Systems & Network Labs

! Configure Multi-Area OSPF on Area Border Router (ABR)
Router(config)# router ospf 1
Router(config-router)# router-id 1.1.1.1
Router(config-router)# network 10.0.0.0 0.0.0.3 area 0
Router(config-router)# network 192.168.10.0 0.0.0.255 area 1
Router(config-router)# area 1 range 192.168.0.0 255.255.0.0
Router(config-router)# passive-interface GigabitEthernet0/0
Router(config-router)# exit
Router# show ip ospf neighbor
Router# show ip route ospf

server {
    listen 443 ssl http2;
    server_name gautambhuwan.com.np;

    ssl_certificate /etc/ssl/certs/fullchain.pem;
    ssl_certificate_key /etc/ssl/private/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Create isolated bridge network with custom subnet
docker network create --driver bridge --subnet 172.28.0.0/16 app_net

# Run isolated container connected only to the defined network
docker run -d --name secure_gateway   --network app_net   --ip 172.28.0.10   -v /var/data/app:/app/data:ro   -p 8080:80   nginx:alpine

# Verify bridge interface on host
ip addr show dev br-$(docker network inspect app_net -f '{{.Id}}' | cut -c1-12)

! 1. Configure LACP EtherChannel Trunk between Distribution Switches
DSW1(config)# interface range GigabitEthernet0/1 - 2
DSW1(config-if-range)# channel-group 1 mode active
DSW1(config-if-range)# exit
DSW1(config)# interface Port-channel 1
DSW1(config-if)# switchport trunk encapsulation dot1q
DSW1(config-if)# switchport mode trunk
DSW1(config-if)# switchport trunk allowed vlan 10,20,99

! 2. Configure HSRPv2 with Priority, Preemption & Uplink Tracking
DSW1(config)# interface Vlan10
DSW1(config-if)# ip address 192.168.10.2 255.255.255.0
DSW1(config-if)# standby version 2
DSW1(config-if)# standby 10 ip 192.168.10.1
DSW1(config-if)# standby 10 priority 110
DSW1(config-if)# standby 10 preempt
DSW1(config-if)# standby 10 track GigabitEthernet0/0 20
DSW1(config-if)# exit

! 3. Align Spanning Tree Root with HSRP Active Node
DSW1(config)# spanning-tree mode rapid-pvst
DSW1(config)# spanning-tree vlan 10 root primary
DSW1(config)# spanning-tree portfast default
DSW1(config)# spanning-tree portfast bpduguard default
DSW1# show standby brief
DSW1# show etherchannel summary

! 1. Hardened IKEv2 Proposal & Keyring
crypto ikev2 proposal IKEV2-SEC-PROP
 encryption aes-gcm-256
 prf sha256
 group 19
crypto ikev2 policy IKEV2-POLICY
 proposal IKEV2-SEC-PROP
crypto ikev2 keyring BRANCH-KEYRING
 peer BRANCH-ROUTER
  address 203.0.113.2
  pre-shared-key SuperSecretVpnKey2026

! 2. IPsec Profile & Virtual Tunnel Interface (VTI)
crypto ipsec transform-set TS-GCM esp-gcm 256
 mode transport
crypto ipsec profile IPSEC-VTI-PROF
 set transform-set TS-GCM
 set ikev2-profile IKEV2-PROFILE

interface Tunnel0
 ip address 10.255.255.1 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0
 tunnel destination 203.0.113.2
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC-VTI-PROF

! 3. Dynamic eBGP Peering across Encrypted Tunnel
router bgp 65001
 neighbor 10.255.255.2 remote-as 65002
 neighbor 10.255.255.2 timers 5 15
 address-family ipv4 unicast
  network 192.168.10.0 mask 255.255.255.0
  neighbor 10.255.255.2 activate
HQ-RTR# show crypto session detail
HQ-RTR# show ip bgp summary

# 1. Multi-Hop Recursive Route Failover via Public DNS
/ip route
add dst-address=1.1.1.1/32 gateway=192.168.1.1 scope=10 comment="Host-Route-ISP1"
add dst-address=8.8.8.8/32 gateway=192.168.2.1 scope=10 comment="Host-Route-ISP2"
add distance=1 gateway=1.1.1.1 check-gateway=ping target-scope=11 comment="Default-ISP1-Recursive"
add distance=2 gateway=8.8.8.8 check-gateway=ping target-scope=11 comment="Default-ISP2-Recursive"

# 2. Firewall Mangle Rules for PCC Load Balancing
/ip firewall mangle
add chain=prerouting dst-address-type=!local in-interface=bridge-lan \
    per-connection-classifier=both-addresses:2/0 action=mark-connection new-connection-mark=ISP1_conn passthrough=yes
add chain=prerouting dst-address-type=!local in-interface=bridge-lan \
    per-connection-classifier=both-addresses:2/1 action=mark-connection new-connection-mark=ISP2_conn passthrough=yes
add chain=prerouting in-interface=bridge-lan connection-mark=ISP1_conn action=mark-routing new-routing-mark=to_ISP1
add chain=prerouting in-interface=bridge-lan connection-mark=ISP2_conn action=mark-routing new-routing-mark=to_ISP2

# 3. Dynamic Bandwidth Fairness via PCQ (Per-Connection Queue)
/queue type
add name=pcq-download kind=pcq pcq-classifier=dst-address pcq-rate=30M
add name=pcq-upload kind=pcq pcq-classifier=src-address pcq-rate=15M
/queue tree
add name=Total-Download parent=bridge-lan queue=pcq-download priority=1
add name=Total-Upload parent=ether1-wan1 queue=pcq-upload priority=1

! Core Gateway 802.1Q Subinterface & Route Summarization Configuration
Core-RTR(config)# ipv6 unicast-routing

! Engineering Subinterface (VLAN 10)
Core-RTR(config)# interface GigabitEthernet0/0/0.10
Core-RTR(config-subif)# encapsulation dot1Q 10
Core-RTR(config-subif)# ip address 172.16.0.1 255.255.255.128
Core-RTR(config-subif)# ipv6 address 2001:db8:acad:10::1/64
Core-RTR(config-subif)# exit

! Guest Wi-Fi Subinterface (VLAN 50)
Core-RTR(config)# interface GigabitEthernet0/0/0.50
Core-RTR(config-subif)# encapsulation dot1Q 50
Core-RTR(config-subif)# ip address 172.16.1.1 255.255.255.128
Core-RTR(config-subif)# ipv6 address 2001:db8:acad:50::1/64
Core-RTR(config-subif)# exit

! Single Contiguous OSPF Route Summarization towards WAN Core
Core-RTR(config)# router ospf 1
Core-RTR(config-router)# area 1 range 172.16.0.0 255.255.254.0
Core-RTR(config-router)# exit
Core-RTR# show ip route summary

! Huawei SmartAX MA5608T GPON Service Provisioning
MA5608T(config)# dba-profile add profile-id 15 profile-name "100M_BIZ" type4 max 102400
MA5608T(config)# ont-lineprofile gpon profile-id 20 profile-name "FTTH_INTERNET"
MA5608T(config-gpon-lineprofile-20)# tcont 1 dba-profile-id 15
MA5608T(config-gpon-lineprofile-20)# gem add 1 eth tcont 1
MA5608T(config-gpon-lineprofile-20)# gem mapping 1 0 vlan 100
MA5608T(config-gpon-lineprofile-20)# commit
MA5608T(config-gpon-lineprofile-20)# exit

! Define Service Profile for 4-port Gigabit Ethernet ONT
MA5608T(config)# ont-srvprofile gpon profile-id 20 profile-name "4GE_WIFI_ONT"
MA5608T(config-gpon-srvprofile-20)# ont-port eth 4
MA5608T(config-gpon-srvprofile-20)# port vlan eth 1 translation 100 user-vlan 100
MA5608T(config-gpon-srvprofile-20)# commit
MA5608T(config-gpon-srvprofile-20)# exit

! Auto-Discovery & Authorization on GPON Port 0/1/0
MA5608T(config)# interface gpon 0/1
MA5608T(config-if-gpon-0/1)# ont add 0 1 sn-auth "48575443B1A2C3D4" omci ont-lineprofile-id 20 ont-srvprofile-id 20 desc "CUST_FIBER_ENTERPRISE_01"
MA5608T(config-if-gpon-0/1)# exit

! QinQ Service Port Tagging (Outer S-VLAN 200, Inner C-VLAN 100)
MA5608T(config)# service-port 10 vlan 200 gpon 0/1/0 ont 1 gemport 1 multi-service user-vlan 100 tag-transform translate-and-add inner-vlan 100 inbound traffic-table index 6 outbound traffic-table index 6

! Diagnostic & Optical Power Budget Verification
MA5608T# display ont optical-info 0/1 0 1
! Output verifies Rx Optical Power: -19.45 dBm (Within -8 to -27 dBm standard margin)

! Cisco Catalyst 3850/9300 Metro Aggregation Hardening
Cat-SW01(config)# spanning-tree mode mst
Cat-SW01(config)# spanning-tree mst configuration
Cat-SW01(config-mst)# name METRO-RING-01
Cat-SW01(config-mst)# revision 1
Cat-SW01(config-mst)# instance 1 vlan 10, 20, 30
Cat-SW01(config-mst)# instance 2 vlan 100, 200, 300
Cat-SW01(config-mst)# exit
Cat-SW01(config)# spanning-tree mst 1 priority 4096

! 802.3ad LACP Uplink Port-Channel to Distribution Switch
Cat-SW01(config)# interface range TenGigabitEthernet1/1/1 - 2
Cat-SW01(config-if-range)# switchport mode trunk
Cat-SW01(config-if-range)# switchport trunk allowed vlan 10,20,30,100,200,300
Cat-SW01(config-if-range)# channel-group 1 mode active
Cat-SW01(config-if-range)# exit

! Layer 2 Boundary Security: DHCP Snooping, Option 82 & DAI
Cat-SW01(config)# ip dhcp snooping
Cat-SW01(config)# ip dhcp snooping vlan 10,20,30,100,200
Cat-SW01(config)# ip dhcp snooping information option
Cat-SW01(config)# interface Port-channel 1
Cat-SW01(config-if)# ip dhcp snooping trust
Cat-SW01(config-if)# ip arp inspection trust
Cat-SW01(config-if)# exit

! Edge Access Ports with DAI & Storm Control
Cat-SW01(config)# interface range GigabitEthernet1/0/1 - 24
Cat-SW01(config-if-range)# switchport mode access
Cat-SW01(config-if-range)# switchport port-security
Cat-SW01(config-if-range)# switchport port-security maximum 2
Cat-SW01(config-if-range)# switchport port-security violation restrict
Cat-SW01(config-if-range)# ip arp inspection limit rate 15
Cat-SW01(config-if-range)# storm-control broadcast level 1.00
Cat-SW01(config-if-range)# spanning-tree portfast
Cat-SW01(config-if-range)# spanning-tree bpduguard enable

# Juniper Junos Hierarchical eBGP Peering & Loopback Defense
set protocols bgp group UPSTREAM-TRANSIT type external
set protocols bgp group UPSTREAM-TRANSIT peer-as 64500
set protocols bgp group UPSTREAM-TRANSIT neighbor 198.51.100.1 description "PRIMARY_TRANSIT_ISP_A"
set protocols bgp group UPSTREAM-TRANSIT neighbor 198.51.100.1 export BGP-EXPORT-POLICY
set protocols bgp group UPSTREAM-TRANSIT neighbor 198.51.100.1 import BGP-IMPORT-POLICY
set protocols bgp group UPSTREAM-TRANSIT neighbor 198.51.100.1 graceful-restart
set protocols bgp group UPSTREAM-TRANSIT neighbor 198.51.100.1 family inet unicast

# Routing Policies with Community Tagging & Local Preference
set policy-options policy-statement BGP-IMPORT-POLICY term PRIMARY-IN from community COMM-PREF-HIGH
set policy-options policy-statement BGP-IMPORT-POLICY term PRIMARY-IN then local-preference 200
set policy-options policy-statement BGP-IMPORT-POLICY term PRIMARY-IN then accept
set policy-options policy-statement BGP-EXPORT-POLICY term ADVERTISE-OUR-PREFIX from route-filter 203.0.113.0/24 exact
set policy-options policy-statement BGP-EXPORT-POLICY term ADVERTISE-OUR-PREFIX then accept
set policy-options policy-statement BGP-EXPORT-POLICY then reject

# Stateless Firewall Filter Protecting the Routing Engine (lo0.0)
set firewall family inet filter PROTECT-ROUTING-ENGINE term ALLOW-BGP from source-prefix-list BGP-NEIGHBORS
set firewall family inet filter PROTECT-ROUTING-ENGINE term ALLOW-BGP from protocol tcp
set firewall family inet filter PROTECT-ROUTING-ENGINE term ALLOW-BGP from port bgp
set firewall family inet filter PROTECT-ROUTING-ENGINE term ALLOW-BGP then accept

set firewall family inet filter PROTECT-ROUTING-ENGINE term ALLOW-NOC-SSH from source-prefix-list NOC-MGMT-SUBNET
set firewall family inet filter PROTECT-ROUTING-ENGINE term ALLOW-NOC-SSH from protocol tcp
set firewall family inet filter PROTECT-ROUTING-ENGINE term ALLOW-NOC-SSH from destination-port 22
set firewall family inet filter PROTECT-ROUTING-ENGINE term ALLOW-NOC-SSH then accept

set firewall family inet filter PROTECT-ROUTING-ENGINE term RATE-LIMIT-ICMP from protocol icmp
set firewall family inet filter PROTECT-ROUTING-ENGINE term RATE-LIMIT-ICMP then policer ICMP-100K-POLICER
set firewall family inet filter PROTECT-ROUTING-ENGINE term RATE-LIMIT-ICMP then accept

set firewall family inet filter PROTECT-ROUTING-ENGINE term DEFAULT-DISCARD-LOG then count RE-ATTACK-DROPS
set firewall family inet filter PROTECT-ROUTING-ENGINE term DEFAULT-DISCARD-LOG then discard

# Apply Filter to Loopback 0 Unit 0
set interfaces lo0 unit 0 family inet filter input PROTECT-ROUTING-ENGINE
commit confirmed 5

! FortiGate Carrier-Grade NAT & Zone Firewall Policy
config firewall ippool
    edit "CGNAT_SUBSCRIBER_POOL"
        set type cgn-resource-allocation
        set startip 198.51.100.10
        set endip 198.51.100.20
        set arp-reply enable
        set cpa-port-block-size 2000
        set cpa-max-port-blocks 2
    next
end

! Define Security Zones for Micro-Segmentation
config system zone
    edit "ZONE_SUBSCRIBER_LAN"
        set interface "vlan100" "vlan200" "vlan300"
    next
    edit "ZONE_WAN_UPSTREAMS"
        set interface "port1" "port2"
    next
end

! Carrier-Grade NAT Policy with Deep Inspection & Session Limits
config firewall policy
    edit 101
        set name "SUBSCRIBER_TO_INTERNET_CGNAT"
        set srcintf "ZONE_SUBSCRIBER_LAN"
        set dstintf "ZONE_WAN_UPSTREAMS"
        set srcaddr "SUBSCRIBER_CGNAT_BLOCK_100.64.0.0_10"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
        set ippool enable
        set poolname "CGNAT_SUBSCRIBER_POOL"
        set tcp-mss-sender 1400
        set tcp-mss-receiver 1400
        set logtraffic all
    next
end

! High Availability Heartbeat & Session Sync
config system ha
    set group-name "NOC_CORE_FW_HA"
    set mode a-p
    set hbdev "port7" 50 "port8" 50
    set session-pickup enable
    set override disable
    set priority 200
end