@takodotid/circuit 0.41.0 → 0.42.0

package/src/helpers/upstreams.ts

@@ -63,10 +63,12 @@ export type Upstream = {
     tunnel?: { interface: string; local: IP; remote: IP; addresses: readonly InterfaceAddress[]; mtu?: number };
     /** Our BGP sessions with it, by name: its address, and ours when it is not the interface's. */
     sessions: Readonly<Record<string, { address: IP; local_address?: IP }>>;
-    /** A BGP group its sessions share, by this name: the group holds the AS, role, policies and multihop settings, and each session names it. Each session holds them itself when absent. */
+    /** A BGP group its sessions share, by this name: the group holds the AS, role, policies, table and multihop settings, and each session names it. Each session holds them itself when absent. */
     group?: string;
     /** The sessions are more than one hop away, from this address of ours. */
     multihop?: { local_address: IP; families?: readonly Family[]; password?: Secret };
+    /** The routing table its sessions install the routes they learn in, one of the router's `routing.tables`: a transit that carries only one block's traffic out. The main table when absent. */
+    table?: string;
     /** The most prefixes a session may send, by its family: about twice what it sends. Over it, the session closes until it is cleared. */
     limits?: { ipv4?: number; ipv6?: number };
     /** What we take, as its policy. Nothing when absent. */
@@ -105,6 +107,8 @@ type PolicyName<C> = Values<{
 }>;
 /** Each BGP group name. */
 type GroupName<C> = Values<{ [K in keyof C]: C[K] extends { group: infer N extends string } ? N : never }>;
+/** Each routing table name. */
+type TableName<C> = Values<{ [K in keyof C]: C[K] extends { table: infer N extends string } ? N : never }>;
 
 /** A network's upstreams written once, and each device's part built from them. */
 export class Upstreams {
@@ -217,7 +221,7 @@ export class Upstreams {
         const uplinks = () => all.flatMap(([, upstream]) => (upstream.handoff ? [upstream.handoff.interface as HandoffInterface<C>] : []));
 
         /** What a session, or the group it is in, takes from its upstream. */
-        const settings = (key: string, upstream: Upstream): NeighborSettings<PolicyName<C>> => {
+        const settings = (key: string, upstream: Upstream): NeighborSettings<PolicyName<C>, TableName<C>> => {
             const multihop = upstream.multihop;
             return {
                 remote_as: upstream.asn,
@@ -225,6 +229,7 @@ export class Upstreams {
                 role: upstream.role,
                 ...(upstream.import ? { import: upstream.import.name as PolicyName<C> } : {}),
                 export: upstream.export.name as PolicyName<C>,
+                ...(upstream.table ? { table: upstream.table as TableName<C> } : {}),
                 ...(multihop
                     ? {
                           local_address: multihop.local_address,
@@ -239,7 +244,7 @@ export class Upstreams {
         const groups = () =>
             Object.fromEntries(
                 all.flatMap(([key, upstream]) => (upstream.group ? [[upstream.group, settings(key, upstream)]] : []))
-            ) as Record<GroupName<C>, NeighborSettings<PolicyName<C>>>;
+            ) as Record<GroupName<C>, NeighborSettings<PolicyName<C>, TableName<C>>>;
 
         const neighbors = () =>
             Object.fromEntries(
@@ -256,7 +261,7 @@ export class Upstreams {
                         ];
                     })
                 )
-            ) as Record<string, Neighbor<PolicyName<C>, GroupName<C>>>;
+            ) as Record<string, Neighbor<PolicyName<C>, GroupName<C>, TableName<C>>>;
 
         /**
          * Each upstream's import and export, by name. The policies and prefix sets their rules name are checked by `validate`, not by the editor, so the rules are typed to fit any device.

package/src/platforms/derive.ts

@@ -5,7 +5,14 @@ import type { Device } from "../schema";
 
 /** A feature a platform renders once proved on one of its devices. */
 export type ProvedFeature =
-    "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter" | "management-vdom";
+    | "bfd-timers"
+    | "static-route-bfd"
+    | "multihop-bfd"
+    | "alarm-severity"
+    | "mac-limit"
+    | "ethertype-filter"
+    | "management-vdom"
+    | "routing-tables";
 
 export class Derive {
     /** Each LAG's number: its own `id`, or its position among the device's LAGs. */
@@ -47,11 +54,26 @@ export class Derive {
         for (const route of routing?.static ?? []) {
             if (route.bfd && !has("static-route-bfd"))
                 found.push(`routing.static ${route.prefix} bfd, BFD on a static route is ${unproved}`);
+            if (route.table && !has("routing-tables"))
+                found.push(`routing.static ${route.prefix} table, a routing table beside the main one is ${unproved}`);
+        }
+
+        if (!has("routing-tables")) {
+            if (routing?.tables) found.push(`routing.tables, a routing table beside the main one is ${unproved}`);
+            if (routing?.rules) found.push(`routing.rules, routing rules are ${unproved}`);
         }
 
         const bgp = routing?.bgp;
 
+        for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
+            if (group.table && !has("routing-tables"))
+                found.push(`routing.bgp.groups.${name}.table, a routing table beside the main one is ${unproved}`);
+        }
+
         for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+            if (neighbor.table && !has("routing-tables"))
+                found.push(`routing.bgp.neighbors.${name}.table, a routing table beside the main one is ${unproved}`);
+
             const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
             const bfd = neighbor.bfd ?? group?.bfd;
             const multihop = neighbor.multihop ?? group?.multihop;

package/src/platforms/fortios/routing.ts

@@ -7,7 +7,7 @@ import { FortiOsNames } from "./names";
 import { FortiOsBlock, FortiOsTree } from "./tree";
 
 type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 
 /** The lengths a prefix list's rule takes within its prefix. */
 type Lengths = { ge?: number; le?: number };
@@ -167,7 +167,7 @@ export class FortiOsRouting {
     static readonly BITS = { ipv4: 32, ipv6: 128 } as const;
 
     /** A neighbor's settings with its group's beneath them. */
-    static neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string> {
+    static neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string> {
         const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
         return { ...group, ...neighbor };
     }

package/src/platforms/junos/bgp.ts

@@ -6,7 +6,7 @@ import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../
 import { JunosRender, type JunosStatements } from "./render";
 
 type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 
 /** BGP sessions, the policies they use, prefix sets and RPKI servers, added to one device's statements. */
 export class JunosBgp {
@@ -41,7 +41,7 @@ export class JunosBgp {
     }
 
     /** A neighbor's settings with its group's beneath them. */
-    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string> {
+    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string> {
         const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
         return { ...group, ...neighbor };
     }

package/src/platforms/routeros/TRAPS.md

@@ -63,3 +63,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `use-bfd=no`, set on a connection that had `use-bfd=yes`, is printed by the export; it is the default, and the plan sets it to take BFD off.
 - No MAC learning limit on 7.23.5: `/interface bridge port` has `learn` but no limit, and `/interface ethernet switch port` has none (CCR2216). `mac_limit` stays refused.
 - A switch rule matches a kind of frame with `mac-protocol` (`ip`, `ipv6`, `arp` among 23 kinds), but cannot match "not" one. An ethertype filter is a rule that lets each kind through and a last one with an empty `new-dst-ports` for the rest, after the port's ACL rules, which match only `ip` or `ipv6`. Four such rules on a free port took the router to 70 switch rules, none invalid (CCR2216, 7.23.5).
+- A routing table holds no routes the router forwards by unless it has `fib`: `/routing table add fib name=...`. The export prints the flag between the properties, `add comment=... fib name=...`.
+- A BGP connection's `routing-table` installs what it learns in that table and not in main; the next hop still resolves through main. Proved on a CCR2216 on 7.23.5 with a session to a test speaker: its routes showed `routing-table=<table>`, active, and main kept only its own static route. The export prints `routing-table` only when it is not `main`.
+- `/routing rule` is an ordered list without names, like a filter chain, and the plan rewrites it whole in the config's order. `lookup-only-in-table` drops a packet its table has no route for (a ping printed `no route`); `lookup` routes it by main instead (the ping left). An interface to match is `interface=`. A `drop` or `unreachable` rule is printed with `!realm`, which Circuit does not write (CCR2216, 7.23.5).
+- An eBGP connection to an address on no connected network, without `multihop=yes`, takes the TCP connection, logs `connection <local> from <remote>`, and closes it with no OPEN and nothing else in the log, even with `bgp,debug` logging on (CCR2216, 7.23.5).

package/src/platforms/routeros/export.ts

@@ -137,6 +137,7 @@ export class RouterOsExport {
     /** Menus whose entries are an ordered list without names. They are rewritten whole, in the order the render gives. */
     static readonly ORDERED = new Set([
         "/routing filter rule",
+        "/routing rule",
         "/ip firewall filter",
         "/ipv6 firewall filter",
         "/ip firewall nat",

package/src/platforms/routeros/index.ts

@@ -207,7 +207,16 @@ export class RouterOs extends Platform {
         }
 
         // BFD on a static route and a MAC limit are refused above, for the reason the device gave, and an ethertype filter on a LAG as unproved.
-        found.push(...Derive.unproved(device, ["bfd-timers", "multihop-bfd", "static-route-bfd", "mac-limit", "ethertype-filter"]));
+        found.push(
+            ...Derive.unproved(device, [
+                "bfd-timers",
+                "multihop-bfd",
+                "static-route-bfd",
+                "mac-limit",
+                "ethertype-filter",
+                "routing-tables",
+            ])
+        );
 
         return found;
     }
@@ -549,7 +558,7 @@ export class RouterOs extends Platform {
 
         return down.map((bgp) =>
             bgp.limit
-                ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} ${bgp.neighbor} --clear-limit`
+                ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} --neighbors '^${bgp.neighbor}$' --clear-limit`
                 : `BGP session ${bgp.neighbor} was established before the apply and is not ${limits.seconds} s after it (${bgp.reason ?? (bgp.uptime === "no session" ? "no session" : "not established")}). Look with: circuit bgp ${device.name} --log`
         );
     }

package/src/platforms/routeros/plan.ts

@@ -30,6 +30,9 @@ export class RouterOsPlan {
         "/interface bridge filter",
         "/interface list",
         "/ip vrf",
+        // Routes, rules and BGP connections name a table, so it exists first.
+        "/routing table",
+        "/routing rule",
         "/ip address",
         "/ipv6 address",
         "/ip pool",

package/src/platforms/routeros/render.ts

@@ -32,7 +32,7 @@ export type AnyInterface = Interface<string, string>;
 
 type Speed = NonNullable<AnyPort["speed"]>;
 type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 
 /** One device's render: the device, and the commands collected under their menu. */
 export class RouterOsRender {
@@ -1101,6 +1101,8 @@ export class RouterOsRender {
     }
 
     private routing(): void {
+        this.routingTables();
+        this.routingRules();
         this.staticRoutes();
         this.rpki();
         if (this.device.routing?.bgp) {
@@ -1113,6 +1115,28 @@ export class RouterOsRender {
         this.bfd();
     }
 
+    /** A table beside the main one. `fib` puts its routes in the forwarding table, so traffic can be routed by them. */
+    private routingTables(): void {
+        for (const [name, table] of Object.entries(this.device.routing?.tables ?? {})) {
+            this.add("/routing table", "add fib", { comment: table.description, name });
+        }
+    }
+
+    /** Rules in the order written. `lookup-only-in-table` drops what the table has no route for, and `lookup` falls back to the main table. */
+    private routingRules(): void {
+        for (const rule of this.device.routing?.rules ?? []) {
+            const onlyInTable = rule.table !== "main" && (rule.fallback ?? "none") === "none";
+            this.add("/routing rule", "add", {
+                action: onlyInTable ? "lookup-only-in-table" : "lookup",
+                comment: rule.description,
+                "dst-address": rule.match?.dst,
+                interface: rule.match?.in_interface && this.name(rule.match.in_interface),
+                "src-address": rule.match?.src,
+                table: rule.table,
+            });
+        }
+    }
+
     private staticRoutes(): void {
         for (const route of this.device.routing?.static ?? []) {
             const menu = Address.family(Address.host(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
@@ -1123,7 +1147,7 @@ export class RouterOsRender {
                 distance: route.distance,
                 "dst-address": route.prefix,
                 gateway,
-                "routing-table": route.vrf,
+                "routing-table": route.vrf ?? route.table,
             });
         }
     }
@@ -1146,7 +1170,7 @@ export class RouterOsRender {
     }
 
     /** A neighbor's settings with its group's beneath them. */
-    private settingsOf(neighbor: AnyNeighbor): NeighborSettings<string> {
+    private settingsOf(neighbor: AnyNeighbor): NeighborSettings<string, string> {
         const group = neighbor.group ? this.device.routing?.bgp?.groups?.[neighbor.group] : undefined;
         return { ...group, ...neighbor };
     }
@@ -1268,6 +1292,7 @@ export class RouterOsRender {
                 "output.network": originates ? RouterOsRender.NETWORKS[family] : undefined,
                 "remote.address": `${neighbor.address}/${addressFamily === "ipv4" ? 32 : 128}`,
                 "remote.as": settings.remote_as,
+                "routing-table": settings.table,
                 "tcp-md5-key": settings.password && Secrets.marker(settings.password),
                 "use-bfd": settings.bfd ? "yes" : undefined,
             });

package/src/schema/device.ts

@@ -71,7 +71,7 @@ export type Vrf = {
 /**
  * Everything one device runs. What is not written here is removed from the device or returned to its default.
  *
- * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates.
+ * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates, T routing tables.
  */
 export type Device<
     Pl extends string = string,
@@ -87,6 +87,7 @@ export type Device<
     U extends string = string,
     F extends string = string,
     C extends string = string,
+    T extends string = string,
 > = {
     /** Hostname. */
     name: string;
@@ -112,8 +113,8 @@ export type Device<
     interfaces?: Record<I, Interface<NoInfer<V>, NoInfer<F>>>;
     /** Separate routing tables, keyed by name. */
     vrfs?: Record<F, Vrf>;
-    /** Static routes, BGP, OSPF and route validation. */
-    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>>;
+    /** Routing tables and rules, static routes, BGP, OSPF and route validation. */
+    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>, T>;
     /** Route policies, keyed by name. */
     policies?: Record<P, RoutePolicy<NoInfer<P>, NoInfer<S>>>;
     /** Prefix sets that policies match on, keyed by name. */

package/src/schema/interfaces.ts

@@ -113,7 +113,7 @@ export type Port<V extends string, A extends string, L extends string, F extends
         acl?: A;
         /** The LAG this port is in. Every other setting goes on the LAG. */
         lag?: L;
-        /** Another of our devices at the other end of the cable. Without a `description`, the port is described from it: the far device and the far port as printed on it, such as `firewall-1 port6`. */
+        /** Another of our devices at the other end of the cable. */
         link?: Link;
     };
 

package/src/schema/routing.ts

@@ -1,7 +1,7 @@
 import type { Family, IP, Prefix, Secret } from "./common";
 
 /** A route the device has without learning it. */
-export type StaticRoute<I extends string, F extends string> = {
+export type StaticRoute<I extends string, F extends string, T extends string = never> = {
     /** Destination. */
     prefix: Prefix;
     /** Next-hop address. */
@@ -14,8 +14,10 @@ export type StaticRoute<I extends string, F extends string> = {
     bfd?: true;
     /** Preference against other routes to the same prefix. Lower wins. 1 when absent. */
     distance?: number;
-    /** The VRF the route is in. The default table when absent. */
+    /** The VRF the route is in. The main table when absent. */
     vrf?: F;
+    /** The table the route is in, one of `routing.tables`. The main table when absent. A route has a `vrf` or a `table`, not both. */
+    table?: T;
     /** Why the route exists. */
     description?: string;
 };
@@ -26,7 +28,7 @@ export type StaticRoute<I extends string, F extends string> = {
 export type BgpRole = "provider" | "customer" | "peer" | "rs" | "rs-client";
 
 /** Settings a BGP neighbor can set itself or take from its group. */
-export type NeighborSettings<P extends string> = {
+export type NeighborSettings<P extends string, T extends string = never> = {
     /** The neighbor's AS. Our own AS makes the session internal. */
     remote_as?: number;
     /** Who the neighbor is. */
@@ -55,10 +57,12 @@ export type NeighborSettings<P extends string> = {
     passive?: boolean;
     /** Detect a dead link in under a second with BFD. */
     bfd?: boolean;
+    /** The table the routes learned are installed in, one of `routing.tables`. The main table when absent. What is announced still comes from `networks` and the main table. */
+    table?: T;
 };
 
 /** One BGP session. Settings it does not set come from its group. */
-export type Neighbor<P extends string, G extends string> = NeighborSettings<P> & {
+export type Neighbor<P extends string, G extends string, T extends string = never> = NeighborSettings<P, T> & {
     /** The neighbor's address. */
     address: IP;
     /** The group this neighbor takes a setting from when it does not set that setting itself. */
@@ -66,15 +70,15 @@ export type Neighbor<P extends string, G extends string> = NeighborSettings<P> &
 };
 
 /** BGP on this device. */
-export type Bgp<P extends string, G extends string> = {
+export type Bgp<P extends string, G extends string, T extends string = never> = {
     /** Our AS number. */
     asn: number;
     /** Prefixes this device originates. Each needs a route, for example a static blackhole. Export policy still decides who receives them. */
     networks?: readonly Prefix[];
     /** Settings shared by several neighbors, keyed by group name. */
-    groups?: Record<G, NeighborSettings<P>>;
+    groups?: Record<G, NeighborSettings<P, T>>;
     /** Sessions keyed by name. */
-    neighbors?: Record<string, Neighbor<P, G>>;
+    neighbors?: Record<string, Neighbor<P, G, T>>;
 };
 
 /** How fast BFD notices a dead neighbor: after `multiplier` packets in a row are missed, so in `interval` times `multiplier` milliseconds. */
@@ -120,14 +124,46 @@ export type Ospf<I extends string> = {
     redistribute?: readonly ("connected" | "static")[];
 };
 
+/** A routing table beside the main one. It holds no interfaces: routes go in from static routes and BGP neighbors that name it in `table`, and `routing.rules` send traffic to it. */
+export type RoutingTable = {
+    /** What the table is for. */
+    description?: string;
+};
+
+/** Traffic a routing rule matches: all of what is given. Every packet when absent. */
+export type RoutingRuleMatch<I extends string> = {
+    /** Source prefix. */
+    src?: Prefix;
+    /** Destination prefix. */
+    dst?: Prefix;
+    /** The interface the traffic arrives on. */
+    in_interface?: I;
+};
+
+/** One routing rule: traffic it matches is routed by `table` instead of the main table. */
+export type RoutingRule<I extends string, T extends string> = {
+    /** Why the rule exists. */
+    description?: string;
+    /** What the traffic must match. Every packet when absent, so such a rule is the last one. */
+    match?: RoutingRuleMatch<I>;
+    /** The table that routes the traffic: one of `routing.tables`, or `main`. */
+    table: T | "main";
+    /** When `table` has no route for a packet: `none` drops it as unroutable, `main` routes it by the main table instead. `none` when absent. Not for a rule whose table is `main`. */
+    fallback?: "none" | "main";
+};
+
 /** Routing on this device. */
-export type Routing<P extends string, G extends string, I extends string, F extends string> = {
+export type Routing<P extends string, G extends string, I extends string, F extends string, T extends string = never> = {
     /** Identifies this router to its neighbors. */
     router_id?: IP;
+    /** Routing tables beside the main one, keyed by name. Not `main`, and not the name of a VRF. */
+    tables?: Record<T, RoutingTable>;
+    /** Rules that route matching traffic by another table, such as traffic from one block by its own transits' default. In order: the first that matches decides, and traffic no rule matches is routed by the main table. */
+    rules?: readonly RoutingRule<I, NoInfer<T>>[];
     /** Routes the device has without learning them. */
-    static?: readonly StaticRoute<I, F>[];
+    static?: readonly StaticRoute<I, F, NoInfer<T>>[];
     /** BGP sessions and what they exchange. */
-    bgp?: Bgp<P, G>;
+    bgp?: Bgp<P, G, NoInfer<T>>;
     /** OSPF areas and interfaces. */
     ospf?: Ospf<I>;
     /** Validators answering route origin validation. */

package/templates/colocation/checks.ts

@@ -3,6 +3,7 @@
 import type { Check, Finding } from "@takodotid/circuit";
 import { Address } from "@takodotid/circuit";
 import { Checks } from "@takodotid/circuit/helpers";
+import { blocksOf, type Tenant } from "./tenancy";
 import { TENANTS } from "./tenants";
 
 export default [
@@ -15,21 +16,27 @@ export default [
     // A native VLAN stays on one trunk and nowhere else, or it joins every trunk it is native on.
     Checks.nativeVlansAreDeadEnds,
 
-    // Tenants never share a name, a number, an address or a port. A port given twice would go to the last tenant alone.
+    // Tenants never share a name, a VLAN, an address or a port. A port given twice would go to the last tenant alone.
     () => {
         const findings: Finding[] = [];
         const error = (message: string) => findings.push({ level: "error", message });
+        const vlansOf = (t: Tenant) => [t.internet.vlan, ...(t.private ? [t.private.vlan] : [])];
 
         TENANTS.forEach((t, index) => {
             for (const other of TENANTS.slice(index + 1)) {
                 if (other.name === t.name) error(`tenant ${t.name} is declared twice`);
-                if (other.number === t.number) error(`tenants ${t.name} and ${other.name} share number ${t.number}`);
 
-                for (const block of t.blocks) {
-                    const clash = other.blocks.find(
-                        ({ prefix }) => Address.contains(prefix, block.prefix) || Address.contains(block.prefix, prefix)
-                    );
-                    if (clash) error(`${block.prefix} of ${t.name} overlaps ${clash.prefix} of ${other.name}`);
+                for (const vlan of vlansOf(t)) {
+                    for (const theirs of vlansOf(other)) {
+                        if (theirs.id === vlan.id)
+                            error(`VLAN ${vlan.id} is both ${vlan.name} of ${t.name} and ${theirs.name} of ${other.name}`);
+                        if (theirs.name === vlan.name) error(`VLAN ${vlan.name} is declared by both ${t.name} and ${other.name}`);
+                    }
+                }
+
+                for (const block of blocksOf(t)) {
+                    const clash = blocksOf(other).find((prefix) => Address.contains(prefix, block) || Address.contains(block, prefix));
+                    if (clash) error(`${block} of ${t.name} overlaps ${clash} of ${other.name}`);
                 }
             }
 
@@ -39,10 +46,6 @@ export default [
                     if (sharer) error(`port ${port} on ${device} is given to both ${t.name} and ${sharer.name}`);
                 }
             }
-
-            for (const { prefix, gateway } of t.blocks) {
-                if (!Address.contains(prefix, gateway)) error(`the gateway ${gateway} of ${t.name} is outside ${prefix}`);
-            }
         });
 
         return findings;

package/templates/colocation/edge-01.ts

@@ -6,7 +6,7 @@ import type { Prefix } from "@takodotid/circuit";
 import { defineDevice, secret, Utils } from "@takodotid/circuit";
 import { Bgp, Filters } from "@takodotid/circuit/helpers";
 import { ASN, communities } from "./routing";
-import { edgeRules, gateways, internetVlanNames, internetVlans } from "./tenancy";
+import { edgeRules, gateways, internetVlanNames, routerVlans } from "./tenancy";
 import { TENANTS } from "./tenants";
 
 /** The address space this router announces. */
@@ -34,7 +34,7 @@ export default defineDevice({
             transit: { id: 300, description: "IP transit from Hurricane Electric, AS6939" },
             ix: { id: 200, description: "Peering LAN of SGIX" },
         },
-        internetVlans(TENANTS)
+        routerVlans(TENANTS)
     ),
 
     ports: {