1795 lines
54 KiB
Plaintext
1795 lines
54 KiB
Plaintext
|
Building configuration...
|
||
|
|
|
||
|
|
Current configuration : 54704 bytes
|
||
|
|
!
|
||
|
|
! Last configuration change at 14:54:37 SAMT Wed Jul 27 2022 by adm_kapustinal
|
||
|
|
! NVRAM config last updated at 14:54:38 SAMT Wed Jul 27 2022 by adm_kapustinal
|
||
|
|
!
|
||
|
|
version 15.4
|
||
|
|
service timestamps debug datetime msec localtime show-timezone year
|
||
|
|
service timestamps log datetime msec localtime show-timezone year
|
||
|
|
no service password-encryption
|
||
|
|
!
|
||
|
|
hostname IZH-MLK-IZM-RT-1-1
|
||
|
|
!
|
||
|
|
boot-start-marker
|
||
|
|
boot-end-marker
|
||
|
|
!
|
||
|
|
!
|
||
|
|
logging userinfo
|
||
|
|
logging buffered 65536
|
||
|
|
enable secret 5 $1$QW0D$QYciH.O0GY9GW37Ao2khP1
|
||
|
|
!
|
||
|
|
aaa new-model
|
||
|
|
!
|
||
|
|
!
|
||
|
|
aaa group server radius NPS
|
||
|
|
server name IZH-RDS002
|
||
|
|
server name P11-RDS003
|
||
|
|
ip radius source-interface GigabitEthernet0/2.300
|
||
|
|
load-balance method least-outstanding
|
||
|
|
!
|
||
|
|
aaa authentication login default group NPS local enable
|
||
|
|
aaa authentication login CONSOLE local group NPS
|
||
|
|
aaa authentication ppp default local
|
||
|
|
aaa authorization exec default group NPS local if-authenticated
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
aaa session-id common
|
||
|
|
clock timezone SAMT 4 0
|
||
|
|
clock calendar-valid
|
||
|
|
!
|
||
|
|
!
|
||
|
|
crypto pki trustpoint TP-self-signed-1393620094
|
||
|
|
enrollment selfsigned
|
||
|
|
subject-name cn=IOS-Self-Signed-Certificate-1393620094
|
||
|
|
revocation-check none
|
||
|
|
rsakeypair TP-self-signed-1393620094
|
||
|
|
!
|
||
|
|
crypto pki trustpoint GEOTRUST
|
||
|
|
enrollment terminal pem
|
||
|
|
revocation-check none
|
||
|
|
!
|
||
|
|
!
|
||
|
|
crypto pki certificate chain TP-self-signed-1393620094
|
||
|
|
certificate self-signed 01
|
||
|
|
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
|
||
|
|
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
|
||
|
|
69666963 6174652D 31333933 36323030 3934301E 170D3135 30313032 31353436
|
||
|
|
32375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
|
||
|
|
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 33393336
|
||
|
|
32303039 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
|
||
|
|
8100AB01 0C306678 D800981E A071B8E5 BAD877CA 3EA05B1D 3F4D4BB3 98888C61
|
||
|
|
2774C683 F564E100 B0284F17 E64BECF7 5C37A0C2 5F450AB9 FCE76F3C 355C6213
|
||
|
|
A0996517 727712D9 0E82CA09 C735E83E 5641ABFC 4B3FC0C8 B341D015 6E1A5F60
|
||
|
|
027E782D 869D7E46 28BE78C7 5F7BA97E 2A5EE9B9 5C28693A 1255E6DA 9D121C1A
|
||
|
|
1BA50203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
|
||
|
|
551D2304 18301680 14020A66 0B88B3F2 6E048A80 48C0B762 D022D70E 0F301D06
|
||
|
|
03551D0E 04160414 020A660B 88B3F26E 048A8048 C0B762D0 22D70E0F 300D0609
|
||
|
|
2A864886 F70D0101 05050003 8181005F B1CB7D90 2E300573 445DEB7E 1117F5DE
|
||
|
|
F9F7A286 4608E79D F50A82D0 92AD66D7 EF24960C 51939A98 FE64E073 579C740A
|
||
|
|
C9568D58 1DF5078A 36102592 F5018434 81B3748F 9DAA57BF E88DDC28 6E5D0424
|
||
|
|
E3904AEC 8D5E870C B3144718 9C7DAEAF 001FE25C 939BF48D 2A7FCF94 85DDFA6E
|
||
|
|
7630727D 39311D17 18DB7601 70FF74
|
||
|
|
quit
|
||
|
|
crypto pki certificate chain GEOTRUST
|
||
|
|
certificate ca 023A6F
|
||
|
|
3082044F 30820337 A0030201 02020302 3A6F300D 06092A86 4886F70D 01010B05
|
||
|
|
00304231 0B300906 03550406 13025553 31163014 06035504 0A130D47 656F5472
|
||
|
|
75737420 496E632E 311B3019 06035504 03131247 656F5472 75737420 476C6F62
|
||
|
|
616C2043 41301E17 0D313331 31303532 31333635 305A170D 32323035 32303231
|
||
|
|
33363530 5A304431 0B300906 03550406 13025553 31163014 06035504 0A130D47
|
||
|
|
656F5472 75737420 496E632E 311D301B 06035504 03131447 656F5472 75737420
|
||
|
|
53534C20 4341202D 20473330 82012230 0D06092A 864886F7 0D010101 05000382
|
||
|
|
010F0030 82010A02 82010100 E3BE7E0A 86A3CF6B 6D3D2BA1 97AD4924 4DD777B9
|
||
|
|
347908A5 9EA29EDE 4712923D 7EEA1986 B1E84F3D 5FF7D0A7 779A5B1F 0A03B519
|
||
|
|
53DBA521 9469639D 6A4C910C 1047BE11 FA6C8625 B7AB0468 42380965 F014DA19
|
||
|
|
9EFA6B0B AB62EF8D A7EF6370 23A8AF81 F3D16E88 6753EC12 A429758A A7F2573D
|
||
|
|
A2839897 F20A7DD4 E7436E30 78622259 59B87127 45AA0F66 C6553FFA 32172B31
|
||
|
|
8F46A0FA 69147C9D 9F5AE2EB 334E10A6 B3ED7763 D8C39EF4 DDDF799A 7AD4EEDE
|
||
|
|
DD9ACCC3 B7A95DCC 113A07BB 6F97A401 2347951F A377FA58 92C6C7D0 BDCF9318
|
||
|
|
42B77EF7 9E65EAD5 3BCAEDAC C570A1FE D4109AF0 120444AC 1A5B7850 45574C6F
|
||
|
|
BD80CB81 5C2DB3BC 76A11E65 02030100 01A38201 4A308201 46301F06 03551D23
|
||
|
|
04183016 8014C07A 98688D89 FBAB0564 0C117DAA 7D65B8CA CC4E301D 0603551D
|
||
|
|
0E041604 14D26FF7 96F4853F 723C307D 23DA8578 9BA37C5A 7C301206 03551D13
|
||
|
|
0101FF04 08300601 01FF0201 00300E06 03551D0F 0101FF04 04030201 06303606
|
||
|
|
03551D1F 042F302D 302BA029 A0278625 68747470 3A2F2F67 312E7379 6D63622E
|
||
|
|
636F6D2F 63726C73 2F677467 6C6F6261 6C2E6372 6C302F06 082B0601 05050701
|
||
|
|
01042330 21301F06 082B0601 05050730 01861368 7474703A 2F2F6732 2E73796D
|
||
|
|
63622E63 6F6D304C 0603551D 20044530 43304106 0A608648 0186F845 01073630
|
||
|
|
33303106 082B0601 05050702 01162568 7474703A 2F2F7777 772E6765 6F747275
|
||
|
|
73742E63 6F6D2F72 65736F75 72636573 2F637073 30290603 551D1104 223020A4
|
||
|
|
1E301C31 1A301806 03550403 13115379 6D616E74 6563504B 492D312D 35333930
|
||
|
|
0D06092A 864886F7 0D01010B 05000382 010100A0 D4F72CFB 740B7F64 F1CD436A
|
||
|
|
9F62531C 027C9890 A2EE4F68 D4201A73 123E77B3 50EB72BC EE88BE7F 17EA778F
|
||
|
|
8361954F 84A1CB32 4F6C21BE D269967D 63BDDC2B A81FD013 8470FEF6 359589F9
|
||
|
|
A677B046 C8BBB713 F5C96069 D64CFED2 8EEFD360 C18080E1 E7FB8B6F 21794AE0
|
||
|
|
DCA91BC1 B7FBC349 595CB577 0744D497 FC490089 6F064E01 7019AC2F 11C0E2E6
|
||
|
|
0F2F864B 8D7BC3B9 A72EF4F1 AC163E39 49519E17 4B4F103A 5BA5A892 6FFDFAD6
|
||
|
|
0B034D47 565719F3 CB6BF5F3 D6CFB0F5 F5A311D2 20531334 37052C43 5A63DF8D
|
||
|
|
40D6851E 51E95117 1E0356C9 F130ADE7 9B11A2B9 D031819B 68B1D9E8 F3E6947E
|
||
|
|
C7AE132F 87EDD025 B068F9DE 085AF329 CCD492
|
||
|
|
quit
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
ip flow-cache timeout inactive 60
|
||
|
|
ip flow-cache timeout active 5
|
||
|
|
no ip domain lookup
|
||
|
|
ip domain name milkom-komos.ru
|
||
|
|
ip host tftp 10.4.0.214
|
||
|
|
ip inspect tcp reassembly queue length 128
|
||
|
|
ip inspect tcp reassembly timeout 10
|
||
|
|
ip inspect name Internet tcp router-traffic
|
||
|
|
ip inspect name Internet udp
|
||
|
|
ip inspect name Internet icmp router-traffic
|
||
|
|
ip dhcp-server 10.10.1.254
|
||
|
|
ip cef
|
||
|
|
login on-failure log
|
||
|
|
login on-success log
|
||
|
|
no ipv6 cef
|
||
|
|
!
|
||
|
|
!
|
||
|
|
flow exporter NAT_FLOW
|
||
|
|
destination 10.4.0.214
|
||
|
|
transport udp 2055
|
||
|
|
!
|
||
|
|
!
|
||
|
|
flow monitor NAT_FLOW
|
||
|
|
exporter NAT_FLOW
|
||
|
|
record netflow-original
|
||
|
|
!
|
||
|
|
!
|
||
|
|
multilink bundle-name authenticated
|
||
|
|
!
|
||
|
|
vpdn enable
|
||
|
|
vpdn session-limit 5000
|
||
|
|
!
|
||
|
|
vpdn-group L2TP_PRIMARY
|
||
|
|
! Default L2TP VPDN group
|
||
|
|
description Primary L2TP VPDN group
|
||
|
|
accept-dialin
|
||
|
|
protocol l2tp
|
||
|
|
virtual-template 1
|
||
|
|
no l2tp tunnel authentication
|
||
|
|
!
|
||
|
|
!
|
||
|
|
no virtual-template subinterface
|
||
|
|
cts logging verbose
|
||
|
|
license udi pid C3900-SPE100/K9 sn FOC18513F2G
|
||
|
|
license boot module c3900 technology-package securityk9
|
||
|
|
!
|
||
|
|
!
|
||
|
|
archive
|
||
|
|
log config
|
||
|
|
logging enable
|
||
|
|
logging size 900
|
||
|
|
notify syslog contenttype plaintext
|
||
|
|
hidekeys
|
||
|
|
path tftp://tftp/IZH/3925/$H-$T
|
||
|
|
write-memory
|
||
|
|
time-period 10080
|
||
|
|
object-group network GRE_SRC_IP
|
||
|
|
host 31.173.105.66
|
||
|
|
host 85.140.32.30
|
||
|
|
host 78.85.13.52
|
||
|
|
host 46.146.210.68
|
||
|
|
host 178.161.175.54
|
||
|
|
host 83.69.126.54
|
||
|
|
host 78.138.171.82
|
||
|
|
host 78.85.13.165
|
||
|
|
host 185.62.195.150
|
||
|
|
host 185.6.175.101
|
||
|
|
host 31.173.105.58
|
||
|
|
host 85.140.32.28
|
||
|
|
host 78.85.13.53
|
||
|
|
host 85.140.32.29
|
||
|
|
host 31.173.105.62
|
||
|
|
host 37.113.128.241
|
||
|
|
host 85.140.32.166
|
||
|
|
host 31.173.105.46
|
||
|
|
host 78.85.35.164
|
||
|
|
host 178.47.128.18
|
||
|
|
host 94.138.150.1
|
||
|
|
host 178.47.128.98
|
||
|
|
host 5.227.125.114
|
||
|
|
host 82.142.146.70
|
||
|
|
!
|
||
|
|
object-group network HEADLINE_IP
|
||
|
|
host 87.249.247.80
|
||
|
|
!
|
||
|
|
object-group network LAINER_TELECOM
|
||
|
|
host 87.249.224.136
|
||
|
|
host 87.249.231.218
|
||
|
|
host 87.249.244.255
|
||
|
|
!
|
||
|
|
object-group network OBJ_BBN_RN_BBN
|
||
|
|
host 85.140.32.104
|
||
|
|
host 78.85.13.205
|
||
|
|
!
|
||
|
|
object-group network OBJ_BBN_VST_BBN
|
||
|
|
host 85.140.32.103
|
||
|
|
host 83.169.220.204
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_MLK_IZM
|
||
|
|
host 85.140.32.27
|
||
|
|
host 78.85.13.42
|
||
|
|
host 5.227.126.169
|
||
|
|
host 31.173.105.54
|
||
|
|
host 217.14.195.253
|
||
|
|
host 85.175.86.74
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_KG_P11
|
||
|
|
91.240.179.0 255.255.255.0
|
||
|
|
host 5.227.124.143
|
||
|
|
host 78.85.13.93
|
||
|
|
host 62.141.96.126
|
||
|
|
host 84.201.247.190
|
||
|
|
host 88.80.33.50
|
||
|
|
host 94.25.46.122
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_VST_IZM
|
||
|
|
host 5.227.124.82
|
||
|
|
host 78.85.13.38
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_TK_M44
|
||
|
|
host 212.46.204.74
|
||
|
|
host 88.80.33.162
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_TK_M48
|
||
|
|
host 87.249.237.250
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_TK_SMR
|
||
|
|
host 87.249.239.226
|
||
|
|
host 88.80.33.42
|
||
|
|
!
|
||
|
|
object-group network OBJ_MZH_TK_TKM
|
||
|
|
host 88.80.32.230
|
||
|
|
host 78.85.35.34
|
||
|
|
!
|
||
|
|
object-group network OBJ_GLZ_TK_TKG
|
||
|
|
host 95.215.208.240
|
||
|
|
host 146.120.104.235
|
||
|
|
host 95.215.208.173
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_TK_M21
|
||
|
|
host 84.201.242.133
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_HLA_PP
|
||
|
|
host 92.61.17.250
|
||
|
|
!
|
||
|
|
object-group network OBJ_MSK_KG_MSK
|
||
|
|
host 185.62.195.150
|
||
|
|
host 185.6.175.101
|
||
|
|
!
|
||
|
|
object-group network OBJ_GLZ_MLK_GMK
|
||
|
|
host 31.173.105.62
|
||
|
|
host 85.140.32.29
|
||
|
|
!
|
||
|
|
object-group network OBJ_KZN_MLK_KMK
|
||
|
|
host 83.69.126.54
|
||
|
|
host 94.180.253.210
|
||
|
|
host 78.138.171.82
|
||
|
|
!
|
||
|
|
object-group network OBJ_KEZ_MLK_KZS
|
||
|
|
host 31.173.105.66
|
||
|
|
host 78.85.13.52
|
||
|
|
host 85.140.32.30
|
||
|
|
!
|
||
|
|
object-group network OBJ_PRM_MLK_PHK
|
||
|
|
host 178.47.128.18
|
||
|
|
host 46.146.210.68
|
||
|
|
!
|
||
|
|
object-group network OBJ_SAR_MLK_SRM
|
||
|
|
host 31.173.105.58
|
||
|
|
host 78.85.13.53
|
||
|
|
host 85.140.32.28
|
||
|
|
!
|
||
|
|
object-group network OBJ_CLB_MLK_CMK
|
||
|
|
host 37.113.128.241
|
||
|
|
host 149.255.6.35
|
||
|
|
!
|
||
|
|
object-group network OBJ_GLZ_GKZ_GKZ
|
||
|
|
host 78.85.13.94
|
||
|
|
host 146.120.104.181
|
||
|
|
!
|
||
|
|
object-group network OBJ_YAN_GKZ_YEL
|
||
|
|
host 77.94.97.222
|
||
|
|
host 213.87.197.29
|
||
|
|
!
|
||
|
|
object-group network OBJ_KIA_RN_KIA
|
||
|
|
host 78.85.14.97
|
||
|
|
!
|
||
|
|
object-group network OBJ_KGB_RN_KGB
|
||
|
|
host 78.85.13.165
|
||
|
|
!
|
||
|
|
object-group network OBJ_NCH_RN_NCH
|
||
|
|
host 78.85.13.166
|
||
|
|
!
|
||
|
|
object-group network OBJ_PRI_RN_PRI
|
||
|
|
host 78.85.13.167
|
||
|
|
!
|
||
|
|
object-group network OBJ_URN_RN_URN
|
||
|
|
host 78.85.20.49
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_TZK_TZK
|
||
|
|
host 78.25.80.134
|
||
|
|
host 5.227.124.235
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_MK_VS17
|
||
|
|
host 5.227.124.141
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_KL_KLI
|
||
|
|
host 78.85.15.85
|
||
|
|
host 84.201.247.24
|
||
|
|
host 79.175.36.97
|
||
|
|
host 84.201.244.235
|
||
|
|
!
|
||
|
|
object-group network OBJ_EKB_KG_EKB
|
||
|
|
host 62.168.232.182
|
||
|
|
host 176.215.14.11
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_KEN_VS56
|
||
|
|
host 83.143.54.246
|
||
|
|
host 92.55.54.109
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_VRS_IZM
|
||
|
|
host 85.140.32.177
|
||
|
|
host 78.85.14.98
|
||
|
|
!
|
||
|
|
object-group network OBJ_GLZ_VRS_UPF
|
||
|
|
host 95.215.208.234
|
||
|
|
host 78.85.13.119
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_VRS_IPF
|
||
|
|
host 85.140.32.141
|
||
|
|
host 78.85.13.117
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_VRS_PFV
|
||
|
|
host 85.140.32.178
|
||
|
|
host 94.181.119.90
|
||
|
|
host 78.85.33.50
|
||
|
|
!
|
||
|
|
object-group network OBJ_VOT_VRS_VPF
|
||
|
|
host 78.85.13.118
|
||
|
|
host 88.80.33.14
|
||
|
|
!
|
||
|
|
object-group network OBJ_PRM_VRS_MPF
|
||
|
|
host 178.47.130.10
|
||
|
|
host 5.227.121.127
|
||
|
|
!
|
||
|
|
object-group network OBJ_LAI_VRS_DPF
|
||
|
|
host 178.205.241.114
|
||
|
|
host 46.232.164.108
|
||
|
|
!
|
||
|
|
object-group network OBJ_ITL_VST_ITL
|
||
|
|
host 5.227.124.130
|
||
|
|
host 78.85.34.99
|
||
|
|
host 81.211.13.82
|
||
|
|
!
|
||
|
|
object-group network OBJ_MZH_VST_MZH
|
||
|
|
host 88.80.33.250
|
||
|
|
host 83.169.220.171
|
||
|
|
!
|
||
|
|
object-group network OBJ_KIA_VST_KIA
|
||
|
|
host 85.140.32.24
|
||
|
|
host 188.94.168.238
|
||
|
|
!
|
||
|
|
object-group network OBJ_KGB_VST_KBB
|
||
|
|
host 78.85.37.88
|
||
|
|
host 88.80.33.154
|
||
|
|
host 78.85.13.165
|
||
|
|
!
|
||
|
|
object-group network OBJ_SAR_VST_SMK
|
||
|
|
host 78.85.19.93
|
||
|
|
host 88.80.33.234
|
||
|
|
!
|
||
|
|
object-group network OBJ_KNK_VST_KMK
|
||
|
|
host 178.161.242.67
|
||
|
|
!
|
||
|
|
object-group network OBJ_SHM_TMA_SHM
|
||
|
|
host 89.232.91.106
|
||
|
|
host 31.173.182.210
|
||
|
|
!
|
||
|
|
object-group network OBJ_MSB_TMA_MSB
|
||
|
|
host 78.138.182.214
|
||
|
|
!
|
||
|
|
object-group network OBJ_EVL_TMA_EVL
|
||
|
|
host 89.232.102.166
|
||
|
|
!
|
||
|
|
object-group network OBJ_KIB_TMA_KIB
|
||
|
|
host 78.138.182.126
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_KM_S61
|
||
|
|
host 84.201.247.32
|
||
|
|
host 88.80.33.194
|
||
|
|
!
|
||
|
|
object-group network OBJ_KUN_KMK_B2
|
||
|
|
94.138.150.0 255.255.255.0
|
||
|
|
host 178.47.138.134
|
||
|
|
!
|
||
|
|
object-group network OBJ_KUN_KMK_H80
|
||
|
|
host 178.161.207.26
|
||
|
|
host 77.43.193.88
|
||
|
|
!
|
||
|
|
object-group network OBJ_KUN_KMK_CH9
|
||
|
|
host 178.47.128.98
|
||
|
|
host 195.69.159.2
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_HLA_UHK
|
||
|
|
host 92.55.7.148
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_VD_VS17
|
||
|
|
host 84.201.247.100
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_KS_H17
|
||
|
|
85.140.32.64 255.255.255.252
|
||
|
|
host 85.140.32.63
|
||
|
|
host 85.140.32.68
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_KLS_P20
|
||
|
|
host 5.227.125.114
|
||
|
|
!
|
||
|
|
object-group network OBJ_IZH_KI_VOR158
|
||
|
|
host 46.147.130.59
|
||
|
|
host 5.227.125.126
|
||
|
|
!
|
||
|
|
object-group network OBJ_OTHER
|
||
|
|
host 78.85.21.21
|
||
|
|
host 78.85.13.165
|
||
|
|
host 78.85.13.167
|
||
|
|
host 78.85.13.166
|
||
|
|
host 78.85.13.205
|
||
|
|
host 78.85.13.201
|
||
|
|
host 78.85.13.107
|
||
|
|
host 78.85.13.106
|
||
|
|
!
|
||
|
|
object-group network OBJ_SPB_KG_SPB
|
||
|
|
host 62.141.114.190
|
||
|
|
host 94.72.27.43
|
||
|
|
!
|
||
|
|
object-group network OBJ_BRANCHES
|
||
|
|
group-object OBJ_IZH_MLK_IZM
|
||
|
|
group-object OBJ_IZH_KG_P11
|
||
|
|
group-object OBJ_IZH_VST_IZM
|
||
|
|
group-object OBJ_IZH_TK_M44
|
||
|
|
group-object OBJ_IZH_TK_M48
|
||
|
|
group-object OBJ_IZH_TK_SMR
|
||
|
|
group-object OBJ_MZH_TK_TKM
|
||
|
|
group-object OBJ_GLZ_TK_TKG
|
||
|
|
group-object OBJ_IZH_TK_M21
|
||
|
|
group-object OBJ_IZH_HLA_PP
|
||
|
|
group-object OBJ_MSK_KG_MSK
|
||
|
|
group-object OBJ_GLZ_MLK_GMK
|
||
|
|
group-object OBJ_KZN_MLK_KMK
|
||
|
|
group-object OBJ_KEZ_MLK_KZS
|
||
|
|
group-object OBJ_PRM_MLK_PHK
|
||
|
|
group-object OBJ_SAR_MLK_SRM
|
||
|
|
group-object OBJ_CLB_MLK_CMK
|
||
|
|
group-object OBJ_GLZ_GKZ_GKZ
|
||
|
|
group-object OBJ_YAN_GKZ_YEL
|
||
|
|
group-object OBJ_KIA_RN_KIA
|
||
|
|
group-object OBJ_BBN_RN_BBN
|
||
|
|
group-object OBJ_KGB_RN_KGB
|
||
|
|
group-object OBJ_NCH_RN_NCH
|
||
|
|
group-object OBJ_PRI_RN_PRI
|
||
|
|
group-object OBJ_URN_RN_URN
|
||
|
|
group-object OBJ_IZH_TZK_TZK
|
||
|
|
group-object OBJ_IZH_MK_VS17
|
||
|
|
group-object OBJ_IZH_KL_KLI
|
||
|
|
group-object OBJ_EKB_KG_EKB
|
||
|
|
group-object OBJ_IZH_KEN_VS56
|
||
|
|
group-object OBJ_IZH_VRS_IZM
|
||
|
|
group-object OBJ_GLZ_VRS_UPF
|
||
|
|
group-object OBJ_IZH_VRS_IPF
|
||
|
|
group-object OBJ_IZH_VRS_PFV
|
||
|
|
group-object OBJ_VOT_VRS_VPF
|
||
|
|
group-object OBJ_PRM_VRS_MPF
|
||
|
|
group-object OBJ_LAI_VRS_DPF
|
||
|
|
group-object OBJ_ITL_VST_ITL
|
||
|
|
group-object OBJ_MZH_VST_MZH
|
||
|
|
group-object OBJ_KIA_VST_KIA
|
||
|
|
group-object OBJ_KGB_VST_KBB
|
||
|
|
group-object OBJ_SAR_VST_SMK
|
||
|
|
group-object OBJ_KNK_VST_KMK
|
||
|
|
group-object OBJ_BBN_VST_BBN
|
||
|
|
group-object OBJ_SHM_TMA_SHM
|
||
|
|
group-object OBJ_MSB_TMA_MSB
|
||
|
|
group-object OBJ_EVL_TMA_EVL
|
||
|
|
group-object OBJ_KIB_TMA_KIB
|
||
|
|
group-object OBJ_IZH_KM_S61
|
||
|
|
group-object OBJ_KUN_KMK_B2
|
||
|
|
group-object OBJ_KUN_KMK_H80
|
||
|
|
group-object OBJ_KUN_KMK_CH9
|
||
|
|
group-object OBJ_IZH_HLA_UHK
|
||
|
|
group-object OBJ_IZH_VD_VS17
|
||
|
|
group-object OBJ_IZH_KS_H17
|
||
|
|
group-object OBJ_IZH_KLS_P20
|
||
|
|
group-object OBJ_IZH_KI_VOR158
|
||
|
|
group-object OBJ_OTHER
|
||
|
|
group-object OBJ_SPB_KG_SPB
|
||
|
|
!
|
||
|
|
object-group network OBJ_NET_BLACKLIST
|
||
|
|
host 167.160.182.20
|
||
|
|
!
|
||
|
|
object-group network OBJ_NET_CISCOASA
|
||
|
|
host 91.240.179.28
|
||
|
|
host 91.240.179.29
|
||
|
|
host 91.240.179.30
|
||
|
|
host 91.240.179.62
|
||
|
|
host 91.240.179.63
|
||
|
|
host 91.240.179.64
|
||
|
|
!
|
||
|
|
object-group network OBJ_PART_SELECTEL
|
||
|
|
host 185.137.232.142
|
||
|
|
!
|
||
|
|
object-group network OBJ_PART_HTC
|
||
|
|
host 95.213.184.82
|
||
|
|
host 185.137.232.142
|
||
|
|
host 178.208.83.31
|
||
|
|
host 37.46.131.147
|
||
|
|
host 5.227.124.141
|
||
|
|
host 195.19.101.162
|
||
|
|
host 194.150.91.170
|
||
|
|
group-object OBJ_PART_SELECTEL
|
||
|
|
!
|
||
|
|
object-group network OBJ_NET_FTP_USERS
|
||
|
|
host 87.249.244.215
|
||
|
|
host 78.85.17.101
|
||
|
|
host 78.85.37.100
|
||
|
|
host 77.245.121.45
|
||
|
|
host 89.148.228.140
|
||
|
|
host 212.33.246.21
|
||
|
|
host 84.201.247.66
|
||
|
|
host 91.210.192.253
|
||
|
|
host 78.85.24.16
|
||
|
|
host 78.85.16.19
|
||
|
|
host 78.85.17.47
|
||
|
|
host 91.210.192.180
|
||
|
|
host 194.79.33.154
|
||
|
|
host 78.85.32.117
|
||
|
|
host 212.48.53.102
|
||
|
|
host 94.181.119.163
|
||
|
|
host 146.120.104.227
|
||
|
|
host 80.76.238.38
|
||
|
|
host 77.41.138.22
|
||
|
|
91.240.179.0 255.255.255.0
|
||
|
|
host 213.87.94.94
|
||
|
|
host 78.85.28.78
|
||
|
|
host 86.109.199.218
|
||
|
|
host 178.161.170.218
|
||
|
|
host 94.181.119.90
|
||
|
|
host 78.25.80.122
|
||
|
|
host 92.55.34.57
|
||
|
|
host 176.9.88.238
|
||
|
|
host 78.85.99.241
|
||
|
|
94.138.150.0 255.255.255.0
|
||
|
|
host 194.150.90.20
|
||
|
|
host 94.51.91.50
|
||
|
|
group-object OBJ_PART_HTC
|
||
|
|
host 95.213.184.82
|
||
|
|
host 185.137.232.142
|
||
|
|
host 178.208.83.31
|
||
|
|
host 37.46.131.147
|
||
|
|
host 5.227.124.141
|
||
|
|
host 195.19.101.162
|
||
|
|
host 194.150.91.170
|
||
|
|
group-object OBJ_PART_SELECTEL
|
||
|
|
!
|
||
|
|
object-group network OBJ_PART_Goods4Cust
|
||
|
|
description Makarov N
|
||
|
|
host 109.236.69.166
|
||
|
|
host 195.209.60.66
|
||
|
|
!
|
||
|
|
object-group network OBJ_PART_HEADLINE
|
||
|
|
host 87.249.247.80
|
||
|
|
!
|
||
|
|
object-group network OBJ_PART_ROSA
|
||
|
|
description Naydenov
|
||
|
|
host 217.114.154.92
|
||
|
|
!
|
||
|
|
object-group network OBJ_SRV_IRONPORT
|
||
|
|
host 91.240.179.26
|
||
|
|
host 91.240.179.27
|
||
|
|
!
|
||
|
|
object-group network OBJ_SRV_SKYPE
|
||
|
|
host 91.240.179.37
|
||
|
|
host 91.240.179.38
|
||
|
|
host 91.240.179.39
|
||
|
|
!
|
||
|
|
object-group service OBJ_SVC_ANY_CONNECT
|
||
|
|
tcp eq 443
|
||
|
|
udp eq 443
|
||
|
|
!
|
||
|
|
object-group service OBJ_SVC_FTP
|
||
|
|
tcp eq ftp
|
||
|
|
tcp eq ftp-data
|
||
|
|
tcp range 50000 65535
|
||
|
|
!
|
||
|
|
object-group network OBJ_SVC_KSMG
|
||
|
|
host 91.240.179.73
|
||
|
|
host 91.240.179.74
|
||
|
|
!
|
||
|
|
object-group service OBJ_SVC_L2TP
|
||
|
|
udp eq isakmp
|
||
|
|
udp eq non500-isakmp
|
||
|
|
udp eq 1701
|
||
|
|
tcp eq 1701
|
||
|
|
esp
|
||
|
|
!
|
||
|
|
object-group service OBJ_SVC_SFB
|
||
|
|
tcp eq 443
|
||
|
|
tcp eq 5061
|
||
|
|
udp eq domain
|
||
|
|
udp eq 3478
|
||
|
|
!
|
||
|
|
object-group service OBJ_SVC_VIPole
|
||
|
|
udp range 3000 9000
|
||
|
|
tcp eq 37210
|
||
|
|
tcp eq 37212
|
||
|
|
tcp eq 443
|
||
|
|
!
|
||
|
|
object-group service SERVICE_L2TP
|
||
|
|
udp eq isakmp
|
||
|
|
udp eq non500-isakmp
|
||
|
|
udp eq 1701
|
||
|
|
tcp eq 1701
|
||
|
|
esp
|
||
|
|
!
|
||
|
|
object-group service SERVICE_PPTP
|
||
|
|
tcp eq 1723
|
||
|
|
gre
|
||
|
|
!
|
||
|
|
object-group network STATIC_ISP_IP
|
||
|
|
host 217.14.195.253
|
||
|
|
host 85.175.86.74
|
||
|
|
!
|
||
|
|
username netadmin privilege 15 secret 5 $1$CIDn$gX5vG9z8lk1YswXnLsl8c1
|
||
|
|
!
|
||
|
|
redundancy
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
bfd-template single-hop BFD-KOMOS
|
||
|
|
interval min-tx 500 min-rx 500 multiplier 3
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
track 1 ip sla 1 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 2 ip sla 2 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 3 ip sla 3 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 4 ip sla 4 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 5 ip sla 5 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 6 ip sla 6 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 10 list boolean or
|
||
|
|
object 1
|
||
|
|
object 2
|
||
|
|
object 3
|
||
|
|
object 4
|
||
|
|
object 5
|
||
|
|
object 6
|
||
|
|
delay down 5 up 30
|
||
|
|
!
|
||
|
|
track 11 ip sla 11 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 12 ip sla 12 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 13 ip sla 13 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 14 ip sla 14 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 15 ip sla 15 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 16 ip sla 16 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 20 list boolean or
|
||
|
|
object 11
|
||
|
|
object 12
|
||
|
|
object 13
|
||
|
|
object 14
|
||
|
|
object 15
|
||
|
|
object 16
|
||
|
|
delay down 5 up 30
|
||
|
|
!
|
||
|
|
track 200 list boolean or
|
||
|
|
object 202
|
||
|
|
object 203
|
||
|
|
delay down 5 up 30
|
||
|
|
!
|
||
|
|
track 202 ip sla 202 reachability
|
||
|
|
delay down 10 up 5
|
||
|
|
!
|
||
|
|
track 203 ip sla 203 reachability
|
||
|
|
!
|
||
|
|
ip ssh authentication-retries 2
|
||
|
|
ip ssh version 2
|
||
|
|
!
|
||
|
|
class-map match-any CM_QOS_Q2
|
||
|
|
match dscp cs2 af21 af22 af23
|
||
|
|
match access-group name ACL_QOS_Q2
|
||
|
|
class-map match-all CM_QOS_Q3
|
||
|
|
match dscp cs3 af31 af32 af33
|
||
|
|
class-map match-all CM_QOS_Q4
|
||
|
|
match dscp cs4 af41 af42 af43
|
||
|
|
class-map match-any CM_QOS_IPSEC-ESP
|
||
|
|
match access-group name ACL_QOS_ESP
|
||
|
|
!
|
||
|
|
policy-map PM_TEST_ARR_ADAP
|
||
|
|
class class-default
|
||
|
|
shape average 5000000
|
||
|
|
policy-map PM_QOS_IN
|
||
|
|
class CM_QOS_Q2
|
||
|
|
set dscp cs2
|
||
|
|
policy-map PM_QOS_GLOBAL_OUT
|
||
|
|
class CM_QOS_IPSEC-ESP
|
||
|
|
police 80000000
|
||
|
|
class CM_QOS_Q3
|
||
|
|
class CM_QOS_Q4
|
||
|
|
class CM_QOS_Q2
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
crypto isakmp policy 20
|
||
|
|
encr 3des
|
||
|
|
authentication pre-share
|
||
|
|
group 2
|
||
|
|
lifetime 500
|
||
|
|
!
|
||
|
|
crypto isakmp policy 30
|
||
|
|
encr aes 256
|
||
|
|
authentication pre-share
|
||
|
|
group 14
|
||
|
|
!
|
||
|
|
crypto isakmp policy 40
|
||
|
|
encr aes 256
|
||
|
|
authentication pre-share
|
||
|
|
group 2
|
||
|
|
!
|
||
|
|
crypto isakmp policy 50
|
||
|
|
encr aes
|
||
|
|
authentication pre-share
|
||
|
|
group 2
|
||
|
|
crypto isakmp key F5BfdOazun4M address 82.142.146.70
|
||
|
|
crypto isakmp key fjhJSHpUcnqbpGfI address 0.0.0.0 no-xauth
|
||
|
|
crypto isakmp keepalive 20
|
||
|
|
!
|
||
|
|
crypto ipsec security-association replay disable
|
||
|
|
!
|
||
|
|
crypto ipsec transform-set L2TP_PRIMARY_TR esp-3des esp-sha-hmac
|
||
|
|
mode transport
|
||
|
|
crypto ipsec transform-set tr-3des esp-3des
|
||
|
|
mode tunnel
|
||
|
|
crypto ipsec transform-set ipsec-transform esp-3des esp-md5-hmac
|
||
|
|
mode transport require
|
||
|
|
crypto ipsec transform-set ipsec-transform-aes esp-aes esp-md5-hmac
|
||
|
|
mode transport require
|
||
|
|
crypto ipsec transform-set TS-BEECLOUD esp-aes 256 esp-sha-hmac
|
||
|
|
mode transport
|
||
|
|
crypto ipsec transform-set TS_GREIPSEC esp-aes 256 esp-sha-hmac
|
||
|
|
mode transport require
|
||
|
|
crypto ipsec df-bit clear
|
||
|
|
!
|
||
|
|
crypto ipsec profile GRE_IPSEC
|
||
|
|
set transform-set TS_GREIPSEC
|
||
|
|
set pfs group2
|
||
|
|
!
|
||
|
|
crypto ipsec profile PF-BEECLOUD
|
||
|
|
set transform-set TS-BEECLOUD
|
||
|
|
set pfs group14
|
||
|
|
!
|
||
|
|
!
|
||
|
|
crypto ipsec profile gre-gre-3des
|
||
|
|
set transform-set ipsec-transform
|
||
|
|
!
|
||
|
|
!
|
||
|
|
crypto dynamic-map L2TP_PRIMARY_DMAP 10
|
||
|
|
set nat demux
|
||
|
|
set transform-set L2TP_PRIMARY_TR
|
||
|
|
!
|
||
|
|
!
|
||
|
|
crypto map L2TP_PRIMARY_MAP 10 ipsec-isakmp dynamic L2TP_PRIMARY_DMAP
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
interface Loopback111
|
||
|
|
description MGM
|
||
|
|
ip address 10.111.12.1 255.255.255.255
|
||
|
|
ip nat outside
|
||
|
|
ip virtual-reassembly in
|
||
|
|
!
|
||
|
|
interface Tunnel31
|
||
|
|
description KGR-KUMK-KUMK-RT-1-1
|
||
|
|
ip address 172.30.31.5 255.255.255.252
|
||
|
|
ip access-group ACL_FROM_KUMK in
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
keepalive 10 3
|
||
|
|
tunnel source GigabitEthernet0/1
|
||
|
|
tunnel destination 94.138.150.1
|
||
|
|
tunnel protection ipsec profile gre-gre-3des
|
||
|
|
!
|
||
|
|
interface Tunnel32
|
||
|
|
description KGR-PRM
|
||
|
|
ip address 172.30.31.9 255.255.255.252
|
||
|
|
ip access-group ACL_FROM_KUMK in
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
keepalive 10 3
|
||
|
|
tunnel source GigabitEthernet0/1
|
||
|
|
tunnel destination 178.47.128.98
|
||
|
|
tunnel protection ipsec profile gre-gre-3des
|
||
|
|
!
|
||
|
|
interface Tunnel45
|
||
|
|
description KKB-KY-01-SW1
|
||
|
|
bandwidth 100000
|
||
|
|
ip address 10.4.50.21 255.255.255.252
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
keepalive 5 5
|
||
|
|
tunnel source GigabitEthernet0/1
|
||
|
|
tunnel destination 78.85.13.165
|
||
|
|
tunnel protection ipsec profile gre-gre-3des
|
||
|
|
!
|
||
|
|
interface Tunnel52
|
||
|
|
description SRSCL-KY-01-SW1
|
||
|
|
bandwidth 100000
|
||
|
|
ip address 10.70.70.118 255.255.255.252
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
keepalive 5 5
|
||
|
|
tunnel source 217.14.195.253
|
||
|
|
tunnel destination 85.140.32.166
|
||
|
|
tunnel protection ipsec profile gre-gre-3des
|
||
|
|
!
|
||
|
|
interface Tunnel54
|
||
|
|
description KZG-KY-01-SW1
|
||
|
|
bandwidth 100000
|
||
|
|
ip address 10.70.70.126 255.255.255.252
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
tunnel source 217.14.195.253
|
||
|
|
tunnel destination 31.173.105.46
|
||
|
|
tunnel protection ipsec profile gre-gre-3des
|
||
|
|
!
|
||
|
|
interface Tunnel56
|
||
|
|
description STR-KY-01-SW1
|
||
|
|
bandwidth 100000
|
||
|
|
ip address 10.70.70.142 255.255.255.252
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
load-interval 30
|
||
|
|
keepalive 5 5
|
||
|
|
tunnel source 217.14.195.253
|
||
|
|
tunnel destination 78.85.35.164
|
||
|
|
tunnel protection ipsec profile gre-gre-3des
|
||
|
|
service-policy output PM_TEST_ARR_ADAP
|
||
|
|
!
|
||
|
|
interface Tunnel101
|
||
|
|
description IZH-KI-VOR158-RT-1-1
|
||
|
|
bandwidth 80000
|
||
|
|
ip address 10.4.50.5 255.255.255.252
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
keepalive 10 3
|
||
|
|
tunnel source GigabitEthernet0/1
|
||
|
|
tunnel destination 46.147.130.59
|
||
|
|
tunnel protection ipsec profile GRE_IPSEC
|
||
|
|
!
|
||
|
|
interface Tunnel102
|
||
|
|
description IZH-KI-VOR158-RT-1-2
|
||
|
|
bandwidth 96000
|
||
|
|
ip address 10.4.50.9 255.255.255.252
|
||
|
|
no ip redirects
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
keepalive 10 3
|
||
|
|
tunnel source GigabitEthernet0/1
|
||
|
|
tunnel destination 5.227.125.126
|
||
|
|
tunnel protection ipsec profile GRE_IPSEC
|
||
|
|
!
|
||
|
|
interface Tunnel103
|
||
|
|
description BeeCLOUD
|
||
|
|
ip address 10.4.50.13 255.255.255.252
|
||
|
|
no ip redirects
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
tunnel source GigabitEthernet0/1
|
||
|
|
tunnel mode ipsec ipv4
|
||
|
|
tunnel destination 82.142.146.70
|
||
|
|
tunnel protection ipsec profile PF-BEECLOUD
|
||
|
|
!
|
||
|
|
interface Tunnel111
|
||
|
|
description [CORE] iBGP Transit to P11
|
||
|
|
bandwidth 200000
|
||
|
|
ip address 172.30.32.21 255.255.255.252
|
||
|
|
no ip redirects
|
||
|
|
no ip unreachables
|
||
|
|
no ip proxy-arp
|
||
|
|
ip mtu 1400
|
||
|
|
ip tcp adjust-mss 1360
|
||
|
|
ip ospf mtu-ignore
|
||
|
|
keepalive 10 3
|
||
|
|
bfd template BFD-KOMOS
|
||
|
|
tunnel source GigabitEthernet0/2.300
|
||
|
|
tunnel destination 10.1.1.2
|
||
|
|
!
|
||
|
|
interface Embedded-Service-Engine0/0
|
||
|
|
no ip address
|
||
|
|
shutdown
|
||
|
|
!
|
||
|
|
interface GigabitEthernet0/0
|
||
|
|
description [ISP-200M] Rostelecom
|
||
|
|
bandwidth 200000
|
||
|
|
ip address 85.175.86.74 255.255.255.252
|
||
|
|
ip access-group ACL_FW_IN in
|
||
|
|
ip flow ingress
|
||
|
|
ip flow egress
|
||
|
|
ip nat outside
|
||
|
|
ip inspect Internet out
|
||
|
|
ip virtual-reassembly in
|
||
|
|
duplex auto
|
||
|
|
speed auto
|
||
|
|
!
|
||
|
|
interface GigabitEthernet0/1
|
||
|
|
description [ISP-100M] MarkITT
|
||
|
|
ip address 217.14.195.253 255.255.255.252
|
||
|
|
ip access-group FIREWALL in
|
||
|
|
ip nat outside
|
||
|
|
ip inspect Internet out
|
||
|
|
ip virtual-reassembly in
|
||
|
|
duplex auto
|
||
|
|
speed auto
|
||
|
|
service-policy output PM_QOS_GLOBAL_OUT
|
||
|
|
!
|
||
|
|
interface GigabitEthernet0/2
|
||
|
|
no ip address
|
||
|
|
ip nat inside
|
||
|
|
ip virtual-reassembly in
|
||
|
|
media-type sfp
|
||
|
|
service-policy input PM_QOS_IN
|
||
|
|
!
|
||
|
|
interface GigabitEthernet0/2.300
|
||
|
|
encapsulation dot1Q 300
|
||
|
|
ip address 10.4.254.251 255.255.255.0
|
||
|
|
ip flow ingress
|
||
|
|
ip flow egress
|
||
|
|
ip nat inside
|
||
|
|
ip virtual-reassembly in
|
||
|
|
!
|
||
|
|
interface GigabitEthernet0/2.551
|
||
|
|
description --TRANSIT_HSRP--
|
||
|
|
encapsulation dot1Q 551
|
||
|
|
ip address 10.4.239.18 255.255.255.240
|
||
|
|
ip flow ingress
|
||
|
|
ip flow egress
|
||
|
|
ip nat inside
|
||
|
|
ip virtual-reassembly in
|
||
|
|
standby 1 ip 10.4.239.17
|
||
|
|
standby 1 priority 110
|
||
|
|
standby 1 preempt
|
||
|
|
standby 1 track 20 decrement 10
|
||
|
|
ip policy route-map GLOBAL-ROUTING
|
||
|
|
!
|
||
|
|
interface GigabitEthernet0/2.556
|
||
|
|
description iBGP KOMOS_AS over ER-Telecom
|
||
|
|
encapsulation dot1Q 556
|
||
|
|
ip address 172.30.32.13 255.255.255.252
|
||
|
|
ip nat outside
|
||
|
|
ip virtual-reassembly in
|
||
|
|
bfd template BFD-KOMOS
|
||
|
|
!
|
||
|
|
interface GigabitEthernet0/2.557
|
||
|
|
description iBGP KOMOS_AS over MTS
|
||
|
|
encapsulation dot1Q 557
|
||
|
|
ip address 172.30.32.17 255.255.255.252
|
||
|
|
ip nat outside
|
||
|
|
ip virtual-reassembly in
|
||
|
|
bfd template BFD-KOMOS
|
||
|
|
!
|
||
|
|
interface GigabitEthernet0/2.597
|
||
|
|
description --BGP_TRANSIT--
|
||
|
|
encapsulation dot1Q 597
|
||
|
|
ip address 172.30.30.60 255.255.255.240
|
||
|
|
no ip redirects
|
||
|
|
no ip unreachables
|
||
|
|
no ip proxy-arp
|
||
|
|
ip flow ingress
|
||
|
|
ip flow egress
|
||
|
|
ip nat inside
|
||
|
|
ip virtual-reassembly in
|
||
|
|
bfd interval 50 min_rx 50 multiplier 3
|
||
|
|
!
|
||
|
|
interface Virtual-Template1
|
||
|
|
ip address 10.10.14.254 255.255.255.0
|
||
|
|
ip mtu 1400
|
||
|
|
ip nat inside
|
||
|
|
ip virtual-reassembly in
|
||
|
|
ip ospf network point-to-point
|
||
|
|
peer default ip address pool DHCP-L2TP-PRIMARY
|
||
|
|
no keepalive
|
||
|
|
ppp encrypt mppe auto
|
||
|
|
ppp authentication ms-chap-v2
|
||
|
|
!
|
||
|
|
router ospf 111
|
||
|
|
router-id 10.111.12.1
|
||
|
|
auto-cost reference-bandwidth 10000
|
||
|
|
passive-interface default
|
||
|
|
no passive-interface GigabitEthernet0/2.556
|
||
|
|
no passive-interface GigabitEthernet0/2.557
|
||
|
|
no passive-interface Tunnel111
|
||
|
|
network 10.111.12.1 0.0.0.0 area 0
|
||
|
|
network 172.30.32.0 0.0.0.255 area 0
|
||
|
|
bfd all-interfaces
|
||
|
|
!
|
||
|
|
router bgp 199014
|
||
|
|
bgp router-id 85.175.86.74
|
||
|
|
bgp log-neighbor-changes
|
||
|
|
bgp graceful-restart restart-time 120
|
||
|
|
bgp graceful-restart stalepath-time 360
|
||
|
|
bgp graceful-restart
|
||
|
|
neighbor PG_BGP_SPOKE_RUSSIAN_NIVA peer-group
|
||
|
|
neighbor PG_BGP_SPOKE_RUSSIAN_NIVA remote-as 64536
|
||
|
|
neighbor PG_BGP_SPOKE_RUSSIAN_NIVA local-as 64512 no-prepend replace-as
|
||
|
|
neighbor PG_IZH-KI-VOR158 peer-group
|
||
|
|
neighbor PG_IZH-KI-VOR158 remote-as 64555
|
||
|
|
neighbor PG_IZH-KI-VOR158 local-as 64512 no-prepend replace-as
|
||
|
|
neighbor PG_MIKROTIK_OTHER peer-group
|
||
|
|
neighbor PG_MIKROTIK_OTHER remote-as 65503
|
||
|
|
neighbor PG_MIKROTIK_OTHER local-as 64512 no-prepend replace-as
|
||
|
|
neighbor 10.4.50.6 peer-group PG_IZH-KI-VOR158
|
||
|
|
neighbor 10.4.50.10 peer-group PG_IZH-KI-VOR158
|
||
|
|
neighbor 10.4.50.14 remote-as 64554
|
||
|
|
neighbor 10.4.50.14 local-as 64512 no-prepend replace-as
|
||
|
|
neighbor 10.4.50.14 description BEECLOUD
|
||
|
|
neighbor 10.4.50.22 peer-group PG_BGP_SPOKE_RUSSIAN_NIVA
|
||
|
|
neighbor 10.70.70.117 peer-group PG_MIKROTIK_OTHER
|
||
|
|
neighbor 10.70.70.117 description SAR-MLK-SIG-RT-1-1
|
||
|
|
neighbor 10.70.70.125 peer-group PG_MIKROTIK_OTHER
|
||
|
|
neighbor 10.70.70.125 description --KEZ_AUTOKOLONNA--
|
||
|
|
neighbor 10.70.70.141 peer-group PG_MIKROTIK_OTHER
|
||
|
|
neighbor 10.70.70.141 description STR-KY-01-SW1
|
||
|
|
neighbor 10.111.13.1 remote-as 199014
|
||
|
|
neighbor 10.111.13.1 description iBGP to P11
|
||
|
|
neighbor 10.111.13.1 update-source Loopback111
|
||
|
|
neighbor 85.175.86.73 remote-as 12389
|
||
|
|
neighbor 85.175.86.73 description Rostelecom
|
||
|
|
neighbor 172.30.30.55 remote-as 64512
|
||
|
|
neighbor 172.30.30.55 description IZH-MLK-IZM-SW-1-1_Huawei
|
||
|
|
neighbor 172.30.30.62 remote-as 64512
|
||
|
|
neighbor 172.30.30.62 description --IZH-MLK-IZM-SW-1-1--
|
||
|
|
neighbor 172.30.31.6 remote-as 65504
|
||
|
|
neighbor 172.30.31.6 local-as 64512 no-prepend replace-as
|
||
|
|
neighbor 172.30.31.6 description KGR-KUMK-KUMK-RT-1-1
|
||
|
|
neighbor 172.30.31.10 remote-as 65505
|
||
|
|
neighbor 172.30.31.10 local-as 64512 no-prepend replace-as
|
||
|
|
neighbor 172.30.31.10 description KGR-KUMK-PRM-RT-1-1
|
||
|
|
!
|
||
|
|
address-family ipv4
|
||
|
|
network 10.4.50.4 mask 255.255.255.252
|
||
|
|
network 10.4.50.8 mask 255.255.255.252
|
||
|
|
network 10.4.50.20 mask 255.255.255.252
|
||
|
|
network 10.70.70.116 mask 255.255.255.252
|
||
|
|
neighbor PG_BGP_SPOKE_RUSSIAN_NIVA next-hop-self all
|
||
|
|
neighbor PG_BGP_SPOKE_RUSSIAN_NIVA soft-reconfiguration inbound
|
||
|
|
neighbor PG_BGP_SPOKE_RUSSIAN_NIVA prefix-list PFL_FROM_RUSSIAN_NIVA in
|
||
|
|
neighbor PG_BGP_SPOKE_RUSSIAN_NIVA prefix-list PFL_TO_RUSSIAN_NIVA out
|
||
|
|
neighbor PG_IZH-KI-VOR158 next-hop-self
|
||
|
|
neighbor PG_IZH-KI-VOR158 soft-reconfiguration inbound
|
||
|
|
neighbor PG_IZH-KI-VOR158 route-map RM_TO_IZH-KI-VOR158 out
|
||
|
|
neighbor PG_MIKROTIK_OTHER next-hop-self
|
||
|
|
neighbor PG_MIKROTIK_OTHER soft-reconfiguration inbound
|
||
|
|
neighbor PG_MIKROTIK_OTHER route-map RM_MIKROT_OTHER_OUT out
|
||
|
|
neighbor 10.4.50.6 activate
|
||
|
|
neighbor 10.4.50.10 activate
|
||
|
|
neighbor 10.4.50.14 activate
|
||
|
|
neighbor 10.4.50.14 soft-reconfiguration inbound
|
||
|
|
neighbor 10.4.50.14 route-map RM_FROM_BEECLOUD in
|
||
|
|
neighbor 10.4.50.14 route-map RM_TO_BEECLOUD out
|
||
|
|
neighbor 10.4.50.22 activate
|
||
|
|
neighbor 10.70.70.117 activate
|
||
|
|
neighbor 10.70.70.125 activate
|
||
|
|
neighbor 10.70.70.141 activate
|
||
|
|
neighbor 10.111.13.1 activate
|
||
|
|
neighbor 10.111.13.1 next-hop-self all
|
||
|
|
neighbor 10.111.13.1 route-map RM_KOMOS_AS in
|
||
|
|
neighbor 10.111.13.1 route-map RM_KOMOS_AS out
|
||
|
|
neighbor 85.175.86.73 activate
|
||
|
|
neighbor 85.175.86.73 route-map RM_ROSTELECOM_IN in
|
||
|
|
neighbor 85.175.86.73 route-map RM_ROSTELECOM_OUT out
|
||
|
|
neighbor 172.30.30.55 activate
|
||
|
|
neighbor 172.30.30.55 soft-reconfiguration inbound
|
||
|
|
neighbor 172.30.30.55 route-map RM_LOCAL_IN in
|
||
|
|
neighbor 172.30.30.55 route-map RM_LOCAL_OUT out
|
||
|
|
neighbor 172.30.30.62 activate
|
||
|
|
neighbor 172.30.30.62 soft-reconfiguration inbound
|
||
|
|
neighbor 172.30.30.62 route-map RM_LOCAL_IN in
|
||
|
|
neighbor 172.30.30.62 route-map RM_LOCAL_OUT out
|
||
|
|
neighbor 172.30.31.6 activate
|
||
|
|
neighbor 172.30.31.6 route-map RM_FROM_KUMK in
|
||
|
|
neighbor 172.30.31.6 route-map RM_TO_KUMK out
|
||
|
|
neighbor 172.30.31.10 activate
|
||
|
|
neighbor 172.30.31.10 route-map RM_FROM_KUMK in
|
||
|
|
neighbor 172.30.31.10 route-map RM_TO_KUMK out
|
||
|
|
distance bgp 150 150 150
|
||
|
|
exit-address-family
|
||
|
|
!
|
||
|
|
ip local policy route-map PBR_LP
|
||
|
|
ip local pool DHCP-L2TP-PRIMARY 10.10.14.21 10.10.14.253
|
||
|
|
ip forward-protocol nd
|
||
|
|
!
|
||
|
|
no ip http server
|
||
|
|
no ip http secure-server
|
||
|
|
ip flow-export source GigabitEthernet0/2.300
|
||
|
|
ip flow-export version 5
|
||
|
|
ip flow-export destination 10.4.0.215 9995
|
||
|
|
ip flow-export destination 10.4.0.217 9995
|
||
|
|
ip flow-top-talkers
|
||
|
|
top 10
|
||
|
|
sort-by bytes
|
||
|
|
cache-timeout 20000
|
||
|
|
!
|
||
|
|
ip nat translation timeout 450
|
||
|
|
ip nat translation tcp-timeout 300
|
||
|
|
ip nat translation pptp-timeout 1800
|
||
|
|
ip nat translation udp-timeout 310
|
||
|
|
ip nat translation dns-timeout 5
|
||
|
|
ip nat translation routemap-entry-timeout 300
|
||
|
|
ip nat translation icmp-timeout 10
|
||
|
|
ip nat translation port-timeout tcp 110 60
|
||
|
|
ip nat translation port-timeout tcp 25 60
|
||
|
|
ip nat translation port-timeout tcp 80 300
|
||
|
|
ip nat translation port-timeout tcp 443 300
|
||
|
|
ip nat translation port-timeout udp 5060 300
|
||
|
|
ip nat translation max-entries all-host 400
|
||
|
|
ip nat translation max-entries host 10.4.7.5 400
|
||
|
|
ip nat translation max-entries host 10.4.7.4 400
|
||
|
|
ip nat translation max-entries host 10.4.7.6 400
|
||
|
|
ip nat translation max-entries host 192.168.8.71 400
|
||
|
|
ip nat translation max-entries host 192.168.8.72 400
|
||
|
|
ip nat translation max-entries host 10.4.38.1 1000
|
||
|
|
ip nat translation max-entries host 192.168.8.73 400
|
||
|
|
ip nat translation max-entries host 192.168.8.74 400
|
||
|
|
ip nat translation max-entries host 192.168.8.75 400
|
||
|
|
ip nat translation max-entries host 192.168.8.77 400
|
||
|
|
ip nat translation max-entries host 10.4.0.172 1000
|
||
|
|
ip nat translation max-entries host 192.168.8.163 400
|
||
|
|
ip nat pool NAT_FTP4 192.168.8.138 192.168.8.138 netmask 255.255.255.0 type rotary
|
||
|
|
ip nat inside source route-map ISP_MARK interface GigabitEthernet0/1 overload
|
||
|
|
ip nat inside source route-map ISP_RT interface GigabitEthernet0/0 overload
|
||
|
|
ip nat inside source static tcp 192.168.8.225 4443 85.175.86.74 4443 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.225 4443 85.175.86.74 4444 extendable
|
||
|
|
ip nat inside source static tcp 10.4.38.2 80 91.240.179.36 80 extendable
|
||
|
|
ip nat inside source static tcp 10.4.38.2 443 91.240.179.36 443 extendable
|
||
|
|
ip nat inside source static 10.4.38.1 91.240.179.48
|
||
|
|
ip nat inside source static 10.4.38.21 91.240.179.73
|
||
|
|
ip nat inside source static 10.4.38.22 91.240.179.74
|
||
|
|
ip nat inside source static 10.4.0.184 91.240.179.131
|
||
|
|
ip nat inside source static 10.4.0.120 91.240.179.133
|
||
|
|
ip nat inside source static 10.4.8.8 91.240.179.240
|
||
|
|
ip nat inside source static tcp 10.4.0.9 21 217.14.195.253 21 extendable
|
||
|
|
ip nat inside source static tcp 10.4.7.12 25 217.14.195.253 25 extendable
|
||
|
|
ip nat inside source static tcp 10.4.7.12 110 217.14.195.253 110 extendable
|
||
|
|
ip nat inside source static tcp 10.4.7.12 143 217.14.195.253 143 extendable
|
||
|
|
ip nat inside source static tcp 10.4.0.172 443 217.14.195.253 443 extendable
|
||
|
|
ip nat inside source static tcp 10.4.7.12 993 217.14.195.253 993 extendable
|
||
|
|
ip nat inside source static tcp 10.4.0.178 3389 217.14.195.253 3389 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.29 1194 217.14.195.253 3394 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.225 4443 217.14.195.253 4443 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.225 4443 217.14.195.253 4444 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.228 3389 217.14.195.253 4446 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.177 3389 217.14.195.253 4494 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.100 7010 217.14.195.253 7010 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.100 7011 217.14.195.253 7011 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.101 7020 217.14.195.253 7020 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.101 7021 217.14.195.253 7021 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.102 7030 217.14.195.253 7030 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.102 7031 217.14.195.253 7031 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.103 7040 217.14.195.253 7040 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.103 7041 217.14.195.253 7041 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.104 7050 217.14.195.253 7050 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.104 7051 217.14.195.253 7051 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.105 7060 217.14.195.253 7060 extendable
|
||
|
|
ip nat inside source static tcp 192.168.9.105 7061 217.14.195.253 7061 extendable
|
||
|
|
ip nat inside source static tcp 172.30.35.254 7789 217.14.195.253 7789 extendable
|
||
|
|
ip nat inside source static tcp 172.17.100.1 8081 217.14.195.253 8081 extendable
|
||
|
|
ip nat inside source static tcp 172.17.100.1 8082 217.14.195.253 8082 extendable
|
||
|
|
ip nat inside source static tcp 172.17.100.5 8081 217.14.195.253 8087 extendable
|
||
|
|
ip nat inside source static tcp 172.17.100.5 8082 217.14.195.253 8088 extendable
|
||
|
|
ip nat inside source static tcp 10.4.7.17 22 217.14.195.253 8089 extendable
|
||
|
|
ip nat inside source static tcp 10.4.7.17 80 217.14.195.253 8090 extendable
|
||
|
|
ip nat inside source static tcp 10.4.7.17 8081 217.14.195.253 8091 extendable
|
||
|
|
ip nat inside source static tcp 10.4.7.17 8082 217.14.195.253 8092 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.176 3389 217.14.195.253 56548 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.159 3389 217.14.195.253 56549 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.138 21 217.14.195.253 58000 extendable
|
||
|
|
ip nat inside source static tcp 192.168.8.187 3389 217.14.195.253 59136 extendable
|
||
|
|
ip nat inside destination list ACL_FTP4 pool NAT_FTP4
|
||
|
|
ip route 0.0.0.0 0.0.0.0 217.14.195.254 90 name --MARK--
|
||
|
|
ip route 0.0.0.0 0.0.0.0 85.175.86.73 100 name --RT--
|
||
|
|
ip route 5.227.125.126 255.255.255.255 78.85.13.1
|
||
|
|
ip route 10.15.72.0 255.255.255.0 10.4.50.14
|
||
|
|
ip route 10.111.0.21 255.255.255.255 172.30.30.62 name LO-P11-RT-1-1
|
||
|
|
ip route 91.240.179.0 255.255.255.0 Null0 254 name KOMOS_PI
|
||
|
|
ip route 172.30.35.254 255.255.255.255 10.4.239.22 200 name --MIKROTIK_VPN--
|
||
|
|
ip route 192.168.8.225 255.255.255.255 10.4.239.22 100 name VREMENNO!!!!!!
|
||
|
|
ip route 192.168.101.152 255.255.255.248 10.70.70.141 200 name --STROYLANDIYA_SARAPUL--
|
||
|
|
!
|
||
|
|
ip access-list standard ACL_NAT_ATERISK
|
||
|
|
permit 172.17.100.1
|
||
|
|
permit 172.17.100.5
|
||
|
|
ip access-list standard ACL_NAT_PET_PRODACTION
|
||
|
|
permit 10.4.37.1
|
||
|
|
ip access-list standard ACL_NAT_SRV
|
||
|
|
permit 10.4.3.0 0.0.0.255
|
||
|
|
permit 10.4.6.0 0.0.0.255
|
||
|
|
ip access-list standard ACL_NAT_Wi-Fi
|
||
|
|
permit 10.4.32.0 0.0.0.255
|
||
|
|
permit 10.4.35.0 0.0.0.255
|
||
|
|
permit 10.4.255.0 0.0.0.255
|
||
|
|
permit 10.4.252.0 0.0.0.255
|
||
|
|
ip access-list standard NOBEL_USERS
|
||
|
|
permit 10.5.208.0 0.0.7.255
|
||
|
|
!
|
||
|
|
ip access-list extended ACL_CREATIO
|
||
|
|
permit ip host 10.4.0.123 any
|
||
|
|
ip access-list extended ACL_EXCHANGE_KG
|
||
|
|
permit ip host 10.4.38.3 any
|
||
|
|
ip access-list extended ACL_FOR_LP_MARK
|
||
|
|
permit ip host 217.14.195.253 any
|
||
|
|
ip access-list extended ACL_FOR_LP_RT
|
||
|
|
permit ip host 78.85.13.95 any
|
||
|
|
permit gre host 78.85.13.95 any
|
||
|
|
permit esp host 78.85.13.95 any
|
||
|
|
ip access-list extended ACL_FROM_KUMK
|
||
|
|
deny tcp any any eq 445
|
||
|
|
permit ip host 172.30.31.10 host 172.30.31.9
|
||
|
|
permit ip host 172.30.31.6 host 172.30.31.5
|
||
|
|
permit icmp 10.12.1.0 0.0.0.255 any
|
||
|
|
permit icmp 10.12.0.0 0.0.0.255 any
|
||
|
|
permit ip 10.12.1.0 0.0.0.255 10.1.9.0 0.0.0.255
|
||
|
|
permit ip 10.12.1.0 0.0.0.255 host 10.1.9.207
|
||
|
|
permit ip 10.12.1.0 0.0.0.255 host 192.168.8.137
|
||
|
|
permit ip 10.12.1.0 0.0.0.255 host 10.4.0.43
|
||
|
|
permit ip 10.12.0.0 0.0.0.255 10.4.0.0 0.0.0.255
|
||
|
|
permit ip host 10.12.0.254 any
|
||
|
|
permit ip 10.12.0.0 0.0.127.255 10.12.252.0 0.0.3.255
|
||
|
|
permit ip 10.12.252.0 0.0.3.255 10.12.252.0 0.0.3.255
|
||
|
|
permit ip host 10.12.252.254 any
|
||
|
|
permit tcp any any eq domain
|
||
|
|
permit udp any any eq domain
|
||
|
|
remark kg-p11-app001.komos-group.ru
|
||
|
|
permit ip any host 10.1.8.14
|
||
|
|
permit ip 10.12.4.0 0.0.3.255 10.1.19.0 0.0.0.255
|
||
|
|
permit icmp any any
|
||
|
|
permit ip any host 10.1.9.207
|
||
|
|
permit ip any host 10.4.0.214
|
||
|
|
permit ip 10.12.4.0 0.0.0.255 any
|
||
|
|
permit tcp any any eq 8291
|
||
|
|
ip access-list extended ACL_FTP4
|
||
|
|
permit tcp any any range 58600 58900
|
||
|
|
ip access-list extended ACL_FW_IN
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq 4444
|
||
|
|
permit icmp any any
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq bgp
|
||
|
|
permit ip object-group OBJ_BRANCHES 91.240.179.0 0.0.0.255
|
||
|
|
permit ip object-group OBJ_BRANCHES object-group STATIC_ISP_IP
|
||
|
|
deny tcp any object-group STATIC_ISP_IP eq 22
|
||
|
|
deny ip object-group OBJ_NET_BLACKLIST any
|
||
|
|
permit tcp any host 91.240.179.1 eq 443 2109 3000 8080 9000 9090
|
||
|
|
permit udp any host 91.240.179.1 eq 3478 syslog
|
||
|
|
permit tcp any host 91.240.179.5 eq 82 www 443 1433 2195 2196 5223
|
||
|
|
permit tcp any host 91.240.179.11 eq domain
|
||
|
|
permit udp any host 91.240.179.11 eq domain
|
||
|
|
permit tcp any host 91.240.179.20 eq 443
|
||
|
|
permit udp any host 91.240.179.28 eq non500-isakmp isakmp
|
||
|
|
permit tcp any host 91.240.179.31 eq 7789
|
||
|
|
permit tcp any host 91.240.179.36 eq www 443
|
||
|
|
permit tcp any host 91.240.179.40 eq 443
|
||
|
|
permit tcp any host 91.240.179.48 eq www 443
|
||
|
|
permit tcp any host 91.240.179.49 eq 8080 9099
|
||
|
|
permit tcp any host 91.240.179.57 eq www 443 8082 10001 12001
|
||
|
|
permit tcp any host 91.240.179.66 eq 443 pop3 www
|
||
|
|
permit tcp any host 91.240.179.68 eq 5060
|
||
|
|
permit tcp any host 91.240.179.70 eq smtp www pop3 143 443 587 993 995
|
||
|
|
permit tcp any host 91.240.179.129 eq smtp www pop3 143 443 587 993 995
|
||
|
|
permit tcp any host 91.240.179.178 eq 4477
|
||
|
|
permit tcp any host 91.240.179.251 eq www 443
|
||
|
|
permit tcp object-group OBJ_PART_Goods4Cust host 91.240.179.2 eq 1433
|
||
|
|
permit tcp object-group OBJ_PART_Goods4Cust host 91.240.179.5 eq 3395 5671 5672 15672
|
||
|
|
permit tcp object-group OBJ_PART_HEADLINE host 91.240.179.1 eq 3389
|
||
|
|
permit tcp object-group OBJ_PART_HEADLINE host 91.240.179.49 eq 3391
|
||
|
|
permit tcp object-group OBJ_PART_HEADLINE host 91.240.179.68 eq 3389
|
||
|
|
permit tcp object-group OBJ_PART_ROSA host 91.240.179.131 eq www 443
|
||
|
|
permit tcp object-group OBJ_PART_HTC host 91.240.179.71
|
||
|
|
permit object-group OBJ_SVC_VIPole any host 91.240.179.32
|
||
|
|
permit object-group OBJ_SVC_SFB any object-group OBJ_SRV_SKYPE
|
||
|
|
permit object-group OBJ_SVC_ANY_CONNECT any object-group OBJ_NET_CISCOASA
|
||
|
|
permit object-group OBJ_SVC_L2TP any host 91.240.179.28
|
||
|
|
permit object-group OBJ_SVC_FTP object-group OBJ_NET_FTP_USERS host 91.240.179.71
|
||
|
|
permit tcp any object-group OBJ_SVC_KSMG eq smtp
|
||
|
|
permit tcp any object-group OBJ_SRV_IRONPORT eq smtp
|
||
|
|
ip access-list extended ACL_NAT_PRODACTION
|
||
|
|
permit tcp host 10.4.39.1 any eq 443
|
||
|
|
permit ip host 10.4.38.1 any
|
||
|
|
permit ip host 10.4.38.2 any
|
||
|
|
permit ip host 10.4.39.65 any
|
||
|
|
permit ip 10.4.39.64 0.0.0.63 any
|
||
|
|
ip access-list extended ACL_QOS_ESP
|
||
|
|
permit esp any any
|
||
|
|
deny ip any any
|
||
|
|
ip access-list extended ACL_QOS_Q2
|
||
|
|
permit tcp any any eq www 443
|
||
|
|
permit tcp any any eq www 443 8443
|
||
|
|
ip access-list extended ACL_RM_ROUTE_MARK_OUT
|
||
|
|
permit ip host 10.4.0.9 any
|
||
|
|
permit ip host 10.4.7.12 any
|
||
|
|
permit ip host 10.4.0.172 any
|
||
|
|
permit ip host 10.4.0.178 any
|
||
|
|
permit ip host 192.168.8.29 any
|
||
|
|
permit ip host 192.168.8.228 any
|
||
|
|
permit ip host 192.168.8.177 any
|
||
|
|
permit ip host 192.168.9.100 any
|
||
|
|
permit ip host 192.168.9.101 any
|
||
|
|
permit ip host 192.168.9.102 any
|
||
|
|
permit ip host 192.168.9.103 any
|
||
|
|
permit ip host 192.168.9.104 any
|
||
|
|
permit ip host 192.168.9.105 any
|
||
|
|
permit ip host 172.30.35.254 any
|
||
|
|
permit ip host 172.17.100.1 any
|
||
|
|
permit ip host 172.17.100.5 any
|
||
|
|
permit ip host 10.4.7.17 any
|
||
|
|
permit ip host 192.168.8.176 any
|
||
|
|
permit ip host 192.168.8.159 any
|
||
|
|
permit ip host 192.168.8.138 any
|
||
|
|
permit ip host 192.168.8.187 any
|
||
|
|
permit ip host 192.168.8.226 any
|
||
|
|
permit ip 192.168.8.0 0.0.0.255 any
|
||
|
|
remark RTO-372
|
||
|
|
permit ip host 10.4.8.80 any
|
||
|
|
ip access-list extended ACL_TEST_ESR-10
|
||
|
|
permit ip host 91.240.179.240 any
|
||
|
|
permit ip host 10.4.8.8 any
|
||
|
|
ip access-list extended ACL_VTY
|
||
|
|
permit ip 10.1.0.0 0.0.255.255 any
|
||
|
|
permit ip 10.4.0.0 0.0.255.255 any
|
||
|
|
permit ip 10.14.112.0 0.0.15.255 any
|
||
|
|
deny ip any any log
|
||
|
|
ip access-list extended FIREWALL
|
||
|
|
deny tcp any object-group STATIC_ISP_IP eq 22
|
||
|
|
permit ip object-group OBJ_BRANCHES object-group STATIC_ISP_IP
|
||
|
|
permit ip object-group GRE_SRC_IP object-group STATIC_ISP_IP
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq 5599 7010 7011 7020 7021 7030 7031 7040
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq 7041 7050 7051 7060 7061 7789 8585 29713
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq 15971 38129 38411 38412 38511 39661 43611 50155 50569 50683
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq 50690 50718 50783 51891 56543 56548 56549 59136 59991 61751
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq 4494
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq 3394
|
||
|
|
deny tcp any host 217.14.195.253 eq 443
|
||
|
|
permit tcp object-group LAINER_TELECOM object-group STATIC_ISP_IP range 8081 8092
|
||
|
|
permit tcp any object-group STATIC_ISP_IP range 58600 58900
|
||
|
|
permit udp any object-group STATIC_ISP_IP range 10000 20000
|
||
|
|
permit object-group SERVICE_L2TP any object-group STATIC_ISP_IP
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq ftp smtp www pop3 143 443 993 2109 4443 4444
|
||
|
|
permit tcp any object-group STATIC_ISP_IP eq 2253 58000
|
||
|
|
permit tcp object-group HEADLINE_IP object-group STATIC_ISP_IP eq 4446
|
||
|
|
permit icmp any object-group STATIC_ISP_IP
|
||
|
|
deny tcp any any eq 22
|
||
|
|
ip access-list extended LOCAL_TRAFFIC
|
||
|
|
permit ip any 192.168.0.0 0.0.255.255
|
||
|
|
permit ip any 10.0.0.0 0.255.255.255
|
||
|
|
permit ip any 172.16.0.0 0.15.255.255
|
||
|
|
!
|
||
|
|
!
|
||
|
|
ip prefix-list PFL_FROM_RUSSIAN_NIVA seq 10 permit 10.5.192.0/19
|
||
|
|
!
|
||
|
|
ip prefix-list PFL_OSPF_FILTER seq 10 deny 10.0.0.0/14 le 32
|
||
|
|
ip prefix-list PFL_OSPF_FILTER seq 20 deny 10.8.0.0/13 le 32
|
||
|
|
ip prefix-list PFL_OSPF_FILTER seq 30 deny 10.16.0.0/12 le 32
|
||
|
|
ip prefix-list PFL_OSPF_FILTER seq 100 permit 0.0.0.0/0 le 24
|
||
|
|
!
|
||
|
|
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 10 permit 10.4.0.0/16
|
||
|
|
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 20 permit 192.168.8.0/24
|
||
|
|
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 25 permit 10.1.0.0/16
|
||
|
|
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 30 permit 192.168.0.0/22
|
||
|
|
ip prefix-list PFL_TO_RUSSIAN_NIVA seq 35 permit 10.14.112.0/20
|
||
|
|
!
|
||
|
|
ip prefix-list PL_BOGON seq 5 permit 0.0.0.0/8 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 10 permit 10.0.0.0/8 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 15 permit 100.64.0.0/10 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 20 permit 127.0.0.0/8 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 25 permit 169.254.0.0/16 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 30 permit 172.16.0.0/12 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 35 permit 192.0.0.0/24 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 40 permit 192.0.2.0/24 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 45 permit 192.168.0.0/16 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 50 permit 192.18.0.0/15 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 55 permit 198.18.0.0/15 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 60 permit 198.51.100.0/24 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 65 permit 203.0.113.0/24 le 32
|
||
|
|
ip prefix-list PL_BOGON seq 70 permit 240.0.0.0/4 le 32
|
||
|
|
!
|
||
|
|
ip prefix-list PL_FROM_BEECLOUD seq 5 permit 10.100.0.0/24 le 25
|
||
|
|
ip prefix-list PL_FROM_BEECLOUD seq 10 permit 10.101.0.0/20 le 24
|
||
|
|
!
|
||
|
|
ip prefix-list PL_FROM_KLS seq 10 permit 10.14.100.0/22
|
||
|
|
!
|
||
|
|
ip prefix-list PL_FROM_KUMK seq 5 permit 10.12.0.0/16 le 24
|
||
|
|
ip prefix-list PL_FROM_KUMK seq 10 permit 10.12.252.0/22
|
||
|
|
!
|
||
|
|
ip prefix-list PL_KOMOS_AS seq 5 permit 0.0.0.0/0
|
||
|
|
ip prefix-list PL_KOMOS_AS seq 10 permit 91.240.179.0/24 le 32
|
||
|
|
!
|
||
|
|
ip prefix-list PL_LOCAL_IN seq 5 deny 0.0.0.0/0
|
||
|
|
ip prefix-list PL_LOCAL_IN seq 10 permit 10.0.0.0/8 le 32
|
||
|
|
ip prefix-list PL_LOCAL_IN seq 15 permit 192.168.0.0/16 le 32
|
||
|
|
ip prefix-list PL_LOCAL_IN seq 20 permit 172.31.35.0/24
|
||
|
|
ip prefix-list PL_LOCAL_IN seq 25 permit 172.31.31.0/24
|
||
|
|
ip prefix-list PL_LOCAL_IN seq 30 permit 172.16.0.0/12 le 32
|
||
|
|
ip prefix-list PL_LOCAL_IN seq 35 permit 91.240.179.243/32
|
||
|
|
ip prefix-list PL_LOCAL_IN seq 40 permit 91.240.179.131/32
|
||
|
|
ip prefix-list PL_LOCAL_IN seq 50 permit 91.240.179.0/24 ge 32
|
||
|
|
!
|
||
|
|
ip prefix-list PL_LOCAL_OUT seq 5 permit 10.0.0.0/8 le 32
|
||
|
|
ip prefix-list PL_LOCAL_OUT seq 10 permit 192.168.0.0/16 le 32
|
||
|
|
ip prefix-list PL_LOCAL_OUT seq 15 permit 172.16.0.0/12 le 32
|
||
|
|
ip prefix-list PL_LOCAL_OUT seq 20 permit 91.240.179.0/24 le 32
|
||
|
|
!
|
||
|
|
ip prefix-list PL_MIKROT_OTHER_OUT seq 1 permit 10.0.0.0/8 le 32
|
||
|
|
ip prefix-list PL_MIKROT_OTHER_OUT seq 2 permit 192.168.0.0/16 le 32
|
||
|
|
ip prefix-list PL_MIKROT_OTHER_OUT seq 5 permit 10.4.0.0/16
|
||
|
|
ip prefix-list PL_MIKROT_OTHER_OUT seq 10 permit 10.1.0.0/16
|
||
|
|
ip prefix-list PL_MIKROT_OTHER_OUT seq 15 permit 192.168.0.0/22
|
||
|
|
ip prefix-list PL_MIKROT_OTHER_OUT seq 20 permit 192.168.8.0/24
|
||
|
|
!
|
||
|
|
ip prefix-list PL_ROSTELECOM_IN seq 5 permit 0.0.0.0/0
|
||
|
|
ip prefix-list PL_ROSTELECOM_IN seq 6 permit 0.0.0.0/0 le 22
|
||
|
|
ip prefix-list PL_ROSTELECOM_IN seq 10 deny 0.0.0.0/0 le 32
|
||
|
|
!
|
||
|
|
ip prefix-list PL_ROSTELECOM_OUT seq 5 permit 91.240.179.0/24
|
||
|
|
!
|
||
|
|
ip prefix-list PL_TO_BEECLOUD seq 5 permit 10.0.0.0/8 le 24
|
||
|
|
!
|
||
|
|
ip prefix-list PL_TO_IZH-KI-VOR158 seq 5 permit 10.0.0.0/8 le 24
|
||
|
|
ip prefix-list PL_TO_IZH-KI-VOR158 seq 10 permit 192.168.0.0/16 le 24
|
||
|
|
ip prefix-list PL_TO_IZH-KI-VOR158 seq 15 permit 172.31.35.0/24
|
||
|
|
!
|
||
|
|
ip prefix-list PL_TO_KUMK seq 5 permit 10.1.0.0/16 le 24
|
||
|
|
ip prefix-list PL_TO_KUMK seq 10 permit 10.4.0.0/16 le 24
|
||
|
|
ip sla 1
|
||
|
|
icmp-echo 8.8.8.8 source-ip 78.85.13.95
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 1 life forever start-time now
|
||
|
|
ip sla 2
|
||
|
|
icmp-echo 8.8.4.4 source-ip 78.85.13.95
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 2 life forever start-time now
|
||
|
|
ip sla 3
|
||
|
|
icmp-echo 77.88.8.8 source-ip 78.85.13.95
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 3 life forever start-time now
|
||
|
|
ip sla 4
|
||
|
|
icmp-echo 77.88.8.1 source-ip 78.85.13.95
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 4 life forever start-time now
|
||
|
|
ip sla 5
|
||
|
|
icmp-echo 77.88.8.88 source-ip 78.85.13.95
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 5 life forever start-time now
|
||
|
|
ip sla 6
|
||
|
|
icmp-echo 77.88.8.2 source-ip 78.85.13.95
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 6 life forever start-time now
|
||
|
|
ip sla 11
|
||
|
|
icmp-echo 8.8.8.8 source-ip 217.14.195.253
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 11 life forever start-time now
|
||
|
|
ip sla 12
|
||
|
|
icmp-echo 8.8.4.4 source-ip 217.14.195.253
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 12 life forever start-time now
|
||
|
|
ip sla 13
|
||
|
|
icmp-echo 77.88.8.8 source-ip 217.14.195.253
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 13 life forever start-time now
|
||
|
|
ip sla 14
|
||
|
|
icmp-echo 77.88.8.1 source-ip 217.14.195.253
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 14 life forever start-time now
|
||
|
|
ip sla 15
|
||
|
|
icmp-echo 77.88.8.88 source-ip 217.14.195.253
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 15 life forever start-time now
|
||
|
|
ip sla 16
|
||
|
|
icmp-echo 77.88.8.2 source-ip 217.14.195.253
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 16 life forever start-time now
|
||
|
|
ip sla 202
|
||
|
|
icmp-echo 1.1.1.1 source-ip 85.175.86.74
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 202 life forever start-time now
|
||
|
|
ip sla 203
|
||
|
|
icmp-echo 8.8.8.8 source-ip 85.175.86.74
|
||
|
|
threshold 2000
|
||
|
|
timeout 3000
|
||
|
|
frequency 10
|
||
|
|
ip sla schedule 203 life forever start-time now
|
||
|
|
logging origin-id hostname
|
||
|
|
logging facility local2
|
||
|
|
logging source-interface GigabitEthernet0/2.300
|
||
|
|
logging host 192.168.8.119 transport udp port 5544
|
||
|
|
logging host 10.4.244.4 transport udp port 515
|
||
|
|
!
|
||
|
|
route-map ISP_MARK permit 10
|
||
|
|
match ip address 20 21 22 23 24 25 26 27 28 29 30 40 41 42 43 44 45 ACL_NAT_Wi-Fi ACL_NAT_PET_PRODACTION ACL_NAT_ATERISK ACL_NAT_PRODACTION NOBEL_USERS ACL_NAT_SRV
|
||
|
|
match interface GigabitEthernet0/1
|
||
|
|
!
|
||
|
|
route-map PBR_LP deny 10
|
||
|
|
match ip address LOCAL_TRAFFIC
|
||
|
|
!
|
||
|
|
route-map PBR_LP permit 20
|
||
|
|
match ip address ACL_FOR_LP_RT
|
||
|
|
set ip next-hop 78.85.13.1
|
||
|
|
!
|
||
|
|
route-map PBR_LP permit 30
|
||
|
|
match ip address ACL_FOR_LP_MARK
|
||
|
|
set ip next-hop 217.14.195.254
|
||
|
|
!
|
||
|
|
route-map RM_ROSTELECOM_IN deny 5
|
||
|
|
match ip address prefix-list PL_BOGON
|
||
|
|
!
|
||
|
|
route-map RM_ROSTELECOM_IN permit 10
|
||
|
|
match ip address prefix-list PL_ROSTELECOM_IN
|
||
|
|
match track 200
|
||
|
|
set local-preference 300
|
||
|
|
!
|
||
|
|
route-map RM_ROSTELECOM_IN permit 20
|
||
|
|
match ip address prefix-list PL_ROSTELECOM_IN
|
||
|
|
set local-preference 200
|
||
|
|
!
|
||
|
|
route-map EIGRP_PUB_RM permit 10
|
||
|
|
description --publish_subnet_to_eigrp--
|
||
|
|
match ip address 99
|
||
|
|
!
|
||
|
|
route-map RM_FROM_KUMK permit 10
|
||
|
|
match ip address prefix-list PL_FROM_KUMK
|
||
|
|
!
|
||
|
|
route-map ISP_RT permit 10
|
||
|
|
match ip address 20 21 22 23 24 25 26 27 28 29 30 40 41 42 43 44 45 ACL_NAT_Wi-Fi ACL_NAT_PET_PRODACTION ACL_NAT_ATERISK ACL_NAT_PRODACTION NOBEL_USERS ACL_NAT_SRV
|
||
|
|
match interface GigabitEthernet0/0
|
||
|
|
!
|
||
|
|
route-map RM_TO_BEECLOUD permit 10
|
||
|
|
match ip address prefix-list PL_TO_BEECLOUD
|
||
|
|
set as-path prepend 64512 64512
|
||
|
|
!
|
||
|
|
route-map RM_FROM_BEECLOUD permit 10
|
||
|
|
match ip address prefix-list PL_FROM_BEECLOUD
|
||
|
|
set as-path prepend 64554 64554
|
||
|
|
!
|
||
|
|
route-map RM_LOCAL_OUT permit 10
|
||
|
|
match ip address prefix-list PL_LOCAL_OUT
|
||
|
|
!
|
||
|
|
route-map RM_TO_KUMK permit 10
|
||
|
|
match ip address prefix-list PL_TO_KUMK
|
||
|
|
!
|
||
|
|
route-map RM_TO_IZH-KI-VOR158 permit 10
|
||
|
|
match ip address prefix-list PL_TO_IZH-KI-VOR158
|
||
|
|
!
|
||
|
|
route-map REDIST_EIGRP_TO_OSPF_AREA_1 permit 10
|
||
|
|
match ip address 98
|
||
|
|
!
|
||
|
|
route-map RM_ROSTELECOM_OUT permit 10
|
||
|
|
match ip address prefix-list PL_ROSTELECOM_OUT
|
||
|
|
set as-path prepend 199014 199014 199014
|
||
|
|
!
|
||
|
|
route-map RM_MIKROT_OTHER_OUT permit 10
|
||
|
|
match ip address prefix-list PL_MIKROT_OTHER_OUT
|
||
|
|
!
|
||
|
|
route-map PPTP-VIA-MARK permit 10
|
||
|
|
match ip address LOCAL_TRAFFIC
|
||
|
|
!
|
||
|
|
route-map PPTP-VIA-MARK permit 20
|
||
|
|
set ip next-hop 217.14.195.254
|
||
|
|
!
|
||
|
|
route-map RM_LOCAL_IN permit 10
|
||
|
|
match ip address prefix-list PL_LOCAL_IN
|
||
|
|
!
|
||
|
|
route-map RM_KOMOS_AS permit 10
|
||
|
|
match ip address prefix-list PL_KOMOS_AS
|
||
|
|
!
|
||
|
|
route-map RM_FROM_KLS permit 10
|
||
|
|
match ip address prefix-list PL_FROM_KLS
|
||
|
|
!
|
||
|
|
route-map GLOBAL-ROUTING permit 5
|
||
|
|
match ip address ACL_RM_ROUTE_MARK_OUT
|
||
|
|
set ip next-hop 217.14.195.254
|
||
|
|
!
|
||
|
|
route-map GLOBAL-ROUTING permit 10
|
||
|
|
match ip address ACL_CREATIO
|
||
|
|
set ip next-hop 78.85.13.1
|
||
|
|
!
|
||
|
|
route-map GLOBAL-ROUTING permit 20
|
||
|
|
match ip address ACL_EXCHANGE_KG
|
||
|
|
set ip next-hop 78.85.13.1
|
||
|
|
!
|
||
|
|
route-map GLOBAL-ROUTING permit 25
|
||
|
|
description TEST_VKTEAMS
|
||
|
|
match ip address ACL_TEST_ESR-10
|
||
|
|
set ip next-hop 172.30.32.14
|
||
|
|
!
|
||
|
|
route-map GLOBAL-ROUTING permit 100
|
||
|
|
!
|
||
|
|
!
|
||
|
|
snmp-server community lmTUEsk6Yvlv RO
|
||
|
|
access-list 5 permit 10.2.1.245
|
||
|
|
access-list 20 permit 10.4.0.249
|
||
|
|
access-list 20 remark -===NET USER 0===-
|
||
|
|
access-list 20 permit 192.168.0.0 0.0.3.255
|
||
|
|
access-list 21 remark -===NET PRINTDEVICE 1===-
|
||
|
|
access-list 21 permit 192.168.4.0 0.0.0.255
|
||
|
|
access-list 22 remark -===NET USER 5===-
|
||
|
|
access-list 22 permit 192.168.5.0 0.0.0.255
|
||
|
|
access-list 23 remark -===NET SERVER 6===-
|
||
|
|
access-list 23 permit 192.168.6.0 0.0.0.255
|
||
|
|
access-list 24 remark -===NET SERVER 7===-
|
||
|
|
access-list 24 permit 192.168.7.0 0.0.0.255
|
||
|
|
access-list 25 deny 192.168.8.120
|
||
|
|
access-list 25 remark -===NET SERVER 8===-
|
||
|
|
access-list 25 permit 192.168.8.0 0.0.0.255
|
||
|
|
access-list 26 remark -===NET SERVER 9===-
|
||
|
|
access-list 26 permit 192.168.9.0 0.0.0.255
|
||
|
|
access-list 27 remark -===NET KIP===-
|
||
|
|
access-list 27 permit 192.168.110.0 0.0.0.255
|
||
|
|
access-list 28 remark -===NET SERVER 150===-
|
||
|
|
access-list 28 permit 192.168.150.0 0.0.0.255
|
||
|
|
access-list 29 remark -===NET_VPN===-
|
||
|
|
access-list 29 permit 172.30.34.0 0.0.1.255
|
||
|
|
access-list 30 remark -===NET VPN===-
|
||
|
|
access-list 30 permit 10.10.14.0 0.0.0.255
|
||
|
|
access-list 34 permit 10.4.7.12
|
||
|
|
access-list 34 remark =-izh-msx001=-
|
||
|
|
access-list 34 permit 192.168.1.5
|
||
|
|
access-list 40 permit 10.4.8.0 0.0.7.255
|
||
|
|
access-list 40 permit 10.4.16.0 0.0.7.255
|
||
|
|
access-list 41 deny 10.4.0.90
|
||
|
|
access-list 41 deny 10.4.0.102
|
||
|
|
access-list 41 deny 10.4.0.241
|
||
|
|
access-list 41 remark -=ServerNetNew=-
|
||
|
|
access-list 41 permit 10.4.0.0 0.0.3.255
|
||
|
|
access-list 42 remark -=WifiUserNetNew=-
|
||
|
|
access-list 42 permit 10.4.32.0 0.0.0.255
|
||
|
|
access-list 44 remark -=ServProcContNet=-
|
||
|
|
access-list 44 permit 10.4.36.0 0.0.0.255
|
||
|
|
access-list 45 remark -=ServMailNet=-
|
||
|
|
access-list 45 permit 10.4.7.0 0.0.0.15
|
||
|
|
access-list 98 deny 192.168.8.120
|
||
|
|
access-list 98 remark --REDIST_EIGRP_OSPF_AREA_1--
|
||
|
|
access-list 98 permit 192.168.0.0 0.0.3.255
|
||
|
|
access-list 98 permit 192.168.8.0 0.0.0.255
|
||
|
|
access-list 99 remark --LIST_TO_REDISTR_IN_EIGRP--
|
||
|
|
access-list 99 permit 10.2.1.0 0.0.0.255
|
||
|
|
!
|
||
|
|
radius server IZH-RDS002
|
||
|
|
address ipv4 10.4.0.248 auth-port 1645 acct-port 1646
|
||
|
|
timeout 3
|
||
|
|
retransmit 2
|
||
|
|
key hykFAA@Hg9X9fsokWh5q8wez#&^a9lIizldHKxlRer3RE7AbsTsJwdB^RESF$eJ0
|
||
|
|
!
|
||
|
|
radius server P11-RDS003
|
||
|
|
address ipv4 10.1.122.248 auth-port 1645 acct-port 1646
|
||
|
|
timeout 3
|
||
|
|
retransmit 2
|
||
|
|
key hykFAA@Hg9X9fsokWh5q8wez#&^a9lIizldHKxlRer3RE7AbsTsJwdB^RESF$eJ0
|
||
|
|
!
|
||
|
|
!
|
||
|
|
!
|
||
|
|
control-plane
|
||
|
|
!
|
||
|
|
!
|
||
|
|
no vstack
|
||
|
|
alias exec sib sh ip int brief
|
||
|
|
!
|
||
|
|
line con 0
|
||
|
|
logging synchronous
|
||
|
|
login authentication CONSOLE
|
||
|
|
line aux 0
|
||
|
|
line 2
|
||
|
|
no activation-character
|
||
|
|
no exec
|
||
|
|
transport preferred none
|
||
|
|
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
|
||
|
|
stopbits 1
|
||
|
|
line vty 0 4
|
||
|
|
access-class ACL_VTY in vrf-also
|
||
|
|
exec-timeout 120 0
|
||
|
|
logging synchronous
|
||
|
|
rotary 1
|
||
|
|
transport input ssh
|
||
|
|
line vty 5 15
|
||
|
|
access-class ACL_VTY in vrf-also
|
||
|
|
exec-timeout 120 0
|
||
|
|
logging synchronous
|
||
|
|
transport input ssh
|
||
|
|
!
|
||
|
|
scheduler allocate 20000 1000
|
||
|
|
ntp server 10.4.0.1
|
||
|
|
ntp server 10.4.0.2
|
||
|
|
event manager applet --MARK_UP--
|
||
|
|
event track 20 state up
|
||
|
|
action 001 cli command "enable"
|
||
|
|
action 002 cli command "conf t"
|
||
|
|
action 003 cli command "interface GigabitEthernet0/1"
|
||
|
|
action 004 cli command "ip nat outside"
|
||
|
|
action 005 cli command "end"
|
||
|
|
action 006 cli command "clear ip nat translation *"
|
||
|
|
action 007 syslog msg "MARK is UP"
|
||
|
|
event manager applet --MARK_DOWN--
|
||
|
|
event track 20 state down
|
||
|
|
action 001 cli command "enable"
|
||
|
|
action 002 cli command "conf t"
|
||
|
|
action 003 cli command "interface GigabitEthernet0/1"
|
||
|
|
action 004 cli command "no ip nat outside"
|
||
|
|
action 005 cli command "end"
|
||
|
|
action 006 cli command "clear ip nat translation *"
|
||
|
|
action 007 syslog msg "MARK is DOWN"
|
||
|
|
!
|
||
|
|
event manager history size events 20
|
||
|
|
end
|