WRKLOG-2026-03-07

# Export from kvm-01 (filter shell noise)
ssh kvm-01 "sudo virsh dumpxml 9800-WLC-01" | grep -v "session active" > /tmp/wlc-01.xml

# Transform for kvm-02
sed -i 's|/usr/bin/qemu-system-x86_64|/usr/libexec/qemu-kvm|' /tmp/wlc-01.xml
sed -i "s|machine='pc-i440fx-10.1'|machine='pc'|" /tmp/wlc-01.xml

# Import to kvm-02
scp /tmp/wlc-01.xml kvm-02:/tmp/
ssh kvm-02 "sudo virsh define /tmp/wlc-01.xml && sudo virsh start 9800-WLC-01"

# On AP console
ping 10.50.1.40
# Success - network path works

# On VyOS
show firewall statistics
# No hits on CAPWAP rule - rule missing!

# VyOS firewall - add CAPWAP rule
configure
set firewall ipv4 name DATA_IN rule 20 action accept
set firewall ipv4 name DATA_IN rule 20 description "CAPWAP to WLC"
set firewall ipv4 name DATA_IN rule 20 destination port 5246,5247
set firewall ipv4 name DATA_IN rule 20 protocol udp
commit
save

# VyOS DHCP - add Option 43
configure
set service dhcp-server shared-network-name DATA subnet 10.50.10.0/24 option vendor-option cisco suboption 241 hex-string '0a320128'
commit
save

# Show Option 43 configured
show configuration commands | grep vendor-option

# After AP reboot/DHCP renewal
ssh wlc-01 "show ap summary"
# AP appears in list

# On vyos-02
dig @10.50.1.90 ise-01.inside.domusdigitalis.dev
# REFUSED

# On bind-01
sudo sed -i '/allow-query/s|{ localhost; 10.50.1.0/24; }|{ localhost; 10.50.1.0/24; 10.50.10.0/24; 10.50.20.0/24; 10.50.40.0/24; 10.50.110.0/24; 10.50.120.0/24; }|' /etc/named.conf

sudo systemctl reload named

dig @10.50.1.90 ise-01.inside.domusdigitalis.dev +short
# 10.50.1.20

# From workstation
ping 8.8.8.8          # SUCCESS - internet via NAT
ping 10.50.10.1       # FAIL - VyOS gateway
ping 10.50.1.99       # FAIL - kvm-01

# ARP shows gateway is learned
ip neigh | grep 10.50.10.1
# 10.50.10.1 dev enp2s0f0 lladdr 52:54:00:31:eb:e3 STALE

configure
set firewall ipv4 name LOCAL_DATA default-action 'accept'
set firewall zone DATA from LOCAL firewall name 'LOCAL_DATA'
commit
save

# From DATA VLAN client (10.50.10.x)
ping 10.50.10.1
# 64 bytes from 10.50.10.1: icmp_seq=1 ttl=64 time=0.409 ms

LAB-3560CX-01#show access-session interface g1/0/2 details
            Interface:  GigabitEthernet1/0/2
          MAC Address:  98bb.1e1f.a713
         IPv4 Address:  10.50.1.251
            User-Name:  modestus-razer.inside.domusdigitalis.dev
               Status:  Authorized
               Domain:  DATA
       Oper host mode:  multi-auth
      Session timeout:  28800s (server), Remaining: 28796s
       Current Policy:  PMAP_DefaultWiredDot1xClosedAuth_1X_MAB

Server Policies:
           Vlan Group:  Vlan: 100
              ACS ACL:  xACSACLx-IP-DACL_ADMIN_FULL-696eef58

Method status list:
      Method            State
      dot1x              Authc Success

# Find EAP-TLS certificate
ls -la /etc/ssl/certs/*razer*.pem /etc/ssl/certs/*eaptls*.pem 2>/dev/null

# Extract key fields with openssl + awk
openssl x509 -in /etc/ssl/certs/modestus-razer-eaptls.pem -noout \
  -subject -issuer -dates -ext subjectAltName,keyUsage,extendedKeyUsage 2>/dev/null | awk '
/^subject=/ {print "SUBJECT:", $0}
/^issuer=/ {print "ISSUER:", $0}
/^notBefore=/ {print "VALID_FROM:", $2, $3, $4}
/^notAfter=/ {print "VALID_TO:", $2, $3, $4}
/DNS:/ {print "SAN:", $0}
/Key Usage/ {getline; print "KEY_USAGE:", $0}
/Extended Key Usage/ {getline; print "EKU:", $0}'

SUBJECT: subject=O=Domus-Infrastructure, OU=Domus-Admins, CN=modestus-razer.inside.domusdigitalis.dev
ISSUER: issuer=CN=DOMUS-ISSUING-CA
VALID_FROM: 16 05:10:27 2026
VALID_TO: 16 05:10:57 2027
KEY_USAGE:     Digital Signature, Key Encipherment, Key Agreement
KEY_USAGE:     TLS Web Server Authentication, TLS Web Client Authentication
SAN:     DNS:modestus-razer.inside.domusdigitalis.dev

# Convert certificate to JSON structure
CERT="/etc/ssl/certs/modestus-razer-eaptls.pem"
openssl x509 -in "$CERT" -noout -subject -issuer -dates -serial \
  -ext subjectAltName,keyUsage,extendedKeyUsage 2>/dev/null | awk '
BEGIN { print "{" }
/^subject=/ {
  gsub(/subject=/, "");
  split($0, parts, ", ");
  for (i in parts) {
    split(parts[i], kv, " = ");
    if (kv[1] == "O") org = kv[2];
    if (kv[1] == "OU") ou = kv[2];
    if (kv[1] == "CN") cn = kv[2];
  }
  printf "  \"subject\": {\"O\": \"%s\", \"OU\": \"%s\", \"CN\": \"%s\"},\n", org, ou, cn
}
/^issuer=/ { gsub(/issuer=CN=/, ""); printf "  \"issuer\": \"%s\",\n", $0 }
/^serial=/ { gsub(/serial=/, ""); printf "  \"serial\": \"%s\",\n", $0 }
/^notBefore=/ { gsub(/notBefore=/, ""); printf "  \"not_before\": \"%s\",\n", $0 }
/^notAfter=/ { gsub(/notAfter=/, ""); printf "  \"not_after\": \"%s\",\n", $0 }
/DNS:/ { gsub(/^[[:space:]]+DNS:/, ""); printf "  \"san\": \"%s\",\n", $0 }
/Digital Signature/ { printf "  \"key_usage\": \"%s\",\n", $0 }
/TLS Web/ { gsub(/^[[:space:]]+/, ""); printf "  \"eku\": \"%s\"\n", $0 }
END { print "}" }
' | jq .

{
  "subject": {
    "O": "Domus-Infrastructure",
    "OU": "Domus-Admins",
    "CN": "modestus-razer.inside.domusdigitalis.dev"
  },
  "issuer": "DOMUS-ISSUING-CA",
  "serial": "5A:3B:...",
  "not_before": "Feb 16 05:10:27 2026 GMT",
  "not_after": "Feb 16 05:10:57 2027 GMT",
  "san": "modestus-razer.inside.domusdigitalis.dev",
  "key_usage": "Digital Signature, Key Encipherment, Key Agreement",
  "eku": "TLS Web Server Authentication, TLS Web Client Authentication"
}

# Extract just the OU (determines VLAN assignment)
... | jq -r '.subject.OU'
# Output: Domus-Admins

# Check if admin cert
... | jq -r 'if .subject.OU == "Domus-Admins" then "MGMT VLAN 100" else "DATA VLAN 10" end'

# Validate issuer trust
... | jq -r 'if .issuer == "DOMUS-ISSUING-CA" then "✓ Trusted" else "✗ Untrusted" end'

# Arch Linux
sudo pacman -S step-cli

# Then use:
step certificate inspect /etc/ssl/certs/modestus-razer-eaptls.pem --format json | jq '{
  subject: .subject.common_name,
  ou: .subject.organizational_unit,
  san: .extensions.subject_alt_name,
  issuer: .issuer.common_name,
  serial: .serial_number,
  not_before: .validity.not_before,
  not_after: .validity.not_after,
  key_usage: .extensions.key_usage,
  eku: .extensions.extended_key_usage
}'

IF Certificate.Subject-OU == "Domus-Admins"
   AND Certificate.Issuer == "DOMUS-ISSUING-CA"
THEN
   VLAN = 100 (MGMT)
   dACL = DACL_ADMIN_FULL
ELSE IF Certificate.Subject-OU == "Domus-Users"
   VLAN = 10 (DATA)
   dACL = DACL_USER_RESTRICTED

EAP-TLS Handshake:
├── Client Certificate
│   ├── Subject: O=Domus-Infrastructure, OU=Domus-Admins, CN=modestus-razer...
│   └── Issuer: CN=DOMUS-ISSUING-CA
└── Server validates → RADIUS Access-Accept with:
    ├── Tunnel-Type: VLAN
    ├── Tunnel-Private-Group-ID: 100
    └── Filter-Id: DACL_ADMIN_FULL

# Infrastructure reachability check from DATA VLAN
HOSTS=(
  bind-01.inside.domusdigitalis.dev
  wlc-02.inside.domusdigitalis.dev
  vyos-02.inside.domusdigitalis.dev
  ise-01.inside.domusdigitalis.dev
  vault-01.inside.domusdigitalis.dev
  # ... full list
)

printf "%-45s %-15s %s\n" "HOSTNAME" "IP" "STATUS"
for h in "${HOSTS[@]}"; do
  ip=$(dig +short +time=2 "$h" 2>/dev/null | head -1)
  if [[ -n "$ip" ]]; then
    if timeout 1 bash -c "echo >/dev/tcp/$ip/22" 2>/dev/null; then
      status="✓ SSH"
    else
      status="○ DNS only — unreachable"
    fi
    printf "%-45s %-15s %s\n" "$h" "$ip" "$status"
  else
    printf "%-45s %-15s %s\n" "$h" "-" "✗ NXDOMAIN"
  fi
done

HOSTNAME                                      IP               STATUS
bind-01.inside.domusdigitalis.dev             10.50.1.90       ✓ DNS
vault-01.inside.domusdigitalis.dev            10.50.1.60       ○ DNS only — unreachable
ise-02.inside.domusdigitalis.dev              10.50.1.21       ○ DNS only — unreachable
kvm-01.inside.domusdigitalis.dev              10.50.1.99       ○ DNS only — unreachable
... (13 hosts unreachable)

# NetworkManager bridge configs extracted from kvm-02
sudo nmcli -g all connection show br-mgmt > br-mgmt.conf
sudo nmcli -g all connection show br-mgmt-port > br-mgmt-port.conf
sudo nmcli -g all connection show br-wan > br-wan.conf
sudo nmcli -g all connection show br-wan-port > br-wan-port.conf

# Libvirt hook and VLAN state
sudo cat /etc/libvirt/hooks/qemu > libvirt-hook.sh
bridge vlan show > bridge-vlan.txt

# Saved to NAS
sudo cp *.conf *.sh *.txt /mnt/nas/backups/kvm-01-rebuild/

# Exported all XML definitions
sudo -i
for vm in $(virsh list --all --name); do
  echo "Exporting: $vm"
  virsh dumpxml "$vm" > /mnt/nas/backups/kvm-01-rebuild/vm-definitions/"$vm".xml
done