Building configuration...

Current configuration : 54704 bytes
!
! Last configuration change at 14:54:37 SAMT Wed Jul 27 2022 by adm_kapustinal
! NVRAM config last updated at 14:54:38 SAMT Wed Jul 27 2022 by adm_kapustinal
!
version 15.4
service timestamps debug datetime msec localtime show-timezone year
service timestamps log datetime msec localtime show-timezone year
no service password-encryption
!
hostname IZH-MLK-IZM-RT-1-1
!
boot-start-marker
boot-end-marker
!
!
logging userinfo
logging buffered 65536
enable secret 5 $1$QW0D$QYciH.O0GY9GW37Ao2khP1
!
aaa new-model
!
!
aaa group server radius NPS
 server name IZH-RDS002
 server name P11-RDS003
 ip radius source-interface GigabitEthernet0/2.300
 load-balance method least-outstanding
!
aaa authentication login default group NPS local enable
aaa authentication login CONSOLE local group NPS
aaa authentication ppp default local
aaa authorization exec default group NPS local if-authenticated 
!
!
!
!
!
aaa session-id common
clock timezone SAMT 4 0
clock calendar-valid
!
!
crypto pki trustpoint TP-self-signed-1393620094
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1393620094
 revocation-check none
 rsakeypair TP-self-signed-1393620094
!
crypto pki trustpoint GEOTRUST
 enrollment terminal pem
 revocation-check none
!
!
crypto pki certificate chain TP-self-signed-1393620094
 certificate self-signed 01
  3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 
  69666963 6174652D 31333933 36323030 3934301E 170D3135 30313032 31353436 
  32375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 33393336 
  32303039 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 
  8100AB01 0C306678 D800981E A071B8E5 BAD877CA 3EA05B1D 3F4D4BB3 98888C61 
  2774C683 F564E100 B0284F17 E64BECF7 5C37A0C2 5F450AB9 FCE76F3C 355C6213 
  A0996517 727712D9 0E82CA09 C735E83E 5641ABFC 4B3FC0C8 B341D015 6E1A5F60 
  027E782D 869D7E46 28BE78C7 5F7BA97E 2A5EE9B9 5C28693A 1255E6DA 9D121C1A 
  1BA50203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 
  551D2304 18301680 14020A66 0B88B3F2 6E048A80 48C0B762 D022D70E 0F301D06 
  03551D0E 04160414 020A660B 88B3F26E 048A8048 C0B762D0 22D70E0F 300D0609 
  2A864886 F70D0101 05050003 8181005F B1CB7D90 2E300573 445DEB7E 1117F5DE 
  F9F7A286 4608E79D F50A82D0 92AD66D7 EF24960C 51939A98 FE64E073 579C740A 
  C9568D58 1DF5078A 36102592 F5018434 81B3748F 9DAA57BF E88DDC28 6E5D0424 
  E3904AEC 8D5E870C B3144718 9C7DAEAF 001FE25C 939BF48D 2A7FCF94 85DDFA6E 
  7630727D 39311D17 18DB7601 70FF74
  	quit
crypto pki certificate chain GEOTRUST
 certificate ca 023A6F
  3082044F 30820337 A0030201 02020302 3A6F300D 06092A86 4886F70D 01010B05 
  00304231 0B300906 03550406 13025553 31163014 06035504 0A130D47 656F5472 
  75737420 496E632E 311B3019 06035504 03131247 656F5472 75737420 476C6F62 
  616C2043 41301E17 0D313331 31303532 31333635 305A170D 32323035 32303231 
  33363530 5A304431 0B300906 03550406 13025553 31163014 06035504 0A130D47 
  656F5472 75737420 496E632E 311D301B 06035504 03131447 656F5472 75737420 
  53534C20 4341202D 20473330 82012230 0D06092A 864886F7 0D010101 05000382 
  010F0030 82010A02 82010100 E3BE7E0A 86A3CF6B 6D3D2BA1 97AD4924 4DD777B9 
  347908A5 9EA29EDE 4712923D 7EEA1986 B1E84F3D 5FF7D0A7 779A5B1F 0A03B519 
  53DBA521 9469639D 6A4C910C 1047BE11 FA6C8625 B7AB0468 42380965 F014DA19 
  9EFA6B0B AB62EF8D A7EF6370 23A8AF81 F3D16E88 6753EC12 A429758A A7F2573D 
  A2839897 F20A7DD4 E7436E30 78622259 59B87127 45AA0F66 C6553FFA 32172B31 
  8F46A0FA 69147C9D 9F5AE2EB 334E10A6 B3ED7763 D8C39EF4 DDDF799A 7AD4EEDE 
  DD9ACCC3 B7A95DCC 113A07BB 6F97A401 2347951F A377FA58 92C6C7D0 BDCF9318 
  42B77EF7 9E65EAD5 3BCAEDAC C570A1FE D4109AF0 120444AC 1A5B7850 45574C6F 
  BD80CB81 5C2DB3BC 76A11E65 02030100 01A38201 4A308201 46301F06 03551D23 
  04183016 8014C07A 98688D89 FBAB0564 0C117DAA 7D65B8CA CC4E301D 0603551D 
  0E041604 14D26FF7 96F4853F 723C307D 23DA8578 9BA37C5A 7C301206 03551D13 
  0101FF04 08300601 01FF0201 00300E06 03551D0F 0101FF04 04030201 06303606 
  03551D1F 042F302D 302BA029 A0278625 68747470 3A2F2F67 312E7379 6D63622E 
  636F6D2F 63726C73 2F677467 6C6F6261 6C2E6372 6C302F06 082B0601 05050701 
  01042330 21301F06 082B0601 05050730 01861368 7474703A 2F2F6732 2E73796D 
  63622E63 6F6D304C 0603551D 20044530 43304106 0A608648 0186F845 01073630 
  33303106 082B0601 05050702 01162568 7474703A 2F2F7777 772E6765 6F747275 
  73742E63 6F6D2F72 65736F75 72636573 2F637073 30290603 551D1104 223020A4 
  1E301C31 1A301806 03550403 13115379 6D616E74 6563504B 492D312D 35333930 
  0D06092A 864886F7 0D01010B 05000382 010100A0 D4F72CFB 740B7F64 F1CD436A 
  9F62531C 027C9890 A2EE4F68 D4201A73 123E77B3 50EB72BC EE88BE7F 17EA778F 
  8361954F 84A1CB32 4F6C21BE D269967D 63BDDC2B A81FD013 8470FEF6 359589F9 
  A677B046 C8BBB713 F5C96069 D64CFED2 8EEFD360 C18080E1 E7FB8B6F 21794AE0 
  DCA91BC1 B7FBC349 595CB577 0744D497 FC490089 6F064E01 7019AC2F 11C0E2E6 
  0F2F864B 8D7BC3B9 A72EF4F1 AC163E39 49519E17 4B4F103A 5BA5A892 6FFDFAD6 
  0B034D47 565719F3 CB6BF5F3 D6CFB0F5 F5A311D2 20531334 37052C43 5A63DF8D 
  40D6851E 51E95117 1E0356C9 F130ADE7 9B11A2B9 D031819B 68B1D9E8 F3E6947E 
  C7AE132F 87EDD025 B068F9DE 085AF329 CCD492
  	quit
!
!
!
!
!
!
!
!
!
!
!
!
!
ip flow-cache timeout inactive 60
ip flow-cache timeout active 5
no ip domain lookup
ip domain name milkom-komos.ru
ip host tftp 10.4.0.214
ip inspect tcp reassembly queue length 128
ip inspect tcp reassembly timeout 10
ip inspect name Internet tcp router-traffic
ip inspect name Internet udp
ip inspect name Internet icmp router-traffic
ip dhcp-server 10.10.1.254
ip cef
login on-failure log
login on-success log
no ipv6 cef
!
!
flow exporter NAT_FLOW
 destination 10.4.0.214
 transport udp 2055
!
!
flow monitor NAT_FLOW
 exporter NAT_FLOW
 record netflow-original
!
!
multilink bundle-name authenticated
!
vpdn enable
vpdn session-limit 5000
!
vpdn-group L2TP_PRIMARY
 ! Default L2TP VPDN group
 description Primary L2TP VPDN group
 accept-dialin
  protocol l2tp
  virtual-template 1
 no l2tp tunnel authentication
!
!
no virtual-template subinterface
cts logging verbose
license udi pid C3900-SPE100/K9 sn FOC18513F2G
license boot module c3900 technology-package securityk9
!
!
archive
 log config
  logging enable
  logging size 900
  notify syslog contenttype plaintext
  hidekeys
 path tftp://tftp/IZH/3925/$H-$T
 write-memory
 time-period 10080
object-group network GRE_SRC_IP 
 host 31.173.105.66
 host 85.140.32.30
 host 78.85.13.52
 host 46.146.210.68
 host 178.161.175.54
 host 83.69.126.54
 host 78.138.171.82
 host 78.85.13.165
 host 185.62.195.150
 host 185.6.175.101
 host 31.173.105.58
 host 85.140.32.28
 host 78.85.13.53
 host 85.140.32.29
 host 31.173.105.62
 host 37.113.128.241
 host 85.140.32.166
 host 31.173.105.46
 host 78.85.35.164
 host 178.47.128.18
 host 94.138.150.1
 host 178.47.128.98
 host 5.227.125.114
 host 82.142.146.70
!
object-group network HEADLINE_IP 
 host 87.249.247.80
!
object-group network LAINER_TELECOM 
 host 87.249.224.136
 host 87.249.231.218
 host 87.249.244.255
!
object-group network OBJ_BBN_RN_BBN 
 host 85.140.32.104
 host 78.85.13.205
!
object-group network OBJ_BBN_VST_BBN 
 host 85.140.32.103
 host 83.169.220.204
!
object-group network OBJ_IZH_MLK_IZM 
 host 85.140.32.27
 host 78.85.13.42
 host 5.227.126.169
 host 31.173.105.54
 host 217.14.195.253
 host 85.175.86.74
!
object-group network OBJ_IZH_KG_P11 
 91.240.179.0 255.255.255.0
 host 5.227.124.143
 host 78.85.13.93
 host 62.141.96.126
 host 84.201.247.190
 host 88.80.33.50
 host 94.25.46.122
!
object-group network OBJ_IZH_VST_IZM 
 host 5.227.124.82
 host 78.85.13.38
!
object-group network OBJ_IZH_TK_M44 
 host 212.46.204.74
 host 88.80.33.162
!
object-group network OBJ_IZH_TK_M48 
 host 87.249.237.250
!
object-group network OBJ_IZH_TK_SMR 
 host 87.249.239.226
 host 88.80.33.42
!
object-group network OBJ_MZH_TK_TKM 
 host 88.80.32.230
 host 78.85.35.34
!
object-group network OBJ_GLZ_TK_TKG 
 host 95.215.208.240
 host 146.120.104.235
 host 95.215.208.173
!
object-group network OBJ_IZH_TK_M21 
 host 84.201.242.133
!
object-group network OBJ_IZH_HLA_PP 
 host 92.61.17.250
!
object-group network OBJ_MSK_KG_MSK 
 host 185.62.195.150
 host 185.6.175.101
!
object-group network OBJ_GLZ_MLK_GMK 
 host 31.173.105.62
 host 85.140.32.29
!
object-group network OBJ_KZN_MLK_KMK 
 host 83.69.126.54
 host 94.180.253.210
 host 78.138.171.82
!
object-group network OBJ_KEZ_MLK_KZS 
 host 31.173.105.66
 host 78.85.13.52
 host 85.140.32.30
!
object-group network OBJ_PRM_MLK_PHK 
 host 178.47.128.18
 host 46.146.210.68
!
object-group network OBJ_SAR_MLK_SRM 
 host 31.173.105.58
 host 78.85.13.53
 host 85.140.32.28
!
object-group network OBJ_CLB_MLK_CMK 
 host 37.113.128.241
 host 149.255.6.35
!
object-group network OBJ_GLZ_GKZ_GKZ 
 host 78.85.13.94
 host 146.120.104.181
!
object-group network OBJ_YAN_GKZ_YEL 
 host 77.94.97.222
 host 213.87.197.29
!
object-group network OBJ_KIA_RN_KIA 
 host 78.85.14.97
!
object-group network OBJ_KGB_RN_KGB 
 host 78.85.13.165
!
object-group network OBJ_NCH_RN_NCH 
 host 78.85.13.166
!
object-group network OBJ_PRI_RN_PRI 
 host 78.85.13.167
!
object-group network OBJ_URN_RN_URN 
 host 78.85.20.49
!
object-group network OBJ_IZH_TZK_TZK 
 host 78.25.80.134
 host 5.227.124.235
!
object-group network OBJ_IZH_MK_VS17 
 host 5.227.124.141
!
object-group network OBJ_IZH_KL_KLI 
 host 78.85.15.85
 host 84.201.247.24
 host 79.175.36.97
 host 84.201.244.235
!
object-group network OBJ_EKB_KG_EKB 
 host 62.168.232.182
 host 176.215.14.11
!
object-group network OBJ_IZH_KEN_VS56 
 host 83.143.54.246
 host 92.55.54.109
!
object-group network OBJ_IZH_VRS_IZM 
 host 85.140.32.177
 host 78.85.14.98
!
object-group network OBJ_GLZ_VRS_UPF 
 host 95.215.208.234
 host 78.85.13.119
!
object-group network OBJ_IZH_VRS_IPF 
 host 85.140.32.141
 host 78.85.13.117
!
object-group network OBJ_IZH_VRS_PFV 
 host 85.140.32.178
 host 94.181.119.90
 host 78.85.33.50
!
object-group network OBJ_VOT_VRS_VPF 
 host 78.85.13.118
 host 88.80.33.14
!
object-group network OBJ_PRM_VRS_MPF 
 host 178.47.130.10
 host 5.227.121.127
!
object-group network OBJ_LAI_VRS_DPF 
 host 178.205.241.114
 host 46.232.164.108
!
object-group network OBJ_ITL_VST_ITL 
 host 5.227.124.130
 host 78.85.34.99
 host 81.211.13.82
!
object-group network OBJ_MZH_VST_MZH 
 host 88.80.33.250
 host 83.169.220.171
!
object-group network OBJ_KIA_VST_KIA 
 host 85.140.32.24
 host 188.94.168.238
!
object-group network OBJ_KGB_VST_KBB 
 host 78.85.37.88
 host 88.80.33.154
 host 78.85.13.165
!
object-group network OBJ_SAR_VST_SMK 
 host 78.85.19.93
 host 88.80.33.234
!
object-group network OBJ_KNK_VST_KMK 
 host 178.161.242.67
!
object-group network OBJ_SHM_TMA_SHM 
 host 89.232.91.106
 host 31.173.182.210
!
object-group network OBJ_MSB_TMA_MSB 
 host 78.138.182.214
!
object-group network OBJ_EVL_TMA_EVL 
 host 89.232.102.166
!
object-group network OBJ_KIB_TMA_KIB 
 host 78.138.182.126
!
object-group network OBJ_IZH_KM_S61 
 host 84.201.247.32
 host 88.80.33.194
!
object-group network OBJ_KUN_KMK_B2 
 94.138.150.0 255.255.255.0
 host 178.47.138.134
!
object-group network OBJ_KUN_KMK_H80 
 host 178.161.207.26
 host 77.43.193.88
!
object-group network OBJ_KUN_KMK_CH9 
 host 178.47.128.98
 host 195.69.159.2
!
object-group network OBJ_IZH_HLA_UHK 
 host 92.55.7.148
!
object-group network OBJ_IZH_VD_VS17 
 host 84.201.247.100
!
object-group network OBJ_IZH_KS_H17 
 85.140.32.64 255.255.255.252
 host 85.140.32.63
 host 85.140.32.68
!
object-group network OBJ_IZH_KLS_P20 
 host 5.227.125.114
!
object-group network OBJ_IZH_KI_VOR158 
 host 46.147.130.59
 host 5.227.125.126
!
object-group network OBJ_OTHER 
 host 78.85.21.21
 host 78.85.13.165
 host 78.85.13.167
 host 78.85.13.166
 host 78.85.13.205
 host 78.85.13.201
 host 78.85.13.107
 host 78.85.13.106
!
object-group network OBJ_SPB_KG_SPB 
 host 62.141.114.190
 host 94.72.27.43
!
object-group network OBJ_BRANCHES 
 group-object OBJ_IZH_MLK_IZM
 group-object OBJ_IZH_KG_P11
 group-object OBJ_IZH_VST_IZM
 group-object OBJ_IZH_TK_M44
 group-object OBJ_IZH_TK_M48
 group-object OBJ_IZH_TK_SMR
 group-object OBJ_MZH_TK_TKM
 group-object OBJ_GLZ_TK_TKG
 group-object OBJ_IZH_TK_M21
 group-object OBJ_IZH_HLA_PP
 group-object OBJ_MSK_KG_MSK
 group-object OBJ_GLZ_MLK_GMK
 group-object OBJ_KZN_MLK_KMK
 group-object OBJ_KEZ_MLK_KZS
 group-object OBJ_PRM_MLK_PHK
 group-object OBJ_SAR_MLK_SRM
 group-object OBJ_CLB_MLK_CMK
 group-object OBJ_GLZ_GKZ_GKZ
 group-object OBJ_YAN_GKZ_YEL
 group-object OBJ_KIA_RN_KIA
 group-object OBJ_BBN_RN_BBN
 group-object OBJ_KGB_RN_KGB
 group-object OBJ_NCH_RN_NCH
 group-object OBJ_PRI_RN_PRI
 group-object OBJ_URN_RN_URN
 group-object OBJ_IZH_TZK_TZK
 group-object OBJ_IZH_MK_VS17
 group-object OBJ_IZH_KL_KLI
 group-object OBJ_EKB_KG_EKB
 group-object OBJ_IZH_KEN_VS56
 group-object OBJ_IZH_VRS_IZM
 group-object OBJ_GLZ_VRS_UPF
 group-object OBJ_IZH_VRS_IPF
 group-object OBJ_IZH_VRS_PFV
 group-object OBJ_VOT_VRS_VPF
 group-object OBJ_PRM_VRS_MPF
 group-object OBJ_LAI_VRS_DPF
 group-object OBJ_ITL_VST_ITL
 group-object OBJ_MZH_VST_MZH
 group-object OBJ_KIA_VST_KIA
 group-object OBJ_KGB_VST_KBB
 group-object OBJ_SAR_VST_SMK
 group-object OBJ_KNK_VST_KMK
 group-object OBJ_BBN_VST_BBN
 group-object OBJ_SHM_TMA_SHM
 group-object OBJ_MSB_TMA_MSB
 group-object OBJ_EVL_TMA_EVL
 group-object OBJ_KIB_TMA_KIB
 group-object OBJ_IZH_KM_S61
 group-object OBJ_KUN_KMK_B2
 group-object OBJ_KUN_KMK_H80
 group-object OBJ_KUN_KMK_CH9
 group-object OBJ_IZH_HLA_UHK
 group-object OBJ_IZH_VD_VS17
 group-object OBJ_IZH_KS_H17
 group-object OBJ_IZH_KLS_P20
 group-object OBJ_IZH_KI_VOR158
 group-object OBJ_OTHER
 group-object OBJ_SPB_KG_SPB
!
object-group network OBJ_NET_BLACKLIST 
 host 167.160.182.20
!
object-group network OBJ_NET_CISCOASA 
 host 91.240.179.28
 host 91.240.179.29
 host 91.240.179.30
 host 91.240.179.62
 host 91.240.179.63
 host 91.240.179.64
!
object-group network OBJ_PART_SELECTEL 
 host 185.137.232.142
!
object-group network OBJ_PART_HTC 
 host 95.213.184.82
 host 185.137.232.142
 host 178.208.83.31
 host 37.46.131.147
 host 5.227.124.141
 host 195.19.101.162
 host 194.150.91.170
 group-object OBJ_PART_SELECTEL
!
object-group network OBJ_NET_FTP_USERS 
 host 87.249.244.215
 host 78.85.17.101
 host 78.85.37.100
 host 77.245.121.45
 host 89.148.228.140
 host 212.33.246.21
 host 84.201.247.66
 host 91.210.192.253
 host 78.85.24.16
 host 78.85.16.19
 host 78.85.17.47
 host 91.210.192.180
 host 194.79.33.154
 host 78.85.32.117
 host 212.48.53.102
 host 94.181.119.163
 host 146.120.104.227
 host 80.76.238.38
 host 77.41.138.22
 91.240.179.0 255.255.255.0
 host 213.87.94.94
 host 78.85.28.78
 host 86.109.199.218
 host 178.161.170.218
 host 94.181.119.90
 host 78.25.80.122
 host 92.55.34.57
 host 176.9.88.238
 host 78.85.99.241
 94.138.150.0 255.255.255.0
 host 194.150.90.20
 host 94.51.91.50
 group-object OBJ_PART_HTC
 host 95.213.184.82
 host 185.137.232.142
 host 178.208.83.31
 host 37.46.131.147
 host 5.227.124.141
 host 195.19.101.162
 host 194.150.91.170
 group-object OBJ_PART_SELECTEL
!
object-group network OBJ_PART_Goods4Cust 
 description Makarov N
 host 109.236.69.166
 host 195.209.60.66
!
object-group network OBJ_PART_HEADLINE 
 host 87.249.247.80
!
object-group network OBJ_PART_ROSA 
 description Naydenov
 host 217.114.154.92
!
object-group network OBJ_SRV_IRONPORT 
 host 91.240.179.26
 host 91.240.179.27
!
object-group network OBJ_SRV_SKYPE 
 host 91.240.179.37
 host 91.240.179.38
 host 91.240.179.39
!
object-group service OBJ_SVC_ANY_CONNECT 
 tcp eq 443
 udp eq 443
!
object-group service OBJ_SVC_FTP 
 tcp eq ftp
 tcp eq ftp-data
 tcp range 50000 65535
!
object-group network OBJ_SVC_KSMG 
 host 91.240.179.73
 host 91.240.179.74
!
object-group service OBJ_SVC_L2TP 
 udp eq isakmp
 udp eq non500-isakmp
 udp eq 1701
 tcp eq 1701
 esp
!
object-group service OBJ_SVC_SFB 
 tcp eq 443
 tcp eq 5061
 udp eq domain
 udp eq 3478
!
object-group service OBJ_SVC_VIPole 
 udp range 3000 9000
 tcp eq 37210
 tcp eq 37212
 tcp eq 443
!
object-group service SERVICE_L2TP 
 udp eq isakmp
 udp eq non500-isakmp
 udp eq 1701
 tcp eq 1701
 esp
!
object-group service SERVICE_PPTP 
 tcp eq 1723
 gre
!
object-group network STATIC_ISP_IP 
 host 217.14.195.253
 host 85.175.86.74
!
username netadmin privilege 15 secret 5 $1$CIDn$gX5vG9z8lk1YswXnLsl8c1
!
redundancy
!
!
!
bfd-template single-hop BFD-KOMOS
 interval min-tx 500 min-rx 500 multiplier 3
!
!
!
track 1 ip sla 1 reachability
 delay down 10 up 5
!
track 2 ip sla 2 reachability
 delay down 10 up 5
!
track 3 ip sla 3 reachability
 delay down 10 up 5
!
track 4 ip sla 4 reachability
 delay down 10 up 5
!
track 5 ip sla 5 reachability
 delay down 10 up 5
!
track 6 ip sla 6 reachability
 delay down 10 up 5
!
track 10 list boolean or
 object 1
 object 2
 object 3
 object 4
 object 5
 object 6
 delay down 5 up 30
!
track 11 ip sla 11 reachability
 delay down 10 up 5
!
track 12 ip sla 12 reachability
 delay down 10 up 5
!
track 13 ip sla 13 reachability
 delay down 10 up 5
!
track 14 ip sla 14 reachability
 delay down 10 up 5
!
track 15 ip sla 15 reachability
 delay down 10 up 5
!
track 16 ip sla 16 reachability
 delay down 10 up 5
!
track 20 list boolean or
 object 11
 object 12
 object 13
 object 14
 object 15
 object 16
 delay down 5 up 30
!
track 200 list boolean or
 object 202
 object 203
 delay down 5 up 30
!
track 202 ip sla 202 reachability
 delay down 10 up 5
!
track 203 ip sla 203 reachability
!
ip ssh authentication-retries 2
ip ssh version 2
!
class-map match-any CM_QOS_Q2
 match dscp cs2  af21  af22  af23 
 match access-group name ACL_QOS_Q2
class-map match-all CM_QOS_Q3
 match dscp cs3  af31  af32  af33 
class-map match-all CM_QOS_Q4
 match dscp cs4  af41  af42  af43 
class-map match-any CM_QOS_IPSEC-ESP
 match access-group name ACL_QOS_ESP
!
policy-map PM_TEST_ARR_ADAP
 class class-default
  shape average 5000000
policy-map PM_QOS_IN
 class CM_QOS_Q2
  set dscp cs2
policy-map PM_QOS_GLOBAL_OUT
 class CM_QOS_IPSEC-ESP
  police 80000000
 class CM_QOS_Q3
 class CM_QOS_Q4
 class CM_QOS_Q2
!
! 
!
crypto isakmp policy 20
 encr 3des
 authentication pre-share
 group 2
 lifetime 500
!
crypto isakmp policy 30
 encr aes 256
 authentication pre-share
 group 14
!
crypto isakmp policy 40
 encr aes 256
 authentication pre-share
 group 2
!
crypto isakmp policy 50
 encr aes
 authentication pre-share
 group 2
crypto isakmp key F5BfdOazun4M address 82.142.146.70  
crypto isakmp key fjhJSHpUcnqbpGfI address 0.0.0.0         no-xauth
crypto isakmp keepalive 20
!
crypto ipsec security-association replay disable
!
crypto ipsec transform-set L2TP_PRIMARY_TR esp-3des esp-sha-hmac 
 mode transport
crypto ipsec transform-set tr-3des esp-3des 
 mode tunnel
crypto ipsec transform-set ipsec-transform esp-3des esp-md5-hmac 
 mode transport require
crypto ipsec transform-set ipsec-transform-aes esp-aes esp-md5-hmac 
 mode transport require
crypto ipsec transform-set TS-BEECLOUD esp-aes 256 esp-sha-hmac 
 mode transport
crypto ipsec transform-set TS_GREIPSEC esp-aes 256 esp-sha-hmac 
 mode transport require
crypto ipsec df-bit clear
!
crypto ipsec profile GRE_IPSEC
 set transform-set TS_GREIPSEC 
 set pfs group2
!
crypto ipsec profile PF-BEECLOUD
 set transform-set TS-BEECLOUD 
 set pfs group14
!
!
crypto ipsec profile gre-gre-3des
 set transform-set ipsec-transform 
!
!
crypto dynamic-map L2TP_PRIMARY_DMAP 10
 set nat demux
 set transform-set L2TP_PRIMARY_TR 
!
!
crypto map L2TP_PRIMARY_MAP 10 ipsec-isakmp dynamic L2TP_PRIMARY_DMAP 
!
!
!
!
!
interface Loopback111
 description MGM
 ip address 10.111.12.1 255.255.255.255
 ip nat outside
 ip virtual-reassembly in
!
interface Tunnel31
 description KGR-KUMK-KUMK-RT-1-1
 ip address 172.30.31.5 255.255.255.252
 ip access-group ACL_FROM_KUMK in
 ip mtu 1400
 ip tcp adjust-mss 1360
 keepalive 10 3
 tunnel source GigabitEthernet0/1
 tunnel destination 94.138.150.1
 tunnel protection ipsec profile gre-gre-3des
!
interface Tunnel32
 description KGR-PRM
 ip address 172.30.31.9 255.255.255.252
 ip access-group ACL_FROM_KUMK in
 ip mtu 1400
 ip tcp adjust-mss 1360
 keepalive 10 3
 tunnel source GigabitEthernet0/1
 tunnel destination 178.47.128.98
 tunnel protection ipsec profile gre-gre-3des
!
interface Tunnel45
 description KKB-KY-01-SW1
 bandwidth 100000
 ip address 10.4.50.21 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 keepalive 5 5
 tunnel source GigabitEthernet0/1
 tunnel destination 78.85.13.165
 tunnel protection ipsec profile gre-gre-3des
!
interface Tunnel52
 description SRSCL-KY-01-SW1
 bandwidth 100000
 ip address 10.70.70.118 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 keepalive 5 5
 tunnel source 217.14.195.253
 tunnel destination 85.140.32.166
 tunnel protection ipsec profile gre-gre-3des
!
interface Tunnel54
 description KZG-KY-01-SW1
 bandwidth 100000
 ip address 10.70.70.126 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source 217.14.195.253
 tunnel destination 31.173.105.46
 tunnel protection ipsec profile gre-gre-3des
!
interface Tunnel56
 description STR-KY-01-SW1
 bandwidth 100000
 ip address 10.70.70.142 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 load-interval 30
 keepalive 5 5
 tunnel source 217.14.195.253
 tunnel destination 78.85.35.164
 tunnel protection ipsec profile gre-gre-3des
 service-policy output PM_TEST_ARR_ADAP
!
interface Tunnel101
 description IZH-KI-VOR158-RT-1-1
 bandwidth 80000
 ip address 10.4.50.5 255.255.255.252
 ip mtu 1400
 ip tcp adjust-mss 1360
 keepalive 10 3
 tunnel source GigabitEthernet0/1
 tunnel destination 46.147.130.59
 tunnel protection ipsec profile GRE_IPSEC
!
interface Tunnel102
 description IZH-KI-VOR158-RT-1-2
 bandwidth 96000
 ip address 10.4.50.9 255.255.255.252
 no ip redirects
 ip mtu 1400
 ip tcp adjust-mss 1360
 keepalive 10 3
 tunnel source GigabitEthernet0/1
 tunnel destination 5.227.125.126
 tunnel protection ipsec profile GRE_IPSEC
!
interface Tunnel103
 description BeeCLOUD
 ip address 10.4.50.13 255.255.255.252
 no ip redirects
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/1
 tunnel mode ipsec ipv4
 tunnel destination 82.142.146.70
 tunnel protection ipsec profile PF-BEECLOUD
!
interface Tunnel111
 description [CORE] iBGP Transit to P11
 bandwidth 200000
 ip address 172.30.32.21 255.255.255.252
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1400
 ip tcp adjust-mss 1360
 ip ospf mtu-ignore
 keepalive 10 3
 bfd template BFD-KOMOS
 tunnel source GigabitEthernet0/2.300
 tunnel destination 10.1.1.2
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 description [ISP-200M] Rostelecom
 bandwidth 200000
 ip address 85.175.86.74 255.255.255.252
 ip access-group ACL_FW_IN in
 ip flow ingress
 ip flow egress
 ip nat outside
 ip inspect Internet out
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 description [ISP-100M] MarkITT
 ip address 217.14.195.253 255.255.255.252
 ip access-group FIREWALL in
 ip nat outside
 ip inspect Internet out
 ip virtual-reassembly in
 duplex auto
 speed auto
 service-policy output PM_QOS_GLOBAL_OUT
!
interface GigabitEthernet0/2
 no ip address
 ip nat inside
 ip virtual-reassembly in
 media-type sfp
 service-policy input PM_QOS_IN
!
interface GigabitEthernet0/2.300
 encapsulation dot1Q 300
 ip address 10.4.254.251 255.255.255.0
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
!
interface GigabitEthernet0/2.551
 description --TRANSIT_HSRP--
 encapsulation dot1Q 551
 ip address 10.4.239.18 255.255.255.240
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 standby 1 ip 10.4.239.17
 standby 1 priority 110
 standby 1 preempt
 standby 1 track 20 decrement 10
 ip policy route-map GLOBAL-ROUTING
!
interface GigabitEthernet0/2.556
 description iBGP KOMOS_AS over ER-Telecom
 encapsulation dot1Q 556
 ip address 172.30.32.13 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 bfd template BFD-KOMOS
!
interface GigabitEthernet0/2.557
 description iBGP KOMOS_AS over MTS
 encapsulation dot1Q 557
 ip address 172.30.32.17 255.255.255.252
 ip nat outside
 ip virtual-reassembly in
 bfd template BFD-KOMOS
!
interface GigabitEthernet0/2.597
 description --BGP_TRANSIT--
 encapsulation dot1Q 597
 ip address 172.30.30.60 255.255.255.240
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
 bfd interval 50 min_rx 50 multiplier 3
!
interface Virtual-Template1
 ip address 10.10.14.254 255.255.255.0
 ip mtu 1400
 ip nat inside
 ip virtual-reassembly in
 ip ospf network point-to-point
 peer default ip address pool DHCP-L2TP-PRIMARY
 no keepalive
 ppp encrypt mppe auto
 ppp authentication ms-chap-v2
!
router ospf 111
 router-id 10.111.12.1
 auto-cost reference-bandwidth 10000
 passive-interface default
 no passive-interface GigabitEthernet0/2.556
 no passive-interface GigabitEthernet0/2.557
 no passive-interface Tunnel111
 network 10.111.12.1 0.0.0.0 area 0
 network 172.30.32.0 0.0.0.255 area 0
 bfd all-interfaces
!
router bgp 199014
 bgp router-id 85.175.86.74
 bgp log-neighbor-changes
 bgp graceful-restart restart-time 120
 bgp graceful-restart stalepath-time 360
 bgp graceful-restart
 neighbor PG_BGP_SPOKE_RUSSIAN_NIVA peer-group
 neighbor PG_BGP_SPOKE_RUSSIAN_NIVA remote-as 64536
 neighbor PG_BGP_SPOKE_RUSSIAN_NIVA local-as 64512 no-prepend replace-as
 neighbor PG_IZH-KI-VOR158 peer-group
 neighbor PG_IZH-KI-VOR158 remote-as 64555
 neighbor PG_IZH-KI-VOR158 local-as 64512 no-prepend replace-as
 neighbor PG_MIKROTIK_OTHER peer-group
 neighbor PG_MIKROTIK_OTHER remote-as 65503
 neighbor PG_MIKROTIK_OTHER local-as 64512 no-prepend replace-as
 neighbor 10.4.50.6 peer-group PG_IZH-KI-VOR158
 neighbor 10.4.50.10 peer-group PG_IZH-KI-VOR158
 neighbor 10.4.50.14 remote-as 64554
 neighbor 10.4.50.14 local-as 64512 no-prepend replace-as
 neighbor 10.4.50.14 description BEECLOUD
 neighbor 10.4.50.22 peer-group PG_BGP_SPOKE_RUSSIAN_NIVA
 neighbor 10.70.70.117 peer-group PG_MIKROTIK_OTHER
 neighbor 10.70.70.117 description SAR-MLK-SIG-RT-1-1
 neighbor 10.70.70.125 peer-group PG_MIKROTIK_OTHER
 neighbor 10.70.70.125 description --KEZ_AUTOKOLONNA--
 neighbor 10.70.70.141 peer-group PG_MIKROTIK_OTHER
 neighbor 10.70.70.141 description STR-KY-01-SW1
 neighbor 10.111.13.1 remote-as 199014
 neighbor 10.111.13.1 description iBGP to P11
 neighbor 10.111.13.1 update-source Loopback111
 neighbor 85.175.86.73 remote-as 12389
 neighbor 85.175.86.73 description Rostelecom
 neighbor 172.30.30.55 remote-as 64512
 neighbor 172.30.30.55 description IZH-MLK-IZM-SW-1-1_Huawei
 neighbor 172.30.30.62 remote-as 64512
 neighbor 172.30.30.62 description --IZH-MLK-IZM-SW-1-1-- 
 neighbor 172.30.31.6 remote-as 65504
 neighbor 172.30.31.6 local-as 64512 no-prepend replace-as
 neighbor 172.30.31.6 description KGR-KUMK-KUMK-RT-1-1
 neighbor 172.30.31.10 remote-as 65505
 neighbor 172.30.31.10 local-as 64512 no-prepend replace-as
 neighbor 172.30.31.10 description KGR-KUMK-PRM-RT-1-1
 !
 address-family ipv4
  network 10.4.50.4 mask 255.255.255.252
  network 10.4.50.8 mask 255.255.255.252
  network 10.4.50.20 mask 255.255.255.252
  network 10.70.70.116 mask 255.255.255.252
  neighbor PG_BGP_SPOKE_RUSSIAN_NIVA next-hop-self all
  neighbor PG_BGP_SPOKE_RUSSIAN_NIVA soft-reconfiguration inbound
  neighbor PG_BGP_SPOKE_RUSSIAN_NIVA prefix-list PFL_FROM_RUSSIAN_NIVA in
  neighbor PG_BGP_SPOKE_RUSSIAN_NIVA prefix-list PFL_TO_RUSSIAN_NIVA out
  neighbor PG_IZH-KI-VOR158 next-hop-self
  neighbor PG_IZH-KI-VOR158 soft-reconfiguration inbound
  neighbor PG_IZH-KI-VOR158 route-map RM_TO_IZH-KI-VOR158 out
  neighbor PG_MIKROTIK_OTHER next-hop-self
  neighbor PG_MIKROTIK_OTHER soft-reconfiguration inbound
  neighbor PG_MIKROTIK_OTHER route-map RM_MIKROT_OTHER_OUT out
  neighbor 10.4.50.6 activate
  neighbor 10.4.50.10 activate
  neighbor 10.4.50.14 activate
  neighbor 10.4.50.14 soft-reconfiguration inbound
  neighbor 10.4.50.14 route-map RM_FROM_BEECLOUD in
  neighbor 10.4.50.14 route-map RM_TO_BEECLOUD out
  neighbor 10.4.50.22 activate
  neighbor 10.70.70.117 activate
  neighbor 10.70.70.125 activate
  neighbor 10.70.70.141 activate
  neighbor 10.111.13.1 activate
  neighbor 10.111.13.1 next-hop-self all
  neighbor 10.111.13.1 route-map RM_KOMOS_AS in
  neighbor 10.111.13.1 route-map RM_KOMOS_AS out
  neighbor 85.175.86.73 activate
  neighbor 85.175.86.73 route-map RM_ROSTELECOM_IN in
  neighbor 85.175.86.73 route-map RM_ROSTELECOM_OUT out
  neighbor 172.30.30.55 activate
  neighbor 172.30.30.55 soft-reconfiguration inbound
  neighbor 172.30.30.55 route-map RM_LOCAL_IN in
  neighbor 172.30.30.55 route-map RM_LOCAL_OUT out
  neighbor 172.30.30.62 activate
  neighbor 172.30.30.62 soft-reconfiguration inbound
  neighbor 172.30.30.62 route-map RM_LOCAL_IN in
  neighbor 172.30.30.62 route-map RM_LOCAL_OUT out
  neighbor 172.30.31.6 activate
  neighbor 172.30.31.6 route-map RM_FROM_KUMK in
  neighbor 172.30.31.6 route-map RM_TO_KUMK out
  neighbor 172.30.31.10 activate
  neighbor 172.30.31.10 route-map RM_FROM_KUMK in
  neighbor 172.30.31.10 route-map RM_TO_KUMK out
  distance bgp 150 150 150
 exit-address-family
!
ip local policy route-map PBR_LP
ip local pool DHCP-L2TP-PRIMARY 10.10.14.21 10.10.14.253
ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip flow-export source GigabitEthernet0/2.300
ip flow-export version 5
ip flow-export destination 10.4.0.215 9995
ip flow-export destination 10.4.0.217 9995
ip flow-top-talkers
 top 10
 sort-by bytes
 cache-timeout 20000
!
ip nat translation timeout 450
ip nat translation tcp-timeout 300
ip nat translation pptp-timeout 1800
ip nat translation udp-timeout 310
ip nat translation dns-timeout 5
ip nat translation routemap-entry-timeout 300
ip nat translation icmp-timeout 10
ip nat translation port-timeout tcp 110 60
ip nat translation port-timeout tcp 25 60
ip nat translation port-timeout tcp 80 300
ip nat translation port-timeout tcp 443 300
ip nat translation port-timeout udp 5060 300
ip nat translation max-entries all-host 400
ip nat translation max-entries host 10.4.7.5 400
ip nat translation max-entries host 10.4.7.4 400
ip nat translation max-entries host 10.4.7.6 400
ip nat translation max-entries host 192.168.8.71 400
ip nat translation max-entries host 192.168.8.72 400
ip nat translation max-entries host 10.4.38.1 1000
ip nat translation max-entries host 192.168.8.73 400
ip nat translation max-entries host 192.168.8.74 400
ip nat translation max-entries host 192.168.8.75 400
ip nat translation max-entries host 192.168.8.77 400
ip nat translation max-entries host 10.4.0.172 1000
ip nat translation max-entries host 192.168.8.163 400
ip nat pool NAT_FTP4 192.168.8.138 192.168.8.138 netmask 255.255.255.0 type rotary
ip nat inside source route-map ISP_MARK interface GigabitEthernet0/1 overload
ip nat inside source route-map ISP_RT interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.8.225 4443 85.175.86.74 4443 extendable
ip nat inside source static tcp 192.168.8.225 4443 85.175.86.74 4444 extendable
ip nat inside source static tcp 10.4.38.2 80 91.240.179.36 80 extendable
ip nat inside source static tcp 10.4.38.2 443 91.240.179.36 443 extendable
ip nat inside source static 10.4.38.1 91.240.179.48
ip nat inside source static 10.4.38.21 91.240.179.73
ip nat inside source static 10.4.38.22 91.240.179.74
ip nat inside source static 10.4.0.184 91.240.179.131
ip nat inside source static 10.4.0.120 91.240.179.133
ip nat inside source static 10.4.8.8 91.240.179.240
ip nat inside source static tcp 10.4.0.9 21 217.14.195.253 21 extendable
ip nat inside source static tcp 10.4.7.12 25 217.14.195.253 25 extendable
ip nat inside source static tcp 10.4.7.12 110 217.14.195.253 110 extendable
ip nat inside source static tcp 10.4.7.12 143 217.14.195.253 143 extendable
ip nat inside source static tcp 10.4.0.172 443 217.14.195.253 443 extendable
ip nat inside source static tcp 10.4.7.12 993 217.14.195.253 993 extendable
ip nat inside source static tcp 10.4.0.178 3389 217.14.195.253 3389 extendable
ip nat inside source static tcp 192.168.8.29 1194 217.14.195.253 3394 extendable
ip nat inside source static tcp 192.168.8.225 4443 217.14.195.253 4443 extendable
ip nat inside source static tcp 192.168.8.225 4443 217.14.195.253 4444 extendable
ip nat inside source static tcp 192.168.8.228 3389 217.14.195.253 4446 extendable
ip nat inside source static tcp 192.168.8.177 3389 217.14.195.253 4494 extendable
ip nat inside source static tcp 192.168.9.100 7010 217.14.195.253 7010 extendable
ip nat inside source static tcp 192.168.9.100 7011 217.14.195.253 7011 extendable
ip nat inside source static tcp 192.168.9.101 7020 217.14.195.253 7020 extendable
ip nat inside source static tcp 192.168.9.101 7021 217.14.195.253 7021 extendable
ip nat inside source static tcp 192.168.9.102 7030 217.14.195.253 7030 extendable
ip nat inside source static tcp 192.168.9.102 7031 217.14.195.253 7031 extendable
ip nat inside source static tcp 192.168.9.103 7040 217.14.195.253 7040 extendable
ip nat inside source static tcp 192.168.9.103 7041 217.14.195.253 7041 extendable
ip nat inside source static tcp 192.168.9.104 7050 217.14.195.253 7050 extendable
ip nat inside source static tcp 192.168.9.104 7051 217.14.195.253 7051 extendable
ip nat inside source static tcp 192.168.9.105 7060 217.14.195.253 7060 extendable
ip nat inside source static tcp 192.168.9.105 7061 217.14.195.253 7061 extendable
ip nat inside source static tcp 172.30.35.254 7789 217.14.195.253 7789 extendable
ip nat inside source static tcp 172.17.100.1 8081 217.14.195.253 8081 extendable
ip nat inside source static tcp 172.17.100.1 8082 217.14.195.253 8082 extendable
ip nat inside source static tcp 172.17.100.5 8081 217.14.195.253 8087 extendable
ip nat inside source static tcp 172.17.100.5 8082 217.14.195.253 8088 extendable
ip nat inside source static tcp 10.4.7.17 22 217.14.195.253 8089 extendable
ip nat inside source static tcp 10.4.7.17 80 217.14.195.253 8090 extendable
ip nat inside source static tcp 10.4.7.17 8081 217.14.195.253 8091 extendable
ip nat inside source static tcp 10.4.7.17 8082 217.14.195.253 8092 extendable
ip nat inside source static tcp 192.168.8.176 3389 217.14.195.253 56548 extendable
ip nat inside source static tcp 192.168.8.159 3389 217.14.195.253 56549 extendable
ip nat inside source static tcp 192.168.8.138 21 217.14.195.253 58000 extendable
ip nat inside source static tcp 192.168.8.187 3389 217.14.195.253 59136 extendable
ip nat inside destination list ACL_FTP4 pool NAT_FTP4
ip route 0.0.0.0 0.0.0.0 217.14.195.254 90 name --MARK--
ip route 0.0.0.0 0.0.0.0 85.175.86.73 100 name --RT--
ip route 5.227.125.126 255.255.255.255 78.85.13.1
ip route 10.15.72.0 255.255.255.0 10.4.50.14
ip route 10.111.0.21 255.255.255.255 172.30.30.62 name LO-P11-RT-1-1
ip route 91.240.179.0 255.255.255.0 Null0 254 name KOMOS_PI
ip route 172.30.35.254 255.255.255.255 10.4.239.22 200 name --MIKROTIK_VPN--
ip route 192.168.8.225 255.255.255.255 10.4.239.22 100 name VREMENNO!!!!!!
ip route 192.168.101.152 255.255.255.248 10.70.70.141 200 name --STROYLANDIYA_SARAPUL--
!
ip access-list standard ACL_NAT_ATERISK
 permit 172.17.100.1
 permit 172.17.100.5
ip access-list standard ACL_NAT_PET_PRODACTION
 permit 10.4.37.1
ip access-list standard ACL_NAT_SRV
 permit 10.4.3.0 0.0.0.255
 permit 10.4.6.0 0.0.0.255
ip access-list standard ACL_NAT_Wi-Fi
 permit 10.4.32.0 0.0.0.255
 permit 10.4.35.0 0.0.0.255
 permit 10.4.255.0 0.0.0.255
 permit 10.4.252.0 0.0.0.255
ip access-list standard NOBEL_USERS
 permit 10.5.208.0 0.0.7.255
!
ip access-list extended ACL_CREATIO
 permit ip host 10.4.0.123 any
ip access-list extended ACL_EXCHANGE_KG
 permit ip host 10.4.38.3 any
ip access-list extended ACL_FOR_LP_MARK
 permit ip host 217.14.195.253 any
ip access-list extended ACL_FOR_LP_RT
 permit ip host 78.85.13.95 any
 permit gre host 78.85.13.95 any
 permit esp host 78.85.13.95 any
ip access-list extended ACL_FROM_KUMK
 deny   tcp any any eq 445
 permit ip host 172.30.31.10 host 172.30.31.9
 permit ip host 172.30.31.6 host 172.30.31.5
 permit icmp 10.12.1.0 0.0.0.255 any
 permit icmp 10.12.0.0 0.0.0.255 any
 permit ip 10.12.1.0 0.0.0.255 10.1.9.0 0.0.0.255
 permit ip 10.12.1.0 0.0.0.255 host 10.1.9.207
 permit ip 10.12.1.0 0.0.0.255 host 192.168.8.137
 permit ip 10.12.1.0 0.0.0.255 host 10.4.0.43
 permit ip 10.12.0.0 0.0.0.255 10.4.0.0 0.0.0.255
 permit ip host 10.12.0.254 any
 permit ip 10.12.0.0 0.0.127.255 10.12.252.0 0.0.3.255
 permit ip 10.12.252.0 0.0.3.255 10.12.252.0 0.0.3.255
 permit ip host 10.12.252.254 any
 permit tcp any any eq domain
 permit udp any any eq domain
 remark kg-p11-app001.komos-group.ru
 permit ip any host 10.1.8.14
 permit ip 10.12.4.0 0.0.3.255 10.1.19.0 0.0.0.255
 permit icmp any any
 permit ip any host 10.1.9.207
 permit ip any host 10.4.0.214
 permit ip 10.12.4.0 0.0.0.255 any
 permit tcp any any eq 8291
ip access-list extended ACL_FTP4
 permit tcp any any range 58600 58900
ip access-list extended ACL_FW_IN
 permit tcp any object-group STATIC_ISP_IP eq 4444
 permit icmp any any
 permit tcp any object-group STATIC_ISP_IP eq bgp
 permit ip object-group OBJ_BRANCHES 91.240.179.0 0.0.0.255
 permit ip object-group OBJ_BRANCHES object-group STATIC_ISP_IP
 deny   tcp any object-group STATIC_ISP_IP eq 22
 deny   ip object-group OBJ_NET_BLACKLIST any
 permit tcp any host 91.240.179.1 eq 443 2109 3000 8080 9000 9090
 permit udp any host 91.240.179.1 eq 3478 syslog
 permit tcp any host 91.240.179.5 eq 82 www 443 1433 2195 2196 5223
 permit tcp any host 91.240.179.11 eq domain
 permit udp any host 91.240.179.11 eq domain
 permit tcp any host 91.240.179.20 eq 443
 permit udp any host 91.240.179.28 eq non500-isakmp isakmp
 permit tcp any host 91.240.179.31 eq 7789
 permit tcp any host 91.240.179.36 eq www 443
 permit tcp any host 91.240.179.40 eq 443
 permit tcp any host 91.240.179.48 eq www 443
 permit tcp any host 91.240.179.49 eq 8080 9099
 permit tcp any host 91.240.179.57 eq www 443 8082 10001 12001
 permit tcp any host 91.240.179.66 eq 443 pop3 www
 permit tcp any host 91.240.179.68 eq 5060
 permit tcp any host 91.240.179.70 eq smtp www pop3 143 443 587 993 995
 permit tcp any host 91.240.179.129 eq smtp www pop3 143 443 587 993 995
 permit tcp any host 91.240.179.178 eq 4477
 permit tcp any host 91.240.179.251 eq www 443
 permit tcp object-group OBJ_PART_Goods4Cust host 91.240.179.2 eq 1433
 permit tcp object-group OBJ_PART_Goods4Cust host 91.240.179.5 eq 3395 5671 5672 15672
 permit tcp object-group OBJ_PART_HEADLINE host 91.240.179.1 eq 3389
 permit tcp object-group OBJ_PART_HEADLINE host 91.240.179.49 eq 3391
 permit tcp object-group OBJ_PART_HEADLINE host 91.240.179.68 eq 3389
 permit tcp object-group OBJ_PART_ROSA host 91.240.179.131 eq www 443
 permit tcp object-group OBJ_PART_HTC host 91.240.179.71
 permit object-group OBJ_SVC_VIPole any host 91.240.179.32
 permit object-group OBJ_SVC_SFB any object-group OBJ_SRV_SKYPE
 permit object-group OBJ_SVC_ANY_CONNECT any object-group OBJ_NET_CISCOASA
 permit object-group OBJ_SVC_L2TP any host 91.240.179.28
 permit object-group OBJ_SVC_FTP object-group OBJ_NET_FTP_USERS host 91.240.179.71
 permit tcp any object-group OBJ_SVC_KSMG eq smtp
 permit tcp any object-group OBJ_SRV_IRONPORT eq smtp
ip access-list extended ACL_NAT_PRODACTION
 permit tcp host 10.4.39.1 any eq 443
 permit ip host 10.4.38.1 any
 permit ip host 10.4.38.2 any
 permit ip host 10.4.39.65 any
 permit ip 10.4.39.64 0.0.0.63 any
ip access-list extended ACL_QOS_ESP
 permit esp any any
 deny   ip any any
ip access-list extended ACL_QOS_Q2
 permit tcp any any eq www 443
 permit tcp any any eq www 443 8443
ip access-list extended ACL_RM_ROUTE_MARK_OUT
 permit ip host 10.4.0.9 any
 permit ip host 10.4.7.12 any
 permit ip host 10.4.0.172 any
 permit ip host 10.4.0.178 any
 permit ip host 192.168.8.29 any
 permit ip host 192.168.8.228 any
 permit ip host 192.168.8.177 any
 permit ip host 192.168.9.100 any
 permit ip host 192.168.9.101 any
 permit ip host 192.168.9.102 any
 permit ip host 192.168.9.103 any
 permit ip host 192.168.9.104 any
 permit ip host 192.168.9.105 any
 permit ip host 172.30.35.254 any
 permit ip host 172.17.100.1 any
 permit ip host 172.17.100.5 any
 permit ip host 10.4.7.17 any
 permit ip host 192.168.8.176 any
 permit ip host 192.168.8.159 any
 permit ip host 192.168.8.138 any
 permit ip host 192.168.8.187 any
 permit ip host 192.168.8.226 any
 permit ip 192.168.8.0 0.0.0.255 any
 remark RTO-372
 permit ip host 10.4.8.80 any
ip access-list extended ACL_TEST_ESR-10
 permit ip host 91.240.179.240 any
 permit ip host 10.4.8.8 any
ip access-list extended ACL_VTY
 permit ip 10.1.0.0 0.0.255.255 any
 permit ip 10.4.0.0 0.0.255.255 any
 permit ip 10.14.112.0 0.0.15.255 any
 deny   ip any any log
ip access-list extended FIREWALL
 deny   tcp any object-group STATIC_ISP_IP eq 22
 permit ip object-group OBJ_BRANCHES object-group STATIC_ISP_IP
 permit ip object-group GRE_SRC_IP object-group STATIC_ISP_IP
 permit tcp any object-group STATIC_ISP_IP eq 5599 7010 7011 7020 7021 7030 7031 7040
 permit tcp any object-group STATIC_ISP_IP eq 7041 7050 7051 7060 7061 7789 8585 29713
 permit tcp any object-group STATIC_ISP_IP eq 15971 38129 38411 38412 38511 39661 43611 50155 50569 50683
 permit tcp any object-group STATIC_ISP_IP eq 50690 50718 50783 51891 56543 56548 56549 59136 59991 61751
 permit tcp any object-group STATIC_ISP_IP eq 4494
 permit tcp any object-group STATIC_ISP_IP eq 3394
 deny   tcp any host 217.14.195.253 eq 443
 permit tcp object-group LAINER_TELECOM object-group STATIC_ISP_IP range 8081 8092
 permit tcp any object-group STATIC_ISP_IP range 58600 58900
 permit udp any object-group STATIC_ISP_IP range 10000 20000
 permit object-group SERVICE_L2TP any object-group STATIC_ISP_IP
 permit tcp any object-group STATIC_ISP_IP eq ftp smtp www pop3 143 443 993 2109 4443 4444
 permit tcp any object-group STATIC_ISP_IP eq 2253 58000
 permit tcp object-group HEADLINE_IP object-group STATIC_ISP_IP eq 4446
 permit icmp any object-group STATIC_ISP_IP
 deny   tcp any any eq 22
ip access-list extended LOCAL_TRAFFIC
 permit ip any 192.168.0.0 0.0.255.255
 permit ip any 10.0.0.0 0.255.255.255
 permit ip any 172.16.0.0 0.15.255.255
!
!
ip prefix-list PFL_FROM_RUSSIAN_NIVA seq 10 permit 10.5.192.0/19
!
ip prefix-list PFL_OSPF_FILTER seq 10 deny 10.0.0.0/14 le 32
ip prefix-list PFL_OSPF_FILTER seq 20 deny 10.8.0.0/13 le 32
ip prefix-list PFL_OSPF_FILTER seq 30 deny 10.16.0.0/12 le 32
ip prefix-list PFL_OSPF_FILTER seq 100 permit 0.0.0.0/0 le 24
!
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 10 permit 10.4.0.0/16
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 20 permit 192.168.8.0/24
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 25 permit 10.1.0.0/16
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 30 permit 192.168.0.0/22
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 35 permit 10.14.112.0/20
!
ip prefix-list PL_BOGON seq 5 permit 0.0.0.0/8 le 32
ip prefix-list PL_BOGON seq 10 permit 10.0.0.0/8 le 32
ip prefix-list PL_BOGON seq 15 permit 100.64.0.0/10 le 32
ip prefix-list PL_BOGON seq 20 permit 127.0.0.0/8 le 32
ip prefix-list PL_BOGON seq 25 permit 169.254.0.0/16 le 32
ip prefix-list PL_BOGON seq 30 permit 172.16.0.0/12 le 32
ip prefix-list PL_BOGON seq 35 permit 192.0.0.0/24 le 32
ip prefix-list PL_BOGON seq 40 permit 192.0.2.0/24 le 32
ip prefix-list PL_BOGON seq 45 permit 192.168.0.0/16 le 32
ip prefix-list PL_BOGON seq 50 permit 192.18.0.0/15 le 32
ip prefix-list PL_BOGON seq 55 permit 198.18.0.0/15 le 32
ip prefix-list PL_BOGON seq 60 permit 198.51.100.0/24 le 32
ip prefix-list PL_BOGON seq 65 permit 203.0.113.0/24 le 32
ip prefix-list PL_BOGON seq 70 permit 240.0.0.0/4 le 32
!
ip prefix-list PL_FROM_BEECLOUD seq 5 permit 10.100.0.0/24 le 25
ip prefix-list PL_FROM_BEECLOUD seq 10 permit 10.101.0.0/20 le 24
!
ip prefix-list PL_FROM_KLS seq 10 permit 10.14.100.0/22
!
ip prefix-list PL_FROM_KUMK seq 5 permit 10.12.0.0/16 le 24
ip prefix-list PL_FROM_KUMK seq 10 permit 10.12.252.0/22
!
ip prefix-list PL_KOMOS_AS seq 5 permit 0.0.0.0/0
ip prefix-list PL_KOMOS_AS seq 10 permit 91.240.179.0/24 le 32
!
ip prefix-list PL_LOCAL_IN seq 5 deny 0.0.0.0/0
ip prefix-list PL_LOCAL_IN seq 10 permit 10.0.0.0/8 le 32
ip prefix-list PL_LOCAL_IN seq 15 permit 192.168.0.0/16 le 32
ip prefix-list PL_LOCAL_IN seq 20 permit 172.31.35.0/24
ip prefix-list PL_LOCAL_IN seq 25 permit 172.31.31.0/24
ip prefix-list PL_LOCAL_IN seq 30 permit 172.16.0.0/12 le 32
ip prefix-list PL_LOCAL_IN seq 35 permit 91.240.179.243/32
ip prefix-list PL_LOCAL_IN seq 40 permit 91.240.179.131/32
ip prefix-list PL_LOCAL_IN seq 50 permit 91.240.179.0/24 ge 32
!
ip prefix-list PL_LOCAL_OUT seq 5 permit 10.0.0.0/8 le 32
ip prefix-list PL_LOCAL_OUT seq 10 permit 192.168.0.0/16 le 32
ip prefix-list PL_LOCAL_OUT seq 15 permit 172.16.0.0/12 le 32
ip prefix-list PL_LOCAL_OUT seq 20 permit 91.240.179.0/24 le 32
!
ip prefix-list PL_MIKROT_OTHER_OUT seq 1 permit 10.0.0.0/8 le 32
ip prefix-list PL_MIKROT_OTHER_OUT seq 2 permit 192.168.0.0/16 le 32
ip prefix-list PL_MIKROT_OTHER_OUT seq 5 permit 10.4.0.0/16
ip prefix-list PL_MIKROT_OTHER_OUT seq 10 permit 10.1.0.0/16
ip prefix-list PL_MIKROT_OTHER_OUT seq 15 permit 192.168.0.0/22
ip prefix-list PL_MIKROT_OTHER_OUT seq 20 permit 192.168.8.0/24
!
ip prefix-list PL_ROSTELECOM_IN seq 5 permit 0.0.0.0/0
ip prefix-list PL_ROSTELECOM_IN seq 6 permit 0.0.0.0/0 le 22
ip prefix-list PL_ROSTELECOM_IN seq 10 deny 0.0.0.0/0 le 32
!
ip prefix-list PL_ROSTELECOM_OUT seq 5 permit 91.240.179.0/24
!
ip prefix-list PL_TO_BEECLOUD seq 5 permit 10.0.0.0/8 le 24
!
ip prefix-list PL_TO_IZH-KI-VOR158 seq 5 permit 10.0.0.0/8 le 24
ip prefix-list PL_TO_IZH-KI-VOR158 seq 10 permit 192.168.0.0/16 le 24
ip prefix-list PL_TO_IZH-KI-VOR158 seq 15 permit 172.31.35.0/24
!
ip prefix-list PL_TO_KUMK seq 5 permit 10.1.0.0/16 le 24
ip prefix-list PL_TO_KUMK seq 10 permit 10.4.0.0/16 le 24
ip sla 1
 icmp-echo 8.8.8.8 source-ip 78.85.13.95
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 1 life forever start-time now
ip sla 2
 icmp-echo 8.8.4.4 source-ip 78.85.13.95
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 2 life forever start-time now
ip sla 3
 icmp-echo 77.88.8.8 source-ip 78.85.13.95
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 3 life forever start-time now
ip sla 4
 icmp-echo 77.88.8.1 source-ip 78.85.13.95
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 4 life forever start-time now
ip sla 5
 icmp-echo 77.88.8.88 source-ip 78.85.13.95
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 5 life forever start-time now
ip sla 6
 icmp-echo 77.88.8.2 source-ip 78.85.13.95
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 6 life forever start-time now
ip sla 11
 icmp-echo 8.8.8.8 source-ip 217.14.195.253
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 11 life forever start-time now
ip sla 12
 icmp-echo 8.8.4.4 source-ip 217.14.195.253
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 12 life forever start-time now
ip sla 13
 icmp-echo 77.88.8.8 source-ip 217.14.195.253
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 13 life forever start-time now
ip sla 14
 icmp-echo 77.88.8.1 source-ip 217.14.195.253
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 14 life forever start-time now
ip sla 15
 icmp-echo 77.88.8.88 source-ip 217.14.195.253
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 15 life forever start-time now
ip sla 16
 icmp-echo 77.88.8.2 source-ip 217.14.195.253
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 16 life forever start-time now
ip sla 202
 icmp-echo 1.1.1.1 source-ip 85.175.86.74
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 202 life forever start-time now
ip sla 203
 icmp-echo 8.8.8.8 source-ip 85.175.86.74
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 203 life forever start-time now
logging origin-id hostname
logging facility local2
logging source-interface GigabitEthernet0/2.300
logging host 192.168.8.119 transport udp port 5544
logging host 10.4.244.4 transport udp port 515
!
route-map ISP_MARK permit 10
 match ip address 20 21 22 23 24 25 26 27 28 29 30 40 41 42 43 44 45 ACL_NAT_Wi-Fi ACL_NAT_PET_PRODACTION ACL_NAT_ATERISK ACL_NAT_PRODACTION NOBEL_USERS ACL_NAT_SRV
 match interface GigabitEthernet0/1
!
route-map PBR_LP deny 10
 match ip address LOCAL_TRAFFIC
!
route-map PBR_LP permit 20
 match ip address ACL_FOR_LP_RT
 set ip next-hop 78.85.13.1
!
route-map PBR_LP permit 30
 match ip address ACL_FOR_LP_MARK
 set ip next-hop 217.14.195.254
!
route-map RM_ROSTELECOM_IN deny 5
 match ip address prefix-list PL_BOGON
!
route-map RM_ROSTELECOM_IN permit 10
 match ip address prefix-list PL_ROSTELECOM_IN
 match track  200
 set local-preference 300
!
route-map RM_ROSTELECOM_IN permit 20
 match ip address prefix-list PL_ROSTELECOM_IN
 set local-preference 200
!
route-map EIGRP_PUB_RM permit 10
 description --publish_subnet_to_eigrp--
 match ip address 99
!
route-map RM_FROM_KUMK permit 10
 match ip address prefix-list PL_FROM_KUMK
!
route-map ISP_RT permit 10
 match ip address 20 21 22 23 24 25 26 27 28 29 30 40 41 42 43 44 45 ACL_NAT_Wi-Fi ACL_NAT_PET_PRODACTION ACL_NAT_ATERISK ACL_NAT_PRODACTION NOBEL_USERS ACL_NAT_SRV
 match interface GigabitEthernet0/0
!
route-map RM_TO_BEECLOUD permit 10
 match ip address prefix-list PL_TO_BEECLOUD
 set as-path prepend 64512 64512
!
route-map RM_FROM_BEECLOUD permit 10
 match ip address prefix-list PL_FROM_BEECLOUD
 set as-path prepend 64554 64554
!
route-map RM_LOCAL_OUT permit 10
 match ip address prefix-list PL_LOCAL_OUT
!
route-map RM_TO_KUMK permit 10
 match ip address prefix-list PL_TO_KUMK
!
route-map RM_TO_IZH-KI-VOR158 permit 10
 match ip address prefix-list PL_TO_IZH-KI-VOR158
!
route-map REDIST_EIGRP_TO_OSPF_AREA_1 permit 10
 match ip address 98
!
route-map RM_ROSTELECOM_OUT permit 10
 match ip address prefix-list PL_ROSTELECOM_OUT
 set as-path prepend 199014 199014 199014
!
route-map RM_MIKROT_OTHER_OUT permit 10
 match ip address prefix-list PL_MIKROT_OTHER_OUT
!
route-map PPTP-VIA-MARK permit 10
 match ip address LOCAL_TRAFFIC
!
route-map PPTP-VIA-MARK permit 20
 set ip next-hop 217.14.195.254
!
route-map RM_LOCAL_IN permit 10
 match ip address prefix-list PL_LOCAL_IN
!
route-map RM_KOMOS_AS permit 10
 match ip address prefix-list PL_KOMOS_AS
!
route-map RM_FROM_KLS permit 10
 match ip address prefix-list PL_FROM_KLS
!
route-map GLOBAL-ROUTING permit 5
 match ip address ACL_RM_ROUTE_MARK_OUT
 set ip next-hop 217.14.195.254
!
route-map GLOBAL-ROUTING permit 10
 match ip address ACL_CREATIO
 set ip next-hop 78.85.13.1
!
route-map GLOBAL-ROUTING permit 20
 match ip address ACL_EXCHANGE_KG
 set ip next-hop 78.85.13.1
!
route-map GLOBAL-ROUTING permit 25
 description TEST_VKTEAMS
 match ip address ACL_TEST_ESR-10
 set ip next-hop 172.30.32.14
!
route-map GLOBAL-ROUTING permit 100
!
!
snmp-server community lmTUEsk6Yvlv RO
access-list 5 permit 10.2.1.245
access-list 20 permit 10.4.0.249
access-list 20 remark -===NET USER 0===-
access-list 20 permit 192.168.0.0 0.0.3.255
access-list 21 remark -===NET PRINTDEVICE 1===-
access-list 21 permit 192.168.4.0 0.0.0.255
access-list 22 remark -===NET USER 5===-
access-list 22 permit 192.168.5.0 0.0.0.255
access-list 23 remark -===NET SERVER 6===-
access-list 23 permit 192.168.6.0 0.0.0.255
access-list 24 remark -===NET SERVER 7===-
access-list 24 permit 192.168.7.0 0.0.0.255
access-list 25 deny   192.168.8.120
access-list 25 remark -===NET SERVER 8===-
access-list 25 permit 192.168.8.0 0.0.0.255
access-list 26 remark -===NET SERVER 9===-
access-list 26 permit 192.168.9.0 0.0.0.255
access-list 27 remark -===NET KIP===-
access-list 27 permit 192.168.110.0 0.0.0.255
access-list 28 remark -===NET SERVER 150===-
access-list 28 permit 192.168.150.0 0.0.0.255
access-list 29 remark -===NET_VPN===-
access-list 29 permit 172.30.34.0 0.0.1.255
access-list 30 remark -===NET VPN===-
access-list 30 permit 10.10.14.0 0.0.0.255
access-list 34 permit 10.4.7.12
access-list 34 remark =-izh-msx001=-
access-list 34 permit 192.168.1.5
access-list 40 permit 10.4.8.0 0.0.7.255
access-list 40 permit 10.4.16.0 0.0.7.255
access-list 41 deny   10.4.0.90
access-list 41 deny   10.4.0.102
access-list 41 deny   10.4.0.241
access-list 41 remark -=ServerNetNew=-
access-list 41 permit 10.4.0.0 0.0.3.255
access-list 42 remark -=WifiUserNetNew=-
access-list 42 permit 10.4.32.0 0.0.0.255
access-list 44 remark -=ServProcContNet=-
access-list 44 permit 10.4.36.0 0.0.0.255
access-list 45 remark -=ServMailNet=-
access-list 45 permit 10.4.7.0 0.0.0.15
access-list 98 deny   192.168.8.120
access-list 98 remark --REDIST_EIGRP_OSPF_AREA_1--
access-list 98 permit 192.168.0.0 0.0.3.255
access-list 98 permit 192.168.8.0 0.0.0.255
access-list 99 remark --LIST_TO_REDISTR_IN_EIGRP--
access-list 99 permit 10.2.1.0 0.0.0.255
!
radius server IZH-RDS002
 address ipv4 10.4.0.248 auth-port 1645 acct-port 1646
 timeout 3
 retransmit 2
 key hykFAA@Hg9X9fsokWh5q8wez#&^a9lIizldHKxlRer3RE7AbsTsJwdB^RESF$eJ0
!
radius server P11-RDS003
 address ipv4 10.1.122.248 auth-port 1645 acct-port 1646
 timeout 3
 retransmit 2
 key hykFAA@Hg9X9fsokWh5q8wez#&^a9lIizldHKxlRer3RE7AbsTsJwdB^RESF$eJ0
!
!
!
control-plane
!
!
no vstack
alias exec sib sh ip int brief
!
line con 0
 logging synchronous
 login authentication CONSOLE
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 access-class ACL_VTY in vrf-also
 exec-timeout 120 0
 logging synchronous
 rotary 1
 transport input ssh
line vty 5 15
 access-class ACL_VTY in vrf-also
 exec-timeout 120 0
 logging synchronous
 transport input ssh
!
scheduler allocate 20000 1000
ntp server 10.4.0.1
ntp server 10.4.0.2
event manager applet --MARK_UP--
 event track 20 state up
 action 001 cli command "enable"
 action 002 cli command "conf t"
 action 003 cli command "interface GigabitEthernet0/1"
 action 004 cli command "ip nat outside"
 action 005 cli command "end"
 action 006 cli command "clear ip nat translation *"
 action 007 syslog msg "MARK is UP"
event manager applet --MARK_DOWN--
 event track 20 state down
 action 001 cli command "enable"
 action 002 cli command "conf t"
 action 003 cli command "interface GigabitEthernet0/1"
 action 004 cli command "no ip nat outside"
 action 005 cli command "end"
 action 006 cli command "clear ip nat translation *"
 action 007 syslog msg "MARK is DOWN"
!
event manager history size events 20
end