diff --git a/files/gw-core01_frr.conf b/files/gw-core01_frr.conf
new file mode 100644
index 0000000..39077d2
--- /dev/null
+++ b/files/gw-core01_frr.conf
@@ -0,0 +1,16 @@
+password zebra
+!
+router ospf
+  redistribute connected
+!
+log syslog
+!
+interface wg0
+  ip ospf area 0
+  ip ospf network point-to-point
+!
+access-list vty permit 127.0.0.0/8
+access-list vty deny any
+!
+line vty
+ access-class vty
diff --git a/files/ospfd.conf b/files/ospfd.conf
new file mode 100644
index 0000000..d7b71a2
--- /dev/null
+++ b/files/ospfd.conf
@@ -0,0 +1,31 @@
+# $OpenBSD: ospfd.conf,v 1.2 2018/08/07 07:06:20 claudio Exp $
+
+# macros
+# id="192.0.2.5"
+
+# global configuration
+# router-id $id
+# fib-update no
+# stub router no
+# spf-delay 1
+# spf-holdtime 5
+
+# auth-key secret
+# auth-type simple
+# hello-interval 10
+# metric 10
+# retransmit-interval 5
+# router-dead-time 40
+# router-priority 1
+# transmit-delay 1
+
+# rtlabel "DMZ" external-tag 1
+
+redistribute connected
+
+# areas
+area 0.0.0.0 {
+	interface wg0 {
+		type p2p
+	}
+}
diff --git a/files/pf.wg0.conf b/files/pf.wg0.conf
new file mode 100644
index 0000000..ad8e828
--- /dev/null
+++ b/files/pf.wg0.conf
@@ -0,0 +1,5 @@
+# allow incoming udp packets for wg0
+pass in proto udp from any to self port 51820
+
+# allow ospf on wg0
+pass on wg0 proto ospf
diff --git a/password-store/wg/wg0/eae-adp-jump01.gpg b/password-store/wg/wg0/eae-adp-jump01.gpg
new file mode 100644
index 0000000..c85dee7
Binary files /dev/null and b/password-store/wg/wg0/eae-adp-jump01.gpg differ
diff --git a/password-store/wg/wg0/eae-adp-jump01.pub.gpg b/password-store/wg/wg0/eae-adp-jump01.pub.gpg
new file mode 100644
index 0000000..5442489
Binary files /dev/null and b/password-store/wg/wg0/eae-adp-jump01.pub.gpg differ
diff --git a/password-store/wg/wg0/gw-core01.gpg b/password-store/wg/wg0/gw-core01.gpg
new file mode 100644
index 0000000..a462155
--- /dev/null
+++ b/password-store/wg/wg0/gw-core01.gpg
@@ -0,0 +1,4 @@
+�
�R�p�~���
��%nT%��P�C::��ڴ�/M-I�Z-��
���E1?R΢������V�Շ+��
+1��T:������(~_q�Ay9F��Fc좕C�����K�����-
D��x�N�[D� 
�iz�1�׀ә���*@�;����c���_�
+
l��woԠV�F���Qt�S�&�J��]���+Ʀe�O��L�Q�� �|.�+$iɆ�l:�O�H�Ia�=�H�7�x�\C����Ծ��P�A�/���;
+ �iG���fͶ�k���Ětbp��uK1�R2�v�GϗL��(�ٓ�u��w(tzFצd�ǁ���z��A̍~�ºua��7��̰y/0��=�J=�O�	ų�r�?	��,+\���y ���yǏ*��e��^
|�!!D���oqLj��+
m>9","��ly0�ZǢ
��%:(��0y�#r��T�����d}��8��k�H��re:���<�Cp��-�� 9
\ No newline at end of file
diff --git a/password-store/wg/wg0/gw-core01.pub.gpg b/password-store/wg/wg0/gw-core01.pub.gpg
new file mode 100644
index 0000000..7b2da72
Binary files /dev/null and b/password-store/wg/wg0/gw-core01.pub.gpg differ
diff --git a/password-store/wg/wg0/psk.gpg b/password-store/wg/wg0/psk.gpg
new file mode 100644
index 0000000..0640769
Binary files /dev/null and b/password-store/wg/wg0/psk.gpg differ
diff --git a/playbook_provision_backbone.yml b/playbook_provision_backbone.yml
new file mode 100644
index 0000000..6948f32
--- /dev/null
+++ b/playbook_provision_backbone.yml
@@ -0,0 +1,105 @@
+---
+- name: configure tunnel on eae-adp-jump01
+  hosts: eae-adp-jump01
+  tasks:
+    - name: create wg0 interface file
+      template:
+        src: templates/hostname.wg0
+        dest: /etc/hostname.wg0
+        mode: 0600
+      notify:
+        - reload interfaces
+
+    - name: create pf.wg0.conf file
+      copy:
+        src: files/pf.wg0.conf
+        dest: /etc/pf.wg0.conf
+        mode: 0600
+      notify:
+        - reload firewall
+
+    - name: include pf.wg0.conf in pf.include.conf
+      lineinfile:
+        path: /etc/pf.include.conf
+        line: 'include "/etc/pf.wg0.conf"'
+      notify:
+        - reload firewall
+
+    - name: create ospfd.conf
+      copy:
+        src: files/ospfd.conf
+        dest: /etc/ospfd.conf
+        mode: 0600
+        validate: "/usr/sbin/ospfd -n -f %s"
+      notify:
+        - restart ospfd
+
+    - name: enable ospfd
+      service:
+        name: ospfd
+        state: started
+        enabled: yes
+
+  handlers:
+    - name: reload firewall
+      command: pfctl -vf /etc/pf.conf
+
+    - name: reload interfaces
+      command: sh /etc/netstart
+
+    - name: restart ospfd
+      service:
+        name: ospfd
+        state: restart
+
+- name: configure tunnel on gw-core01
+  hosts: gw-core01
+  gather_facts: no
+  tasks:
+    - name: create wg0 interface
+      blockinfile:
+        path: /etc/config/network
+        content: |
+          config interface 'wg0'
+            option proto 'wireguard'
+            option private_key "{{ lookup('passwordstore', 'wg/wg0/gw-core01') }}"
+            option listen_port 51820
+            option mtu 1350
+            list addresses '10.84.254.1/31'
+
+          config wireguard_wg0 'eap_adp_jump01'
+            option public_key "{{ lookup('passwordstore', 'wg/wg0/eae-adp-jump01.pub') }}"
+            option preshared_key "{{ lookup('passwordstore', 'wg/wg0/psk') }}"
+            option endpoint_host '162.55.53.85'
+            option endpoint_port '51820'
+            option route_allowed_ips '0'
+            option persistent_keepalive 15
+            list allowed_ips '0.0.0.0/0'
+      notify:
+        - restart network
+
+    - name: configure frr (daemons)
+      lineinfile:
+        regexp: '^ospfd=.*$'
+        line: 'ospfd=yes'
+        path: /etc/frr/daemons
+      notify:
+        - restart frr
+
+    - name: configure frr (frr.conf)
+      copy:
+        src: files/gw-core01_frr.conf
+        dest: /etc/frr/frr.conf
+      notify:
+        - restart frr
+
+  handlers:
+    - name: restart network
+      service:
+        name: network
+        state: restarted
+
+    - name: restart frr
+      service:
+        name: frr
+        state: restarted
diff --git a/templates/hostname.wg0 b/templates/hostname.wg0
new file mode 100644
index 0000000..3a3125f
--- /dev/null
+++ b/templates/hostname.wg0
@@ -0,0 +1,5 @@
+inet 10.84.254.0/31
+mtu 1350
+wgport 51820
+wgkey {{ lookup('passwordstore', 'wg/wg0/eae-adp-jump01') }}
+wgpeer {{ lookup('passwordstore', 'wg/wg0/gw-core01.pub') }} wgpsk {{ lookup('passwordstore', 'wg/wg0/psk') }} wgaip 0.0.0.0/0