Skip to content

commands-reference.md

Latest commit

 

History

History
304 lines (245 loc) · 7.54 KB

commands-reference.md

File metadata and controls

304 lines (245 loc) · 7.54 KB
Raw

Commands Reference — NexusCorp Enterprise Capstone

📋 The Design (matches hand-drawn topology)

INTERNET → F(ASA) → SW(transit) → C1/C2(cores HSRP)
                                   → D1/D2(distribution mesh)
                                   → access switches → endpoints
F also connects: M(mgmt), R(RADIUS-Kali), DMZ

📋 IP Map

Element IP Notes
ASA outside 192.168.91.12 VMnet2, AnyConnect
ASA inside 192.168.100.1 to transit switch
ASA dmz 192.168.80.1 DMZ servers
ASA radius 192.168.71.12 VMnet3 to Kali
ASA mgmt 192.168.81.12 VMnet1 ASDM
CORE1 transit SVI 192.168.100.2 HSRP active
CORE2 transit SVI 192.168.100.3 HSRP standby
Transit HSRP VIP 192.168.100.254 ASA routes here
Kali RADIUS 192.168.71.128 FreeRADIUS
ASDM PC 192.168.81.204 VMnet1
VPN PC 192.168.91.204 VMnet2
VPN pool 192.168.60.10-100 VLAN 60

🔑 Transit Switch Config

hostname TRANSIT-SW
vlan 100
 name TRANSIT
interface ethernet 0/0
 switchport mode access
 switchport access vlan 100      ! to ASA
interface ethernet 0/1
 switchport mode access
 switchport access vlan 100      ! to CORE1
interface ethernet 0/2
 switchport mode access
 switchport access vlan 100      ! to CORE2

🔑 HSRP Templates

! Transit VLAN 100 — CORE1 active
interface vlan 100
 ip address 192.168.100.2 255.255.255.0
 standby 100 ip 192.168.100.254
 standby 100 priority 110
 standby 100 preempt
ip route 0.0.0.0 0.0.0.0 192.168.100.1

! Transit VLAN 100 — CORE2 standby
interface vlan 100
 ip address 192.168.100.3 255.255.255.0
 standby 100 ip 192.168.100.254
 standby 100 priority 100
 standby 100 preempt
ip route 0.0.0.0 0.0.0.0 192.168.100.1

! User VLAN — CORE1 active (repeat per VLAN)
interface vlan X
 ip address 192.168.X.2 255.255.255.0
 standby X ip 192.168.X.1
 standby X priority 110
 standby X preempt

! User VLAN — CORE2 standby (repeat per VLAN)
interface vlan X
 ip address 192.168.X.3 255.255.255.0
 standby X ip 192.168.X.1
 standby X priority 100
 standby X preempt

🔑 EtherChannel Templates

! Inter-core port-channel
interface range ethernet 0/2 - 3
 channel-group 10 mode active
interface Port-channel10
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,50,60,70,100

! Core to distribution
interface range ethernet 0/0 - 1
 channel-group 1 mode active
interface Port-channel1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,50,60,70

🔑 ASA Edge Config

hostname ASA-EDGE

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 192.168.91.12 255.255.255.0
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.100.1 255.255.255.0
interface GigabitEthernet0/2
 nameif dmz
 security-level 50
 ip address 192.168.80.1 255.255.255.0
interface GigabitEthernet0/3
 nameif radius
 security-level 80
 ip address 192.168.71.12 255.255.255.0
interface GigabitEthernet0/4
 nameif mgmt
 security-level 100
 ip address 192.168.81.12 255.255.255.0

! Routes to internal via transit HSRP VIP
route inside 192.168.10.0 255.255.255.0 192.168.100.254
route inside 192.168.20.0 255.255.255.0 192.168.100.254
route inside 192.168.30.0 255.255.255.0 192.168.100.254
route inside 192.168.40.0 255.255.255.0 192.168.100.254
route inside 192.168.50.0 255.255.255.0 192.168.100.254
route inside 192.168.60.0 255.255.255.0 192.168.100.254
route inside 192.168.70.0 255.255.255.0 192.168.100.254

! ASDM
http server enable
http 192.168.81.0 255.255.255.0 mgmt
http 0.0.0.0 0.0.0.0 outside
username admin password Admin@123 privilege 15
aaa authentication http console LOCAL

🔑 Kali FreeRADIUS

sudo apt install freeradius -y

! /etc/freeradius/3.0/clients.conf
client ASA-EDGE {
    ipaddr = 192.168.71.12
    secret = RadiusKey123
    shortname = asa-edge
    nastype = cisco
}

! /etc/freeradius/3.0/users
employee1  Cleartext-Password := "Emp@2024"
employee2  Cleartext-Password := "Emp@2024"
employee3  Cleartext-Password := "Emp@2024"

sudo systemctl restart freeradius
sudo freeradius -X

🔑 ASA AnyConnect + RADIUS

aaa-server RADIUS-KALI protocol radius
aaa-server RADIUS-KALI (radius) host 192.168.71.128
 key RadiusKey123

crypto ca trustpoint SSL-CERT
 enrollment self
 subject-name CN=192.168.91.12
crypto ca enroll SSL-CERT noconfirm
ssl trust-point SSL-CERT outside
ssl server-version tlsv1

webvpn
 enable outside
 anyconnect image disk0:/anyconnect-win-4.5.04029-webdeploy-k9.pkg 1
 anyconnect enable

ip local pool VPN-POOL 192.168.60.10-192.168.60.100 mask 255.255.255.0

! Split-tunnel: what the CLIENT routes through the tunnel (DMZ + VLAN 10 + 20)
access-list SPLIT-ACL standard permit 192.168.80.0 255.255.255.0
access-list SPLIT-ACL standard permit 192.168.10.0 255.255.255.0
access-list SPLIT-ACL standard permit 192.168.20.0 255.255.255.0

! vpn-filter: ENFORCED on ASA, BIDIRECTIONAL (blocks other VLANs both ways)
access-list VPN-FILTER extended permit ip 192.168.60.0 255.255.255.0 192.168.80.0 255.255.255.0
access-list VPN-FILTER extended permit ip 192.168.60.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list VPN-FILTER extended permit ip 192.168.60.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list VPN-FILTER extended deny ip any any

group-policy NEXUS-POLICY internal
group-policy NEXUS-POLICY attributes
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value SPLIT-ACL
 vpn-filter value VPN-FILTER
 dns-server value 8.8.8.8

tunnel-group NEXUS-VPN type remote-access
tunnel-group NEXUS-VPN general-attributes
 address-pool VPN-POOL
 authentication-server-group RADIUS-KALI
 default-group-policy NEXUS-POLICY
tunnel-group NEXUS-VPN webvpn-attributes
 group-alias NEXUS-VPN enable

! CRITICAL: DefaultWEBVPNGroup also needs RADIUS (AnyConnect may use it)
tunnel-group DefaultWEBVPNGroup general-attributes
 authentication-server-group RADIUS-KALI
 default-group-policy NEXUS-POLICY
 address-pool VPN-POOL

! NAT exemption (VPN traffic, no translation) — must come FIRST
object network VPN-POOL-NET
 subnet 192.168.60.0 255.255.255.0
object network INTERNAL-NET
 subnet 192.168.0.0 255.255.0.0
object network DMZ-NET
 subnet 192.168.80.0 255.255.255.0
nat (outside,inside) source static VPN-POOL-NET VPN-POOL-NET destination static INTERNAL-NET INTERNAL-NET
nat (outside,dmz) source static VPN-POOL-NET VPN-POOL-NET destination static DMZ-NET DMZ-NET

! Dynamic PAT (internet access) — AFTER exemptions
object network INTERNAL-TO-NET
 subnet 192.168.0.0 255.255.0.0
 nat (inside,outside) dynamic interface
object network DMZ-TO-NET
 subnet 192.168.80.0 255.255.255.0
 nat (dmz,outside) dynamic interface

🔍 Show Commands

! HSRP and transit
show standby brief
show standby vlan 100
ping 192.168.100.254

! EtherChannel
show etherchannel summary

! VLANs / Trunks
show vlan brief
show interfaces trunk

! Routing
show ip route

! ASA
show interface ip brief
show route
show aaa-server RADIUS-KALI
show vpn-sessiondb anyconnect

! RADIUS test
test aaa-server authentication RADIUS-KALI host 192.168.71.128 username employee1 password Emp@2024

🔬 Failover Test Commands

! Confirm active
CORE1# show standby brief

! Start ping from PC
ping 192.168.100.1 -t

! Kill CORE1
CORE1(config)# interface vlan 100
CORE1(config-if)# shutdown

! CORE2 takes over
CORE2# show standby brief → Active

! Ping continues via transit switch → CORE2 → ASA ✅

! Restore
CORE1(config-if)# no shutdown