Modern enterprise IT infrastructure is rarely homogeneous. Systems engineers and security auditors continuously shift between Cisco IOS switchboards, Linux server terminals, and Windows (PowerShell) domain controllers. Modern compliance directives (NIS2, DORA, ISO/IEC 27001, and CIS Benchmarks) mandate stringent baseline hardening across all three layers.
This master reference bridges regulatory requirements with executable terminal commands, featuring an interactive instant search engine and one-click clipboard copying.
1. Executive Compliance Checklist (NIS2 / DORA / CIS)
🛡️ Infrastructure Audit Checklist:
- Unused Port Control (NIS2 Art. 21 / CIS Control 4): All inactive physical switch interfaces and open server listening sockets must be administrative-down or firewall-restricted.
- Session Inactivity Timeout (ISO 27001 A.8.20): Mandatory automatic logout for idle administrative sessions across SSH, VTY, and console ports.
- Access Layer Security (Zero-Trust L2): Enforce switchport port-security (Sticky MAC, MAC limits, violation shutdown) to prevent CAM table exhaustion and rogue rogue rogue switches.
- Time Synchronization (NTP / DORA): Certified central NTP synchronization across all appliances to guarantee forensic log correlation in SIEM.
🌐
Need the physical Rosetta Network Card on your desk?
Download the print-ready A4 Rosetta Cheat Sheet: 28 network tasks mapped 1:1 across Cisco IOS, Linux iproute2, and Windows PowerShell.
| Administrative Task | 🌐 Cisco IOS | 🐧 Linux CLI | 🪟 Windows PowerShell | 📶 MikroTik RouterOS | 🛡️ Fortinet FortiOS |
|---|---|---|---|---|---|
| Routing Table View routes & default gateway |
show ip route |
ip route show |
Get-NetRoute |
/ip route print |
get router info routing-table all |
| Listening Ports Audit active listening services |
show control-plane host open-ports |
ss -tulpn |
Get-NetTCPConnection -State Listen |
/ip service print |
diagnose sys top |
| TCP Port Test Verify firewall reachability |
telnet 10.0.0.1 443 |
nc -zv 10.0.0.1 443 |
Test-NetConnection 10.0.0.1 -Port 443 |
/tool fetch url="https://10.0.0.1" keep-result=no |
diagnose sniffer packet any "host 10.0.0.1 and port 443" 4 10 |
| ARP / Neighbor Table Inspect IP-to-MAC resolutions |
show ip arp |
ip neigh show |
Get-NetNeighbor |
/ip arp print |
get system arp |
| Interface Statistics Packet counters & CRC errors |
show interfaces status |
ip -s link |
Get-NetAdapterStatistics |
/interface print stats |
diagnose hardware deviceinfo nic port1 |
| Interface Reset Cycle network link state |
shutdown |
ip link set eth0 down && up |
Restart-NetAdapter -Name "Ethernet" |
/interface disable ether1 |
config system interface |
| Firewall Allow Rule (Port 443) Permit inbound HTTPS traffic |
permit tcp any any eq 443 |
ufw allow 443/tcp |
New-NetFirewallRule -Name "HTTPS" -Port 443 -Protocol TCP -Action Allow |
/ip firewall filter add chain=input protocol=tcp dst-port=443 action=accept |
config firewall policy |
| Flush DNS Cache Clear cached resolver records |
clear hosts cache |
resolvectl flush-caches |
Clear-DnsClientCache |
/ip dns cache flush |
diagnose test application dnsproxy 1 |
| IP Address Overview Inspect all active adapters |
show ip interface brief |
ip -br addr show |
Get-NetIPAddress -AddressFamily IPv4 |
/ip address print |
get system interface physical |
3. Cisco IOS Module — Production Hardening
VLAN & 802.1Q Trunking Configuration
Define production VLANs and configure high-throughput 802.1Q trunking uplinks with explicit VLAN filtering.
vlan 10
name SERVERS_PROD
exit
interface GigabitEthernet0/1
description UPLINK-TO-CORE
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10,20,30
no shutdown
Port-Security & Sticky MAC (L2 Hardening)
Enforce Zero-Trust switchport security. Restrict port to learned MAC addresses and automatically disable on violation.
interface GigabitEthernet0/2
switchport mode access
switchport port-security
switchport port-security maximum 2
switchport port-security mac-address sticky
switchport port-security violation shutdown
Dynamic OSPF v2 Routing
Initialize the OSPF routing process, advertise local subnets, and configure passive management interfaces.
router ospf 1
router-id 1.1.1.1
network 192.168.1.0 0.0.0.255 area 0
passive-interface GigabitEthernet0/0
Rapid Operational Verification
Core diagnostic commands for network incident triage.
show ip interface brief ! Status and assigned IP addresses
show cdp neighbors detail ! Inspect adjacent Cisco infrastructure
show mac address-table dynamic ! Learned MAC entries
show running-config | section ospf ! Filter active OSPF configuration
4. Linux (CLI) Module — Systems & Network Operations
Modern Network Management (iproute2)
Assign static CIDR address, bring up interface, and set the default gateway without restarting network services.
sudo ip addr add 192.168.10.50/24 dev eth0
sudo ip link set dev eth0 up
sudo ip route add default via 192.168.10.1 dev eth0
Socket & Port Inspection (`ss` / `lsof`)
Audit listening TCP/UDP services and identify process ownership with PID mappings.
sudo ss -tulpn # Audit listening processes (PID & binary name)
sudo lsof -i :80 # Identify which daemon binds port 80
sudo resolvectl status # Verify active upstream DNS resolvers
UFW Firewall Hardening (NIS2 Baseline)
Enforce default-deny inbound posture and allow strictly authorized administrative subnets.
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp
sudo ufw allow 443/tcp
sudo ufw enable && sudo ufw status verbose
Service & Log Telemetry (systemd / journalctl)
Inspect real-time service logs, filter by syslog severity, and identify crashed daemon units.
sudo journalctl -u nginx.service -f --no-tail
sudo journalctl -p err..emerg -b 0 # Show only critical/error entries
sudo systemctl list-units --type=service --state=failed
5. Windows PowerShell Module — NetOps & Security
Network Adapter Telemetry & IP Assignment
Modern cmdlet replacements for legacy ipconfig, route, and netsh utilities.
Get-NetIPConfiguration | Format-Table InterfaceAlias, IPv4Address, IPv4DefaultGateway
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.10.10.5 -PrefixLength 24 -DefaultGateway 10.10.10.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses ("1.1.1.1","8.8.8.8")
Comprehensive Socket Diagnostic (`Test-NetConnection`)
Unified ping, DNS resolution, routing hops, and TCP handshake test.
Test-NetConnection -ComputerName dc01.corp.local -Port 389 -InformationLevel Detailed
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess
Windows Defender Firewall Rule Management
Create granular inbound allow/block rules restricted to secure management subnets.
New-NetFirewallRule -DisplayName "SSH-Admin-Access" -Direction Inbound -LocalPort 22 -Protocol TCP -Action Allow -RemoteAddress 192.168.1.0/24
Get-NetFirewallRule -Enabled True | Where-Object Direction -eq "Inbound"
6. MikroTik RouterOS v7 Module — Edge & Firewall Triage
Safe Mode, Configuration Backup & L2 RoMON Access
Activate automatic rollback before risky edits, export clean non-default configuration, and enable emergency L2 RoMON management.
# Press Ctrl + X to toggle Safe Mode (console indicates <SAFE>)
/export file=rescue_cfg compact hide-sensitive
/romon set enabled=yes secrets="RescuePass2026"
/system backup save name=before_change_backup
Connection Tracking Triage & Hardware FastTrack
Inspect exhausted conntrack tables under DDoS, flush stale TCP states, and accelerate routing using FastTrack bypass.
/ip firewall connection print count-only
/ip firewall connection remove [find timeout>60s]
/ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related order=1
/ip firewall raw add chain=prerouting src-address-list=blackhole action=drop
Real-Time Traffic Inspection (`/tool torch`)
Live per-IP, per-port bandwidth analyzer directly in the CLI console to isolate saturation or rogue streaming endpoints.
/tool torch interface=ether1 src-address=0.0.0.0/0 port=any
/tool profile cpu=all
7. Fortinet FortiOS CLI Module — NGFW & Diagnostic Flow
Conserve Mode Triage & Process Monitoring
Triage firewall memory exhaustion (Conserve Mode > 88%), restart WAD/IPS proxy workers, and review kernel crash dumps.
diagnose sys top 2 20
fnsysctl killall wad
diagnose debug crashlog read
diagnose hardware sysinfo memory
Real-Time Packet Flow & Sniffer Engine
Hardware-grade packet trace to diagnose dropped SYN packets, routing evaluation, and NAT policy mismatches on the wire.
diagnose debug reset
diagnose debug flow filter saddr 192.168.1.50
diagnose debug flow filter dport 443
diagnose debug flow show function-name enable
diagnose debug flow trace start 10
diagnose debug enable
IPsec Site-to-Site VPN Tunnel Triage
Inspect Phase 1 (IKE SA) and Phase 2 (IPsec SA) states, clear negotiation errors, and trigger tunnel re-keying.
diagnose vpn ike gateway list name "B2B_IPSEC"
diagnose vpn tunnel list
diagnose vpn ike gateway clear name "B2B_IPSEC"