MoP - Management SWITCH & UAT SDC v0.1

No
DBS Indonesia - UAT SDC
1) Comments (Task completed before this changes)

1.1
1.1.1
1.2
1.3
1.4
2) Pre-Implementation Checklist
2.1
2.2
3) Implementation
3.1 Integration Device Management
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7
4) Post Migration Checklist

4.1
6) Fallback Plan
3.1 Rollback if TACACS Fail
3.1.1
3.1.2
6) Post Implementation Monitoring (Standby D2)

7
Tasks
S Indonesia - UAT SDC
omments (Task completed before this changes)

Working Permit
Working Permit from DBS Indonesia
Mounting switch on rack, and Power ON
Open FW Rules for MGMT (SNMP, NTP, SSH, TACACS, Syslog, Cisco Smart License Satellite Manager)
Plug Management cable, prepare cable
re-Implementation Checklist
Capture and backup Device
Labeling cable
Save & Backup configuration
mplementation
ntegration Device Management
Bring UP Management Switch PDC
Bring UP Management Switch SDC
Plug cable & Configure Management Port UAT SDC Devices
Config & verify NTP
Config SNMP & Adding nodes to Solarwind
Telnet port 49 for TACACS Verification
Configure TACACS for NEW MGMT SW (PDC & SDC) & UAT Devices
ost Migration Checklist

Hardening devices report
Rollback if TACACS Fail

Remove TACACS Config
Open FW & Checking Tacacs SG
ost Implementation Monitoring (Standby D2)

Standby Monitor (D2 Activity)
Responsibility Down Time
Start time Finish time Duration /min
DBSI NTT USER (Y/N)
1 Day N
√
√ 1 Day N
√ 1 Day N
√ √ 1 Day N
√ √ 17:00 18:00 1:00 N

√ 18:00 18:30 0:30 N
√ 19:00 20:00 1:00 N

√ 20:00 21:00 1:00 N
21:00 22:00 1:00
√ 22:00 22:30 1:00 N
√ 22:30 23:00 0:30 N
√ 23:00 23:30 0:30 N
√ 23:30 1:00 1:00 N
√ 1 Day
√ 1:00 2:00 1:00 N

√ 1 Day N
8:00 12:00 04:00:00

Remarks
Step Description PDC
idjktpdc01extxes03
IMPLEMENTATION
1 Move cable
!!! Move MGMT cable to NEW Switch
2 Global Configuration
3 SNMP Configuration
4 Access-List
5 NTP & SYSLOG
6 Interface Configuration
interface Fa0/6
description ***To idjktpdc01extxes05 Gi1/0/47**
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 8,38
switchport mode trunk
7 AAA and Radius Configuration
FALLBACK
1 Remove AAA and Radius Configuration

4 Remove Access-List
PDC SDC
idjktpdc01extxes04 idjktpdc01extxes03
interface Fa0/6 interface Fa0/6
description ***To idjktpdc01extxes05 Gi1/0/48** description ***To idjktsdc03extxes06 Gi1/0/47**
switchport trunk encapsulation dot1q switchport trunk encapsulation dot1q
switchport trunk allowed vlan 8,38 switchport trunk allowed vlan 8,38
switchport mode trunk switchport mode trunk
SDC PDC
hostname idjktpdc01extxes05
!
banner login ^C
idjktpdc01extxes05 (WS-C3650-48FS-S)
^C
ip route 0.0.0.0 0.0.0.0 10.232.8.254
spanning-tree mode rapid-pvst

spanning-tree vlan 8,38 priority 61440
snmp-server trap-source Vlan8

snmp-server group NetIdnUser v3 auth
snmp-server group NetworkUser v3 auth
snmp-server group DBSNetworkGrp v3 auth
snmp-server group dbsnacgroup v3 auth read D
snmp-server host 10.67.10.15 version 3 auth Ne
snmp-server host 10.192.4.1 version 2c DB
snmp-server host 10.67.22.155 version 3 auth N
snmp-server host 10.192.50.201 version 3 auth
snmp-server enable traps snmp linkdown linkup
snmp-server enable traps tty
snmp-server enable traps mac-notification chan
ip access-list extended RESTRICT-NTP

permit ip host 10.232.8.88 host 10.232.10.3
access-list 91 permit 10.232.36.212

access-list 12 permit 10.232.9.128 0.0.0.127
logging source-interface Vlan8

logging trap notifications
logging host 10.232.36.140
!
ntp source Vlan8
ntp access-group peer RESTRICT-NTP
ntp server 10.232.10.3
interface Fa0/11 no interface Port-channel5
description ***To idjktsdc03extxes06 Gi1/0/48**interface Loopback0
switchport trunk encapsulation dot1q no shutdown
switchport trunk allowed vlan 8,38 description ***FOR CONTROL/MANAGEMENT*
switchport mode trunk ip address 10.232.10.88 255.255.255.255
no ip redirects
no ip unreachables
no ip proxy-arp
interface GigabitEthernet1/0/1
description ***To idjktpdc01extxr14 Gi0***
switchport access vlan 8
switchport mode access
spanning-tree portfast
!
description ***To idjktpdc01extxr15 Gig0***
!
interface range GigabitEthernet1/0/3-46
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
description ***To idjktpdc01extxes04 Fa0/6***
no channel-group 5 mode on
!
description ***To idjktpdc01extxes04 Fa0/31***
no channel-group 5 mode on
!
interface Vlan1
no ip address
shutdown
!
interface Vlan8
no shutdown
description ***MGMT PDC***
ip address 10.232.8.88 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
!
interface Vlan38
no shutdown
description ***MGMT SDC***
ip address 10.232.38.88 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
!
aaa new-model
aaa authentication login DBS_TACACS group ta
aaa authorization console
aaa authorization config-commands
aaa authorization exec default group tacacs+ no
aaa authorization exec DBSINDO_TACACS grou
aaa authorization configuration default group ta
aaa authorization commands 15 default group t
aaa accounting exec default start-stop group ta
aaa accounting commands 15 default start-stop
ip tacacs source-interface Vlan8

tacacs-server host 10.67.1.75 key 7 104A0B0
tacacs-server host 10.232.6.237 key 7 01170
!
line con 0
exec-timeout 15 0
login authentication DBSINDO_TACACS
line aux 0
exec-timeout 15 0
line vty 0 4
access-class 12 in
exec-timeout 15 0
transport input ssh
line vty 5 15
transport input none
no username admin
no aaa new-model
line vty 0 4
login local
no access-class 12 in vrf-also
no login authentication DBSINDO_TACACS
SDC
idjktsdc03extxes06
idjktsdc03extxes06
hostname idjktsdc03extxes06
!
banner login ^C
idjktsdc03extxes06 (WS-C3650-48FS-S)
^C
ip route 0.0.0.0 0.0.0.0 10.232.38.254
spanning-tree mode rapid-pvst

spanning-tree vlan 8,38 priority 61440
snmp-server trap-source Vlan38

snmp-server group dbsnacgroup v3 auth read D
snmp-server host 10.67.10.15 version 3 auth Ne
snmp-server host 10.192.4.1 version 2c DB
snmp-server enable traps mac-notification chan


logging source-interface Vlan38

!
ntp source Vlan38
interface Loopback0
no shutdown
description ***FOR CONTROL/MANAGEMENT*
ip address 10.232.40.98 255.255.255.255
no ip redirects
no ip unreachables
no ip proxy-arp
description ***To idjktsdc03extxr14 Gi0***
!
description ***To idjktsdc03extxr15 Gi0***
!
description ***To idjktsdc03uatxr01 Gi0***
!
description ***To idjktsdc03uatxr02 Gi0***
!
description ***To idjktsdc03uatxs01 Gi0/0***
!
description ***To idjktsdc03uatxs01 Gi0/0***
!
interface range GigabitEthernet1/0/7-46
!
description ***To idjktsdc03extxes03 Fa0/x***
!
description ***To idjktsdc03extxes03 Fa0/x***
!
interface Vlan1
no ip address
shutdown
!
interface Vlan8
no shutdown
description ***MGMT PDC***
ip address 10.232.8.98 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
!
interface Vlan38
no shutdown
description ***MGMT SDC***
ip address 10.232.38.98 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
!
aaa new-model
aaa authentication login DBS_TACACS group ta
aaa authorization exec default group tacacs+ no
aaa authorization exec DBSINDO_TACACS grou
aaa authorization configuration default group ta
aaa authorization commands 15 default group t
aaa accounting exec default start-stop group ta
aaa accounting commands 15 default start-stop
ip tacacs source-interface Vlan38

tacacs-server host 10.67.1.75 key 7 104A0B0
!
line con 0
exec-timeout 15 0
line aux 0
exec-timeout 15 0
line vty 0 4
access-class 12 in
exec-timeout 15 0
transport input ssh
line vty 5 15
no username admin
no aaa new-model
line vty 0 4
login local
SDC
idjktsdc03uatxs01
idjktsdc03uatxs01
hostname idjktsdc03uatxs01
!
banner login ^C
idjktsdc03uatxs01 (C9500-48Y4C-A)
^C
ip route vrf Mgmt-vrf 10.0.0.0 255.0.0.0 10.232.38.254
!
snmp-server trap-source GigabitEthernet0/0

snmp-server group dbsnacgroup v3 auth read Dbsnacview write Dbsnacview
snmp-server host 10.192.4.1 vrf Mgmt-vrf version 2c DB5N1BMC5TR1NG mac-notification snmp
snmp-server host 10.67.10.15 vrf Mgmt-vrf version 3 auth NetIdnUser
snmp-server host 10.192.50.201 vrf Mgmt-vrf version 3 auth NetworkUser
snmp-server enable traps mac-notification change move threshold


logging source-interface GigabitEthernet0/0 vrf Mgmt-vrf

logging host 10.232.36.140 vrf Mgmt-vrf
!
ntp source GigabitEthernet0/0
ntp server vrf Mgmt-vrf 10.232.40.3
interface Loopback0
no shutdown
ip address 10.232.40.101 255.255.255.255
no ip redirects
no ip unreachables
no ip proxy-arp
interface GigabitEthernet0/0
no shutdown
ip address 10.232.38.212 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
aaa new-model
aaa authentication login DBS_TACACS group tacacs+ enable
aaa authorization exec default group tacacs+ none
aaa authorization exec DBSINDO_TACACS group tacacs+ none
aaa authorization configuration default group tacacs+
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
!
ip tacacs source-interface GigabitEthernet0/0
tacacs-server host 10.67.1.75 key 7 104A0B0A0F16190A1E102B
tacacs-server host 10.232.6.237 key 7 01170417510A0D0E33584F
tacacs-server host 10.232.36.237 key 7 13011501010D0F2B393029
tacacs-server host 10.67.1.78 key 7 01170417510A0D0E33584
!
line con 0
exec-timeout 15 0
line aux 0
exec-timeout 15 0
line vty 0 4
access-class 12 in vrf-also
exec-timeout 15 0
transport input ssh
line vty 5 15
no username admin
no aaa new-model
line vty 0 4
login local
CWJ 31st Floor
no ip access-list extended ACL-POSTURE-REDIRECT
SDC
idjktsdc03uatxs02
idjktsdc03uatxs02
!
banner login ^C
idjktsdc03uatxs02 (C9500-48Y4C-A)
^C
ip route vrf Mgmt-vrf 10.0.0.0 255.0.0.0 10.232.38.254
!
snmp-server trap-source GigabitEthernet0/0



logging source-interface GigabitEthernet0/0 vrf Mgmt-vrf

!
ntp source GigabitEthernet0/0
interface Loopback0
no shutdown
ip address 10.232.40.102 255.255.255.255
no ip redirects
no ip unreachables
no ip proxy-arp
!
interface GigabitEthernet0/0
no shutdown
ip address 10.232.38.213 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
aaa new-model
!
!
line con 0
exec-timeout 15 0
line aux 0
exec-timeout 15 0
line vty 0 4
exec-timeout 15 0
transport input ssh
line vty 5 15
no username admin
no aaa new-model
line vty 0 4
login local
CWJ 31st Floor
SDC
idjktsdc03uatxr01
idjktsdc03uatxr01
!
banner login ^C
idjktsdc03uatxr01 (ISR4331)
^C
ip route vrf Mgmt-intf 10.0.0.0 255.0.0.0 10.232.38.254
!
snmp-server trap-source GigabitEthernet0



logging source-interface GigabitEthernet0 vrf Mgmt-vrf

!
ntp source GigabitEthernet0
interface Loopback0
no shutdown
ip address 10.232.40.99 255.255.255.255
no ip redirects
no ip unreachables
no ip proxy-arp
!
interface GigabitEthernet0
no shutdown
ip address 10.232.38.210 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
aaa new-model
!
!
line con 0
exec-timeout 15 0
line aux 0
exec-timeout 15 0
line vty 0 4
exec-timeout 15 0
transport input ssh
line vty 5 15
no username admin
no aaa new-model
line vty 0 4
login local
CWJ 31st Floor
SDC
idjktsdc03uatxr02
idjktsdc03uatxr02
hostname idjktsdc03uatxr02
!
banner login ^C
idjktsdc03uatxr02 (ISR4331)
^C
ip route vrf Mgmt-intf 10.0.0.0 255.0.0.0 10.232.38.254
!
snmp-server trap-source GigabitEthernet0



logging source-interface GigabitEthernet0 vrf Mgmt-vrf

!
ntp source GigabitEthernet0
interface Loopback0
no shutdown
ip address 10.232.40.100 255.255.255.255
no ip redirects
no ip unreachables
no ip proxy-arp
!
interface GigabitEthernet0
no shutdown
ip address 10.232.38.101 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
aaa new-model
!
ip tacacs source-interface GigabitEthernet0
!
line con 0
exec-timeout 15 0
line aux 0
exec-timeout 15 0
line vty 0 4
exec-timeout 15 0
transport input ssh
line vty 5 15
no username admin
no aaa new-model
line vty 0 4
login local
CWJ 31st Floor
aaa authentication login
aaa authorization consol
aaa authorization config-
aaa authorization exec d
aaa authorization exec D
aaa authorization configu
aaa authorization comm
aaa accounting exec def
aaa accounting comman
!
ip tacacs source-interfac
tacacs-server host 10.67
!
line con 0
exec-timeout 15 0
login authentication DBS
line aux 0
exec-timeout 15 0
line vty 0 4
access-class 12 in vrf-a
exec-timeout 15 0
transport input ssh
line vty 5 15
no username admin
ip tacacs source-interface GigabitEthernet0

exec-timeout 15 0
exec-timeout 15 0
line vty 0 4
exec-timeout 15 0
transport input ssh
line vty 5 15
no username admin
Open Rule based on this requirement:
SOURCE
Hostname/
No. IP Address
Location
10.234.34.0/24 NET_DBSI_USER_CWJ_SEGMENT34
10.234.44.0/24 NET_DBSI_USER_CWJ_SEGMENT44
10.232.39.0/24 NET_DBSI_Working_Room_Sigma
1
10.232.9.0/24 NET_DBSI_Working_Room_DCI
10.232.38.210/32 idjktsdc03uatxr01
10.232.38.211/32 idjktsdc03uatxr02
10.232.38.212/32 idjktsdc03uatxs01
2
10.232.38.213/32 idjktsdc03uatxs02
10.232.8.88/32 idjktpdc01extxes05
10.232.38.98/32 idjktsdc03extxes06
10.232.38.210/32 idjktsdc03uatxr01
10.232.38.211/32 idjktsdc03uatxr02
10.232.38.212/32 idjktsdc03uatxs01
3
10.232.38.213/32 idjktsdc03uatxs02
10.232.36.212/32
10.232.36.213/32
10.67.10.15/32 Solarwind
4
Netbrain
10.67.22.155/32
10.67.22.157/32
10.232.38.210/32 idjktsdc03uatxr01
10.232.38.211/32 idjktsdc03uatxr02
5 10.232.38.212/32 idjktsdc03uatxs01
10.232.38.213/32 idjktsdc03uatxs02
6 10.232.8.88/32 idjktpdc01extxes05
10.232.38.210/32 idjktsdc03uatxr01
10.232.38.211/32 idjktsdc03uatxr02
7 10.232.38.212/32 idjktsdc03uatxs01
10.232.38.213/32 idjktsdc03uatxs02
10.232.38.210/32 idjktsdc03uatxr01
10.232.38.211/32 idjktsdc03uatxr02
8
8
10.232.38.212/32 idjktsdc03uatxs01
10.232.38.213/32 idjktsdc03uatxs02
10.232.38.210/32 idjktsdc03uatxr01
10.232.38.211/32 idjktsdc03uatxr02
9
10.232.38.212/32 idjktsdc03uatxs01
10.232.38.213/32 idjktsdc03uatxs02
IP NAT Allocation
Device IP Real
idjktsdc03uatxr01 10.232.38.210/24
idjktsdc03uatxr02 10.232.38.211/24
idjktsdc03uatxs01 10.232.38.212/24
idjktsdc03uatxs02 10.232.38.213/24
idjktpdc01extxes05 10.232.8.88/24
idjktsdc03extxes06 10.232.38.98/24
DESTINATION
Hostname/ Protocol (TCP / UDP)

IP Address
Location & Port no
10.232.38.210/32 idjktsdc03uatxr01
10.232.38.211/32 idjktsdc03uatxr02
10.232.38.212/32 idjktsdc03uatxs01
TCP_22
10.232.38.213/32 idjktsdc03uatxs02
10.67.1.75/32 Tacacs-SG1 TACACSplus
10.67.1.78/32 Tacacs-SG2 TCP_49
10.232.6.237/32 Tacacs-Indo1
10.232.36.237/32 Tacacs-Indo2
10.232.36.212/32 Solarwind
10.232.36.213/32 Netbrain
10.67.10.15/32
UDP_161
10.67.22.155/32
10.67.22.157/32
10.232.38.210/32 idjktsdc03uatxr01
10.232.38.211/32 idjktsdc03uatxr02
10.232.38.212/32 idjktsdc03uatxs01 UDP_162
10.232.38.213/32 idjktsdc03uatxs02
TCP_123
UDP_123
10.232.40.3/32
NTP SDC
10.232.40.4/32
TCP_123
10.232.10.3/32, 10.232.10.3/32 NTP PDC
UDP_123
10.232.36.140/32 Syslog UDP_514

10.232.38.213/32
10.232.74.10/32
10.232.74.11/32
DNS UDP_53
DNS UDP_53
10.232.70.52/32
10.67.7.66/32 Cisco Smart License Satellite https_443
IP NAT
10.232.36.245
10.232.36.246
10.232.36.247
10.232.36.248
10.232.6.238
10.232.36.138
Rule
ADD/
DELETE
ADD
ADD
ADD
ADD
ADD
ADD
ADD
ADD
ADD
ADD
Hostname Port Mgt Sw Mgt Hostname Sw Mgt Port VLAN
idjktsdc03uatxr01 Gi0 idjktsdc03extxes06 Gi0/3 access vlan 38
idjktsdc03uatxr02 Gi0 idjktsdc03extxes06 Gi0/4 access vlan 38
idjktsdc03uatxs01 Gi0/0 idjktsdc03extxes06 Gi0/5 access vlan 38
idjktsdc03uatxs02 Gi0/0 idjktsdc03extxes06 Gi0/6 access vlan 38
Old Port New Port Description Cable Type
Idjktsdc03uatxs01
Gi1/0/1 Twen1/0/1 *** To idjktsdc03uatxr01 _Gi0/0/1*** UTP
Gi1/0/2 Twen1/0/2 *** To idjktsdc03extxis03_Gi1/0/42*** UTP
Gi1/0/3 Twen1/0/47 idjktsdc03uatxs02_Twenty1/0/47 UTP
Idjktsdc03uatxs02
Gi1/0/1 Twen1/0/1 *** To idjktsdc03uatxr02 _Gi0/0/1*** UTP
Gi1/0/2 Twen1/0/2 *** To idjktsdc03extxis04_Gi1/0/42*** UTP
Device A Port Device B Port Cable Type

Idjktsdc03uatxr01 Gi0 NEW SW MGMT Gi0/5 UTP
Idjktsdc03uatxr02 Gi0 NEW SW MGMT Gi0/6 UTP
Idjktsdc03uatxs01 Gi0/0 NEW SW MGMT Gi0/7 UTP
Idjktsdc03uatxs02 Gi0/0 NEW SW MGMT Gi0/8 UTP

MoP - Management SWITCH & UAT SDC v0.1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

MoP - Management SWITCH & UAT SDC v0.1

Uploaded by

Copyright:

Available Formats

No

DBS Indonesia - UAT SDC

1) Comments (Task completed before this changes)

4) Post Migration Checklist

6) Post Implementation Monitoring (Standby D2)

S Indonesia - UAT SDC

omments (Task completed before this changes)

ost Migration Checklist

Rollback if TACACS Fail

ost Implementation Monitoring (Standby D2)

√ √ 17:00 18:00 1:00 N

√ 19:00 20:00 1:00 N

√ 1:00 2:00 1:00 N

8:00 12:00 04:00:00

1 Remove AAA and Radius Configuration

spanning-tree mode rapid-pvst

snmp-server trap-source Vlan8

ip access-list extended RESTRICT-NTP

access-list 91 permit 10.232.36.212

logging source-interface Vlan8

ip tacacs source-interface Vlan8

spanning-tree mode rapid-pvst

snmp-server trap-source Vlan38

ip access-list extended RESTRICT-NTP

access-list 91 permit 10.232.36.212

logging source-interface Vlan38

ip tacacs source-interface Vlan38

snmp-server trap-source GigabitEthernet0/0

ip access-list extended RESTRICT-NTP

access-list 91 permit 10.232.36.212

logging source-interface GigabitEthernet0/0 vrf Mgmt-vrf

snmp-server trap-source GigabitEthernet0/0

ip access-list extended RESTRICT-NTP

access-list 91 permit 10.232.36.212

logging source-interface GigabitEthernet0/0 vrf Mgmt-vrf

snmp-server trap-source GigabitEthernet0

ip access-list extended RESTRICT-NTP

access-list 91 permit 10.232.36.212

logging source-interface GigabitEthernet0 vrf Mgmt-vrf

snmp-server trap-source GigabitEthernet0

ip access-list extended RESTRICT-NTP

access-list 91 permit 10.232.36.212

logging source-interface GigabitEthernet0 vrf Mgmt-vrf

ip tacacs source-interface GigabitEthernet0

Hostname/ Protocol (TCP / UDP)

10.232.36.140/32 Syslog UDP_514

10.67.7.66/32 Cisco Smart License Satellite https_443

Device A Port Device B Port Cable Type

You might also like