Probleem
In verband met een defecte 876 heb ik deze vervangen voor een nieuwe. Een backup van de config heb ik gerestored en vervolgens aangesloten op het netwerk. Alles werkt als voorheen, behalve dat alle clients in het VLan2 niet het internet kunnen benaderen en zelfs de def. gateway niet.
Zelf geprobeerd
*1 Kabeltje in de FE02 en geprobeerd te pingen van 192.168.10.1 naar 192.168.10.254 (geen resultaat)
Router gereboot
*1
*2 Config opnieuw gerestored->save running startup->reload
*1
Handmatig de Vlan in de Cli ingesteld
*2
*1
Maar hoe ziet je config er dan uit?
In verband met een defecte 876 heb ik deze vervangen voor een nieuwe. Een backup van de config heb ik gerestored en vervolgens aangesloten op het netwerk. Alles werkt als voorheen, behalve dat alle clients in het VLan2 niet het internet kunnen benaderen en zelfs de def. gateway niet.
Zelf geprobeerd
*1 Kabeltje in de FE02 en geprobeerd te pingen van 192.168.10.1 naar 192.168.10.254 (geen resultaat)
Router gereboot
*1
*2 Config opnieuw gerestored->save running startup->reload
*1
Handmatig de Vlan in de Cli ingesteld
*2
*1
Maar hoe ziet je config er dan uit?
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
| version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname company-rt01
!
boot-start-marker
boot-end-marker
!
logging buffered 51200
enable secret 5 xxxxxxxp
enable password 7 xxxxxxx
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authentication login sdm_vpn_xauth_ml_2 local
aaa authentication ppp default local
aaa authorization exec default local
aaa authorization network sdm_vpn_group_ml_1 local
aaa authorization network sdm_vpn_group_ml_2 local
!
!
aaa session-id common
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
!
crypto pki trustpoint TP-self-signed-3755824864
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3755824864
revocation-check none
rsakeypair TP-self-signed-3755824864
!
!
crypto pki certificate chain TP-self-signed-3755824864
certificate self-signed 01
3082024A 308201B3 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33373535 38323438 3634301E 170D3032 30333031 30303235
34335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 37353538
32343836 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100D4F8 66B3BA3A FF028288 4A422024 054A694D 0E2CD4DF 6545A2AB 1BE4F937
DB861C20 E46FD220 5B8A62C8 5DB223A2 DFD726DC 5A5F9805 87B76A1D 68B1EDF5
BC66BE89 F3EC84FE 09238FC9 DCCFE6B7 BC951B6F 54675EC8 47497E57 183A114A
4DC8B137 DD637BE6 3A419F9E EB1083E6 A3160CE8 0B3B10AF 05362645 CA3433AC
F5CB0203 010001A3 72307030 0F060355 1D130101 FF040530 030101FF 301D0603
551D1104 16301482 12746962 2D727430 312E7469 622E6C6F 63616C30 1F060355
1D230418 30168014 04015D04 5DAA85F7 A0A5632D DAE0FD25 C5EFE941 301D0603
551D0E04 16041404 015D045D AA85F7A0 A5632DDA E0FD25C5 EFE94130 0D06092A
864886F7 0D010104 05000381 8100A1EB 53204B6B BFF12DA7 C5443F4F 9D7D605C
6D36D644 C1F9F2F3 804E37D0 DA10DA19 4AA6F5B7 8B35F8D1 8BBE18A2 C1144501
BB76C74C 492A98DF 798F8B22 F8D09317 B609A05F 425E4B21 6E4D6411 687F945E
085F5F7B 12DBCA3F EBFB53D5 EA453B84 EB7DBEC9 41FB0678 03FE2240 7DD2EEC6
A2D1D6BF 416CF7F9 1E97224A 4A19
quit
dot11 syslog
no ip source-route
ip cef
!
!
ip inspect log drop-pkt
ip inspect name SDM_HIGH appfw SDM_HIGH
ip inspect name SDM_HIGH icmp
ip inspect name SDM_HIGH dns
ip inspect name SDM_HIGH esmtp
ip inspect name SDM_HIGH imap reset
ip inspect name SDM_HIGH pop3 reset
ip inspect name SDM_HIGH tcp
ip inspect name SDM_HIGH udp
ip inspect name SDM_HIGH pptp
ip inspect name SDM_HIGH l2tp
ip inspect name SDM_HIGH ftp
ip inspect name SDM_HIGH ftps
ip inspect name SDM_HIGH ntp
ip inspect name SDM_HIGH https
ip inspect name dmzinspect tcp
ip inspect name dmzinspect udp
ip inspect name dmzinspect ftp
ip inspect name sdm_ins_in_100 appfw SDM_HIGH
ip inspect name sdm_ins_in_100 icmp
ip inspect name sdm_ins_in_100 dns
ip inspect name sdm_ins_in_100 esmtp
ip inspect name sdm_ins_in_100 imap reset
ip inspect name sdm_ins_in_100 pop3 reset
ip inspect name sdm_ins_in_100 tcp
ip inspect name sdm_ins_in_100 udp
ip inspect name sdm_ins_in_100 pptp
ip inspect name sdm_ins_in_100 l2tp
ip inspect name sdm_ins_in_100 ftp
ip inspect name sdm_ins_in_100 ftps
no ip bootp server
ip domain name company.local
ip name-server 194.109.6.66
ip name-server 194.109.9.99
!
appfw policy-name SDM_HIGH
application im aol
service default action reset alarm
service text-chat action reset alarm
server deny name login.oscar.aol.com
server deny name toc.oscar.aol.com
server deny name oam-d09a.blue.aol.com
audit-trail on
application im msn
service default action reset alarm
service text-chat action reset alarm
server deny name messenger.hotmail.com
server deny name gateway.messenger.hotmail.com
server deny name webmessenger.msn.com
audit-trail on
application http
port-misuse im action reset alarm
port-misuse p2p action reset alarm
application im yahoo
service default action reset alarm
service text-chat action reset alarm
server deny name scs.msg.yahoo.com
server deny name scsa.msg.yahoo.com
server deny name scsb.msg.yahoo.com
server deny name scsc.msg.yahoo.com
server deny name scsd.msg.yahoo.com
server deny name cs16.msg.dcn.yahoo.com
server deny name cs19.msg.dcn.yahoo.com
server deny name cs42.msg.dcn.yahoo.com
server deny name cs53.msg.dcn.yahoo.com
server deny name cs54.msg.dcn.yahoo.com
server deny name ads1.vip.scd.yahoo.com
server deny name radio1.launch.vip.dal.yahoo.com
server deny name in1.msg.vip.re2.yahoo.com
server deny name data1.my.vip.sc5.yahoo.com
server deny name address1.pim.vip.mud.yahoo.com
server deny name edit.messenger.yahoo.com
server deny name messenger.yahoo.com
server deny name http.pager.yahoo.com
server deny name privacy.yahoo.com
server deny name csa.yahoo.com
server deny name csb.yahoo.com
server deny name csc.yahoo.com
audit-trail on
!
!
!
username admin privilege 15 secret 5 $1$k9UD$n2vUKyDT8hiaw5y7vV3FM0
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
!
crypto isakmp client configuration group VPNcompany
key companyremote
dns 192.168.1.5
wins 192.168.1.5
domain company.local
pool SDM_POOL_2
max-users 2
netmask 255.255.255.0
crypto isakmp profile sdm-ike-profile-1
match identity group VPNcompany
client authentication list sdm_vpn_xauth_ml_2
isakmp authorization list sdm_vpn_group_ml_2
client configuration address respond
virtual-template 2
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
!
crypto ipsec profile SDM_Profile1
set transform-set ESP-3DES-SHA1
set isakmp-profile sdm-ike-profile-1
!
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
!
class-map match-any sdm_p2p_kazaa
class-map match-any sdm_p2p_edonkey
class-map match-any sdm_p2p_gnutella
class-map match-any sdm_p2p_bittorrent
!
!
policy-map sdmappfwp2p_SDM_HIGH
class sdm_p2p_edonkey
drop
class sdm_p2p_gnutella
drop
class sdm_p2p_kazaa
drop
class sdm_p2p_bittorrent
drop
!
!
!
!
interface Null0
no ip unreachables
!
interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
encapsulation hdlc
shutdown
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no atm ilmi-keepalive
pvc 8/48
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
dsl operating-mode auto
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
switchport access vlan 2
!
interface FastEthernet3
switchport access vlan 2
!
interface Virtual-Template2 type tunnel
ip unnumbered Vlan1
tunnel mode ipsec ipv4
tunnel protection ipsec profile SDM_Profile1
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
ip address 192.168.1.254 255.255.255.0
ip access-group 104 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect SDM_HIGH in
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
interface Vlan2
description $FW_DMZ$
ip address 192.168.10.254 255.255.255.0
ip access-group 100 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect sdm_ins_in_100 in
ip inspect dmzinspect out
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
interface Vlan3
no ip address
!
interface Dialer0
description $FW_OUTSIDE$
ip address negotiated
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication pap callin
ppp pap sent-username xxxx@xx.xx password 7 xxxxxxxxxxxx
service-policy input sdmappfwp2p_SDM_HIGH
service-policy output sdmappfwp2p_SDM_HIGH
!
ip local pool DIAL-IN 192.168.1.230 192.168.1.239
ip local pool SDM_POOL_1 192.168.100.10 192.168.100.15
ip local pool SDM_POOL_2 172.16.1.10 172.16.1.15
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0 permanent
!
no ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static tcp 192.168.1.5 25 interface Dialer0 25
ip nat inside source static tcp 192.168.1.5 443 interface Dialer0 443
ip nat inside source static tcp 192.168.10.1 21 interface Dialer0 21
ip nat inside source static tcp 192.168.10.1 80 interface Dialer0 80
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1,2
access-list 1 remark SDM_ACL Category=2
access-list 1 remark VLAN1
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 remark VLAN2
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 23 remark Management Access
access-list 23 remark SDM_ACL Category=17
access-list 23 permit 192.168.1.0 0.0.0.255
access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny ip any 192.168.1.0 0.0.0.255 log
access-list 100 remark Auto generated by SDM for NTP (123) 194.109.22.18
access-list 100 permit udp host 194.109.22.18 eq ntp host 192.168.10.254 eq ntp
access-list 100 permit ip 192.168.10.0 0.0.0.255 any
access-list 100 deny ip any any log
access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.10.1 range ftp-data ftp
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 remark Auto generated by SDM for NTP (123) 194.109.22.18
access-list 101 permit udp host 194.109.22.18 eq ntp any eq ntp
access-list 101 permit udp any any eq non500-isakmp
access-list 101 permit udp any any eq isakmp
access-list 101 permit esp any any
access-list 101 permit ahp any any
access-list 101 permit tcp any any eq smtp
access-list 101 permit tcp any any eq 443
access-list 101 permit tcp any any eq ftp
access-list 101 permit tcp any any eq www
access-list 101 permit udp host 194.109.9.99 eq domain any
access-list 101 permit udp host 194.109.6.66 eq domain any
access-list 101 deny ip 192.168.10.0 0.0.0.255 any
access-list 101 deny ip 192.168.1.0 0.0.0.255 any
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip any any log
access-list 104 remark auto generated by SDM firewall configuration
access-list 104 remark SDM_ACL Category=1
access-list 104 permit udp any host 192.168.1.254 eq non500-isakmp
access-list 104 permit udp any host 192.168.1.254 eq isakmp
access-list 104 permit esp any host 192.168.1.254
access-list 104 permit ahp any host 192.168.1.254
access-list 104 permit tcp any host 192.168.10.1 range ftp-data ftp
access-list 104 deny ip any 192.168.10.0 0.0.0.255 log
access-list 104 deny ip host 255.255.255.255 any
access-list 104 deny ip 127.0.0.0 0.255.255.255 any
access-list 104 permit ip any any
dialer-list 1 protocol ip permit
no cdp run
!
!
!
control-plane
!
banner login ^CC==================================
Our company
company-RT01
==================================^C
!
line con 0
no modem enable
transport output telnet
line aux 0
transport output telnet
line vty 0 4
access-class 23 in
password 7 xxxxxxx
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
ntp clock-period 17175159
ntp server 194.109.22.18 source Dialer0
ntp server 194.109.22.18 source Vlan1 prefer
!
webvpn context Default_context
ssl authenticate verify all
!
no inservice
!
end |
[ Voor 0% gewijzigd door Cai op 23-09-2009 14:57 . Reden: Typo. Edit2: Wachtwoorden weggehaald ]
:strip_exif()/u/42858/matrix-icon.gif?f=community){kind=icon}
