version 6.4R4.3;
groups {
    ROUTE-primary {
        routing-options {
            static {
                route <*> community 209:776;
            }
        }
    }
}
system {
    host-name wdc-edge-06;
    domain-name inet.qwest.net;
    default-address-selection;
    dump-on-panic;
    authentication-order [ radius password ];
    name-server {
        205.171.3.65;
    }
    radius-server {
        208.47.0.153 {
            secret "$9$BUi1EyevL-dsvM-wYgUDCtu1clW8xN-bUjmTz3tp";
            timeout 5;
            retry 3;
        }
        216.111.65.20 {
            secret "$9$f5z6CtOEhrtpEylKx7ik.539u01RESxNs4aZkq";
            timeout 5;
            retry 3;
        }
    }
    login {
        message "\n\n\t\t\Unauthorized Access is Prohibited. For operational problems\n\t\tplease contact noc@qwest.net or call 1-888-336-6306.\n\n";
        class full {
            idle-timeout 15;
            permissions [ admin clear configure interface-control network routing-control shell snmp system trace view maintenance firewall-control secret rollback ];
            deny-configuration "protocols (bgp|isis|rsvp|mpls) disable|protocols isis interface|protocols mpls label-switched-path .* metric";
        }
        class limited {
            idle-timeout 15;
            permissions [ clear configure interface network routing system trace view firewall ];
            allow-configuration "interfaces (at|t1|t3|ml|ge|gr|so|ds|fe)";
        }
        class nmc2 {
            idle-timeout 15;
            permissions [ admin clear configure interface-control network routing-control shell snmp system trace view maintenance firewall-control secret rollback ];
            deny-configuration "protocols (bgp|isis|rsvp|mpls) disable|protocols mpls label-switched-path .* metric";
        }
        class partial {
            idle-timeout 15;
            permissions [ clear configure interface-control network routing system trace view firewall-control ];
            allow-configuration "protocols bgp group|protocols connections|protocols mpls interface|policy-options|routing-instances|routing-options";
            deny-configuration "protocols bgp group (Qwest|Peer)";
        }
        class readonly {
            idle-timeout 15;
            permissions [ interface network routing trace view firewall ];
            allow-commands "clear interfaces";
            deny-commands "request|telnet|test|ssh";
        }
        class superuser-eng {
            idle-timeout 15;
            permissions [ admin clear configure field floppy interface-control network reset routing-control shell snmp system trace trace-control view maintenance firewall-control secret rollback security access-control ];
            deny-configuration "protocols (bgp|isis|rsvp|mpls) disable|protocols mpls label-switched-path .* metric";
        }
        class superuser-local {
            idle-timeout 15;
            permissions all;
            deny-configuration "protocols (bgp|isis|rsvp|mpls) disable";
        }
        class superuser-non-ops {
            idle-timeout 15;
            permissions [ admin clear configure field floppy interface-control network reset routing-control shell snmp system trace trace-control view maintenance firewall-control secret rollback security access-control ];
            deny-configuration "protocols isis interface|protocols mpls label-switched-path .* metric";
        }
        class view_config_only {
            idle-timeout 15;
            permissions [ admin configure interface routing snmp system view firewall secret security access ];
            allow-commands "request system snapshot";
            deny-commands "request|test|file";
            allow-configuration policy-options;
        }
        user autoload {
            uid 108;
            class view_config_only;
        }
        user eng {
            uid 107;
            class superuser-eng;
        }
        user imp {
            uid 103;
            class partial;
        }
        user ipnoc {
            uid 102;
            class partial;
        }
        user lab {
            uid 109;
            class superuser-non-ops;
        }
        user nmc {
            uid 104;
            class full;
        }
        user nmc2 {
            uid 110;
            class nmc2;
        }
        user opseng {
            uid 106;
            class superuser-local;
        }
        user prov {
            uid 101;
            class limited;
        }
        user readonly {
            uid 100;
            class readonly;
        }
        user tac {
            uid 105;
            class full;
        }
    }
    services {
        ssh;
        telnet;
    }
    syslog {
        user * {
            any emergency;
        }
        host 205.171.6.20 {
            interactive-commands any;
        }
        host 216.111.65.1 {
            interactive-commands any;
        }
        host 208.47.0.114 {
            any warning;
            facility-override local5;
        }
        host 216.207.100.16 {
            any warning;
            facility-override local5;
        }
        host 216.111.65.81 {
            any warning;
            facility-override local5;
        }
        file messages {
            any info;
            authorization notice;
            interactive-commands any;
            archive size 20m files 3 no-world-readable;
        }
    }
    ntp {
        server 205.171.0.44;
        server 205.171.0.45;
        server 205.171.0.46;
    }
}
chassis {
    no-source-route;
    dump-on-panic;
    alarm {
        management-ethernet {
            link-down ignore;
        }
    }
}
interfaces {
    so-0/0/0 {
        description "OC48 to wdc-core-01; pos3/0; x-connect; qip_prod; edgecore";
        encapsulation cisco-hdlc;
        sonet-options {
            fcs 32;
            payload-scrambler;
        }
        unit 0 {
            description "OC48 to wdc-core-01; pos3/0; x-connect; qip_prod; edgecore";
            point-to-point;
            family inet {
                address 205.171.24.118/30;
            }
            family iso;
        }
    }
    so-1/0/0 {
        description "OC48 to wdc-core-03; pos1/0; x-connect; qip_prod; edgecore";
        enable;
        encapsulation cisco-hdlc;
        sonet-options {
            fcs 32;
            payload-scrambler;
        }
        unit 0 {
            description "OC48 to wdc-core-03; pos1/0; x-connect; qip_prod; edgecore";
            family inet {
                address 205.171.24.126/30;
            }
            family iso;
        }
    }
    t3-2/2/3 {
        disable;
    }
    t3-3/3/0 {
        encapsulation cisco-hdlc;
        t3-options {
            no-payload-scrambler;
        }
        unit 0 {
            family inet {
                rpf-check;
            }
        }
    }
    fxp0 {
        disable;
    }
    lo0 {
        description "wdc-edge-06.inet.qwest.net; qip_prod; edgertr";
        unit 0 {
            description "wdc-edge-06.inet.qwest.net; qip_prod; edgertr";
            family inet {
                filter {
                    input edge-secure-RE;
                }
                address 205.171.3.136/32;
            }
            family iso {
                address 39.752f.0100.0014.0000.2000.0000.2051.7100.3136.00;
            }
        }
    }
}
forwarding-options {
    sampling {
        input {
            family inet {
                rate 1000;
                run-length 5;
            }
        }
        output {
            file filename samplinglog files 5 size 30m world-readable stamp;
        }
    }
}
snmp {
    community WA45a0r214Do {
        clients {
            63.151.189.25/32;
            65.100.64.120/32;
            65.100.65.64/27;
            65.120.19.203/32;
            155.70.32.7/32;
            155.70.137.234/32;
            204.147.85.135/32;
            205.171.6.5/32;
            205.171.6.34/32;
            205.171.6.35/32;
            205.171.6.38/32;
            205.171.6.46/32;
            205.171.9.202/32;
            205.171.10.247/32;
            205.171.13.221/32;
            205.171.14.244/32;
            205.171.14.246/32;
            205.171.17.202/32;
            205.171.21.198/32;
            205.171.25.207/32;
            205.171.26.242/32;
            205.171.27.247/32;
            205.171.29.193/32;
            205.171.30.203/32;
            205.171.31.208/32;
            205.171.128.203/32;
            205.171.128.204/32;
            205.171.129.195/32;
            205.171.139.201/32;
            208.47.0.15/32;
            208.47.0.43/32;
            208.47.0.138/32;
            216.111.65.0/24;
            216.111.66.0/24;
            216.207.100.0/24;
        }
    }
    trap-group all-traps {
        categories {
            authentication;
            chassis;
            link;
            routing;
            startup;
        }
        targets {
            205.171.6.10;
            216.111.66.153;
            216.207.100.143;
            216.111.65.144;
            216.111.65.143;
        }
    }
}
routing-options {
    static {
        rib-group unicast-multicast-rib;
        route 0.0.0.0/0 {
            discard;
            no-install;
        }
        route 151.196.0.250/32 next-hop [ 208.46.126.174 208.46.126.182 ];
        route 63.146.17.128/27 next-hop 63.146.0.134;
        route 151.205.128.249/32 next-hop 63.237.65.98;
        route 207.68.64.249/32 next-hop [ t3-3/3/0.0 t3-3/3/2.0 ];
        route 192.0.2.0/24 {
            discard;
            no-readvertise;
        }
        route 198.26.132.81/32 next-hop 63.148.66.246;
    }
    rib-groups {
        unicast-multicast-rib {
            import-rib [ inet.0 inet.2 ];
        }
        multicast-rib {
            export-rib inet.2;
            import-rib inet.2;
        }
        ifrg {
            import-rib [ inet.0 inet.2 ];
        }
        mcrg {
            export-rib inet.2;
            import-rib inet.2;
        }
    }
    router-id 205.171.3.136;
    autonomous-system 209;
    forwarding-table {
        export customer-loadshare;
        unicast-reverse-path feasible-paths;
    }
}
protocols {
    bgp {
        enable;
        log-updown;
        import import-with-defaults;
        export export-with-defaults;
        group Qwest-Internal {
            type internal;
            local-address 205.171.3.136;
            import import-accept;
            family inet {
                any;
            }
            authentication-key "$9$A5yKtIEleW-VYEcs24Zkq";
            export [ core-out static-bgp connected-bgp ];
            peer-as 209;
            neighbor 205.171.0.44;
            neighbor 205.171.0.45;
            neighbor 205.171.0.46;
        }
        inactive: group Customer-full-routes {
            type external;
            metric-out igp;
            family inet {
                any {
                    prefix-limit {
                        maximum 800;
                        teardown 65 idle-timeout forever;
                    }
                }
            }
            export full-routes;
        }
        inactive: group Customer-full-routes-w-default {
            type external;
            metric-out igp;
            family inet {
                any {
                    prefix-limit {
                        maximum 800;
                        teardown 65 idle-timeout forever;
                    }
                }
            }
            export full-routes-w-default;
        }
        inactive: group Customer-qwest-routes {
            type external;
            metric-out igp;
            family inet {
                any {
                    prefix-limit {
                        maximum 800;
                        teardown 65 idle-timeout forever;
                    }
                }
            }
            export qwest-routes;
        }
        inactive: group Customer-qwest-routes-w-default {
            type external;
            metric-out igp;
            family inet {
                any {
                    prefix-limit {
                        maximum 800;
                        teardown 65 idle-timeout forever;
                    }
                }
            }
            export qwest-routes-w-default;
        }
        inactive: group Customer-default-only {
            type external;
            metric-out igp;
            family inet {
                any {
                    prefix-limit {
                        maximum 800;
                        teardown 65 idle-timeout forever;
                    }
                }
            }
            export default-only;
        }
        inactive: group Peer-External_UseMeds {
            type external;
            metric-out igp;
            family inet {
                any;
            }
            export external-out;
        }
        inactive: group Peer-External_NoUseMeds {
            type external;
            metric-out igp;
            family inet {
                any;
            }
            export external-out;
        }
        inactive: group Peer-External_UseMeds_Hopaway {
            type external;
            metric-out igp;
            family inet {
                any;
            }
            export external-out;
        }
    }
    isis {
        no-holddown;
        rib-group inet unicast-multicast-rib;
        overload timeout 900;
        level 2 wide-metrics-only;
        level 1 disable;
        interface so-0/0/0.0 {
            level 1 disable;
            level 2 metric 5;
        }
        interface so-1/0/0.0 {
            level 1 disable;
            level 2 metric 5;
        }
        interface lo0.0 {
            level 1 disable;
            level 2 passive;
        }
    }
}
policy-options {
    prefix-list bgp-regexp {
        apply-path "protocols bgp group <*> neighbor <*>";
    }
    prefix-list services-snmp {
        apply-path "snmp community <*> clients <*>";
    }
    prefix-list services-radius {
        apply-path "system radius-server <*>";
    }
    prefix-list services-tacplus {
        apply-path "system tacplus-server <*>";
    }
    prefix-list services-domain {
        apply-path "system name-server <*>";
    }
    prefix-list services-ntp {
        205.171.0.0/22;
        205.171.200.0/22;
        apply-path "system ntp server <*>";
    }
    prefix-list loopback-ip {
        apply-path "interfaces lo0 unit 0 family inet address <*>";
    }
    prefix-list NGS-blocks {
        65.119.64.0/20;
        65.147.144.0/20;
    }
    prefix-list ntp-services;
    prefix-list bogons {
        0.0.0.0/7;
        2.0.0.0/8;
        5.0.0.0/8;
        7.0.0.0/8;
        10.0.0.0/8;
        23.0.0.0/8;
        27.0.0.0/8;
        31.0.0.0/8;
        36.0.0.0/7;
        39.0.0.0/8;
        42.0.0.0/8;
        49.0.0.0/8;
        50.0.0.0/8;
        77.0.0.0/8;
        78.0.0.0/7;
        92.0.0.0/6;
        96.0.0.0/4;
        112.0.0.0/5;
        120.0.0.0/8;
        127.0.0.0/8;
        169.254.0.0/16;
        172.16.0.0/12;
        173.0.0.0/8;
        174.0.0.0/7;
        176.0.0.0/5;
        184.0.0.0/6;
        192.0.2.0/24;
        192.168.0.0/16;
        197.0.0.0/8;
        198.18.0.0/15;
        223.0.0.0/8;
        224.0.0.0/3;
    }
    policy-statement external-in {
        term external-in-10 {
            then {
                metric 10000;
                local-preference 80;
                community set comm-209-888;
                accept;
            }
        }
        term external-in-20 {
            then reject;
        }
    }
    policy-statement deny-gunk {
        term deny-gunk-10 {
            from {
                route-filter 0.0.0.0/0 upto /24 next term;
                route-filter 0.0.0.0/0 upto /32;
            }
            then reject;
        }
        term deny-gunk-20 {
            from {
                route-filter 0.0.0.0/0 through 0.0.0.0/32 reject;
                route-filter 10.0.0.0/8 orlonger reject;
                route-filter 127.0.0.0/8 orlonger reject;
                route-filter 172.16.0.0/12 orlonger reject;
                route-filter 192.168.0.0/16 orlonger reject;
                route-filter 128.0.0.0/16 orlonger reject;
                route-filter 191.255.0.0/16 orlonger reject;
                route-filter 233.255.255.0/24 orlonger reject;
                route-filter 224.0.0.0/3 orlonger reject;
                route-filter 198.32.176.0/24 orlonger reject;
                route-filter 192.157.69.0/24 orlonger reject;
                route-filter 198.32.186.0/24 orlonger reject;
                route-filter 192.41.177.0/24 orlonger reject;
                route-filter 198.32.136.0/24 orlonger reject;
                route-filter 198.32.184.0/24 orlonger reject;
                route-filter 198.32.130.0/24 orlonger reject;
                route-filter 206.220.243.0/24 orlonger reject;
                route-filter 198.32.128.0/24 orlonger reject;
                route-filter 198.32.200.0/24 orlonger reject;
                route-filter 198.32.139.0/24 orlonger reject;
                route-filter 198.32.187.0/24 orlonger reject;
                route-filter 198.32.177.0/24 orlonger reject;
                route-filter 198.9.201.0/24 orlonger reject;
                route-filter 198.36.137.0/24 orlonger reject;
            }
            then next term;
        }
    }
    policy-statement customer-loadshare {
        term 1 {
            from {
                protocol bgp;
                neighbor [ 151.196.0.250 151.205.0.249 209.158.128.200 151.196.0.249 207.68.64.249 151.200.255.253 151.205.128.249 ];
            }
            then {
                load-balance per-packet;
            }
        }
    }
    policy-statement export-default {
        from {
            protocol static;
            route-filter 0.0.0.0/0 exact;
        }
        then accept;
    }
    policy-statement deny-gunk-allow-default {
        term deny-gunk-10 {
            from {
                route-filter 0.0.0.0/0 upto /24 next term;
                route-filter 0.0.0.0/0 upto /32;
            }
            then reject;
        }
        term deny-gunk-20 {
            from {
                route-filter 10.0.0.0/8 orlonger reject;
                route-filter 127.0.0.0/8 orlonger reject;
                route-filter 172.16.0.0/12 orlonger reject;
                route-filter 192.168.0.0/16 orlonger reject;
                route-filter 128.0.0.0/16 orlonger reject;
                route-filter 191.255.0.0/16 orlonger reject;
                route-filter 233.255.255.0/24 orlonger reject;
                route-filter 224.0.0.0/3 orlonger reject;
                route-filter 198.32.176.0/24 orlonger reject;
                route-filter 192.157.69.0/24 orlonger reject;
                route-filter 198.32.186.0/24 orlonger reject;
                route-filter 192.41.177.0/24 orlonger reject;
                route-filter 198.32.136.0/24 orlonger reject;
                route-filter 198.32.184.0/24 orlonger reject;
                route-filter 198.32.130.0/24 orlonger reject;
                route-filter 206.220.243.0/24 orlonger reject;
                route-filter 198.32.128.0/24 orlonger reject;
                route-filter 198.32.200.0/24 orlonger reject;
                route-filter 198.32.139.0/24 orlonger reject;
                route-filter 198.32.187.0/24 orlonger reject;
                route-filter 198.32.177.0/24 orlonger reject;
                route-filter 198.9.201.0/24 orlonger reject;
                route-filter 198.36.137.0/24 orlonger reject;
            }
            then next term;
        }
    }
    policy-statement non-transit-in {
        term non-transit-in-10 {
            then {
                metric 10000;
                local-preference 80;
                community set comm-209-888;
                accept;
            }
        }
    }
    policy-statement bogons {
        from {
            route-filter 10.0.0.0/8 orlonger;
            route-filter 172.16.0.0/12 orlonger;
            route-filter 192.168.0.0/16 orlonger;
            route-filter 0.0.0.0/0 through 0.0.0.0/32;
        }
        then accept;
    }
    policy-statement external-out {
        term 10 {
            from policy connected-bgp;
            then next term;
        }
        term 20 {
            from policy static-bgp;
            then next term;
        }
        term 30 {
            from as-path 20;
            then reject;
        }
        term 40 {
            from community [ 209:777 209:888 209:999 ];
            then reject;
        }
        term 50 {
            from {
                community 209:209;
                policy stnd_external_out;
            }
            then accept;
        }
        term 60 {
            then reject;
        }
    }
    policy-statement import-with-defaults {
        then {
            metric 100000;
            preference 255;
            local-preference 1;
            origin incomplete;
            community set 209:001;
            reject;
        }
    }
    policy-statement export-with-defaults {
        then {
            metric 100000;
            preference 255;
            local-preference 1;
            origin incomplete;
            community set 209:001;
            reject;
        }
    }
    policy-statement import-accept {
        then accept;
    }
    policy-statement full-routes {
        term 10 {
            from policy connected-bgp;
            then next term;
        }
        term 20 {
            from policy static-bgp;
            then next term;
        }
        term 30 {
            from as-path 21;
            then reject;
        }
        term 40 {
            from community [ 209:777 209:999 ];
            then reject;
        }
        term 50 {
            from {
                community [ 209:888 209:209 ];
                policy stnd_external_out;
            }
            then accept;
        }
        term 60 {
            then reject;
        }
    }
    policy-statement full-routes-w-default {
        term 10 {
            from policy connected-bgp;
            then next term;
        }
        term 20 {
            from policy static-bgp;
            then next term;
        }
        term 30 {
            from as-path 21;
            then reject;
        }
        term 40 {
            from community [ 209:777 209:999 ];
            then reject;
        }
        term 50 {
            from {
                protocol static;
                route-filter 0.0.0.0/0 exact;
            }
            then accept;
        }
        term 60 {
            from {
                community [ 209:888 209:209 ];
                policy stnd_external_out;
            }
            then accept;
        }
        term 70 {
            then reject;
        }
    }
    policy-statement qwest-routes {
        term 10 {
            from policy connected-bgp;
            then next term;
        }
        term 20 {
            from policy static-bgp;
            then next term;
        }
        term 30 {
            from as-path 21;
            then reject;
        }
        term 40 {
            from community [ 209:777 209:888 209:999 ];
            then reject;
        }
        term 50 {
            from {
                community 209:209;
                policy stnd_external_out;
            }
            then accept;
        }
        term 60 {
            then reject;
        }
    }
    policy-statement qwest-routes-w-default {
        term 10 {
            from policy connected-bgp;
            then next term;
        }
        term 20 {
            from policy static-bgp;
            then next term;
        }
        term 30 {
            from as-path 21;
            then reject;
        }
        term 40 {
            from community [ 209:777 209:888 209:999 ];
            then reject;
        }
        term 50 {
            from {
                protocol static;
                route-filter 0.0.0.0/0 exact;
            }
            then accept;
        }
        term 60 {
            from {
                community 209:209;
                policy stnd_external_out;
            }
            then accept;
        }
        term 70 {
            then reject;
        }
    }
    policy-statement default-only {
        term 10 {
            from {
                protocol static;
                route-filter 0.0.0.0/0 exact;
            }
            then accept;
        }
        term 20 {
            then reject;
        }
    }
    policy-statement connected-bgp {
        term deny-bogons {
            from {
                protocol direct;
                policy bogons;
            }
            then reject;
        }
        term default {
            from protocol direct;
            then {
                local-preference 100;
                origin igp;
                community set 209:777;
                community add wdc-pop;
                next-hop self;
                accept;
            }
        }
    }
    policy-statement static-bgp {
        term deny-10 {
            from {
                protocol static;
                policy bogons;
            }
            then reject;
        }
        term permit-20 {
            from {
                protocol static;
                policy stnd_backup_qwest;
            }
            then {
                local-preference 90;
                origin igp;
                community add wdc-pop;
                community add 209:777;
                next-hop self;
                accept;
            }
        }
        term permit-30 {
            from {
                protocol static;
                policy stnd_netblocks_qwest;
            }
            then {
                local-preference 100;
                origin igp;
                community add wdc-pop;
                community add 209:777;
                next-hop self;
                accept;
            }
        }
        term permit-40 {
            from {
                protocol static;
                policy stnd_backup_cust;
            }
            then {
                local-preference 90;
                origin igp;
                community add wdc-pop;
                community add 209:209;
                next-hop self;
                accept;
            }
        }
        term permit-50 {
            from protocol static;
            then {
                local-preference 100;
                origin igp;
                community add wdc-pop;
                community add 209:209;
                next-hop self;
                accept;
            }
        }
    }
    policy-statement stnd_backup_cust {
        from {
            route-filter 0.0.0.0/32 exact;
        }
        then accept;
    }
    policy-statement stnd_backup_qwest {
        from {
            route-filter 0.0.0.0/32 exact;
        }
        then accept;
    }
    policy-statement stnd_netblocks_qwest {
        from {
            route-filter 63.144.0.0/12 longer;
            route-filter 63.224.0.0/12 longer;
            route-filter 65.100.0.0/14 longer;
            route-filter 65.112.0.0/12 longer;
            route-filter 65.128.0.0/11 longer;
            route-filter 66.77.0.0/16 longer;
            route-filter 67.0.0.0/13 longer;
            route-filter 67.40.0.0/15 longer;
            route-filter 67.42.0.0/16 longer;
            route-filter 67.128.0.0/13 longer;
            route-filter 67.144.0.0/14 longer;
            route-filter 67.148.0.0/16 longer;
            route-filter 68.176.0.0/15 longer;
            route-filter 69.8.192.0/18 longer;
            route-filter 168.103.0.0/16 longer;
            route-filter 198.36.128.0/17 longer;
            route-filter 198.59.0.0/18 longer;
            route-filter 198.59.64.0/19 longer;
            route-filter 198.233.0.0/16 longer;
            route-filter 198.243.0.0/16 longer;
            route-filter 199.117.0.0/16 longer;
            route-filter 204.131.0.0/16 longer;
            route-filter 204.26.64.0/18 longer;
            route-filter 204.98.0.0/16 longer;
            route-filter 204.132.0.0/15 longer;
            route-filter 204.134.0.0/16 longer;
            route-filter 204.147.80.0/20 longer;
            route-filter 204.228.64.0/18 longer;
            route-filter 204.245.64.0/18 longer;
            route-filter 205.168.0.0/14 longer;
            route-filter 205.215.192.0/19 longer;
            route-filter 206.80.192.0/19 longer;
            route-filter 206.81.128.0/19 longer;
            route-filter 206.81.192.0/19 longer;
            route-filter 206.196.128.0/19 longer;
            route-filter 207.108.0.0/15 longer;
            route-filter 207.159.64.0/18 longer;
            route-filter 207.224.0.0/15 longer;
            route-filter 208.44.0.0/14 longer;
            route-filter 209.3.0.0/16 longer;
            route-filter 209.45.128.0/17 longer;
            route-filter 209.180.0.0/15 longer;
            route-filter 209.201.0.0/17 longer;
            route-filter 209.211.0.0/16 longer;
            route-filter 216.111.0.0/16 longer;
            route-filter 216.160.0.0/15 longer;
            route-filter 216.206.0.0/15 longer;
            route-filter 70.56.0.0/14 longer;
            route-filter 71.32.0.0/13 longer;
            route-filter 72.164.0.0/15 longer;
            route-filter 71.208.0.0/12 longer;
            route-filter 72.166.0.0/16 longer;
        }
        then accept;
    }
    policy-statement core-out {
        term blackhole {
            from community blackhole-209:0;
            then {
                next-hop 192.0.2.3;
                accept;
            }
        }
        term default {
            then {
                next-hop self;
            }
        }
    }
    policy-statement stnd_external_out {
        from {
            route-filter 0.0.0.0/0 exact reject;
            route-filter 0.0.0.0/7 orlonger reject;
            route-filter 2.0.0.0/8 orlonger reject;
            route-filter 5.0.0.0/8 orlonger reject;
            route-filter 7.0.0.0/8 orlonger reject;
            route-filter 10.0.0.0/8 orlonger reject;
            route-filter 23.0.0.0/8 orlonger reject;
            route-filter 27.0.0.0/8 orlonger reject;
            route-filter 31.0.0.0/8 orlonger reject;
            route-filter 36.0.0.0/7 orlonger reject;
            route-filter 39.0.0.0/8 orlonger reject;
            route-filter 42.0.0.0/8 orlonger reject;
            route-filter 49.0.0.0/8 orlonger reject;
            route-filter 50.0.0.0/8 orlonger reject;
            route-filter 77.0.0.0/8 orlonger reject;
            route-filter 78.0.0.0/7 orlonger reject;
            route-filter 92.0.0.0/6 orlonger reject;
            route-filter 96.0.0.0/4 orlonger reject;
            route-filter 112.0.0.0/5 orlonger reject;
            route-filter 120.0.0.0/8 orlonger reject;
            route-filter 127.0.0.0/8 orlonger reject;
            route-filter 169.254.0.0/16 orlonger reject;
            route-filter 172.16.0.0/12 orlonger reject;
            route-filter 173.0.0.0/8 orlonger reject;
            route-filter 174.0.0.0/7 orlonger reject;
            route-filter 176.0.0.0/5 orlonger reject;
            route-filter 184.0.0.0/6 orlonger reject;
            route-filter 192.0.2.0/24 orlonger reject;
            route-filter 192.168.0.0/16 orlonger reject;
            route-filter 197.0.0.0/8 orlonger reject;
            route-filter 198.18.0.0/15 orlonger reject;
            route-filter 223.0.0.0/8 orlonger reject;
            route-filter 224.0.0.0/3 orlonger reject;
            route-filter 0.0.0.0/0 prefix-length-range /25-/32 reject;
            route-filter 0.0.0.0/0 orlonger accept;
        }
    }
    policy-statement stnd_external_out_bogons {
        from {
            route-filter 0.0.0.0/0 exact reject;
            route-filter 0.0.0.0/7 orlonger reject;
            route-filter 2.0.0.0/8 orlonger reject;
            route-filter 5.0.0.0/8 orlonger reject;
            route-filter 7.0.0.0/8 orlonger reject;
            route-filter 10.0.0.0/8 orlonger reject;
            route-filter 23.0.0.0/8 orlonger reject;
            route-filter 27.0.0.0/8 orlonger reject;
            route-filter 31.0.0.0/8 orlonger reject;
            route-filter 36.0.0.0/7 orlonger reject;
            route-filter 39.0.0.0/8 orlonger reject;
            route-filter 42.0.0.0/8 orlonger reject;
            route-filter 49.0.0.0/8 orlonger reject;
            route-filter 50.0.0.0/8 orlonger reject;
            route-filter 77.0.0.0/8 orlonger reject;
            route-filter 78.0.0.0/7 orlonger reject;
            route-filter 92.0.0.0/6 orlonger reject;
            route-filter 96.0.0.0/4 orlonger reject;
            route-filter 112.0.0.0/5 orlonger reject;
            route-filter 120.0.0.0/8 orlonger reject;
            route-filter 127.0.0.0/8 orlonger reject;
            route-filter 169.254.0.0/16 orlonger reject;
            route-filter 172.16.0.0/12 orlonger reject;
            route-filter 173.0.0.0/8 orlonger reject;
            route-filter 174.0.0.0/7 orlonger reject;
            route-filter 176.0.0.0/5 orlonger reject;
            route-filter 184.0.0.0/6 orlonger reject;
            route-filter 192.0.2.0/24 orlonger reject;
            route-filter 192.168.0.0/16 orlonger reject;
            route-filter 197.0.0.0/8 orlonger reject;
            route-filter 198.18.0.0/15 orlonger reject;
            route-filter 223.0.0.0/8 orlonger reject;
            route-filter 224.0.0.0/3 orlonger reject;
            route-filter 0.0.0.0/0 orlonger accept;
        }
    }
    policy-statement transit-customer-in {
        term bad-communities {
            from community BAD_COMMUNITIES;
            then reject;
        }
        term peer-routes {
            from as-path 19;
            then reject;
        }
        term blackhole {
            from community blackhole-209:0;
            then {
                community set blackhole-209:0;
                community add no-export;
                next-hop 192.0.2.3;
                accept;
            }
        }
        term permit-20 {
            from {
                community 10;
                policy stnd_external_out;
            }
            then {
                local-preference 100;
                community set 209:888;
                community add wdc-pop;
                next policy;
            }
        }
        term permit-30 {
            from {
                community 6;
                policy stnd_external_out_bogons;
            }
            then {
                local-preference 100;
                community set 209:999;
                community add wdc-pop;
                next policy;
            }
        }
        term permit-40 {
            from {
                community 7;
                policy stnd_external_out;
            }
            then {
                local-preference 70;
                community add 209:209;
                community add wdc-pop;
                next policy;
            }
        }
        term permit-50 {
            from {
                community 8;
                policy stnd_external_out;
            }
            then {
                local-preference 80;
                community add 209:209;
                community add wdc-pop;
                next policy;
            }
        }
        term permit-60 {
            from {
                community 9;
                policy stnd_external_out;
            }
            then {
                local-preference 90;
                community add 209:209;
                community add wdc-pop;
                next policy;
            }
        }
        term permit-70 {
            from policy stnd_external_out;
            then {
                local-preference 100;
                community add 209:209;
                community add wdc-pop;
                next policy;
            }
        }
        term deny-all {
            then reject;
        }
    }
    community 10 members 209:888;
    community 209:001 members 209:001;
    community 209:209 members 209:209;
    community 209:65504 members 209:65504;
    community 209:777 members 209:777;
    community 209:888 members 209:888;
    community 209:889 members 209:889;
    community 209:999 members 209:999;
    community 6 members 209:999;
    community 7 members 209:70;
    community 8 members 209:80;
    community 9 members 209:90;
    community BAD_COMMUNITIES members "^(209:(([1-9])|([0-6].)|([3-7]..)|(....)|([0-5]....)|(6[0-3]...)|(64[0-4]..)|(65...)))$";
    community blackhole-209:0 members 209:0;
    community comm-209-209 members 209:209;
    community comm-209-300 members 209:300;
    community comm-209-65018 members 209:65018;
    community comm-209-65032 members 209:65032;
    community comm-209-70 members 209:70;
    community comm-209-777 members 209:777;
    community comm-209-80 members 209:80;
    community comm-209-888 members 209:888;
    community comm-209-90 members 209:90;
    community comm-209-999 members 209:999;
    community comm-popaggr members 209:707;
    community comm-primary members 209:776;
    community no-export members no-export;
    community wdc-pop members 209:20228;
    as-path 21 ".*(64512-65535).*";
    as-path 98 .;
    as-path as_path_20_reject ".* (64512-65535|1|174|701|1239|1299|2548|2828|2914|3257|3356|3549|3561|4006|4134|4200|4544|4565|6453|6461|7018|7911) .*";
    as-path as_path_20_accept .*;
    as-path 19 ".*(174|577|701|852|1239|1299|1668|2828|2914|3320|3257|3356|3549|3561|4134|4637|4725|5400|5511|6453|6461|7018|7473|7911|12956).*";
    as-path 20 ".*(64512-65535|174|577|701|852|1239|1299|1668|2828|2914|3257|3320|3356|3549|3561|4134|4637|4725|5400|5511|6453|6461|7018|7473|7911|12956).*";
}
firewall {
    policer limit-small {
        if-exceeding {
            bandwidth-limit 500k;
            burst-size-limit 50k;
        }
        then discard;
    }
    policer limit-medium {
        if-exceeding {
            bandwidth-limit 2m;
            burst-size-limit 500k;
        }
        then discard;
    }
    policer limit-medium-high {
        if-exceeding {
            bandwidth-limit 10m;
            burst-size-limit 1m;
        }
        then discard;
    }
    policer limit-high {
        if-exceeding {
            bandwidth-limit 15m;
            burst-size-limit 1m;
        }
        then discard;
    }
    policer limit-spoofing {
        if-exceeding {
            bandwidth-limit 3m;
            burst-size-limit 300k;
        }
        then discard;
    }
    policer limit-customer {
        if-exceeding {
            bandwidth-limit 500k;
            burst-size-limit 50k;
        }
        then discard;
    }
    policer 22Meg {
        if-exceeding {
            bandwidth-limit 30m;
            burst-size-limit 50k;
        }
        then discard;
    }
    policer 3Meg {
        if-exceeding {
            bandwidth-limit 3m;
            burst-size-limit 50k;
        }
        then discard;
    }
    filter edge-secure-RE {
        term limit-syn-fin {
            from {
                protocol tcp;
                tcp-flags "syn | fin";
            }
            then {
                policer limit-small;
                next term;
            }
        }
        term icmp-source-quench {
            from {
                protocol icmp;
                icmp-type source-quench;
            }
            then {
                discard;
            }
        }
        term icmp {
            from {
                protocol icmp;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term traceroute {
            from {
                protocol udp;
                destination-port 33434-33523;
            }
            then {
                policer limit-small;
                accept;
            }
        }
        term management-access {
            from {
                source-address {
                    216.111.65.1/32;
                    208.47.0.248/32;
                    204.147.85.60/32;
                    204.147.85.59/32;
                    208.47.0.15/32;
                    216.111.66.1/32;
                    208.47.0.43/32;
                    207.225.133.120/32;
                }
                protocol tcp;
                port [ telnet ssh ];
            }
            then accept;
        }
        term snmp {
            from {
                source-prefix-list {
                    services-snmp;
                }
                protocol udp;
                port snmp;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term radius {
            from {
                source-prefix-list {
                    services-radius;
                }
                protocol udp;
                port radius;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term domain {
            from {
                source-prefix-list {
                    services-domain;
                }
                protocol udp;
                port domain;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term ntp {
            from {
                source-prefix-list {
                    services-ntp;
                }
                protocol udp;
                port ntp;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term bgp {
            from {
                source-prefix-list {
                    bgp-regexp;
                }
                protocol tcp;
                port bgp;
            }
            then {
                policer limit-high;
                sample;
                accept;
            }
        }
        term tcp-fragments {
            from {
                is-fragment;
                protocol tcp;
            }
            then {
                policer limit-medium-high;
                accept;
            }
        }
        term rsvp {
            from {
                source-address {
                    205.171.0.0/16;
                    67.14.0.0/15;
                    67.14.128.0/23;
                }
                protocol rsvp;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term ldp {
            from {
                source-address {
                    205.171.0.0/16;
                    67.133.0.0/23;
                }
                protocol [ tcp udp ];
                port 646;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term gretunnel {
            from {
                source-address {
                    205.171.0.0/16;
                }
                protocol gre;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term sap {
            from {
                destination-address {
                    224.2.127.254/32;
                }
                protocol udp;
                port 9875;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term vrrp {
            from {
                source-address {
                    205.171.0.0/16;
                }
                destination-address {
                    224.0.0.18/32;
                }
                protocol 112;
            }
            then {
                policer limit-medium;
                accept;
            }
        }
        term ftp-data {
            from {
                source-address {
                    205.171.0.0/16;
                    207.17.137.34/32;
                }
                protocol tcp;
                source-port [ ftp ftp-data ];
            }
            then {
                policer limit-high;
                accept;
            }
        }
        term deny-all {
            then {
                count discards;
                log;
                sample;
                discard;
            }
        }
    }
    filter dos-identifier-out {
        interface-specific;
        term sample {
            then {
                sample;
                next term;
            }
        }
        term bogons {
            from {
                source-prefix-list {
                    bogons;
                }
            }
            then {
                count bogons;
                next term;
            }
        }
        term tcp-established {
            from {
                protocol tcp;
                tcp-established;
            }
            then {
                count tcp-established;
                next term;
            }
        }
        term tcp-syn {
            from {
                protocol tcp;
                tcp-flags syn;
            }
            then {
                count tcp-syn;
                next term;
            }
        }
        term icmp-echo-reply {
            from {
                protocol icmp;
                icmp-type echo-reply;
            }
            then {
                count icmp-echo-replies;
                accept;
            }
        }
        term icmp-echo-request {
            from {
                protocol icmp;
                icmp-type echo-request;
            }
            then {
                count icmp-echo-requests;
                accept;
            }
        }
        term netbios {
            from {
                protocol [ udp tcp ];
                destination-port [ netbios-ssn netbios-ns netbios-dgm ];
            }
            then {
                count netbios;
                accept;
            }
        }
        term port-135 {
            from {
                protocol [ udp tcp ];
                port 135;
            }
            then {
                count port-135;
                accept;
            }
        }
        term port-445 {
            from {
                protocol [ udp tcp ];
                port 445;
            }
            then {
                count port-445;
                accept;
            }
        }
        term port-1434 {
            from {
                protocol udp;
                port 1434;
            }
            then {
                count port-1434;
                accept;
            }
        }
        term accept-all {
            then accept;
        }
    }
    filter 200-00-3-in {
        term allow-bgp {
            from {
                protocol tcp;
                port bgp;
            }
            then accept;
        }
        term rate-limit {
            then {
                policer 3Meg;
                accept;
            }
        }
    }
    filter 200-00-3-out {
        term allow-bgp {
            from {
                protocol tcp;
                port bgp;
            }
            then accept;
        }
        term rate-limit {
            then {
                policer 3Meg;
                accept;
            }
        }
    }
}