# Australia security and isolation verification

## VRFs
- AU_SYDNEY_VRF | VRF_AU | RD 65011:101 | import=accept own AU routes and shared services | export=advertise only the claimed partner /28
- AU_MELBOURNE_VRF | VRF_AU | RD 65011:102 | import=accept own AU routes and shared services | export=advertise only the claimed partner /28
- AU_VA_VRF | VRF_AU | RD 65011:1 | import=permit AU_PARENT and shared-services only | export=deny all other country VRFs; export AU_PARENT
- AU_TX_VRF | VRF_AU | RD 65011:2 | import=permit AU_PARENT and shared-services only | export=deny all other country VRFs; export AU_PARENT
- AU_ADELAIDE_VRF | VRF_AU | RD 65011:105 | import=accept own AU routes and shared services | export=advertise only the claimed partner /28
- AU_BRISBANE_VRF | VRF_AU | RD 65011:103 | import=accept own AU routes and shared services | export=advertise only the claimed partner /28
- AU_CORE_VRF | VRF_AU | RD 65011:100 | import=accept own AU routes and shared services | export=summarize 10.42.0.0/16
- AU_PERTH_VRF | VRF_AU | RD 65011:104 | import=accept own AU routes and shared services | export=advertise only the claimed partner /28

## EIGRP controls
- AU_CORE_TO_TX_EIGRP | AS 65011 | advertise=summary 10.42.0.0/16 | accept=10.255.0.0/16 shared services and default with leak prevention | isolation=deny 10.41.0.0/16 through 10.45.0.0/16 except 10.42.0.0/16
- AU_CORE_TO_VA_EIGRP | AS 65011 | advertise=summary 10.42.0.0/16 | accept=10.255.0.0/16 shared services and default with leak prevention | isolation=deny 10.41.0.0/16 through 10.45.0.0/16 except 10.42.0.0/16
- AU_SYDNEY_TO_USA_VA_EIGRP | AS 65011 | advertise=permit 10.42.1.0/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_MELBOURNE_TO_USA_VA_EIGRP | AS 65011 | advertise=permit 10.42.1.16/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_SYDNEY_TO_COUNTRY_CORE_EIGRP | AS 65011 | advertise=permit 10.42.1.0/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_MELBOURNE_TO_COUNTRY_CORE_EIGRP | AS 65011 | advertise=permit 10.42.1.16/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_PERTH_TO_USA_TX_EIGRP | AS 65011 | advertise=permit 10.42.1.48/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_ADELAIDE_TO_USA_VA_EIGRP | AS 65011 | advertise=permit 10.42.1.64/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_SYDNEY_TO_USA_TX_EIGRP | AS 65011 | advertise=permit 10.42.1.0/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_MELBOURNE_TO_USA_TX_EIGRP | AS 65011 | advertise=permit 10.42.1.16/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_BRISBANE_TO_USA_TX_EIGRP | AS 65011 | advertise=permit 10.42.1.32/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_PERTH_TO_USA_VA_EIGRP | AS 65011 | advertise=permit 10.42.1.48/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_ADELAIDE_TO_COUNTRY_CORE_EIGRP | AS 65011 | advertise=permit 10.42.1.64/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_BRISBANE_TO_COUNTRY_CORE_EIGRP | AS 65011 | advertise=permit 10.42.1.32/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_BRISBANE_TO_USA_VA_EIGRP | AS 65011 | advertise=permit 10.42.1.32/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_PERTH_TO_COUNTRY_CORE_EIGRP | AS 65011 | advertise=permit 10.42.1.48/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs
- AU_ADELAIDE_TO_USA_TX_EIGRP | AS 65011 | advertise=permit 10.42.1.64/28 only | accept=permit 10.42.0.0/16, 10.255.0.0/16, and default | isolation=deny sibling partner /28s for direct forwarding; deny all non-AU VRFs

## ASA protocol breaks
- AU_PERTH_CLEAN_BREAK | AU_PERTH_FW -> AU_PERTH_OVERLAY | ASA IKEv1 AES-256 SHA-256 DH-group14 lifetime 86400; NAT exemption and crypto ACL
- AU_BRISBANE_CLEAN_BREAK | AU_BRISBANE_FW -> AU_BRISBANE_OVERLAY | ASA IKEv1 AES-256 SHA-256 DH-group14 lifetime 86400; NAT exemption and crypto ACL
- AU_CORE_CLEAN_BREAK | AU_CORE_FW -> AU_CORE_OVERLAY | ASA IKEv1 AES-256 SHA-256 DH-group14 lifetime 86400; NAT exemption and crypto ACL
- AU_MELBOURNE_CLEAN_BREAK | AU_MELBOURNE_FW -> AU_MELBOURNE_OVERLAY | ASA IKEv1 AES-256 SHA-256 DH-group14 lifetime 86400; NAT exemption and crypto ACL
- AU_SYDNEY_CLEAN_BREAK | AU_SYDNEY_FW -> AU_SYDNEY_OVERLAY | ASA IKEv1 AES-256 SHA-256 DH-group14 lifetime 86400; NAT exemption and crypto ACL
- AU_ADELAIDE_CLEAN_BREAK | AU_ADELAIDE_FW -> AU_ADELAIDE_OVERLAY | ASA IKEv1 AES-256 SHA-256 DH-group14 lifetime 86400; NAT exemption and crypto ACL


Checks:
- IKEv2 is used only on dirty DMVPN relationships.
- IKEv1 is used for every ASA clean-side protocol break.
- Every partner advertises one claimed /28.
- Country-specific VRFs deny all other parent summaries.
- ASA ACL and NAT exemption policy allow country/shared services and deny direct sibling traffic.