Skip to content

Cheatsheet Enterprise Networking

Johan Beysen — 30-12-2025

Inhoudsopgave

Configuratiestappen

Verificatie & Debug

Voorbeelden

Prep

No log off:

line con 0
 exec-timeout 0 0

STAP 1: Basis Configuratie

Basic settings Router

no ip domain-lookup
hostname R1
enable secret class
service password-encryption
banner motd #
Unauthorized access is strictly prohibited. #
line con 0
password cisco
login
logging synchronous
line vty 0 4
password cisco
login
end

Basic settings Switch

no ip domain-lookup
hostname SW1
enable secret class
service password-encryption
banner motd #
Unauthorized access is strictly prohibited. #
line con 0
password cisco
login
logging synchronous
line vty 0 15
password cisco
login
exit

SSH Configuratie (Router & Switch)

ip domain-name lab.local
crypto key generate rsa
1024
of
crypto key generate rsa general-keys modulus 2048
ip ssh version 2
username admin secret cisco
line vty 0 4
 transport input ssh
 login local

CDP & LLDP Configuratie

CDP activeren (standaard actief op Cisco)

cdp run
interface g0/0
 cdp enable

CDP uitschakelen (best op access ports)

no cdp run
interface g0/0
 no cdp enable

LLDP activeren

lldp run
interface g0/0
 lldp transmit
 lldp receive

LLDP uitschakelen

no lldp run
interface g0/0
 no lldp transmit
 no lldp receive
Ongedaan maken 
ip domain-lookup
hostname Switch
no enable secret
no service password-encryption
no banner motd
line con 0
 no password
 no login
 no logging synchronous
line vty 0 4
 no password
 no transport input ssh
 login
crypto key zeroize rsa
no username admin

STAP 2: VLAN Configuratie

VLANs aanmaken (zonder VTP)

vlan 10
 name HR
vlan 20
 name IT
vlan 30
 name Sales
vlan 99
 name Management
vlan 1111
 name Unused

Met VTP

vtp domain CreaTech
vtp mode server
vtp password geheim
vtp version 2

vlan 10
 name HR
vlan 20
 name IT
vlan 100
 name VLAN100
vlan 200
 name VLAN200

Op alle andere switches:

vtp domain CreaTech
vtp mode client
vtp password geheim
vtp version 2

Management VLAN Interface (Switch)

interface vlan 99
 ip address 172.16.99.11 255.255.255.0
 no shutdown
exit
ip default-gateway 172.16.99.1

Trunk configuratie

interface fa0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
 switchport trunk native vlan 99
 switchport nonegotiate
 no shutdown

VTP instellen (optioneel)

vtp domain SNB
vtp mode server
vtp password geheim
Ongedaan maken 
no vlan 10
no vlan 20
no vlan 30
no vlan 99
no vlan 100
no vlan 200
no vlan 1111

interface vlan 99
 no ip address
 shutdown
no ip default-gateway

interface fa0/24
 no switchport mode trunk
 no switchport trunk allowed vlan
 no switchport trunk native vlan
 no switchport nonegotiate
 switchport mode access

vtp mode transparent
no vtp password

STAP 3: Interface Configuratie

Router Interfaces

interface g0/1
 ip address 172.16.99.1 255.255.255.0
 no shutdown

Switch Access Poorten

interface range fa0/1 - 24
 switchport mode access
 switchport access vlan 10
 no shutdown

Inter-VLAN Routing (Router-on-a-stick)

interface g0/0
 no shutdown
interface g0/0.10
 encapsulation dot1q 10
 ip address 172.17.10.1 255.255.255.0
interface g0/0.20
 encapsulation dot1q 20
 ip address 172.17.20.1 255.255.255.0
interface g0/0.30
 encapsulation dot1q 30
 ip address 172.17.30.1 255.255.255.0
interface g0/0.99
 encapsulation dot1q 99
 ip address 172.17.99.1 255.255.255.0

Voice VLAN configuratie

interface fa0/11
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 110
 mls qos trust cos

QoS Configuratie

mls qos

interface fa0/11
 mls qos trust cos

interface g0/1
 mls qos trust dscp

interface fa0/11
 auto qos voip cisco-phone

policy-map VOICE-POLICY
 class VOICE-CLASS
  priority percent 30
 class VIDEO-CLASS
  bandwidth percent 30
 class class-default
  fair-queue

interface g0/1
 service-policy output VOICE-POLICY
Ongedaan maken 
interface g0/1
 no ip address
 shutdown

interface range fa0/1 - 24
 no switchport mode access
 no switchport access vlan
 shutdown

interface g0/0
 shutdown
no interface g0/0.10
no interface g0/0.20
no interface g0/0.30
no interface g0/0.99

interface fa0/11
 no switchport voice vlan
 no mls qos trust

no mls qos
no policy-map VOICE-POLICY
interface g0/1
 no service-policy output

STAP 4: Redundantie & Load Balancing

Static EtherChannel (mode on)

interface range g1/0/1 - 4
 channel-group 1 mode on
 no shutdown
exit
interface port-channel 1
 switchpor 10,20,30,99
 switchport trunk native vlan 99

PAgP EtherChannel

Switch 1:

interface range g1/0/1-2
 channel-group 1 mode desirable
 no shutdown
exit

interface port-channel 1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 99

Switch 2:

interface range g1/0/1-2
 channel-group 1 mode auto
 no shutdown
exit

interface port-channel 1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 99

LACP EtherChannel

interface range g1/0/1 - 4
 channel-group 3 mode active
 no shutdown

port-channel load-balance src-dst-mac

STP PVST+ Configuratie

spanning-tree mode pvst
of
spanning-tree mode rapid-pvst

Primary/Secondary:

Switch S1:

spanning-tree vlan 10,100 root primary
spanning-tree vlan 20,200 root secondary

Switch S2:

spanning-tree vlan 20,200 root primary
spanning-tree vlan 10,100 root secondary

PortFast + BPDU Guard

interface range fa0/1-20
 spanning-tree portfast
 spanning-tree bpduguard enable

of

spanning-tree portfast default
spanning-tree portfast bpduguard default
Ongedaan maken 
interface range g1/0/1 - 4
 no channel-group 1
 shutdown

no interface port-channel 1
no interface port-channel 2
no interface port-channel 3

port-channel load-balance src-mac

spanning-tree mode pvst
no spanning-tree vlan 10 root
no spanning-tree vlan 20 root
no spanning-tree vlan 100 root
no spanning-tree vlan 200 root

interface range fa0/1-24
 no spanning-tree portfast
 no spanning-tree bpduguard enable

no spanning-tree portfast default
no spanning-tree portfast bpduguard default

STAP 5: Layer 2 Beveiliging

Port Security

1 MAC sticky (AS1)

interface fa0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security mac-address sticky
 switchport port-security aging time 15
 switchport port-security aging type inactivity
 switchport port-security violation restrict

3 MAC sticky (AS2)

interface fa0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 3
 switchport port-security mac-address sticky
 switchport port-security aging time 5
 switchport port-security aging type inactivity
 switchport port-security violation restrict

Management poorten

interface fa0/3
 switchport mode access
 switchport access vlan 3
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address 1234.5678.abcd
 switchport port-security aging time 10
 switchport port-security aging type inactivity
 switchport port-security violation restrict

VLAN Hopping Tegengaan

Ongebruikte poorten disablen:

interface range fa0/10 - 24
 switchport mode access
 switchport access vlan 1111
 shutdown

DHCP Snooping

ip dhcp snooping
ip dhcp snooping vlan 10,20,100,200

Trusted ports:

interface g0/1
 ip dhcp snooping trust

interface fa0/1
 ip dhcp snooping limit rate 8

Dynamic ARP Inspection (DAI)

ip arp inspection vlan 10,20,100,200

Trusted ports:

interface g0/1
 ip arp inspection trust

ip arp inspection validate src-mac dst-mac ip
Ongedaan maken 
interface fa0/1
 no switchport port-security
 no switchport port-security maximum
 no switchport port-security mac-address sticky
 no switchport port-security aging time
 no switchport port-security violation

interface range fa0/10 - 24
 no switchport access vlan
 no shutdown
 switchport mode access

no ip dhcp snooping
no ip dhcp snooping vlan 10,20,100,200

interface g0/1
 no ip dhcp snooping trust

interface fa0/1
 no ip dhcp snooping limit rate

no ip arp inspection vlan 10,20,100,200

interface g0/1
 no ip arp inspection trust

no ip arp inspection validate

STAP 6: DHCP Services

DHCP Exclusions

ip dhcp excluded-address 192.168.1.1 192.168.1.10

DHCP Pool

ip dhcp pool GeefhierEenZinvolleNaam
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 9.9.9.9
 domain-name mijnLAN.lab
 lease 1 0 0

DHCP Relay

interface g0/1
 ip helper-address 192.168.10.100

Router Interface DHCP Client

interface g0/1
 ip address dhcp
 no shut
Ongedaan maken 
no ip dhcp excluded-address 192.168.1.1 192.168.1.10
no ip dhcp pool GeefhierEenZinvolleNaam

interface g0/1
 no ip helper-address

interface g0/1
 no ip address dhcp
 ip address 192.168.1.1 255.255.255.0

STAP 7: Routing Configuratie

Static Routes

ip route 0.0.0.0 0.0.0.0 <next-hop-ip>
ip route <destination-network> <subnet-mask> <next-hop-ip>
ip route <destination-network> <subnet-mask> <exit-interface>

IPv6 Static Routes

ipv6 unicast-routing
ipv6 route 2001:DB8:1:1::/64 2001:DB8:1:A001::1

OSPF Configuratie

router ospf 10
 router-id 1.1.1.1
 network 172.21.100.0 0.0.0.255 area 0
 network 172.21.200.0 0.0.0.255 area 0
 network 172.21.250.0 0.0.0.3 area 0
 passive-interface g0/0
 default-information originate always

Interface OSPF

interface g0/0
 ip ospf 10 area 0

OSPFv3 (IPv6)

ipv6 unicast-routing
ipv6 router ospf 10
 router-id 1.1.1.1
exit
interface g0/0
 ipv6 address 2001:FACE:CAFE:1::1/64
 ipv6 address FE80::1 link-local
 ipv6 ospf 10 area 0

Loopback Interface

interface loopback0
 ip address 1.1.1.1 255.255.255.255

BGP Configuratie

router bgp 65001
 bgp log-neighbor-changes
 neighbor 10.1.1.2 remote-as 65001
 neighbor 203.0.113.1 remote-as 65002
 network 192.168.1.0 mask 255.255.255.0

HSRP Configuratie (First Hop Redundancy)

Router 1 (Active):

interface g0/0
 ip address 192.168.1.2 255.255.255.0
 standby 1 ip 192.168.1.1
 standby 1 priority 110
 standby 1 preempt
 standby 1 authentication md5 key-string cisco123

Router 2 (Standby):

interface g0/0
 ip address 192.168.1.3 255.255.255.0
 standby 1 ip 192.168.1.1
 standby 1 priority 90
 standby 1 preempt
 standby 1 authentication md5 key-string cisco123

HSRP Timers

standby 1 timers 1 3

(hello 1 sec, hold 3 sec)

HSRP Tracking

track 1 interface g0/1 line-protocol
interface g0/0
 standby 1 track 1 decrement 20

HSRPv2 (voor IPv6 support)

standby version 2

GLBP Configuratie (Load Balancing)

Router 1:

interface g0/0
 ip address 192.168.1.2 255.255.255.0
 glbp 1 ip 192.168.1.1
 glbp 1 priority 110
 glbp 1 preempt
 glbp 1 load-balancing round-robin

Router 2:

interface g0/0
 ip address 192.168.1.3 255.255.255.0
 glbp 1 ip 192.168.1.1
 glbp 1 priority 90
 glbp 1 preempt
 glbp 1 load-balancing round-robin
Ongedaan maken 
no ip route 0.0.0.0 0.0.0.0
no ip route <destination-network> <subnet-mask> <next-hop-ip>

no ipv6 unicast-routing
no ipv6 route 2001:DB8:1:1::/64 2001:DB8:1:A001::1

no router ospf 10
interface g0/0
 no ip ospf 10 area 0

no ipv6 router ospf 10
interface g0/0
 no ipv6 ospf 10 area 0

no interface loopback0

no router bgp 65001

interface g0/0
 no standby 1
no track 1

interface g0/0
 no glbp 1

STAP 8: Access Control Lists

Basic ACL

access-list 10 deny 192.168.10.0 0.0.0.255
access-list 10 permit any
interface g0/0
 ip access-group 10 in

Named ACL aanpassen

ip access-list standard DENY-L2
 no 10
 10 deny host 172.16.0.2
 20 permit any

Extended ACL

access-list 100 deny tcp any host 192.168.30.10 eq 80
access-list 100 permit ip any any
interface g0/1
 ip access-group 100 in

of

access-list 110 permit ip any 192.168.31.10 0.0.0.0
access-list 110 deny ip any any
interface s0/0/1
ip access-group 110 out
Ongedaan maken 
no access-list 10
no access-list 20
no access-list 100
no access-list 110

no ip access-list standard DENY-L2
no ip access-list extended INTERNET-FILTER

interface g0/0
 no ip access-group 10 in

interface g0/1
 no ip access-group 100 in

interface s0/0/1
 no ip access-group 110 out

STAP 9: NAT Configuratie

NAT Overload (PAT)

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface g0/1 overload

interface g0/0
 ip nat inside
interface g0/1
 ip nat outside
Ongedaan maken 
no ip nat inside source list 1 interface g0/1 overload
no access-list 1

interface g0/0
 no ip nat inside

interface g0/1
 no ip nat outside

STAP 10: Monitoring & Analysis

SPAN Configuratie (Port Mirroring)

Local SPAN (binnen zelfde switch)

monitor session 1 source interface fa0/1
monitor session 1 destination interface fa0/24

of

monitor session 1 source interface fa0/1 - 5
monitor session 1 destination interface fa0/24

of

monitor session 1 source vlan 10
monitor session 1 destination interface fa0/24

Rx/Tx filtering

monitor session 1 source interface fa0/1 rx
monitor session 1 source interface fa0/2 tx
monitor session 1 destination interface fa0/24

Remote SPAN (RSPAN) (tussen switches)

Source switch:

vlan 999
 name RSPAN
 remote-span
monitor session 1 source interface fa0/1
monitor session 1 destination remote vlan 999

Destination switch:

vlan 999
 name RSPAN
 remote-span
monitor session 1 source remote vlan 999
monitor session 1 destination interface fa0/24

SPAN session verwijderen

no monitor session 1

Verificatie SPAN

show monitor session 1
show monitor session all
Ongedaan maken 
no monitor session 1
no monitor session 2

no vlan 999

STAP 11: 802.1X Port-Based Authentication

AAA Configuratie

aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius

RADIUS Server configureren

radius server RADIUS-SERVER
 address ipv4 192.168.1.100 auth-port 1812 acct-port 1813
 key SecretKey123

802.1x Globaal activeren

dot1x system-auth-control

802.1x per Interface

interface fa0/1
 switchport mode access
 switchport access vlan 10
 authentication port-control auto
 dot1x pae authenticator

802.1x met MAB (MAC Authentication Bypass)

interface fa0/1
 authentication order dot1x mab
 authentication priority dot1x mab
 mab

Guest VLAN configuratie

interface fa0/1
 authentication event fail action authorize vlan 999
 authentication event no-response action authorize vlan 999

Verificatie 802.1x

show dot1x all
show dot1x interface fa0/1
show authentication sessions
show dot1x statistics
Ongedaan maken 
no aaa new-model
no radius server RADIUS-SERVER
no dot1x system-auth-control

interface fa0/1
 no authentication port-control
 no dot1x pae authenticator
 no authentication order
 no authentication priority
 no mab
 no authentication event fail action
 no authentication event no-response action

STAP 12: Multicast (IGMP)

IGMP activeren (standaard actief op IPv4 interfaces)

interface g0/0
 ip pim sparse-mode
 ip igmp version 3

IGMP Snooping (Switch)

Globaal activeren:

ip igmp snooping

Per VLAN:

ip igmp snooping vlan 10

Querier configureren:

ip igmp snooping vlan 10 querier
ip igmp snooping vlan 10 querier address 192.168.10.1

Static Multicast Group

interface fa0/5
 ip igmp static-group 239.1.1.1

PIM (Protocol Independent Multicast)

ip multicast-routing
interface g0/0
ip pim sparse-mode
ip pim rp-address 10.1.1.1

Verificatie Multicast/IGMP

show ip igmp groups
show ip igmp interface
show ip igmp snooping
show ip igmp snooping groups
show ip mroute
show ip pim neighbor
show ip pim interface
Ongedaan maken 
interface g0/0
 no ip pim sparse-mode
 no ip igmp version

no ip igmp snooping
no ip igmp snooping vlan 10

interface fa0/5
 no ip igmp static-group 239.1.1.1

no ip multicast-routing

interface g0/0
 no ip pim sparse-mode

no ip pim rp-address 10.1.1.1

Notaties & Beschrijvingen

Interface Description

interface g0/0
 description een omschrijving

interface fa0/5
 description Werkplek Manager - PC1

ACL Remarks

Standard ACL:

access-list 10 remark een omschrijving
access-list 10 deny 192.168.10.0 0.0.0.255

Extended ACL:

access-list 100 remark een omschrijving
access-list 100 permit tcp any host 192.168.1.10 eq 443

Named ACL:

ip access-list extended INTERNET-FILTER
 remark een omschrijving
 deny tcp any host 31.13.24.0 0.0.0.255
 remark Sta rest toe
 permit ip any any

banner motd #
========================================
UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED
All activity is monitored and logged
========================================
#

Login Banner:

banner login # een omschrijving #

Exec Banner:

banner exec # een omschrijving #

Config File Comments

! ===================================
! CORE LAYER CONFIGURATIE
! ===================================
interface g0/1
 description een omschrijving

! ===================================
! ACCESS LAYER - VLAN 10
! ===================================
interface fa0/1
 description een omschrijving

! Tijdelijke config voor testing
interface fa0/24
 shutdown

Verificatie & Troubleshooting

Show Commando's

Algemeen & Basis

show running-config
show startup-config
show version
show ip interface brief
show ipv6 interface brief
show interfaces
show interfaces status
show interfaces trunk

IP & Routing

show ip route
show ip route summary
show ip protocols
show ipv6 route

OSPF

show ip ospf neighbor
show ip ospf interface brief
show ip ospf database
show ipv6 ospf neighbor

BGP

show ip bgp summary
show ip bgp neighbors

DHCP & NAT

show ip dhcp binding
show ip dhcp pool
show ip nat translations
show ip nat statistics

ACL

show access-lists
show ip access-lists

VLANs & Switching

show vlan brief
show vtp status
show interfaces trunk

Spanning Tree

show spanning-tree
show spanning-tree summary
show spanning-tree vlan 10

EtherChannel

show etherchannel summary
show etherchannel load-balance

Port Security

show port-security
show port-security interface fa0/1
show port-security address

DHCP Snooping & DAI

show ip dhcp snooping
show ip dhcp snooping binding
show ip arp inspection
show ip arp inspection vlan 10

MAC & ARP

show mac address-table
show mac address-table dynamic
show arp
show ip arp

CDP & LLDP

show cdp neighbors
show cdp neighbors detail
show cdp interface
show lldp neighbors
show lldp neighbors detail
show lldp interface

HSRP & GLBP

show standby
show standby brief
show standby interface g0/0
show glbp
show glbp brief
show glbp interface g0/0

IGMP & Multicast

show ip igmp groups
show ip igmp interface
show ip igmp snooping
show ip igmp snooping groups
show ip mroute
show ip pim neighbor

802.1x

show dot1x all
show dot1x interface fa0/1
show authentication sessions
show dot1x statistics
show aaa servers

QoS

show mls qos
show mls qos interface
show policy-map interface g0/1
show mls qos maps

SPAN

show monitor session 1
show monitor session all

Logging

show logging
show processes cpu
show memory

Debug Commando's

IP & Routing

debug ip routing
debug ip packet
debug ip icmp

OSPF

debug ip ospf events
debug ip ospf adj
debug ip ospf hello

BGP

debug ip bgp
debug ip bgp events
debug ip bgp updates

DHCP & NAT

debug ip dhcp server events
debug ip nat
debug ip nat detailed

Spanning Tree

debug spanning-tree events
debug spanning-tree bpdu

EtherChannel

debug etherchannel
debug lacp all
debug pagp all

Security

debug port-security
debug ip dhcp snooping
debug arp inspection

HSRP & GLBP

debug standby
debug standby events
debug standby packets
debug glbp

CDP & LLDP

debug cdp packets
debug cdp events
debug lldp packets

QoS

debug mls qos

Stop alle debug

undebug all
no debug all
u all

Clear Commando's

clear ip dhcp binding
clear ip nat translations *
clear ip nat statistics
clear ip bgp *
clear ip bgp * soft
clear mac address-table dynamic
clear cdp table
clear lldp table
clear standby
clear glbp

Full Configuratie Voorbeelden

Full Switch Configuratie

hostname AS1
!
enable secret 5 $1$mERr$FRkgxvVJB2hrNOTLtiH4g.
!
ip ssh version 2
no ip domain-lookup
ip domain-name CreaTech.local
!
username beheerder secret 5 $1$mERr$FRkgxvVJB2hrNOTLtiH4g.
!
vtp mode transparent
!
ip arp inspection vlan 3,99-100,200
ip arp inspection validate src-mac dst-mac ip
!
ip dhcp snooping vlan 3,99,100,200
ip dhcp snooping
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan 3
 name Management
!
vlan 99
 name Native_VLAN
!
vlan 100
 name Company_Devices
!
vlan 200
 name BYOD
!
vlan 1111
 name Unused_Ports
!
interface Port-channel1
 description Po1 naar DS1
 switchport trunk native vlan 99
 switchport trunk allowed vlan 3,99,100,200
 switchport mode trunk
 switchport nonegotiate
!
interface Port-channel4
 description Po4 naar DS2
 switchport trunk native vlan 99
 switchport trunk allowed vlan 3,99,100,200
 switchport mode trunk
 switchport nonegotiate
!
interface FastEthernet0/1
 description EtherChannel naar DS2
 switchport trunk native vlan 99
 switchport trunk allowed vlan 3,99,100,200
 ip arp inspection trust
 ip dhcp snooping trust
 switchport mode trunk
 switchport nonegotiate
 channel-group 4 mode on
!
interface FastEthernet0/2
 description EtherChannel naar DS2
 switchport trunk native vlan 99
 switchport trunk allowed vlan 3,99,100,200
 ip arp inspection trust
 ip dhcp snooping trust
 switchport mode trunk
 switchport nonegotiate
 channel-group 4 mode on
!
interface FastEthernet0/3
 description Management Laptop Access
 switchport access vlan 3
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address 1234.5678.ABCD
 switchport port-security aging time 10
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/4
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/5
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/6
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/7
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/8
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/9
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/10
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/11
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/12
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/13
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/14
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/15
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/16
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/17
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/18
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/19
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/20
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/21
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/22
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/23
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface FastEthernet0/24
 description Company Device Access Ports - VLAN100
 switchport access vlan 100
 ip dhcp snooping limit rate 8
 switchport mode access
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 15
 spanning-tree portfast
 spanning-tree bpduguard enable
!
interface GigabitEthernet0/1
 description EtherChannel naar DS1
 switchport trunk native vlan 99
 switchport trunk allowed vlan 3,99-100,200
 ip arp inspection trust
 ip dhcp snooping trust
 switchport mode trunk
 switchport nonegotiate
 channel-group 1 mode on
!
interface GigabitEthernet0/2
 description EtherChannel naar DS1
 switchport trunk native vlan 99
 switchport trunk allowed vlan 3,99-100,200
 ip arp inspection trust
 ip dhcp snooping trust
 switchport mode trunk
 switchport nonegotiate
 channel-group 1 mode on
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan3
 description Management Interface
 ip address 172.21.3.1 255.255.255.0
!
ip default-gateway 172.21.3.5
!
banner motd #
========================================
UNAUTHORIZED ACCESS - CreaTech AS1
Access Switch - VLAN100
========================================
#
!
line con 0
 password 7 0822455D0A16
 logging synchronous
 login
 exec-timeout 0 0
!
line vty 0 4
 exec-timeout 0 0
 login local
 transport input ssh
line vty 5 15
 exec-timeout 0 0
 login local
 transport input ssh
!
end

Router

hostname R1
!
enable secret 5 $1$mERr$FRkgxvVJB2hrNOTLtiH4g.
!
ip dhcp excluded-address 172.21.100.1 172.21.100.50
ip dhcp excluded-address 172.21.200.1 172.21.200.50
!
ip dhcp pool VLAN100-POOL
 network 172.21.100.0 255.255.255.0
 default-router 172.21.100.254
 dns-server 8.8.8.8
 domain-name CreaTech.local
ip dhcp pool VLAN200-POOL
 network 172.21.200.0 255.255.255.0
 default-router 172.21.200.254
 dns-server 8.8.8.8
 domain-name CreaTech.local
!
no ip cef
no ipv6 cef
!
username beheerder secret 5 $1$mERr$FRkgxvVJB2hrNOTLtiH4g.
!
ip ssh version 2
no ip domain-lookup
ip domain-name CreaTech.local
!
interface GigabitEthernet0/0
 description Link naar DS1 - VLAN Trunk
 ip address 172.21.100.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
interface GigabitEthernet0/0.3
 description Management VLAN 3
 encapsulation dot1Q 3
 ip address 172.21.3.5 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0.100
 description VLAN 100 - Company Devices
 encapsulation dot1Q 100
 no ip address
 ip nat inside
!
interface GigabitEthernet1/0
 description Link naar DS2 - VLAN Trunk
 ip address 172.21.200.1 255.255.255.0
 ip nat inside
 duplex auto
 speed auto
!
interface GigabitEthernet1/0.200
 description VLAN 200 - BYOD
 encapsulation dot1Q 200
 no ip address
 ip nat inside
!
interface GigabitEthernet2/0
 description Link naar R3 - Transit
 ip address 172.21.250.1 255.255.255.252
 ip nat inside
!
interface GigabitEthernet3/0
 description Internet Uplink
 ip address 130.140.1.1 255.255.0.0
 ip nat outside
 duplex auto
 speed auto
 no cdp enable
!
router ospf 123
 router-id 1.1.1.1
 log-adjacency-changes
 passive-interface GigabitEthernet0/0.3
 passive-interface GigabitEthernet0/0.100
 passive-interface GigabitEthernet1/0.200
 network 172.21.100.0 0.0.0.255 area 0
 network 172.21.200.0 0.0.0.255 area 0
 network 172.21.250.0 0.0.0.3 area 0
 network 172.21.3.0 0.0.0.255 area 0
 default-information originate
!
ip nat inside source list 1 interface GigabitEthernet3/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 130.140.1.254
!
ip flow-export version 9
!
access-list 100 remark Alleen VLAN100 naar datacenter
access-list 100 permit ip 172.21.100.0 0.0.0.255 172.31.0.0 0.0.255.255
access-list 100 deny ip 172.21.200.0 0.0.0.255 172.31.0.0 0.0.255.255
access-list 100 permit ip any any
access-list 1 remark NAT Pool voor interne netwerken
access-list 1 permit 172.21.100.0 0.0.0.255
access-list 1 permit 172.21.200.0 0.0.0.255
access-list 1 permit 172.21.3.0 0.0.0.255
!
banner motd #
========================================
UNAUTHORIZED ACCESS - CreaTech R1
All activity is monitored and logged
========================================
#
!
line con 0
 exec-timeout 0 0
 password 7 0822455D0A16
 logging synchronous
 login
!
line aux 0
!
line vty 0 4
 exec-timeout 0 0
 login local
 transport input ssh
!
end