Kumpulan Command Cisco Penting untuk Teknisi Jaringan

! Navigasi mode CLI
Switch> enable                 ! user EXEC -> privileged EXEC
Switch# configure terminal     ! masuk global configuration
Switch(config)#

! Beri nama perangkat — memudahkan identifikasi
Switch(config)# hostname SW-LANTAI1

! Password untuk masuk privileged mode
SW-LANTAI1(config)# enable secret KataSandiKuat

! WAJIB pakai 'enable secret' (di-hash) — BUKAN 'enable password' (polos)

! Password akses lewat kabel console
SW-LANTAI1(config)# line console 0
SW-LANTAI1(config-line)# password KonsolKu
SW-LANTAI1(config-line)# login
SW-LANTAI1(config-line)# exit

! Buat user lokal — login pakai username + password
SW-LANTAI1(config)# username admin privilege 15 secret AdminKuat
SW-LANTAI1(config)# username teknisi privilege 1 secret TeknisiKuat
! privilege 15 = akses penuh    privilege 1 = terbatas

! Akses remote (Telnet/SSH) lewat jalur VTY
SW-LANTAI1(config)# line vty 0 4
SW-LANTAI1(config-line)# login local           ! verifikasi pakai username di atas
SW-LANTAI1(config-line)# transport input telnet ssh

! SSH butuh: hostname (bukan default) + domain-name + RSA key
SW-LANTAI1(config)# ip domain-name kantor.local
SW-LANTAI1(config)# crypto key generate rsa modulus 2048
SW-LANTAI1(config)# ip ssh version 2

! Arahkan VTY hanya ke SSH — Telnet dimatikan
SW-LANTAI1(config)# line vty 0 4
SW-LANTAI1(config-line)# transport input ssh
SW-LANTAI1(config-line)# login local
SW-LANTAI1(config-line)# exit

! Kembali ke privileged mode
SW-LANTAI1(config)# end

! SIMPAN — tanpa ini, semua config hilang saat perangkat reboot
SW-LANTAI1# copy running-config startup-config
SW-LANTAI1# write memory          ! cara singkat, sama saja (atau cukup: wr)

! Verifikasi hasil setup
SW-LANTAI1# show running-config
SW-LANTAI1# show ip ssh            ! status dan versi SSH
SW-LANTAI1# show users            ! sesi yang sedang terhubung

show ip interface brief

! Output:
Interface      IP-Address      OK? Method Status   Protocol
GigE0/0/0      203.0.113.1     YES NVRAM  up       up
GigE0/0/1      192.168.1.1     YES NVRAM  up       up
GigE0/0/2      unassigned      YES NVRAM  admin down down

! up/up          = sehat
! up/down        = Layer 2 masalah (encap, keepalive, duplex)
! admin down     = di-shutdown manual

show interface GigabitEthernet0/0/0

! Output penting:
GigabitEthernet0/0/0 is up, line protocol is up
  MTU 1500 bytes, BW 1000000 Kbit/sec
  5 minute input rate  45000000 bits/sec, 3200 packets/sec
  5 minute output rate 12000000 bits/sec, 1100 packets/sec
     0 input errors, 0 CRC, 0 frame, 0 overrun
     0 output errors, 0 collisions, 0 interface resets

! CRC > 0        = masalah fisik (kabel, SFP, noise EMI)
! Input drops    = interface overloaded / buffer penuh
! Resets > 0     = keepalive failure atau duplex mismatch
! Output drops   = queue penuh, QoS policy terlalu ketat

! Semua route
show ip route

! Filter prefix spesifik
show ip route 10.0.0.0

! Output:
Codes: C-connected, S-static, R-RIP, O-OSPF, B-BGP, * candidate default

Gateway of last resort is 203.0.113.2 to network 0.0.0.0

B*    0.0.0.0/0 [20/0] via 203.0.113.2, 2d04h
C     192.168.1.0/24 is directly connected, GigE0/0/1
O     10.10.0.0/16 [110/20] via 192.168.1.2, 00:45:12, GigE0/0/1
S     198.51.100.0/24 [1/0] via 203.0.113.2

! [20/0] = [administrative distance / metric]
! AD: Connected=0, Static=1, OSPF=110, BGP=20(eBGP)/200(iBGP)

! Cek CEF (Cisco Express Forwarding) entry
show ip cef 10.10.0.0/16 detail

! Cek route lewat interface apa
show ip route | include via

! Status semua BGP neighbor
show bgp summary

! Output:
Neighbor     V  AS     MsgRcvd MsgSent TblVer InQ OutQ Up/Down  State/PfxRcd
203.0.113.2  4  65000   84521   12340  150234   0    0  2d04h       824531
192.168.1.2  4  65001     234     198  150234   0    0  00:45:12        12

! Angka di State/PfxRcd = jumlah prefix diterima (established)
! "Active"  = mencoba connect, belum berhasil
! "Idle"    = tidak mencoba (cek neighbor config atau routing ke peer)
! "OpenSent"= SYN terkirim, tunggu reply

! Detail prefix dari neighbor
show bgp neighbors 203.0.113.2 received-routes
show bgp neighbors 203.0.113.2 advertised-routes

! Cek route spesifik di BGP table
show bgp ipv4 unicast 10.0.0.0/8

! Reset BGP session (soft = tanpa putus sesi)
clear ip bgp 203.0.113.2 soft
clear ip bgp 203.0.113.2 soft in   ! hanya refresh inbound
clear ip bgp 203.0.113.2 soft out  ! hanya re-advertise outbound

! Status OSPF neighbor
show ip ospf neighbor

! Output:
Neighbor ID  Pri  State       Dead Time  Address      Interface
10.0.0.2       1  FULL/DR     00:00:35   192.168.1.2  GigE0/0/1
10.0.0.3       1  FULL/BDR    00:00:38   192.168.1.3  GigE0/0/1

! FULL/DR   = adjacency ok, neighbor adalah DR
! FULL/BDR  = adjacency ok, neighbor adalah BDR
! FULL/-    = adjacency ok, point-to-point link
! 2WAY      = neighbor terlihat, tapi tidak akan full (non DR/BDR di broadcast)
! EXSTART   = adjacency sedang dibentuk, cek MTU mismatch

! OSPF database
show ip ospf database summary
show ip ospf database router 10.0.0.2

! Cek kenapa neighbor tidak muncul
show ip ospf interface GigabitEthernet0/0/1
! Cek: hello/dead interval, area ID, auth, network type, MTU

! Lihat semua NAT translation aktif
show ip nat translations

! Output:
Pro  Inside global       Inside local        Outside local      Outside global
tcp  203.0.113.1:45231   192.168.1.10:45231  8.8.8.8:443        8.8.8.8:443
tcp  203.0.113.1:45232   192.168.1.11:52100  1.1.1.1:80         1.1.1.1:80

! Inside global  = IP publik yang terlihat dari internet
! Inside local   = IP private sumber dari dalam

! Statistik NAT (hit count, miss, dll)
show ip nat statistics

! Filter translation dari host tertentu
show ip nat translations | include 192.168.1.10

! Clear NAT table — HATI-HATI, putus semua session
clear ip nat translation *

! Clear satu entry saja (lebih aman)
clear ip nat translation inside 192.168.1.10 outside 8.8.8.8

! List semua ACL yang ada
show access-lists

! Detail ACL spesifik dengan hit count
show access-lists BLOCK_SMTP

! Output:
Extended IP access list BLOCK_SMTP
    10 deny   tcp any any eq smtp (8924 matches)
    20 deny   tcp any any eq 465 (234 matches)
    30 permit ip any any (1823456 matches)

! matches = berapa kali rule tersebut di-match traffic
! matches=0 di rule penting = rule tidak pernah match (mungkin salah urutan)

! Cek ACL yang applied di interface
show ip interface GigabitEthernet0/0/0 | include access list

! Reset hit counter
clear ip access-list counters BLOCK_SMTP

! Lihat policy map yang applied di interface
show policy-map interface GigabitEthernet0/0/0

! Output:
GigabitEthernet0/0/0
  Service-policy output: WAN-QOS
    Class-map: VOICE (match-all)
      5 minute offered rate 2000000 bps
      Match: dscp ef (46)
      Priority: 2000 kbps, burst bytes 50000, b/w exceed drops: 0
    Class-map: DATA (match-all)
      5 minute offered rate 45000000 bps
      Queueing: queue limit 64 packets
      (total drops) 12453
      (bytes output) 9823456123

! total drops tinggi = queue penuh, bandwidth tidak cukup
! b/w exceed drops   = traffic melebihi bandwidth yang dialokasikan

! Cek class map
show class-map VOICE
show policy-map WAN-QOS

! Status IKE Phase 1 (ISAKMP SA)
show crypto isakmp sa

! Output:
dst            src            state     conn-id  status
203.0.113.2    198.51.100.1   QM_IDLE        1  ACTIVE

! QM_IDLE = Phase 1 up dan idle (normal)
! MM_NO_STATE = Phase 1 gagal, cek pre-shared key dan proposal

! Status IKE Phase 2 (IPsec SA)
show crypto ipsec sa

! Output penting:
local  addr  192.168.1.0/24
remote addr  10.10.0.0/24
  #pkts encaps: 45231, #pkts encrypt: 45231, #pkts digest: 45231
  #pkts decaps: 38912, #pkts decrypt: 38912, #pkts verify: 38912
  #pkts errors 0, #recv errors 0

! pkts encaps vs decrypt tidak match jauh = traffic satu arah saja
! recv errors > 0 = integrity check failure (key mismatch atau replay)

! Clear IPsec SA (force renegotiate)
clear crypto ipsec sa peer 203.0.113.2

! WAJIB: set terminal monitor dulu kalau SSH/Telnet
terminal monitor

! Debug OSPF event (lebih ringan dari debug ospf adj)
debug ip ospf events

! Debug BGP update dari neighbor tertentu saja (conditional debug)
debug ip bgp 203.0.113.2 updates

! Debug packet ke/dari IP tertentu (conditional — lebih aman)
debug ip packet 192.168.1.10 detail

! SELALU matikan debug setelah selesai!
undebug all
! atau shortcut:
u all

! Lihat debug apa yang aktif
show debugging

! Semua VLAN dan port yang belong
show vlan brief

! Output:
VLAN Name                  Status    Ports
1    default                active    Gi0/1, Gi0/2
10   VLAN_USERS             active    Gi0/3, Gi0/4, Gi0/5
20   VLAN_SERVERS           active    Gi0/6
99   VLAN_MGMT              active    Gi0/8

! Detail port tertentu (trunk/access info)
show interfaces GigabitEthernet0/3 switchport

! Output:
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 10 (VLAN_USERS)
Voice VLAN: none

! VLAN ID not found = VLAN belum dibuat di database
! Port tidak muncul di VLAN = belum di-assign

! Semua trunk port
show interfaces trunk

! Output:
Port   Mode  Encapsulation Status    Native vlan
Gi0/1  on    802.1q        trunking  1

Port   Vlans allowed on trunk
Gi0/1  1-4094

Port   Vlans allowed and active in management domain
Gi0/1  1,10,20,99

Port   Vlans in spanning tree forwarding state and not pruned
Gi0/1  1,10,20,99

! VLAN tidak di baris terakhir = STP blocking atau VLAN tidak aktif

! Tambah VLAN ke trunk (tanpa hapus VLAN lain)
switchport trunk allowed vlan add 30

! Cek native VLAN mismatch (penyebab CDP warning)
show interfaces trunk | include Native

! STP summary semua VLAN
show spanning-tree summary

! STP detail per VLAN
show spanning-tree vlan 10

! Output:
VLAN0010
  Spanning tree enabled protocol ieee
  Root ID  Priority 24586
           Address  aabb.cc00.0100
           This bridge is the root

Interface   Role  Sts  Cost  Prio.Nbr Type
Gi0/1       Desg  FWD  4     128.1    P2p
Gi0/2       Desg  FWD  4     128.2    P2p
Gi0/3       Altn  BLK  4     128.3    P2p

! Desg/FWD = Designated, Forwarding (normal)
! Altn/BLK = Alternate, Blocking (backup path, normal di RSTP)
! Root/FWD = Root port (path ke root bridge)

! Lihat STP topology change history
show spanning-tree detail | include topology

! Cek port yang jadi root bridge
show spanning-tree vlan 10 root

! Semua MAC yang dipelajari switch
show mac address-table

! Cari MAC tertentu
show mac address-table address aabb.cc00.0200

! Cari MAC di VLAN tertentu
show mac address-table vlan 10

! Output:
Vlan  Mac Address       Type     Ports
  10  aabb.cc00.0200    DYNAMIC  Gi0/3
  10  aabb.cc00.0300    DYNAMIC  Gi0/3
  99  aabb.cc00.0100    STATIC   Gi0/8

! Banyak MAC di satu port = port ke switch lain atau hub
! MAC tidak muncul = device belum kirim traffic atau salah VLAN

! Hitung jumlah MAC per port (deteksi hub/switch downstream)
show mac address-table count

! Ringkasan semua port channel
show etherchannel summary

! Output:
Flags:  D-down  P-bundled  s-suspended  I-stand-alone  r-hot-standby
        U-in use  f-failed to allocate aggregator

Number of channel-groups in use: 1
Group  Port-channel  Protocol  Ports
1      Po1(SU)       LACP      Gi0/1(P) Gi0/2(P) Gi0/3(P) Gi0/4(P)

! SU = port channel up dan in use (normal)
! P  = port bundled ke channel (normal)
! D  = port down
! s  = port suspended (LACP mismatch dengan peer)

! Detail load balancing
show etherchannel load-balance

! Detail per port channel
show etherchannel 1 detail

! CDP neighbor ringkasan
show cdp neighbors

! CDP neighbor detail (termasuk IP address!)
show cdp neighbors detail

! Output detail:
Device ID: SW-CORE-01
Entry address(es):
  IP address: 192.168.99.2
Platform: cisco WS-C3750X-48P, Capabilities: Switch IGMP
Interface: GigabitEthernet0/1, Port ID: GigabitEthernet1/0/24
Holdtime: 144 sec, Version: IOS 15.2(4)E7

! LLDP (cross-vendor, untuk non-Cisco juga)
show lldp neighbors
show lldp neighbors detail

! CDP per interface
show cdp neighbors GigabitEthernet0/1 detail

! Status port security semua interface
show port-security

! Detail per interface
show port-security interface GigabitEthernet0/5

! Output:
Port Security              : Enabled
Port Status                : Secure-shutdown
Violation Mode             : Shutdown
Maximum MAC Addresses      : 1
Security Violation Count   : 3

! Secure-shutdown = port kena violation, masuk err-disable

! Recovery manual (shutdown → no shutdown)
interface GigabitEthernet0/5
 shutdown
 no shutdown

! Auto recovery (tanpa manual intervention)
errdisable recovery cause psecure-violation
errdisable recovery interval 300

! Lihat semua interface yang err-disabled
show interfaces status err-disabled

! Ringkasan interface
show interface ip brief

! Nama interface dan security level
show nameif

! Output:
Interface                Name           Security
GigabitEthernet0/0       outside               0
GigabitEthernet0/1       inside              100
GigabitEthernet0/2       dmz                  50

! Security level 0   = paling tidak trusted (internet)
! Security level 100 = paling trusted (LAN)
! High → Low = allowed by default
! Low → High = butuh ACL explicit

! Detail interface dengan error counter
show interface GigabitEthernet0/0 detail

! Jumlah total connection aktif
show conn count

! Output: 14231 in use, 24891 most used

! Lihat connection dari/ke IP tertentu
show conn address 192.168.1.10

! Output:
TCP outside 203.0.113.50:443 inside 192.168.1.10:52341, idle 0:00:02, bytes 12453, flags UIO

! flags: U=up, I=inbound data, O=outbound data
! flags SaA = TCP SYN sent, SYN-ACK received, ACK sent

! Filter berdasarkan port
show conn port 443

! Lihat conn limit per host (untuk detect connection flood)
show conn | include 192.168.1.10 | count

! Statistik resource usage
show resource usage

! Simulasi: apakah traffic dari outside ke inside port 443 diizinkan?
packet-tracer input outside tcp 198.51.100.1 12345 192.168.1.10 443

! Output (allowed):
Phase 1: ROUTE-LOOKUP       Result: ALLOW
Phase 2: ACCESS-LIST        Result: ALLOW
         Config: access-group OUTSIDE_IN in interface outside
Phase 3: NAT                Result: ALLOW
Phase 4: IP-OPTIONS         Result: ALLOW

Result: input-interface: outside
        output-interface: inside
        Action: allow

! Kalau Action: drop — lihat phase mana yang menunjukkan BLOCK
! dan "Config:" di phase tersebut = rule yang menyebabkan drop

! Packet tracer untuk UDP
packet-tracer input outside udp 198.51.100.1 12345 192.168.1.10 53

! Packet tracer detail (lebih verbose)
packet-tracer input outside tcp 198.51.100.1 12345 192.168.1.10 443 detail

! Semua ACL dengan hit count
show access-list

! ACL spesifik
show access-list OUTSIDE_IN

! Output:
access-list OUTSIDE_IN; 3 elements; name hash: 0x12345678
access-list OUTSIDE_IN line 1 extended permit tcp any host 203.0.113.10 eq 443 (hitcnt=45231)
access-list OUTSIDE_IN line 2 extended permit tcp any host 203.0.113.10 eq 80  (hitcnt=12453)
access-list OUTSIDE_IN line 3 extended deny ip any any log              (hitcnt=892)

! hitcnt=0 di rule penting = rule tidak pernah match (urutan salah / misconfiguration)
! hitcnt tinggi di deny = ada scan/attack atau whitelist kurang

! Cek ACL yang applied di interface mana
show running-config access-group

! Reset hit count
clear access-list OUTSIDE_IN counters

! Buat capture di interface inside, filter ke host tertentu
capture CAP interface inside match ip host 192.168.1.10 any

! Lihat hasil capture (ringkasan)
show capture CAP

! Lihat detail setiap packet
show capture CAP detail

! Output contoh:
1: 10:23:45.123456 192.168.1.10:52341 > 8.8.8.8:443 S seq 1234567
2: 10:23:45.234567 8.8.8.8:443 > 192.168.1.10:52341 S seq 9876543 ack 1234568

! Export capture ke TFTP server
copy capture:CAP tftp://192.168.99.10/capture.pcap

! Hapus capture setelah selesai
no capture CAP

! Status IKEv1/IKEv2 SA (Phase 1)
show crypto ikev1 sa
show crypto ikev2 sa

! Status IPsec SA (Phase 2)
show crypto ipsec sa

! AnyConnect (Remote Access VPN) — active session
show vpn-sessiondb anyconnect

! Output AnyConnect:
Session Type: AnyConnect
Username     : user01          Index        : 1
Assigned IP  : 10.100.1.2      Public IP    : 203.0.113.50
Protocol     : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel
Duration     : 0h:45m:12s      Bytes Tx     : 12453321

! Jumlah VPN session aktif
show vpn-sessiondb summary

! Logout user VPN tertentu
vpn-sessiondb logoff name user01

! Ringkasan semua interface
show interface status

! Output:
Port          Name       Status     Vlan  Duplex  Speed   Type
Eth1/1        UPLINK     connected  trunk full    10G     10Gbase-SR
Eth1/2        SERVER-01  connected  20    full    1000    1000base-T
Eth1/3        --         notconnect 1     auto    auto    10Gbase-SR

! Error counter
show interface counters errors

! Cek transceiver / SFP info (penting untuk 10G/25G/40G)
show interface Ethernet1/1 transceiver

! Output transceiver:
Ethernet1/1
    transceiver is present
    type is 10Gbase-SR
    Rx Power: -3.21 dBm (normal range: -11.0 to 0.0 dBm)
    Tx Power: -2.45 dBm (normal range: -8.2 to 0.5 dBm)

! Rx Power mendekati -11 dBm = sinyal lemah, cek kabel fiber

! Status VPC domain
show vpc

! Output penting:
vPC domain id                     : 1
Peer status                       : peer adjacency formed ok
vPC keep-alive status             : peer is alive
Configuration consistency status  : success
vPC role                          : primary

vPC Peer-link status
id  Port  Status  Active vlans
1   Po1   up      1,10,20,99

! "peer adjacency formed ok" + "peer is alive" = VPC sehat
! "consistency status: failed" = config tidak match antar peer

! Cek apa yang tidak match
show vpc consistency-parameters global

! Status semua VPC member port
show vpc brief

! Cek orphan port (port yang hanya ada di satu Nexus)
show vpc orphan-ports

! Status NVE interface dan VTEP peer
show nve peers

! Output:
Interface  Peer-IP     State  LearnType  Uptime   Router-Mac
nve1       10.0.0.2    Up     CP         1d02h    aabb.cc00.0200
nve1       10.0.0.3    Up     CP         0d12h    aabb.cc00.0300

! CP = Control Plane learning (via BGP EVPN) — recommended
! DP = Data Plane learning (flood and learn) — legacy

! VNI mapping
show nve vni

! EVPN BGP summary
show bgp l2vpn evpn summary

! EVPN route type 2 (MAC/IP advertisement)
show bgp l2vpn evpn | include "Route Distinguisher"

! Cek MAC learning via EVPN
show l2route evpn mac all

! Hardware inventory
show module
show inventory

! Fabric health (Nexus 9000 ACI mode)
show system health

! Cek FEX (Fabric Extender) status
show fex
show fex 101 detail

! Port channel di NX-OS
show port-channel summary

! HSRP / VRRP status
show hsrp brief
show vrrp brief

! Cek NX-OS version dan hardware
show version

! Checkpoint dan rollback config
checkpoint BEFORE-MAINTENANCE
rollback running-config checkpoint BEFORE-MAINTENANCE

! Step 1: Apakah route ada di table?
show ip route 10.10.10.0

! Step 2: Trace path paket dengan source spesifik
traceroute 10.10.10.1 source GigabitEthernet0/0/1

! Step 3: Cek CEF entry
show ip cef 10.10.10.0/24 detail

! Step 4: Kalau OSPF, apakah LSA ada di database?
show ip ospf database | include 10.10.10

! Step 5: Kalau BGP, cek prefix dari neighbor
show bgp ipv4 unicast 10.10.10.0/24

! Step 6: Apakah route di-filter prefix-list/route-map?
show ip bgp neighbors 203.0.113.2 received-routes | include 10.10.10

! Step 7: Cek policy routing yang mungkin redirect traffic
show route-map
show ip policy

! Cek CPU usage per process
show processes cpu sorted

! Output:
CPU utilization: 89%/12% (5sec); 78% (1min); 65% (5min)
 PID  5Sec  1Min  5Min  Process
  88   45%   38%   32%  IP Input
  45    8%    6%    5%  BGP Router
  12    3%    2%    2%  OSPF Hello

! "IP Input" tinggi = process switching (bukan CEF):
!   - ACL/NAT kompleks yang force software switching
!   - Paket TTL expired flooding ke CPU (routing loop)
!   - Broadcast/multicast storm
!   - Fragmentation besar

! Cek broadcast rate per interface
show interface | include broadcast|input rate

! Cek apakah ada routing loop (TTL expired)
show ip traffic | include unroutable

! CoPP drop (traffic yang di-police ke CPU)
show policy-map control-plane

! Cek broadcast rate per interface
show interface | include broadcast

! Cek interface dengan input rate tertinggi (kemungkinan sumber)
show interface | include "input rate|line protocol"

! Cek STP topology change (storm sering dari TC)
show spanning-tree detail | include "topology change|from"

! Identifikasi port yang kirim broadcast paling banyak
show interface counters | include broadcast

! Tindakan darurat: storm control di port yang dicurigai
interface GigabitEthernet0/5
 storm-control broadcast level 20.00
 storm-control action shutdown

! Kalau sudah pasti sumbernya, shutdown port tersebut
interface GigabitEthernet0/5
 shutdown