SANITIZED UBUNTU WAN SIMULATOR SETUP

These are adapted copies of the scripts used to configure the lab server,
plus the configuration files those scripts generate. Addresses, VLAN IDs,
hostnames, MAC addresses, interface names and user paths are examples.
No private keys, authorized_keys, passwords or certificates are included.

EXAMPLE TOPOLOGY
Existing untagged administration: preserve your current Netplan configuration.
Physical trunk interface: enp1s0 (replace with the real interface everywhere).
wantransit VLAN 900: 10.255.0.2/29, upstream gateway 10.255.0.1.
robomgmt VLAN 910: 10.20.10.1/28.
robovmotion VLAN 920: 10.20.20.1/28.
robotep VLAN 930: 10.20.30.1/28.
robovna VLAN 931: 10.20.30.17/28.
robodtgw VLAN 932: 10.20.30.33/28.
Reserved overlay prefixes: 10.20.50.0/27, 10.20.50.32/27, 10.20.40.0/25.
Classification of these prefixes does not create NSX routes.

PREREQUISITES AND SETUP
Use Ubuntu with Netplan and systemd and local console access. Install Python 3,
iproute2 (tc), nftables and dnsmasq-base using the distribution package manager.
Adapt every file, including the DHCP reservation and HTTPS boot FQDN.
Configure the physical trunk to carry the chosen VLANs. The central router
needs return routes for the ROBO networks via 10.255.0.2. This setup does not
configure the physical switch or upstream router and does not perform NAT.
The existing parent Ethernet interface must already be defined in Netplan.
Inspect existing firewall chains: another chain can still drop forwarded traffic.

Place install.sh, network.sh, wanctl.py and install-robo-ztp.sh in /opt/wan-build.
After reviewing and adapting them, run:
  cd /opt/wan-build
  sudo bash install.sh
  sudo bash install-robo-ztp.sh

install.sh backs up Netplan/cloud-init, routes/rules and nftables under
/var/backups/wan-simulator, disables cloud-init network generation, writes
Netplan VLAN definitions and forwarding sysctls, installs wan-network and
wanctl, and enables wan-network.service. It applies Netplan immediately.
It can interrupt networking; use a disposable lab server and local console.
install-robo-ztp.sh writes DHCP configuration and enables wan-ztp-dhcp.service.
It refuses to start if another DHCP listener is present. DHCP is management
only, static reservations only, and supplies the native UEFI HTTPS boot URL.
Firmware trust of the vCenter certificate is a separate prerequisite.
The etc/ directory is a reference copy of generated configuration payloads;
do not also copy these blindly over existing server files.

DELAY AND OTHER CONTROLS (RUN ON THE UBUNTU SIMULATOR)
  sudo wanctl status
  sudo wanctl set --delay-ms 40
  sudo wanctl set --delay-ms 80
  sudo wanctl set --delay-ms 40 --loss-pct 0.1 --rate-mbit 100
  sudo wanctl clear
  sudo wanctl restore

Delay and rate are per direction. 40 ms adds roughly 80 ms round-trip delay,
plus the original path latency. Each set replaces the entire profile; omitted
options become zero. Rate zero means no configured cap. Loss zero disables
simulated loss. clear removes impairment but retains routing and DHCP.
The profile is saved in /etc/wan-simulator-profile.json and restored by the
network service at boot. Shaping is IPv4 prefix-based at the transit boundary;
site-local traffic and simulator-originated administration are not shaped.

VERIFICATION
  ip -br address
  ip rule
  ip route show table 900
  sudo systemctl status wan-network.service wan-ztp-dhcp.service
  sudo journalctl -u wan-ztp-dhcp.service -n 30
  sudo wanctl status
Compare ping round-trip times from a ROBO host to a central endpoint before
and after a delay change. Confirm the path crosses the simulator. Restore
zero impairment with sudo wanctl clear after a test if desired.

These sanitized examples have been checked for consistent example values
and Python syntax, but have not been deployed as a new server configuration.
They do not configure MTU 9000, IPv6 forwarding, NSX or VCF import.
Retain backups; stopping a service alone does not undo routes or firewall rules.
