##●Hawaii-> Tokyo
###①ping確認

```shell-session
[root@onp-inst01:~]$ ping 10.0.0.2 -c 3
    PING 10.0.0.2 (10.0.0.2): 56 data bytes
    64 bytes from 10.0.0.2: icmp_seq=0 ttl=62 time=175.013 ms
    64 bytes from 10.0.0.2: icmp_seq=1 ttl=62 time=168.506 ms
    64 bytes from 10.0.0.2: icmp_seq=2 ttl=62 time=168.111 ms

    --- 10.0.0.2 ping statistics ---
    3 packets transmitted, 3 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 168.111/170.543/175.013/3.165 ms
```

###②traceroute確認

```shell-session
[root@onp-inst01:~]$ traceroute -I 10.0.0.2
    traceroute to 10.0.0.2 (10.0.0.2), 64 hops max, 72 byte packets
    1  * * *
    2  * * *
    3  10.0.0.2 (10.0.0.2)  168.008 ms  167.699 ms  168.381 ms
```



#●Hawaii-> Phoenix

###①ping確認

```shell-session
[root@onp-inst01:~]$ ping 10.20.0.2 -c 3
    PING 10.20.0.2 (10.20.0.2): 56 data bytes
    64 bytes from 10.20.0.2: icmp_seq=0 ttl=62 time=68.881 ms
    64 bytes from 10.20.0.2: icmp_seq=1 ttl=62 time=71.827 ms
    64 bytes from 10.20.0.2: icmp_seq=2 ttl=62 time=72.269 ms

    --- 10.20.0.2 ping statistics ---
    3 packets transmitted, 3 packets received, 0.0% packet loss
    round-trip min/avg/max/stddev = 68.881/70.992/72.269/1.504 ms
```


###②traceroute確認

```shell-session
[root@onp-inst01:~]$ traceroute -I 10.20.0.2
    traceroute to 10.20.0.2 (10.20.0.2), 64 hops max, 72 byte packets
    1  * * *
    2  * * *
    3  10.20.0.2 (10.20.0.2)  70.350 ms  70.649 ms  70.574 ms
```


#■最終Config

```shell-session
# show config
    # NVR700W Rev.15.00.16 (Thu Jun 20 19:48:42 2019)
    # MAC Address : 00:a0:cd:a2:c1, 00:a0:cd:a2:c2
    # Memory 256Mbytes, 2LAN, 1ONU, 1WWAN
    # main:  NVR700W ver=00 serial=TESTSERIAL MAC-Address=00:a0:cd:a2:c1 MAC-Addr
    ess=00:a0:cd:a2:c2
    # Reporting Date: Mar 11 15:48:06 2020
    console character en.ascii
    ip route default gateway 192.168.1.1
    ip keepalive 1 icmp-echo 10 5 192.168.1.1
    ip lan1 address 192.168.100.1/24
    description lan2 Hawaii-Hotel01
    ip lan2 address 192.168.1.254/24
    ip lan2 nat descriptor 200
    tunnel select 1
    description tunnel OCI-VPN1
    ipsec tunnel 1
    ipsec sa policy 1 1 esp aes256-cbc sha-hmac
    ipsec ike duration ipsec-sa 1 3600
    ipsec ike duration isakmp-sa 1 28800
    ipsec ike encryption 1 aes256-cbc
    ipsec ike group 1 modp1536
    ipsec ike hash 1 sha256
    ipsec ike keepalive log 1 off
    ipsec ike keepalive use 1 on dpd 5 4
    ipsec ike local address 1 192.168.1.254
    ipsec ike local id 1 0.0.0.0/0
    ipsec ike nat-traversal 1 on
    ipsec ike pfs 1 on
    ipsec ike pre-shared-key 1 text IPSecSharedSecret01
    ipsec ike remote address 1 140.204.100.101
    ipsec ike remote id 1 0.0.0.0/0
    ip tunnel address 192.168.255.201/30
    ip tunnel remote address 192.168.255.202
    ip tunnel tcp mss limit auto
    tunnel enable 1
    tunnel select 2
    description tunnel OCI-VPN2
    ipsec tunnel 2
    ipsec sa policy 2 2 esp aes256-cbc sha-hmac
    ipsec ike duration ipsec-sa 2 3600
    ipsec ike duration isakmp-sa 2 28800
    ipsec ike encryption 2 aes256-cbc
    ipsec ike group 2 modp1536
    ipsec ike hash 2 sha256
    ipsec ike keepalive log 2 off
    ipsec ike keepalive use 2 on dpd 5 4
    ipsec ike local address 2 192.168.1.254
    ipsec ike local id 2 0.0.0.0/0
    ipsec ike nat-traversal 2 on
    ipsec ike pfs 2 on
    ipsec ike pre-shared-key 2 text IPSecSharedSecret02
    ipsec ike remote address 2 140.204.100.102
    ipsec ike remote id 2 0.0.0.0/0
    ip tunnel address 192.168.255.205/30
    ip tunnel remote address 192.168.255.206
    ip tunnel tcp mss limit auto
    tunnel enable 2
    tunnel select 11
    description tunnel OCI-VPN11
    ipsec tunnel 11
    ipsec sa policy 11 11 esp aes256-cbc sha-hmac
    ipsec ike duration ipsec-sa 11 3600
    ipsec ike duration isakmp-sa 11 28800
    ipsec ike encryption 11 aes256-cbc
    ipsec ike group 11 modp1536
    ipsec ike hash 11 sha256
    ipsec ike keepalive log 11 off
    ipsec ike keepalive use 11 on dpd 5 4
    ipsec ike local address 11 192.168.1.254
    ipsec ike local id 11 0.0.0.0/0
    ipsec ike nat-traversal 11 on
    ipsec ike pfs 11 on
    ipsec ike pre-shared-key 11 text IPSecSharedSecret01
    ipsec ike remote address 11 129.146.200.201
    ipsec ike remote id 11 0.0.0.0/0
    ip tunnel address 192.168.255.213/30
    ip tunnel remote address 192.168.255.214
    ip tunnel tcp mss limit auto
    tunnel enable 11
    tunnel select 12
    description tunnel OCI-VPN12
    ipsec tunnel 12
    ipsec sa policy 12 12 esp aes256-cbc sha-hmac
    ipsec ike duration ipsec-sa 12 3600
    ipsec ike duration isakmp-sa 12 28800
    ipsec ike encryption 12 aes256-cbc
    ipsec ike group 12 modp1536
    ipsec ike hash 12 sha256
    ipsec ike keepalive log 12 off
    ipsec ike keepalive use 12 on dpd 5 4
    ipsec ike local address 12 192.168.1.254
    ipsec ike local id 12 0.0.0.0/0
    ipsec ike nat-traversal 12 on
    ipsec ike pfs 12 on
    ipsec ike pre-shared-key 12 text IPSecSharedSecret02
    ipsec ike remote address 12 129.146.200.202
    ipsec ike remote id 12 0.0.0.0/0
    ip tunnel address 192.168.255.217/30
    ip tunnel remote address 192.168.255.218
    ip tunnel tcp mss limit auto
    tunnel enable 12
    ip filter 500000 restrict * * * * *
    nat descriptor type 200 masquerade
    nat descriptor address outer 200 primary
    bgp use on
    bgp autonomous-system 65000
    bgp log neighbor
    bgp neighbor 1 31898 192.168.255.202 hold-time=180 local-address=192.168.255.201
    bgp neighbor 2 31898 192.168.255.206 hold-time=180 local-address=192.168.255.205
    bgp neighbor 11 31898 192.168.255.214 hold-time=180 local-address=192.168.255.213
    bgp neighbor 12 31898 192.168.255.218 hold-time=180 local-address=192.168.255.217
    bgp import filter 1 equal 0.0.0.0/0
    bgp import 31898 static filter 1
    ipsec auto refresh on
    telnetd host lan
    dhcp service server
    dhcp server rfc2131 compliant except remain-silent
    dhcp scope 1 192.168.100.2-192.168.100.191/24
    dns host lan1
    dns server 192.168.1.1
    dns server select 500201 192.168.1.1 any .
    dns private address spoof on
    dns private name setup.netvolante.jp
    httpd host lan1
    analog supplementary-service pseudo call-waiting
    analog extension dial prefix sip prefix="9#"
    statistics traffic on
```


#■Config保存
SAVEコマンドで保存して完了です

```shell-session
# save
    Saving ... CONFIG0 Done .
```