Building configuration...

Current configuration : 27382 bytes
!
! Last configuration change at 13:46:27 MSK Mon May 30 2022 by adm_kapustinal
! NVRAM config last updated at 01:00:11 MSK Thu Jul 28 2022
!
version 15.5
service timestamps debug datetime msec localtime show-timezone year
service timestamps log datetime msec localtime show-timezone year
no service password-encryption
!
hostname SPB-KG-SPB-RT-1-1
!
boot-start-marker
boot-end-marker
!
!
vrf definition ispA
 description [100M] ISP_Beeline
 rd 1:1
 !
 address-family ipv4
  import ipv4 unicast map RM-IMPORT
  export ipv4 unicast map RM-EXPORT
  route-target export 1:1
  route-target import 1:1
 exit-address-family
!
logging buffered 128000
enable secret 5 $1$Y4ic$8w2gfNBS5UIavk3t7BSXP/
!
aaa new-model
!
!
aaa group server radius NPS
 server name IZH-RDS002
 server name P11-RDS003
 ip radius source-interface Loopback300
 load-balance method least-outstanding
!
aaa authentication login default group NPS local enable
aaa authentication login CONSOLE local group NPS
aaa authorization exec default group NPS local if-authenticated 
!
!
!
!
!
aaa session-id common
ethernet lmi ce
clock timezone MSK 3 0
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!


!
!
ip dhcp pool DHCP-SPB-NET-MGM
 network 10.14.89.0 255.255.255.0
 domain-name komos.local
 default-router 10.14.89.254 
 dns-server 10.14.89.254 
 option 43 hex 0104.0a01.0c1d
!
ip dhcp pool DHCP-SPB-VOIP
 network 10.14.92.0 255.255.255.0
 default-router 10.14.92.254 
 dns-server 10.14.92.254 
 domain-name komos.local
 option 4 ip 192.168.1.21 192.168.1.100 
 option 2 hex 0000.2a30
!
ip dhcp pool DHCP-SPB-USERS
 network 10.14.88.0 255.255.255.0
 domain-name komos.local
 default-router 10.14.88.254 
 dns-server 10.14.88.254 
!
ip dhcp pool DHCP-SPB-WIFI-WORK
 network 10.14.90.0 255.255.255.0
 default-router 10.14.90.254 
 dns-server 10.14.90.254 
 domain-name komos.local
!
ip dhcp pool DHCP-SPB-WIFI-GUEST
 network 10.14.91.0 255.255.255.0
 default-router 10.14.91.254 
 domain-name GUEST_SPB
 dns-server 10.14.91.254 
!
!
!
no ip domain lookup
ip domain name komos.ru
ip host tftp 10.4.0.214
ip name-server 1.1.1.1
ip name-server 8.8.8.8
ip cef
login on-failure log
login on-success log
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
license udi pid C891-24X/K9 sn FJC2118L2G9
!
!
archive
 log config
  logging enable
  logging size 900
  notify syslog contenttype plaintext
  hidekeys
 path tftp://tftp/SPB/KG/SPB-RT/$H$T
 write-memory
 time-period 10080
object-group network OBJ_BBN_RN_BBN 
 host 85.140.32.104
 host 78.85.13.205
!
object-group network OBJ_BBN_VST_BBN 
 host 85.140.32.103
 host 83.169.220.204
!
object-group network OBJ_IZH_MLK_IZM 
 host 85.140.32.27
 host 78.85.13.42
 host 5.227.126.169
 host 31.173.105.54
 host 217.14.195.253
 host 85.175.86.74
!
object-group network OBJ_IZH_KG_P11 
 91.240.179.0 255.255.255.0
 host 5.227.124.143
 host 78.85.13.93
 host 62.141.96.126
 host 84.201.247.190
 host 88.80.33.50
 host 94.25.46.122
!
object-group network OBJ_IZH_VST_IZM 
 host 5.227.124.82
 host 78.85.13.38
!
object-group network OBJ_IZH_TK_M44 
 host 212.46.204.74
 host 88.80.33.162
!
object-group network OBJ_IZH_TK_M48 
 host 87.249.237.250
!
object-group network OBJ_IZH_TK_SMR 
 host 87.249.239.226
 host 88.80.33.42
!
object-group network OBJ_MSK_KG_MSK 
 host 185.62.195.150
 host 185.6.175.101
!
object-group network OBJ_GLZ_MLK_GMK 
 host 31.173.105.62
 host 85.140.32.29
!
object-group network OBJ_KZN_MLK_KMK 
 host 83.69.126.54
 host 94.180.253.210
 host 78.138.171.82
!
object-group network OBJ_KEZ_MLK_KZS 
 host 31.173.105.66
 host 78.85.13.52
 host 85.140.32.30
!
object-group network OBJ_PRM_MLK_PHK 
 host 178.47.128.18
 host 46.146.210.68
!
object-group network OBJ_SAR_MLK_SRM 
 host 31.173.105.58
 host 78.85.13.53
 host 85.140.32.28
!
object-group network OBJ_CLB_MLK_CMK 
 host 37.113.128.241
 host 149.255.6.35
!
object-group network OBJ_GLZ_GKZ_GKZ 
 host 78.85.13.94
 host 146.120.104.181
!
object-group network OBJ_KIA_RN_KIA 
 host 78.85.14.97
!
object-group network OBJ_IZH_TZK_TZK 
 host 78.25.80.134
 host 5.227.124.235
!
object-group network OBJ_IZH_MK_VS17 
 host 5.227.124.141
!
object-group network OBJ_IZH_KL_KLI 
 host 78.85.15.85
 host 84.201.247.24
 host 79.175.36.97
 host 84.201.244.235
!
object-group network OBJ_EKB_KG_EKB 
 host 62.168.232.182
 host 176.215.14.11
!
object-group network OBJ_IZH_KEN_VS56 
 host 83.143.54.246
 host 92.55.54.109
!
object-group network OBJ_IZH_VRS_IZM 
 host 85.140.32.177
 host 78.85.14.98
!
object-group network OBJ_GLZ_VRS_UPF 
 host 95.215.208.234
 host 78.85.13.119
!
object-group network OBJ_IZH_VRS_IPF 
 host 85.140.32.141
 host 78.85.13.117
!
object-group network OBJ_IZH_VRS_PFV 
 host 85.140.32.178
 host 94.181.119.90
 host 78.85.33.50
!
object-group network OBJ_VOT_VRS_VPF 
 host 78.85.13.118
 host 88.80.33.14
!
object-group network OBJ_MSB_TMA_MSB 
 host 78.138.182.214
!
object-group network OBJ_KIB_TMA_KIB 
 host 78.138.182.126
!
object-group network OBJ_PRM_VRS_MPF 
 host 178.47.130.10
 host 5.227.121.127
!
object-group network OBJ_LAI_VRS_DPF 
 host 178.205.241.114
 host 46.232.164.108
!
object-group network OBJ_SHM_TMA_SHM 
 host 89.232.91.106
 host 31.173.182.210
!
object-group network OBJ_EVL_TMA_EVL 
 host 89.232.102.166
!
object-group network OBJ_ITL_VST_ITL 
 host 5.227.124.130
 host 78.85.34.99
 host 78.85.13.165
 host 81.211.13.82
!
object-group network OBJ_MZH_VST_MZH 
 host 88.80.33.250
 host 83.169.220.171
!
object-group network OBJ_KIA_VST_KIA 
 host 85.140.32.24
 host 188.94.168.238
!
object-group network OBJ_KGB_VST_KBB 
 host 78.85.37.88
 host 88.80.33.154
!
object-group network OBJ_SAR_VST_SMK 
 host 78.85.19.93
 host 88.80.33.234
!
object-group network OBJ_KNK_VST_KMK 
 host 178.161.242.67
!
object-group network OBJ_IZH_KM_S61 
 host 84.201.247.32
 host 88.80.33.194
!
object-group network OBJ_YAN_GKZ_YEL 
 host 77.94.97.222
!
object-group network OBJ_KUN_KMK_B2 
 94.138.150.0 255.255.255.0
!
object-group network OBJ_KUN_KMK_H80 
 host 178.161.207.26
 host 77.43.193.88
!
object-group network OBJ_KUN_KMK_CH9 
 host 178.47.128.98
 host 194.150.90.20
!
object-group network OBJ_KGB_RN_KGB 
 host 78.85.13.165
!
object-group network OBJ_NCH_RN_NCH 
 host 78.85.13.166
!
object-group network OBJ_PRI_RN_PRI 
 host 78.85.13.167
!
object-group network OBJ_URN_RN_URN 
 host 78.85.20.49
 group-object OBJ_SAR_MLK_SRM
 group-object OBJ_CLB_MLK_CMK
 group-object OBJ_BBN_RN_BBN
 group-object OBJ_GLZ_GKZ_GKZ
 group-object OBJ_KIA_RN_KIA
 group-object OBJ_IZH_TZK_TZK
 group-object OBJ_IZH_MK_VS17
!
object-group network OBJ_MZH_TK_TKM 
 host 88.80.32.230
 host 78.85.35.34
!
object-group network OBJ_GLZ_TK_TKG 
 host 95.215.208.240
 host 146.120.104.235
 host 95.215.208.173
!
object-group network OBJ_IZH_TK_M21 
 host 84.201.242.133
!
object-group network OBJ_IZH_HLA_PP 
 host 92.61.17.250
!
object-group network OBJ_IZH_HLA_UHK 
 host 92.55.7.148
!
object-group network OBJ_IZH_VD_VS17 
 host 84.201.247.100
!
object-group network OBJ_IZH_KS_H17 
 85.140.32.64 255.255.255.252
 host 85.140.32.63
 host 85.140.32.68
!
object-group network OBJ_SPB_KG_SPB 
 host 62.141.114.190
 host 94.72.27.43
!
object-group network OBJ_BRANCHES 
 group-object OBJ_IZH_MLK_IZM
 group-object OBJ_IZH_KG_P11
 group-object OBJ_IZH_VST_IZM
 group-object OBJ_IZH_TK_M44
 group-object OBJ_IZH_TK_M48
 group-object OBJ_IZH_TK_SMR
 group-object OBJ_MSK_KG_MSK
 group-object OBJ_GLZ_MLK_GMK
 group-object OBJ_KZN_MLK_KMK
 group-object OBJ_KEZ_MLK_KZS
 group-object OBJ_PRM_MLK_PHK
 group-object OBJ_SAR_MLK_SRM
 group-object OBJ_CLB_MLK_CMK
 group-object OBJ_BBN_RN_BBN
 group-object OBJ_GLZ_GKZ_GKZ
 group-object OBJ_KIA_RN_KIA
 group-object OBJ_IZH_TZK_TZK
 group-object OBJ_IZH_MK_VS17
 group-object OBJ_IZH_KL_KLI
 group-object OBJ_EKB_KG_EKB
 group-object OBJ_IZH_KEN_VS56
 group-object OBJ_IZH_VRS_IZM
 group-object OBJ_GLZ_VRS_UPF
 group-object OBJ_IZH_VRS_IPF
 group-object OBJ_IZH_VRS_PFV
 group-object OBJ_VOT_VRS_VPF
 group-object OBJ_MSB_TMA_MSB
 group-object OBJ_KIB_TMA_KIB
 group-object OBJ_PRM_VRS_MPF
 group-object OBJ_LAI_VRS_DPF
 group-object OBJ_BBN_VST_BBN
 group-object OBJ_SHM_TMA_SHM
 group-object OBJ_EVL_TMA_EVL
 group-object OBJ_ITL_VST_ITL
 group-object OBJ_MZH_VST_MZH
 group-object OBJ_KIA_VST_KIA
 group-object OBJ_KGB_VST_KBB
 group-object OBJ_SAR_VST_SMK
 group-object OBJ_KNK_VST_KMK
 group-object OBJ_IZH_KM_S61
 group-object OBJ_YAN_GKZ_YEL
 group-object OBJ_KUN_KMK_B2
 group-object OBJ_KUN_KMK_H80
 group-object OBJ_KUN_KMK_CH9
 group-object OBJ_KGB_RN_KGB
 group-object OBJ_NCH_RN_NCH
 group-object OBJ_PRI_RN_PRI
 group-object OBJ_URN_RN_URN
 group-object OBJ_MZH_TK_TKM
 group-object OBJ_GLZ_TK_TKG
 group-object OBJ_IZH_TK_M21
 group-object OBJ_IZH_HLA_PP
 group-object OBJ_IZH_HLA_UHK
 group-object OBJ_IZH_VD_VS17
 group-object OBJ_IZH_KS_H17
 group-object OBJ_SPB_KG_SPB
!
object-group network STATIC_ISP_IP 
 host 94.72.27.43
 host 91.240.179.150
 host 62.141.114.190
!
vtp version 2
username netadmin privilege 15 secret 5 $1$pPAP$.NMs7.LZamaCZmg4hLUS91
username akhmetzyanovrr privilege 15 password 0 F[vtnpzyjd12
!
!
!
!
lldp run
!
track 10 list boolean or
 object 12
 object 13
 delay down 5 up 30
!
track 11 ip sla 11 reachability
 delay down 10 up 5
!
track 12 ip sla 12 reachability
 delay down 10 up 5
!
track 13 ip sla 13 reachability
 delay down 10 up 5
!
track 100 list boolean or
 object 102
 object 103
 delay down 5 up 30
!
track 101 ip sla 101 reachability
 delay down 10 up 5
!
track 102 ip sla 102 reachability
 delay down 10 up 5
!
track 103 ip sla 103 reachability
 delay down 10 up 5
!
!
class-map match-all CM_QOS_Q6
! 
crypto keyring KR-KOMOS vrf ispA 
  pre-shared-key address 0.0.0.0 0.0.0.0 key mlk20kom19
crypto logging session
!
crypto isakmp policy 150
 encr aes
 authentication pre-share
 group 2
crypto isakmp key mlk20kom19 address 0.0.0.0         no-xauth
crypto isakmp keepalive 30
crypto isakmp nat keepalive 10
crypto isakmp profile PF-ISAKMP-KOMOS
   keyring KR-KOMOS
   match identity address 0.0.0.0 ispA
!
!
crypto ipsec transform-set CRYPTO_TS_DMVPN esp-aes esp-sha-hmac 
 mode transport
!
crypto ipsec profile CRYPTO_IPSEC_DMVPN
 description --SPOKE_TO_SITE_DMVPN_IPSEC_GRE--
 set transform-set CRYPTO_TS_DMVPN 
!
crypto ipsec profile PF-IPSEC-DMVPN
 description --SPOKE_TO_SITE_DMVPN_IPSEC_GRE_VRF--
 set transform-set CRYPTO_TS_DMVPN 
 set isakmp-profile PF-ISAKMP-KOMOS
!
!
!
!
!
!
!
!
interface Loopback300
 description --Managment--
 ip address 10.14.89.254 255.255.255.0
!
interface Loopback7777
 description TK9507m
 no ip address
 shutdown
!
interface Tunnel1001
 description --DMVPN_SPOKE_70_CLOUD_1--
 bandwidth 100000
 ip address 172.30.1.73 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1400
 ip nhrp authentication M_K.Cl01
 ip nhrp map 172.30.1.1 85.140.32.27
 ip nhrp map 172.30.1.2 78.85.13.42
 ip nhrp map multicast 85.140.32.27
 ip nhrp map multicast 78.85.13.42
 ip nhrp network-id 1001
 ip nhrp holdtime 300
 ip nhrp nhs 172.30.1.1
 ip nhrp nhs 172.30.1.2
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0
 tunnel mode gre multipoint
 tunnel key 1001
 tunnel route-via GigabitEthernet0/0 mandatory
 tunnel protection ipsec profile CRYPTO_IPSEC_DMVPN shared
!
interface Tunnel1002
 description --DMVPN_SPOKE_70_CLOUD_2--
 ip address 172.30.2.73 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1400
 ip nhrp authentication M_K.Cl02
 ip nhrp map 172.30.2.1 5.227.124.143
 ip nhrp map 172.30.2.2 78.85.13.93
 ip nhrp map multicast 5.227.124.143
 ip nhrp map multicast 78.85.13.93
 ip nhrp network-id 1002
 ip nhrp holdtime 300
 ip nhrp nhs 172.30.2.1
 ip nhrp nhs 172.30.2.2
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/1
 tunnel mode gre multipoint
 tunnel key 1002
 tunnel vrf ispA
 tunnel protection ipsec profile PF-IPSEC-DMVPN shared
!
interface GigabitEthernet0/0
 description [ISP-100M] MTS
 ip address 94.72.27.43 255.255.255.0
 ip access-group FIREWALL in
 ip access-group LANTOWAN out
 ip nat outside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface GigabitEthernet0/1
 description [ISP-100M] BEELINE
 vrf forwarding ispA
 ip address 62.141.114.190 255.255.255.252
 ip access-group FIREWALL in
 ip access-group LANTOWAN out
 ip nat outside
 ip virtual-reassembly in
 load-interval 30
 duplex auto
 speed auto
!
interface GigabitEthernet1/1
 description [WIFI] AP-2
 switchport access vlan 300
 switchport trunk native vlan 300
 switchport trunk allowed vlan 1,150,300,500,1002-1005
 switchport mode trunk
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/2
 description [WIFI] AP-1
 switchport trunk native vlan 300
 switchport trunk allowed vlan 1,150,300,500,1002-1005
 switchport mode trunk
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/3
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/4
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/5
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/6
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/7
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/8
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/9
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/10
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/11
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/12
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/13
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/14
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/15
 description [PRN] Printer
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/16
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/17
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/18
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/19
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/20
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/21
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/22
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/23
 description ACCESS
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface GigabitEthernet1/24
 description [VOIP] Yalink
 switchport access vlan 2
 switchport voice vlan 350
 no ip address
 storm-control broadcast level 0.50
 storm-control multicast level 0.50
 spanning-tree portfast
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan2
 description --Users--
 ip address 10.14.88.254 255.255.255.0
 ip dns view-group DNS_ACCESS_AREA
 ip nat inside
 ip virtual-reassembly in
!
interface Vlan150
 description --WiFi_Work--
 ip address 10.14.90.254 255.255.255.0
 ip dns view-group DNS_ACCESS_AREA_150
 ip nat inside
 ip virtual-reassembly in
!
interface Vlan300
 description --Managment--
 ip unnumbered Loopback300
 ip dns view-group DNS_ACCESS_AREA_300
 ip virtual-reassembly in
!
interface Vlan350
 description --VOIP--
 ip address 10.14.92.254 255.255.255.0
 ip virtual-reassembly in
!
interface Vlan500
 description --WiFi_Guest--
 ip address 10.14.91.254 255.255.255.0
 ip access-group WIFI_GUEST in
 ip dns view-group DNS_GUEST_AREA
 ip nat inside
 ip virtual-reassembly in
!
router bgp 64552
 bgp log-neighbor-changes
 bgp graceful-restart restart-time 120
 bgp graceful-restart stalepath-time 360
 bgp graceful-restart
 network 10.14.88.0 mask 255.255.248.0
 redistribute connected
 neighbor PG_BGP_OCOD peer-group
 neighbor PG_BGP_OCOD remote-as 64512
 neighbor PG_BGP_OCOD next-hop-self
 neighbor PG_BGP_OCOD soft-reconfiguration inbound
 neighbor PG_BGP_OCOD prefix-list PL-TO_COD out
 neighbor PG_BGP_RCOD peer-group
 neighbor PG_BGP_RCOD remote-as 64513
 neighbor PG_BGP_RCOD next-hop-self
 neighbor PG_BGP_RCOD soft-reconfiguration inbound
 neighbor PG_BGP_RCOD prefix-list PL-TO_COD out
 neighbor 172.30.1.1 peer-group PG_BGP_OCOD
 neighbor 172.30.1.2 peer-group PG_BGP_OCOD
 neighbor 172.30.2.1 peer-group PG_BGP_RCOD
 neighbor 172.30.2.2 peer-group PG_BGP_RCOD
 !
 address-family ipv4 vrf ispA
  redistribute connected metric 11
  redistribute static metric 9
  default-information originate
 exit-address-family
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip tftp source-interface Loopback300
ip dns view KOMOS.LOCAL
 domain name komos.local
 domain list komos.local
 domain round-robin
 dns forwarder 192.168.1.21
 dns forwarder 192.168.1.100
 dns forwarding source-interface Vlan2
ip dns view KOMOS.LOCAL.150
 domain name komos.local
 domain list komos.local
 domain round-robin
 dns forwarder 192.168.1.21
 dns forwarder 192.168.1.100
 dns forwarding source-interface Vlan150
ip dns view KOMOS.LOCAL.300
 domain name komos.local
 domain list komos.local
 domain round-robin
 dns forwarder 192.168.1.21
 dns forwarder 192.168.1.100
 dns forwarding source-interface Vlan300
ip dns view MILKOM-KOMOS.RU
 domain name milkom-komos.ru
 domain list milkom-komos.ru
 domain round-robin
 dns forwarder 192.168.8.200
 dns forwarder 192.168.8.201
 dns forwarding source-interface Vlan2
ip dns view MILKOM-KOMOS.RU.150
 domain name milkom-komos.ru
 domain list milkom-komos.ru
 domain round-robin
 dns forwarder 192.168.8.200
 dns forwarder 192.168.8.201
 dns forwarding source-interface Vlan150
ip dns view MILKOM-KOMOS.RU.300
 domain name milkom-komos.ru
 domain list milkom-komos.ru
 domain round-robin
 dns forwarder 192.168.8.200
 dns forwarder 192.168.8.201
 dns forwarding source-interface Vlan300
ip dns view default
 dns forwarding
 dns forwarder 8.8.8.8
 dns forwarder 8.8.4.4
 dns forwarding source-interface Vlan150
ip dns view-list DNS_GUEST_AREA
 view default 10
ip dns view-list DNS_ACCESS_AREA
 view KOMOS.LOCAL 10
  restrict name-group 1
 view MILKOM-KOMOS.RU 20
  restrict name-group 2
 view default 100
ip dns view-list DNS_ACCESS_AREA_150
 view KOMOS.LOCAL.150 10
  restrict name-group 1
 view MILKOM-KOMOS.RU.150 20
  restrict name-group 2
 view default 100
ip dns view-list DNS_ACCESS_AREA_300
 view KOMOS.LOCAL.300 10
  restrict name-group 1
 view MILKOM-KOMOS.RU.300 20
  restrict name-group 2
 view default 100
ip dns name-list 1 permit .*\.KOMOS\.LOCAL
ip dns name-list 1 permit 192\.IN-ADDR
ip dns name-list 1 permit .*\.KOMOS\.RU
ip dns name-list 1 permit .*\.KOMOS-GROUP\.RU
ip dns name-list 2 permit .*\.MILKOM-KOMOS\.RU
ip dns name-list 2 permit 192\.IN-ADDR
ip dns server view-group DNS_ACCESS_AREA
ip dns server
ip nat inside source route-map RM_NAT_ISP_A interface GigabitEthernet0/1 overload
ip nat inside source route-map RM_NAT_MTS interface GigabitEthernet0/0 overload
ip route 1.1.1.1 255.255.255.255 94.72.27.1 254 name MTS_GW_TEST track 11
ip route 8.8.8.8 255.255.255.255 94.72.27.1 254 name MTS_GW_TEST track 11
ip route vrf ispA 0.0.0.0 0.0.0.0 62.141.114.189 100 name --ISP_A_BeeLine-- track 100
ip route vrf ispA 1.1.1.2 255.255.255.255 62.141.114.189 101 name over_BeeLine_ISP_A track 101
ip route vrf ispA 8.8.4.4 255.255.255.255 62.141.114.189 101 name over_BeeLine_ISP_A track 101
ip route 0.0.0.0 0.0.0.0 94.72.27.1 254 name DEFAULT_ROUTE_TO_ISP_B-MTS
ip route 10.14.88.0 255.255.248.0 Null0 254
ip route 78.85.13.42 255.255.255.255 GigabitEthernet0/0 94.72.27.1 name TO_MLK_DMVPN_1
ip route 85.140.32.27 255.255.255.255 GigabitEthernet0/0 94.72.27.1 name TO_MLK_DMVPN_2
ip ssh logging events
ip ssh version 2
!
ip access-list standard NAT_POOL
 permit 10.14.88.0 0.0.0.255
 permit 10.14.90.0 0.0.0.255
ip access-list standard SPB_NET
 permit 10.14.88.0 0.0.7.255
!
ip access-list extended ACL_QOS_Q6
ip access-list extended FIREWALL
 permit ip object-group OBJ_BRANCHES object-group STATIC_ISP_IP
 permit tcp any object-group STATIC_ISP_IP eq 2110
 permit udp any eq domain object-group STATIC_ISP_IP
 permit udp any eq ntp object-group STATIC_ISP_IP
 permit tcp any object-group STATIC_ISP_IP eq 2109
 permit icmp any any
 evaluate reflectedtraffic 
 permit udp any eq 5060 object-group STATIC_ISP_IP
 deny   ip any any
ip access-list extended LANTOWAN
 permit udp any eq domain any
 permit ip any any reflect reflectedtraffic timeout 300
 permit udp any any eq domain
ip access-list extended LOCAL_TRAFFIC
 permit ip any 192.168.0.0 0.0.255.255
 permit ip any 10.0.0.0 0.255.255.255
ip access-list extended WIFI_GUEST
 permit udp any host 10.14.91.254 eq domain
 deny   ip any 10.0.0.0 0.255.255.255
 deny   ip any 192.168.0.0 0.0.255.255
 deny   ip any 172.16.0.0 0.15.255.255
 permit ip any any
!
!
ip prefix-list PFL_TO_HUB seq 5 permit 10.14.88.0/21
!
ip prefix-list PL-GRT2VRF description Global Router to VRF
ip prefix-list PL-GRT2VRF seq 5 permit 10.14.88.0/21 le 24
!
ip prefix-list PL-ISP_A description ISP_A
ip prefix-list PL-ISP_A seq 5 permit 0.0.0.0/0
ip prefix-list PL-ISP_A seq 10 permit 62.141.114.188/30
!
ip prefix-list PL-TO_COD description Net for COD
ip prefix-list PL-TO_COD seq 5 permit 10.14.88.0/21
ip radius source-interface Vlan300 
ip sla 11
 icmp-echo 94.72.27.1 source-interface GigabitEthernet0/0
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 11 life forever start-time now
ip sla 12
 icmp-echo 1.1.1.1 source-interface GigabitEthernet0/0
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 12 life forever start-time now
ip sla 13
 icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 13 life forever start-time now
ip sla 101
 icmp-echo 62.141.114.189 source-interface GigabitEthernet0/1
 vrf ispA
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 101 life forever start-time now
ip sla 102
 icmp-echo 1.1.1.2 source-interface GigabitEthernet0/1
 vrf ispA
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 102 life forever start-time now
ip sla 103
 icmp-echo 8.8.4.4 source-interface GigabitEthernet0/1
 vrf ispA
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 103 life forever start-time now
ip sla 201
 icmp-echo 1.1.1.1 source-interface GigabitEthernet0/0
kron occurrence EveryDay at 1:00 recurring
 policy-list SaveBackup
!
kron policy-list SaveBackup
 cli write memory
 cli write memory
!
!
route-map RM_NAT_MTS permit 10
 match ip address NAT_POOL
 match interface GigabitEthernet0/0
!
route-map RM_NAT_ISP_A permit 10
 match ip address NAT_POOL
 match interface GigabitEthernet0/1
!
route-map test permit 10
!
route-map RM-IMPORT permit 10
 match ip address prefix-list PL-GRT2VRF
!
route-map RM-EXPORT permit 10
 match ip address prefix-list PL-ISP_A
!
route-map RM_BGP_TO_HUB permit 10
 match ip address prefix-list PFL_TO_HUB
!
route-map RM_ISP_1 permit 10
 match ip address SPB_NET
!
snmp-server community lmTUEsk6Yvlv RO
snmp-server ifindex persist
snmp-server location SPB_Ligovskiy_pr_153_litA
!
radius server IZH-RDS002
 address ipv4 10.4.0.248 auth-port 1645 acct-port 1646
 timeout 3
 retransmit 2
 key hykFAA@Hg9X9fsokWh5q8wez#&^a9lIizldHKxlRer3RE7AbsTsJwdB^RESF$eJ0
!
radius server P11-RDS003
 address ipv4 10.1.122.248 auth-port 1645 acct-port 1646
 timeout 3
 retransmit 2
 key hykFAA@Hg9X9fsokWh5q8wez#&^a9lIizldHKxlRer3RE7AbsTsJwdB^RESF$eJ0
!
!
!
control-plane
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
alias exec sis sh int status
alias exec sib show ip int brief
!
line con 0
 logging synchronous
 login authentication CONSOLE
 no modem enable
line aux 0
line vty 0 4
 exec-timeout 120 0
 logging synchronous
 login authentication NPS
 length 0
 transport input telnet ssh
line vty 5 15
 exec-timeout 120 0
 login authentication NPS
 transport input telnet ssh
!
scheduler allocate 20000 1000
ntp source Loopback300
ntp server 192.168.8.200
ntp server 10.1.8.1 prefer
event manager applet --ISP_A_DOWN--
 event track 100 state down
 action 001 cli command "enable"
 action 002 cli command "clear ip nat translation forced"
 action 003 syslog msg "ISP A BEELINE is DOWN"
event manager applet --ISP_A_UP--
 event track 100 state up
 action 001 cli command "enable"
 action 002 cli command "clear  ip nat translation forced"
 action 003 syslog msg "ISP A BEELINE is UP"
!
end