WRKLOG-2026-03-05

# Check BMC LAN mode (from kvm-01)
sudo ipmitool raw 0x30 0x70 0x0c 0
# Returns: 02 = Failover, 00 = Dedicated

# Set to Dedicated mode
sudo ipmitool raw 0x30 0x70 0x0c 1 0

# Reset BMC
sudo ipmitool mc reset cold

# Verify physical port (shows state UP = cable connected)
ip link show eno2

dsource d000 dev/storage
netapi ise backup --repo nas-01 --name "pre-ise35-restore" --wait

configure terminal
repository nas-01
  url nfs://10.50.1.70:/volume1/ise_backups
exit

show repository nas-01 | include pre-ise35-restore

restore pre-ise35-restore-CFG10-260305-1159.tar.gpg repository nas-01 encryption-key plain <KEY>

# View specific line numbers
awk 'NR==689 || NR==700' docs/asciidoc/modules/ROOT/pages/runbooks/ise-35-deployment.adoc

# Output:
# restore <backup-filename> repository nas-01 encryption-key plain <YOUR_KEY>
# restore scheduled-CFG10-260222-1948.tar.gpg repository nas-01 encryption-key plain MySecretKey123

# Find all restore references
grep -n "restore" ise-35-deployment.adoc | head -20

# Check for ISE_BACKUP_KEY location
grep -i "ISE_BACKUP_KEY" ise-35-deployment.adoc

# Filter repository listing
show repository nas-01 | include pre-ise35-restore-CFG10-260305-1159.tar.gpg

dsource d000 dev/vault

vault write pki_int/issue/domus-server \
  common_name="ise-02.inside.domusdigitalis.dev" \
  ip_sans="10.50.1.21" \
  ttl="8760h" \
  -format=json > /dev/shm/ise-02-cert.json

jq -r '.data.certificate' /dev/shm/ise-02-cert.json > /dev/shm/ise-02.crt
jq -r '.data.private_key' /dev/shm/ise-02-cert.json > /dev/shm/ise-02.key
jq -r '.data.ca_chain[]' /dev/shm/ise-02-cert.json > /dev/shm/ise-02-chain.pem

awk '/-----BEGIN CERTIFICATE-----/{n++} n==1' /dev/shm/ise-02-chain.pem > /dev/shm/DOMUS-ISSUING-CA.pem
awk '/-----BEGIN CERTIFICATE-----/{n++} n==2' /dev/shm/ise-02-chain.pem > /dev/shm/DOMUS-ROOT-CA.pem

openssl x509 -in /dev/shm/ise-02.crt -subject -issuer -noout
openssl x509 -in /dev/shm/DOMUS-ISSUING-CA.pem -subject -noout
openssl x509 -in /dev/shm/DOMUS-ROOT-CA.pem -subject -noout

sudo virt-install \
  --name 9800-WLC-01 \
  --memory 16384 \
  --vcpus 4 \
  --import \
  --disk path=/mnt/onboard-ssd/vms/C9800-CL-universalk9.17.15.03.qcow2,format=qcow2 \
  --network bridge=virbr0,model=virtio \
  --os-variant generic \
  --graphics vnc \
  --noautoconsole

# BEFORE (broken)
interface GigabitEthernet1/0/6
 source template DefaultWiredDot1xClosedAuth  <-- 802.1X ON INFRASTRUCTURE PORT
 switchport access vlan 10                      <-- WRONG VLAN (should be 100)

sudo virsh domblklist ise-02
# sda showed "-" (empty)

sudo virsh change-media ise-02 sda /mnt/nas/isos/Cisco-ISE-3.5.0.527.SPA.x86_64.iso --insert --config
sudo virsh destroy ise-02 && sudo virsh start ise-02

***** The ZTP configuration image is missing or improper. Automatic installation flow exited.
***** Power off and attach the proper ZTP configuration image or choose manual boot to proceed.
[   44.710453] reboot: System halted

# Confirm eth0.40 interface up
show interfaces | grep -E 'eth0\.(20|30|40)'
# Expected: eth0.40  10.50.40.1/24  u/u  IOT

# Confirm DHCP pool available
show dhcp server statistics
# Expected: IOT pool with 100+ available addresses

# Create backup connection for USB ethernet adapter
nmcli conn add type ethernet con-name Domus-Wired-Backup ifname "enp0s13f0u2u1"

# View active connections with awk
nmcli conn show --active | awk 'NR>1 {print $1, $3}'

interface GigabitEthernet1/0/2
 description [DOT1X] User Access Port
 switchport access vlan 40
 switchport mode access
 switchport voice vlan 20
 ip arp inspection trust
 spanning-tree portfast edge
end

# Force DHCP on backup interface
sudo nmcli conn down Domus-Wired-Backup && sudo nmcli conn up Domus-Wired-Backup

# Check IP from vyos-02 DHCP (should be 10.50.40.x)
ip -4 addr show enp0s13f0u2u1 | awk '/inet/{print $2}'

# Verify gateway is vyos-02
ip route | awk '/enp0s13f0u2u1/ && /default|10.50.40/ {print}'

# Check DHCP source in journal
journalctl -u NetworkManager --since "2 min ago" | awk '/enp0s13f0u2u1.*DHCP/ {print}'

show firewall ipv4 name IOT_LOCAL
# rule 30: accept UDP port 67 - packets matched

show firewall ipv4 name LOCAL_IOT
# Ruleset Information (EMPTY - no rules!)

configure
set firewall ipv4 name LOCAL_IOT rule 10 action accept
set firewall ipv4 name LOCAL_IOT rule 10 protocol udp
set firewall ipv4 name LOCAL_IOT rule 10 destination port 68
set firewall ipv4 name LOCAL_IOT rule 10 description "DHCP replies"
commit
save

show firewall ipv4 name LOCAL_IOT
# rule 10 { action accept; destination { port 68 }; protocol udp }

# Force DHCP renewal
sudo nmcli conn down Domus-Wired-Backup && sudo nmcli conn up Domus-Wired-Backup

# Verify IP from vyos-02 DHCP pool (10.50.40.x)
ip -4 addr show enp0s13f0u2u1 | awk '/inet/{print $2}'

# Verify gateway is vyos-02
ip route | awk '/enp0s13f0u2u1/{print}'

# Check bridge VLAN assignments
sudo bridge vlan show

# Output showed:
# vnet1             1 PVID Egress Untagged  <-- NO VLAN 40!
# br-mgmt had VLANs 10,20,30,40,100,110,120 ✓
# eno8 (trunk) had same VLANs ✓

# Verify vyos-02 uses br-mgmt, not virbr0
sudo virsh domiflist vyos-02
# vnet1 → br-mgmt ✓

sudo bridge vlan add vid 40 dev vnet1

sudo bridge vlan show dev vnet1
# vnet1             1 PVID Egress Untagged
#                   40  <-- NOW PRESENT

ip -4 addr show enp0s13f0u2u1 | awk '/inet/{print $2}'
# 10.50.40.100/24  ✓ FROM VYOS!

ip route | awk '/enp0s13f0u2u1/ && /default/{print}'
# default via 10.50.40.1 ... ✓ VYOS GATEWAY

v3/domains/d000/identity/ise/ise-01/{admin,cli,dataconnect}
v3/domains/d000/identity/ise/ise-02/{admin,cli,dataconnect}

dsource d000 dev/vault && vault-ssh-sign  # If this works, Vault is accessible

# Full BEGIN CERTIFICATE string required (not just "BEGIN CERT")
awk '/-----BEGIN CERTIFICATE-----/{n++} n==1' chain.pem > first-cert.pem
awk '/-----BEGIN CERTIFICATE-----/{n++} n==2' chain.pem > second-cert.pem

***** The ZTP configuration image is missing or improper.