hostname HERCP-CR1-1
user admin group administrators password ciphertext ******
profile aggregation-leaf
ntp server 10.2.120.98 minpoll 4 maxpoll 4 iburst
ntp server 10.2.120.99 minpoll 4 maxpoll 4 iburst
ntp enable
ssh server vrf mgmt
gbp enable
gbp role intranet 4
gbp role internet 3
gbp role isl 5
gbp role infra 2
gbp role EMPLOYEE 100
gbp role IT-ADMIN 200
gbp role CONTRACTOR 201
gbp role IT-SUPP 300
gbp role VISITOR 400
gbp role PRINTER 500
gbp role IOT-NO-INET 600
gbp role IOT-INTERNAL 700
gbp role IOT-LMT-INET 800
gbp role REJECT 900
gbp role QUARANTINE 1000
gbp role CRITICAL 1100
gbp role SECURITY 1200
class gbp-ip CONTRACTOR_ALLOW
    1 match any CONTRACTOR CONTRACTOR
    2 match any EMPLOYEE CONTRACTOR
    4 match any IT-SUPP CONTRACTOR
    10000 match any default CONTRACTOR count
class gbp-ip CRITICAL_ALLOW
    1 match any IT-ADMIN CRITICAL
class gbp-ip EMPLOYEE_ALLOW
    2 match any IT-ADMIN EMPLOYEE
    3 match any IT-SUPP EMPLOYEE
    5 match any CONTRACTOR EMPLOYEE
class gbp-ip IOT-INTERNAL_ALLOW
    1 match any IT-ADMIN IOT-INTERNAL
    2 match any IT-SUPP IOT-INTERNAL
class gbp-ip IOT-LMT-INET_ALLOW
    1 match any IT-ADMIN IOT-LMT-INET
    2 match any IT-SUPP IOT-LMT-INET
class gbp-ip IOT-NO-INET_ALLOW
    1 match any IOT-NO-INET IOT-NO-INET
    2 match any IT-SUPP IOT-NO-INET
class gbp-ip IT-ADMIN_ALLOW
    1 match any IT-ADMIN IT-ADMIN
    12 match any IT-SUPP IT-ADMIN
class gbp-ip IT-SUPP_ALLOW
    1 match any IT-ADMIN IT-SUPP
    10 match any CONTRACTOR IT-SUPP
class gbp-ip PRINTER_ALLOW
    1 match any EMPLOYEE PRINTER
    2 match any IT-ADMIN PRINTER
    3 match any IT-SUPP PRINTER
class gbp-ip QUARANTINE_ALLOW
    1 match any IT-ADMIN QUARANTINE
class gbp-ip REJECT_ALLOW
    1 match any IT-ADMIN REJECT
    2 match any IT-SUPP REJECT
class gbp-ip SECURITY_ALLOW
    1 match any IT-ADMIN SECURITY
class gbp-ip VISITOR_ALLOW
    1 match any IT-ADMIN VISITOR
class gbp-ipv6 CONTRACTOR_ALLOW
    1 match any CONTRACTOR CONTRACTOR
    2 match any EMPLOYEE CONTRACTOR
    4 match any IT-SUPP CONTRACTOR
    10000 match any default CONTRACTOR count
class gbp-ipv6 CRITICAL_ALLOW
    1 match any IT-ADMIN CRITICAL
class gbp-ipv6 EMPLOYEE_ALLOW
    2 match any IT-ADMIN EMPLOYEE
    3 match any IT-SUPP EMPLOYEE
    5 match any CONTRACTOR EMPLOYEE
class gbp-ipv6 IOT-INTERNAL_ALLOW
    1 match any IT-ADMIN IOT-INTERNAL
    2 match any IT-SUPP IOT-INTERNAL
class gbp-ipv6 IOT-LMT-INET_ALLOW
    1 match any IT-ADMIN IOT-LMT-INET
    2 match any IT-SUPP IOT-LMT-INET
class gbp-ipv6 IOT-NO-INET_ALLOW
    1 match any IOT-NO-INET IOT-NO-INET
    2 match any IT-SUPP IOT-NO-INET
class gbp-ipv6 IT-ADMIN_ALLOW
    1 match any IT-ADMIN IT-ADMIN
    12 match any IT-SUPP IT-ADMIN
class gbp-ipv6 IT-SUPP_ALLOW
    1 match any IT-ADMIN IT-SUPP
    10 match any CONTRACTOR IT-SUPP
class gbp-ipv6 PRINTER_ALLOW
    1 match any EMPLOYEE PRINTER
    2 match any IT-ADMIN PRINTER
    3 match any IT-SUPP PRINTER
class gbp-ipv6 QUARANTINE_ALLOW
    1 match any IT-ADMIN QUARANTINE
class gbp-ipv6 REJECT_ALLOW
    1 match any IT-ADMIN REJECT
    2 match any IT-SUPP REJECT
class gbp-ipv6 SECURITY_ALLOW
    1 match any IT-ADMIN SECURITY
class gbp-ipv6 VISITOR_ALLOW
    1 match any IT-ADMIN VISITOR
class gbp-mac CONTRACTOR_ALLOW
    1 match CONTRACTOR CONTRACTOR any
    2 match EMPLOYEE CONTRACTOR any
    4 match IT-SUPP CONTRACTOR any
    10000 match default CONTRACTOR any count
    10001 match any CONTRACTOR arp count
class gbp-mac CRITICAL_ALLOW
    1 match IT-ADMIN CRITICAL any
class gbp-mac EMPLOYEE_ALLOW
    2 match IT-ADMIN EMPLOYEE any
    3 match IT-SUPP EMPLOYEE any
    5 match CONTRACTOR EMPLOYEE any
class gbp-mac IOT-INTERNAL_ALLOW
    1 match IT-ADMIN IOT-INTERNAL any
    2 match IT-SUPP IOT-INTERNAL any
class gbp-mac IOT-LMT-INET_ALLOW
    1 match IT-ADMIN IOT-LMT-INET any
    2 match IT-SUPP IOT-LMT-INET any
class gbp-mac IOT-NO-INET_ALLOW
    1 match IOT-NO-INET IOT-NO-INET any
    2 match IT-SUPP IOT-NO-INET any
class gbp-mac IT-ADMIN_ALLOW
    1 match IT-ADMIN IT-ADMIN any
    12 match IT-SUPP IT-ADMIN any
class gbp-mac IT-SUPP_ALLOW
    1 match IT-ADMIN IT-SUPP any
    10 match CONTRACTOR IT-SUPP any
class gbp-mac PRINTER_ALLOW
    1 match EMPLOYEE PRINTER any
    2 match IT-ADMIN PRINTER any
    3 match IT-SUPP PRINTER any
class gbp-mac QUARANTINE_ALLOW
    1 match IT-ADMIN QUARANTINE any
class gbp-mac REJECT_ALLOW
    1 match IT-ADMIN REJECT any
    2 match IT-SUPP REJECT any
class gbp-mac SECURITY_ALLOW
    1 match IT-ADMIN SECURITY any
class gbp-mac VISITOR_ALLOW
    1 match IT-ADMIN VISITOR any
vlan 1
spanning-tree
interface mgmt
    no shutdown
    ip dhcp
port-access gbp CONTRACTOR_r2r_policy
    10 class gbp-ip CONTRACTOR_ALLOW
    20 class gbp-ipv6 CONTRACTOR_ALLOW
    30 class gbp-mac CONTRACTOR_ALLOW
port-access gbp CRITICAL_r2r_policy
    10 class gbp-ip CRITICAL_ALLOW
    20 class gbp-ipv6 CRITICAL_ALLOW
    30 class gbp-mac CRITICAL_ALLOW
port-access gbp EMPLOYEE_r2r_policy
    10 class gbp-ip EMPLOYEE_ALLOW
    20 class gbp-ipv6 EMPLOYEE_ALLOW
    30 class gbp-mac EMPLOYEE_ALLOW
port-access gbp IOT-INTERNAL_r2r_policy
    10 class gbp-ip IOT-INTERNAL_ALLOW
    20 class gbp-ipv6 IOT-INTERNAL_ALLOW
    30 class gbp-mac IOT-INTERNAL_ALLOW
port-access gbp IOT-LMT-INET_r2r_policy
    10 class gbp-ip IOT-LMT-INET_ALLOW
    20 class gbp-ipv6 IOT-LMT-INET_ALLOW
    30 class gbp-mac IOT-LMT-INET_ALLOW
port-access gbp IOT-NO-INET_r2r_policy
    10 class gbp-ip IOT-NO-INET_ALLOW
    20 class gbp-ipv6 IOT-NO-INET_ALLOW
    30 class gbp-mac IOT-NO-INET_ALLOW
port-access gbp IT-ADMIN_r2r_policy
    10 class gbp-ip IT-ADMIN_ALLOW
    20 class gbp-ipv6 IT-ADMIN_ALLOW
    30 class gbp-mac IT-ADMIN_ALLOW
port-access gbp IT-SUPP_r2r_policy
    10 class gbp-ip IT-SUPP_ALLOW
    20 class gbp-ipv6 IT-SUPP_ALLOW
    30 class gbp-mac IT-SUPP_ALLOW
port-access gbp PRINTER_r2r_policy
    10 class gbp-ip PRINTER_ALLOW
    20 class gbp-ipv6 PRINTER_ALLOW
    30 class gbp-mac PRINTER_ALLOW
port-access gbp QUARANTINE_r2r_policy
    10 class gbp-ip QUARANTINE_ALLOW
    20 class gbp-ipv6 QUARANTINE_ALLOW
    30 class gbp-mac QUARANTINE_ALLOW
port-access gbp REJECT_r2r_policy
    10 class gbp-ip REJECT_ALLOW
    20 class gbp-ipv6 REJECT_ALLOW
    30 class gbp-mac REJECT_ALLOW
port-access gbp SECURITY_r2r_policy
    10 class gbp-ip SECURITY_ALLOW
    20 class gbp-ipv6 SECURITY_ALLOW
    30 class gbp-mac SECURITY_ALLOW
port-access gbp VISITOR_r2r_policy
    10 class gbp-ip VISITOR_ALLOW
    20 class gbp-ipv6 VISITOR_ALLOW
    30 class gbp-mac VISITOR_ALLOW
port-access role CONTRACTOR
    associate gbp CONTRACTOR_r2r_policy
port-access role CRITICAL
    associate gbp CRITICAL_r2r_policy
port-access role EMPLOYEE
    associate gbp EMPLOYEE_r2r_policy
port-access role IOT-INTERNAL
    associate gbp IOT-INTERNAL_r2r_policy
port-access role IOT-LMT-INET
    associate gbp IOT-LMT-INET_r2r_policy
port-access role IOT-NO-INET
    associate gbp IOT-NO-INET_r2r_policy
port-access role IT-ADMIN
    associate gbp IT-ADMIN_r2r_policy
port-access role IT-SUPP
    associate gbp IT-SUPP_r2r_policy
port-access role PRINTER
    associate gbp PRINTER_r2r_policy
port-access role QUARANTINE
    associate gbp QUARANTINE_r2r_policy
port-access role REJECT
    associate gbp REJECT_r2r_policy
port-access role SECURITY
    associate gbp SECURITY_r2r_policy
port-access role VISITOR
    associate gbp VISITOR_r2r_policy
interface 1/1/1
    no shutdown
    mtu 9198
    description core accessAgg ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.28/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/2
    no shutdown
    mtu 9198
    description core accessAgg ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.30/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/3
    no shutdown
    mtu 9198
    description core wlanServiceAgg ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.32/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/4
    no shutdown
    mtu 9198
    description core wlanServiceAgg ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.34/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/5
    no shutdown
    no routing
    vlan access 1
interface 1/1/6
    no shutdown
    no routing
    vlan access 1
interface 1/1/7
    no shutdown
    mtu 9198
    description core accessAgg ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.36/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/8
    no shutdown
    mtu 9198
    description core accessAgg ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.38/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/9
    no shutdown
    no routing
    vlan access 1
interface 1/1/10
    no shutdown
    no routing
    vlan access 1
interface 1/1/11
    no shutdown
    no routing
    vlan access 1
interface 1/1/12
    no shutdown
    no routing
    vlan access 1
interface 1/1/13
    no shutdown
    no routing
    vlan access 1
interface 1/1/14
    no shutdown
    no routing
    vlan access 1
interface 1/1/15
    no shutdown
    no routing
    vlan access 1
interface 1/1/16
    no shutdown
    no routing
    vlan access 1
interface 1/1/17
    no shutdown
    no routing
    vlan access 1
interface 1/1/18
    no shutdown
    no routing
    vlan access 1
interface 1/1/19
    no shutdown
    no routing
    vlan access 1
interface 1/1/20
    no shutdown
    no routing
    vlan access 1
interface 1/1/21
    no shutdown
    no routing
    vlan access 1
interface 1/1/22
    no shutdown
    no routing
    vlan access 1
interface 1/1/23
    no shutdown
    no routing
    vlan access 1
interface 1/1/24
    no shutdown
    no routing
    vlan access 1
interface 1/1/25
    no shutdown
    no routing
    vlan access 1
interface 1/1/26
    no shutdown
    no routing
    vlan access 1
interface 1/1/27
    no shutdown
interface 1/1/28
    no shutdown
interface 1/1/29
    no shutdown
interface 1/1/30
    no shutdown
    no routing
    vlan access 1
interface 1/1/31
    no shutdown
    mtu 9198
    description core wanServiceAgg ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.9/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/32
    no shutdown
    mtu 9198
    description core wanServiceAgg ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.7/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/33
    no shutdown
    mtu 9198
    description core core ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.19/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/34
    no shutdown
    mtu 9198
    description core core ROP to Peer Switch
    ip mtu 9198
    ip address 10.10.0.21/31
    ip ospf 1 area 0.0.0.0
    ip ospf network point-to-point
    no ip ospf passive
interface 1/1/35
    no shutdown
interface 1/1/36
    no shutdown
    no routing
    vlan access 1
interface loopback 0
    description OSPF Underlay
    ip address 10.10.1.1/32
interface loopback 1
    description VTEP Non-redundant Source
    ip address 10.10.1.17/32
snmp-server system-location Seattle
snmp-server system-contact rpn
ip dns server-address 10.2.120.98
ip dns server-address 10.2.120.99
router ospf 1
    router-id 10.10.1.1
    max-metric router-lsa include-stub on-startup 300
    passive-interface default
    redistribute local loopback
    area 0.0.0.0
router bgp 65001
    bgp router-id 10.10.1.1
    neighbor Herndon_Fabric peer-group
    neighbor Herndon_Fabric remote-as 65001
    neighbor Herndon_Fabric fall-over
    neighbor Herndon_Fabric update-source loopback 0
    neighbor 10.10.1.10 peer-group Herndon_Fabric
    neighbor 10.10.1.11 peer-group Herndon_Fabric
    neighbor 10.10.1.12 peer-group Herndon_Fabric
    neighbor 10.10.1.13 peer-group Herndon_Fabric
    neighbor 10.10.1.2 peer-group Herndon_Fabric
    neighbor 10.10.1.3 peer-group Herndon_Fabric
    neighbor 10.10.1.4 peer-group Herndon_Fabric
    neighbor 10.10.1.5 peer-group Herndon_Fabric
    address-family l2vpn evpn
        neighbor 10.10.1.10 activate
        neighbor 10.10.1.10 route-reflector-client
        neighbor 10.10.1.10 send-community extended
        neighbor 10.10.1.11 activate
        neighbor 10.10.1.11 route-reflector-client
        neighbor 10.10.1.11 send-community extended
        neighbor 10.10.1.12 activate
        neighbor 10.10.1.12 route-reflector-client
        neighbor 10.10.1.12 send-community extended
        neighbor 10.10.1.13 activate
        neighbor 10.10.1.13 route-reflector-client
        neighbor 10.10.1.13 send-community extended
        neighbor 10.10.1.2 activate
        neighbor 10.10.1.2 route-reflector-client
        neighbor 10.10.1.2 send-community extended
        neighbor 10.10.1.3 activate
        neighbor 10.10.1.3 route-reflector-client
        neighbor 10.10.1.3 send-community extended
        neighbor 10.10.1.4 activate
        neighbor 10.10.1.4 route-reflector-client
        neighbor 10.10.1.4 send-community extended
        neighbor 10.10.1.5 activate
        neighbor 10.10.1.5 route-reflector-client
        neighbor 10.10.1.5 send-community extended
https-server vrf mgmt
configuration-lockout central managed