CR-2026-04-15: SRT Research VLAN Deployment

show cdp neighbors detail | include Device|IP|Platform|Interface
show vlan brief
show interfaces trunk
show interfaces status
show spanning-tree summary
show spanning-tree vlan <VLAN_ID>
show run | section ^interface|switchport|allowed
show run | section aaa|radius-server|dot1x|authentication
show access-session
show access-session interface <INT> details
show authentication sessions
show ip dhcp snooping binding
show mac address-table dynamic
show ip arp
show etherchannel summary
show run | include hostname
show version | include uptime|Software|Model
show env all

show vlan brief
show vlan id <VLAN_ID>
show interface trunk
show interface trunk | json | python3 -c "import sys,json; d=json.load(sys.stdin); [print(f'{i[\"interface\"]} vlans: {i[\"allowed_vlans\"]}') for i in d['TABLE_interface']['ROW_interface']]"
show vpc brief
show vpc consistency-parameters global
show port-channel summary
show hsrp brief
show ip route vrf all
show run | section ^interface | awk '/^interface/{intf=$0} /allowed vlan/{print intf, $0}'
show system resources
show spanning-tree summary
show fex
show mac address-table dynamic | awk '{print $3}' | sort | uniq -c | sort -rn | head -20
show ip arp | awk 'NR>1{print $3}' | sort | uniq -c | sort -rn
show logging last 50

# Endpoints in SRT
netapi cisco ise endpoints --filter "location=SRT" --format json \
  | jq '[.[] | {mac, ip, profile, identityGroup}]'

# Authorization profiles — find existing research DACL
netapi cisco ise authz-profiles --format json \
  | jq '[.[] | select(.name | test("research|dacl"; "i")) | {name, dacl: .daclName, vlan: .vlan}]'

# Policy sets — wired closed mode rules
netapi cisco ise policies wired --format json \
  | jq '[.[] | {name, condition, profile}]'

# Active sessions on SRT switches
netapi cisco ise sessions --filter "nas=SRT" --format json \
  | jq '[.[] | {mac, ip, nas: .nasIpAddress, vlan: .assignedVlan, authzProfile}]'

# Network devices — confirm SRT switch registration in ISE
netapi cisco ise network-devices --format json \
  | jq '[.[] | select(.name | test("SRT"; "i")) | {name, ip, location, profileName}]'

# List all authorization profiles
curl -sk -u "${ISE_USER}:${ISE_PASS}" \
  -H "Accept: application/json" \
  "https://${ISE_HOST}:9060/ers/config/authorizationprofile" \
  | jq '[.SearchResult.resources[] | {name: .name, id: .id[:12]}]'

# Get full profile detail (VLAN + DACL)
curl -sk -u "${ISE_USER}:${ISE_PASS}" \
  -H "Accept: application/json" \
  "https://${ISE_HOST}:9060/ers/config/authorizationprofile/<PROFILE_ID>" \
  | jq '{name: .AuthorizationProfile.name, vlan: .AuthorizationProfile.vlan, dacl: .AuthorizationProfile.daclName}'

# Endpoint identity groups — find research group
curl -sk -u "${ISE_USER}:${ISE_PASS}" \
  -H "Accept: application/json" \
  "https://${ISE_HOST}:9060/ers/config/endpointgroup" \
  | jq '[.SearchResult.resources[] | select(.name | test("research"; "i"))]'

# Build VLAN inventory across all switches
netapi cisco ise network-devices --format json \
  | jq -r '.[].ip' \
  | while read ip; do
    printf "=== %s ===\n" "$ip"
    ssh admin@"$ip" "show vlan brief" 2>/dev/null \
      | awk 'NR>2 && /^[0-9]/{printf "  VLAN %-6s %s\n", $1, $2}'
  done

# Find which switches already have the research VLAN
netapi cisco ise network-devices --format json \
  | jq -r '.[].ip' \
  | while read ip; do
    result=$(ssh admin@"$ip" "show vlan id <VLAN_ID>" 2>/dev/null | grep -c "active")
    [[ $result -gt 0 ]] && printf "%-15s HAS VLAN\n" "$ip" || printf "%-15s MISSING\n" "$ip"
  done

# Trunk VLAN comparison across all switches
netapi cisco ise network-devices --format json \
  | jq -r '.[].ip' \
  | while read ip; do
    printf "=== %s ===\n" "$ip"
    ssh admin@"$ip" "show interfaces trunk" 2>/dev/null \
      | awk '/^[A-Z]/{port=$1} /allowed/{print "  " port " → " $0}'
  done

BASELINE=~/atelier/_bibliotheca/domus-captures/data/cr-baseline/CR-2026-04-15-srt-research-vlan
AGE_RCPT=~/.age/recipients/self.txt

ssh admin@<SRT-SW-01> "show vlan brief; show interfaces trunk; show cdp neighbors detail; show access-session; show authentication sessions; show ip arp; show mac address-table dynamic" \
  | age -e -R "${AGE_RCPT}" -o "${BASELINE}/access/srt-sw-01.txt.age"

ssh admin@<NEXUS-DIST> "show vlan brief; show vpc brief; show interface trunk; show port-channel summary; show hsrp brief; show ip route vrf all" \
  | age -e -R "${AGE_RCPT}" -o "${BASELINE}/nexus/nexus-dist.txt.age"

netapi cisco ise authz-profiles --format json \
  | age -e -R "${AGE_RCPT}" -o "${BASELINE}/ise/authz-profiles.json.age"

netapi cisco ise network-devices --format json \
  | age -e -R "${AGE_RCPT}" -o "${BASELINE}/ise/network-devices.json.age"

netapi cisco ise endpoints --filter "location=SRT" --format json \
  | age -e -R "${AGE_RCPT}" -o "${BASELINE}/ise/srt-endpoints.json.age"

age -d -i ~/.age/identities "${BASELINE}/access/srt-sw-01.txt.age"

# Pipe to awk/jq for analysis
age -d -i ~/.age/identities "${BASELINE}/ise/authz-profiles.json.age" \
  | jq '[.[] | {name, dacl: .daclName, vlan: .vlan}]'

git -C ~/atelier/_bibliotheca/domus-captures add data/cr-baseline/CR-2026-04-15-srt-research-vlan/
git -C ~/atelier/_bibliotheca/domus-captures commit -m "$(cat <<'EOF'
data(CR-2026-04-15): pre-change baseline — access, nexus, ISE (age-encrypted)
EOF
)"