Building configuration...


Current configuration : 26440 bytes
!
! Last configuration change at 21:40:25 UTC Fri Jul 15 2022
! NVRAM config last updated at 01:00:01 UTC Thu Jul 28 2022
!
version 16.6
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone year
service timestamps log datetime msec localtime show-timezone year
service password-encryption
service sequence-numbers
platform qfp utilization monitor load 80
no platform punt-keepalive disable-kernel-core
platform hardware throughput level 100000
!
hostname MSK-KG-MSK-RT-1-2
!
boot-start-marker
boot system flash bootflash:isr4300-universalk9.16.06.01.SPA.bin
boot-end-marker
!
!
vrf definition Mgmt-intf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
security authentication failure rate 3 log
logging buffered 16386
logging rate-limit 100 except warnings
enable secret 5 $1$oWNg$DXeTXoctFS.LBnwtqgrv..
!
aaa new-model
!
!
aaa group server radius NPS
 server name IZH-RDS002
 server name P11-RDS003
 ip radius source-interface GigabitEthernet0/0/0.300
 load-balance method least-outstanding
!
aaa authentication login default group NPS local enable
aaa authentication login CONSOLE local group NPS
aaa authorization exec default group NPS local if-authenticated 
!
!
!
!
!
!
aaa session-id common
no ip source-route
no ip gratuitous-arps
!
!
!
no ip bootp server
ip host tftp 10.4.0.214
ip host VM-KG-NET 10.1.12.70
ip name-server 1.1.1.1 9.9.9.9
ip domain name komos.ru
!
!
!
login block-for 60 attempts 3 within 20
login on-failure log
login on-success log
!
!
!
!
!
!
!
subscriber templating
! 
! 
! 
! 
!
!
!
multilink bundle-name authenticated
!
flow exporter FLOW_EXPORTER_NTOP
 destination 10.4.0.215
 source GigabitEthernet0/0/0.300
 transport udp 9995
 export-protocol netflow-v5
!
!
flow exporter FLOW_EXPORTER_CISCO
 destination 10.4.0.217
 source GigabitEthernet0/0/0.300
 transport udp 9995
 export-protocol netflow-v5
!
!
flow monitor FLOW_MONITOR_INPUT
 description input
 exporter FLOW_EXPORTER_CISCO
 cache timeout inactive 10
 cache timeout active 60
 record netflow ipv4 original-input
!
!
flow monitor FLOW_MONITOR_OUTPUT
 description output
 exporter FLOW_EXPORTER_CISCO
 cache timeout inactive 10
 cache timeout active 60
 record netflow ipv4 original-output
!
!
!
!
!
!
!
license udi pid ISR4321/K9 sn FDO22461JNM
license boot level securityk9
diagnostic bootup level minimal
spanning-tree extend system-id
archive
 log config
  logging enable
  logging size 900
  notify syslog contenttype plaintext
  hidekeys
 path tftp://tftp/MSK/KG/MSK-RT/$H.$T.conf
 write-memory
 time-period 10080
!
!
!
!
!
object-group network NET_KOMOSGROUP 
 description --KOMOS--
 91.240.179.0 255.255.255.0
 host 5.227.124.143
 host 62.141.96.126
 host 84.201.247.190
 host 88.80.33.10
 host 88.80.33.50
 host 94.25.46.122
!
object-group network NET_MLK_IZH 
 description --IZHMOLOKO--
 host 78.85.13.42
 host 85.140.32.27
 host 31.173.105.54
 host 217.14.195.253
 host 84.201.247.157
!
object-group network NET_RMT_PS 
 description --REMOTE_PRODACTIUON_SITES--
 group-object NET_MLK_IZH
 group-object NET_KOMOSGROUP
!
object-group network OBJ_BBN_RN_BBN 
 host 85.140.32.104
 host 78.85.13.205
!
object-group network OBJ_BBN_VST_BBN 
 host 85.140.32.103
 host 83.169.220.204
!
object-group network OBJ_IZH_MLK_IZM 
 host 85.140.32.27
 host 78.85.13.42
 host 5.227.126.169
 host 31.173.105.54
 host 217.14.195.253
 host 85.175.86.74
!
object-group network OBJ_IZH_KG_P11 
 91.240.179.0 255.255.255.0
 host 5.227.124.143
 host 78.85.13.93
 host 62.141.96.126
 host 84.201.247.190
 host 88.80.33.50
 host 94.25.46.122
!
object-group network OBJ_IZH_VST_IZM 
 host 5.227.124.82
 host 78.85.13.38
!
object-group network OBJ_IZH_TK_M44 
 host 212.46.204.74
 host 88.80.33.162
!
object-group network OBJ_IZH_TK_M48 
 host 87.249.237.250
!
object-group network OBJ_IZH_TK_SMR 
 host 87.249.239.226
 host 88.80.33.42
!
object-group network OBJ_MSK_KG_MSK 
 host 185.62.195.150
 host 185.6.175.101
!
object-group network OBJ_GLZ_MLK_GMK 
 host 31.173.105.62
 host 85.140.32.29
!
object-group network OBJ_KZN_MLK_KMK 
 host 83.69.126.54
 host 94.180.253.210
 host 78.138.171.82
!
object-group network OBJ_KEZ_MLK_KZS 
 host 31.173.105.66
 host 78.85.13.52
 host 85.140.32.30
!
object-group network OBJ_PRM_MLK_PHK 
 host 178.47.128.18
 host 46.146.210.68
!
object-group network OBJ_SAR_MLK_SRM 
 host 31.173.105.58
 host 78.85.13.53
 host 85.140.32.28
!
object-group network OBJ_CLB_MLK_CMK 
 host 37.113.128.241
 host 149.255.6.35
!
object-group network OBJ_GLZ_GKZ_GKZ 
 host 78.85.13.94
 host 146.120.104.181
!
object-group network OBJ_KIA_RN_KIA 
 host 78.85.14.97
!
object-group network OBJ_IZH_TZK_TZK 
 host 78.25.80.134
 host 5.227.124.235
!
object-group network OBJ_IZH_MK_VS17 
 host 5.227.124.141
!
object-group network OBJ_IZH_KL_KLI 
 host 78.85.15.85
 host 84.201.247.24
 host 79.175.36.97
 host 84.201.244.235
!
object-group network OBJ_EKB_KG_EKB 
 host 62.168.232.182
 host 176.215.14.11
!
object-group network OBJ_IZH_KEN_VS56 
 host 83.143.54.246
 host 92.55.54.109
!
object-group network OBJ_IZH_VRS_IZM 
 host 85.140.32.177
 host 78.85.14.98
!
object-group network OBJ_GLZ_VRS_UPF 
 host 95.215.208.234
 host 78.85.13.119
!
object-group network OBJ_IZH_VRS_IPF 
 host 85.140.32.141
 host 78.85.13.117
!
object-group network OBJ_IZH_VRS_PFV 
 host 85.140.32.178
 host 94.181.119.90
 host 78.85.33.50
!
object-group network OBJ_VOT_VRS_VPF 
 host 78.85.13.118
 host 88.80.33.14
!
object-group network OBJ_MSB_TMA_MSB 
 host 78.138.182.214
!
object-group network OBJ_KIB_TMA_KIB 
 host 78.138.182.126
!
object-group network OBJ_PRM_VRS_MPF 
 host 178.47.130.10
 host 5.227.121.127
!
object-group network OBJ_LAI_VRS_DPF 
 host 178.205.241.114
 host 46.232.164.108
!
object-group network OBJ_SHM_TMA_SHM 
 host 89.232.91.106
 host 31.173.182.210
!
object-group network OBJ_EVL_TMA_EVL 
 host 89.232.102.166
!
object-group network OBJ_ITL_VST_ITL 
 host 5.227.124.130
 host 78.85.34.99
 host 81.211.13.82
!
object-group network OBJ_MZH_VST_MZH 
 host 88.80.33.250
 host 83.169.220.171
!
object-group network OBJ_KIA_VST_KIA 
 host 85.140.32.24
 host 188.94.168.238
!
object-group network OBJ_KGB_VST_KBB 
 host 78.85.37.88
 host 88.80.33.154
!
object-group network OBJ_SAR_VST_SMK 
 host 78.85.19.93
 host 88.80.33.234
!
object-group network OBJ_KNK_VST_KMK 
 host 178.161.242.67
!
object-group network OBJ_IZH_KM_S61 
 host 84.201.247.32
 host 88.80.33.194
!
object-group network OBJ_YAN_GKZ_YEL 
 host 77.94.97.222
!
object-group network OBJ_KGB_RN_KGB 
 host 78.85.13.165
!
object-group network OBJ_NCH_RN_NCH 
 host 78.85.13.166
!
object-group network OBJ_PRI_RN_PRI 
 host 78.85.13.167
!
object-group network OBJ_URN_RN_URN 
 host 78.85.20.49
!
object-group network OBJ_MZH_TK_TKM 
 host 88.80.32.230
 host 78.85.35.34
!
object-group network OBJ_GLZ_TK_TKG 
 host 95.215.208.240
 host 146.120.104.235
 host 95.215.208.173
!
object-group network OBJ_IZH_TK_M21 
 host 84.201.242.133
!
object-group network OBJ_IZH_HLA_PP 
 host 92.61.17.250
!
object-group network OBJ_IZH_HLA_UHK 
 host 92.55.7.148
!
object-group network OBJ_IZH_VD_VS17 
 host 84.201.247.100
!
object-group network OBJ_IZH_KS_H17 
 85.140.32.64 255.255.255.252
 host 85.140.32.63
 host 85.140.32.68
!
object-group network OBJ_IZH_KI_VOR158 
 host 46.147.130.59
 host 5.227.125.126
!
object-group network OBJ_SPB_KG_SPB 
 host 62.141.114.190
 host 94.72.27.43
!
object-group network OBJ_BRANCHES 
 group-object OBJ_IZH_MLK_IZM
 group-object OBJ_IZH_KG_P11
 group-object OBJ_IZH_VST_IZM
 group-object OBJ_IZH_TK_M44
 group-object OBJ_IZH_TK_M48
 group-object OBJ_IZH_TK_SMR
 group-object OBJ_MSK_KG_MSK
 group-object OBJ_GLZ_MLK_GMK
 group-object OBJ_KZN_MLK_KMK
 group-object OBJ_KEZ_MLK_KZS
 group-object OBJ_PRM_MLK_PHK
 group-object OBJ_SAR_MLK_SRM
 group-object OBJ_CLB_MLK_CMK
 group-object OBJ_BBN_RN_BBN
 group-object OBJ_GLZ_GKZ_GKZ
 group-object OBJ_KIA_RN_KIA
 group-object OBJ_IZH_TZK_TZK
 group-object OBJ_IZH_MK_VS17
 group-object OBJ_IZH_KL_KLI
 group-object OBJ_EKB_KG_EKB
 group-object OBJ_IZH_KEN_VS56
 group-object OBJ_IZH_VRS_IZM
 group-object OBJ_GLZ_VRS_UPF
 group-object OBJ_IZH_VRS_IPF
 group-object OBJ_IZH_VRS_PFV
 group-object OBJ_VOT_VRS_VPF
 group-object OBJ_MSB_TMA_MSB
 group-object OBJ_KIB_TMA_KIB
 group-object OBJ_PRM_VRS_MPF
 group-object OBJ_LAI_VRS_DPF
 group-object OBJ_BBN_VST_BBN
 group-object OBJ_SHM_TMA_SHM
 group-object OBJ_EVL_TMA_EVL
 group-object OBJ_ITL_VST_ITL
 group-object OBJ_MZH_VST_MZH
 group-object OBJ_KIA_VST_KIA
 group-object OBJ_KGB_VST_KBB
 group-object OBJ_SAR_VST_SMK
 group-object OBJ_KNK_VST_KMK
 group-object OBJ_IZH_KM_S61
 group-object OBJ_YAN_GKZ_YEL
 group-object OBJ_KGB_RN_KGB
 group-object OBJ_NCH_RN_NCH
 group-object OBJ_PRI_RN_PRI
 group-object OBJ_URN_RN_URN
 group-object OBJ_MZH_TK_TKM
 group-object OBJ_GLZ_TK_TKG
 group-object OBJ_IZH_TK_M21
 group-object OBJ_IZH_HLA_PP
 group-object OBJ_IZH_HLA_UHK
 group-object OBJ_IZH_VD_VS17
 group-object OBJ_IZH_KS_H17
 group-object OBJ_IZH_KI_VOR158
 group-object OBJ_SPB_KG_SPB
!
object-group network OBJ_KUN_KMK_B2 
 94.138.150.0 255.255.255.0
!
object-group network STATIC_ISP_IP 
 host 185.6.175.101
!
!
!
username netadmin privilege 15 secret 5 $1$02tT$URNsWJZ2QMB3u2zijSlBy1
!
redundancy
 mode none
!
!
!
!
!
!
track 1 ip sla 1 reachability
 delay down 10 up 5
!
track 2 ip sla 2 reachability
 delay down 10 up 5
!
track 3 ip sla 3 reachability
 delay down 10 up 5
!
track 4 ip sla 4 reachability
 delay down 10 up 5
!
track 5 ip sla 5 reachability
 delay down 10 up 5
!
track 6 ip sla 6 reachability
 delay down 5 up 30
!
track 10 list boolean or
 object 1
 object 2
 object 3
 object 4
 object 5
 object 6
 delay down 5 up 30
!
!
class-map type inspect match-any CM_WAN_TO_SELF
 match access-group name ACL_WAN_TO_SELF
class-map type inspect match-any CM_SELF_TO_WAN
 match protocol tcp
 match protocol udp
 match protocol icmp
 match protocol dns
class-map type inspect match-any CM_LAN_TO_WAN
 match protocol tcp
 match protocol udp
 match protocol icmp
!
policy-map type inspect PM_WAN_TO_SELF
 class type inspect CM_WAN_TO_SELF
  inspect
 class class-default
policy-map type inspect PM-PASSANY
 class class-default
  pass
policy-map type inspect PM_LAN_TO_WAN
 class type inspect CM_LAN_TO_WAN
  inspect
 class class-default
policy-map type inspect PM_SELF_TO_WAN
 class type inspect CM_SELF_TO_WAN
  inspect
 class class-default
  pass
!
zone security LAN
 description LAN_TRAFFIC
zone security WAN
 description WAN_TRAFFIC
zone-pair security ZBF_LAN_TO_WAN source LAN destination WAN
 service-policy type inspect PM_LAN_TO_WAN
zone-pair security ZBF_SELF_TO_WAN source self destination WAN
 service-policy type inspect PM_SELF_TO_WAN
zone-pair security ZBF_WAN_TO_SELF source WAN destination self
 service-policy type inspect PM_WAN_TO_SELF
zone-pair security ZP-LAN_TO_SELF source LAN destination self
 service-policy type inspect PM-PASSANY
zone-pair security ZP-SELF_TO_LAN source self destination LAN
 service-policy type inspect PM-PASSANY
! 
crypto logging session
!
!
!
!
!
!
crypto isakmp policy 150
 encr aes
 authentication pre-share
 group 2
crypto isakmp key mlk20kom19 address 0.0.0.0         no-xauth
crypto isakmp keepalive 30
crypto isakmp nat keepalive 10
!
!
crypto ipsec transform-set CRYPTO_TS_DMVPN esp-aes esp-sha-hmac 
 mode transport
!
crypto ipsec profile CRYPTO_IPSEC_DMVPN
 description --SPOKE_TO_SITE_DMVPN_IPSEC_GRE--
 set transform-set CRYPTO_TS_DMVPN 
!
!
!
!
!
!
! 
! 
!
!
interface Loopback7777
 description TK7787m
 no ip address
 shutdown
!
interface Tunnel1001
 description --DMVPN_SPOKE_36_CLOUD_1--
 bandwidth 3000
 ip flow monitor FLOW_MONITOR_INPUT input
 ip flow monitor FLOW_MONITOR_OUTPUT output
 ip address 172.30.1.38 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1400
 ip nhrp authentication M_K.Cl01
 ip nhrp map 172.30.1.1 85.140.32.27
 ip nhrp map 172.30.1.2 78.85.13.42
 ip nhrp map multicast 85.140.32.27
 ip nhrp map multicast 78.85.13.42
 ip nhrp network-id 1001
 ip nhrp holdtime 300
 ip nhrp nhs 172.30.1.1
 ip nhrp nhs 172.30.1.2
 zone-member security LAN
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0/1
 tunnel mode gre multipoint
 tunnel key 1001
 tunnel protection ipsec profile CRYPTO_IPSEC_DMVPN shared
!
interface Tunnel1002
 description --DMVPN_SPOKE_36_CLOUD_2--
 bandwidth 3000
 ip flow monitor FLOW_MONITOR_INPUT input
 ip flow monitor FLOW_MONITOR_OUTPUT output
 ip address 172.30.2.38 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1400
 ip nhrp authentication M_K.Cl02
 ip nhrp map 172.30.2.1 5.227.124.143
 ip nhrp map 172.30.2.2 78.85.13.93
 ip nhrp map multicast 5.227.124.143
 ip nhrp map multicast 78.85.13.93
 ip nhrp network-id 1002
 ip nhrp holdtime 300
 ip nhrp nhs 172.30.2.1
 ip nhrp nhs 172.30.2.2
 zone-member security LAN
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet0/0/1
 tunnel mode gre multipoint
 tunnel key 1002
 tunnel protection ipsec profile CRYPTO_IPSEC_DMVPN shared
!
interface GigabitEthernet0/0/0
 description LOCAL_NETWORK
 no ip address
 zone-member security LAN
 negotiation auto
!
interface GigabitEthernet0/0/0.2
 description MSK_LAN-USER
 encapsulation dot1Q 2
 ip dhcp relay information trusted
 ip address 10.1.129.252 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 zone-member security LAN
 standby 1 ip 10.1.129.254
 standby 1 priority 95
 standby 1 preempt
 standby 1 track 10 decrement 20
 ip virtual-reassembly
!
interface GigabitEthernet0/0/0.100
 description MSK_FemtoCell
 encapsulation dot1Q 100
 ip dhcp relay information trusted
 ip address 10.1.135.12 255.255.255.240
 ip nat inside
 standby version 2
 standby 100 ip 10.1.135.14
 standby 100 priority 90
 standby 100 preempt
 standby 100 track 10 decrement 20
!
interface GigabitEthernet0/0/0.150
 description MSK_WIFI-USER
 encapsulation dot1Q 150
 ip dhcp relay information trusted
 ip address 10.1.130.252 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip dns view-group DNS_ACCESS_AREA_150
 zone-member security LAN
 standby 1 ip 10.1.130.254
 standby 1 priority 120
 standby 1 preempt
 standby 1 track 10 decrement 20
 ip virtual-reassembly
!
interface GigabitEthernet0/0/0.200
 description MSK_MGMT-SRV
 encapsulation dot1Q 200
 ip dhcp relay information trusted
 ip address 10.1.131.252 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 zone-member security LAN
 standby 1 ip 10.1.131.254
 standby 1 priority 95
 standby 1 preempt
 standby 1 track 10 decrement 20
 ip virtual-reassembly
!
interface GigabitEthernet0/0/0.300
 description MSK_MGMT-NET
 encapsulation dot1Q 300
 ip dhcp relay information trusted
 ip address 10.1.132.252 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 zone-member security LAN
 standby 1 ip 10.1.132.254
 standby 1 priority 95
 standby 1 preempt
 standby 1 track 10 decrement 20
 ip virtual-reassembly
!
interface GigabitEthernet0/0/0.350
 description MSK_VOIP
 encapsulation dot1Q 350
 ip dhcp relay information trusted
 ip address 10.1.133.252 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 zone-member security LAN
 standby 1 ip 10.1.133.254
 standby 1 priority 95
 standby 1 preempt
 standby 1 track 10 decrement 20
 ip virtual-reassembly
!
interface GigabitEthernet0/0/0.400
 description MSK_VIDEO-NET
 encapsulation dot1Q 400
 ip dhcp relay information trusted
 ip address 10.1.134.252 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 zone-member security LAN
 standby 1 ip 10.1.134.254
 standby 1 priority 95
 standby 1 preempt
 standby 1 track 10 decrement 20
 ip virtual-reassembly
!
interface GigabitEthernet0/0/0.555
 description --BGP_TRANSIT--
 encapsulation dot1Q 555
 ip address 172.30.30.130 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 zone-member security LAN
!
interface GigabitEthernet0/0/1
 description [ISP-100M] MEGAFON/GARS
 ip flow monitor FLOW_MONITOR_INPUT input
 ip flow monitor FLOW_MONITOR_OUTPUT output
 ip address 185.6.175.101 255.255.255.192
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 zone-member security WAN
 negotiation auto
!
interface GigabitEthernet0
 vrf forwarding Mgmt-intf
 no ip address
 shutdown
 negotiation auto
!
router bgp 64530
 bgp router-id 172.30.30.130
 bgp log-neighbor-changes
 bgp graceful-restart
 redistribute connected route-map RM_BGP_REDISTR_CON
 neighbor PG_BGP_OCOD peer-group
 neighbor PG_BGP_OCOD remote-as 64512
 neighbor PG_BGP_OCOD next-hop-self
 neighbor PG_BGP_OCOD soft-reconfiguration inbound
 neighbor PG_BGP_OCOD route-map RM_BGP_TO_HUB out
 neighbor PG_BGP_RCOD peer-group
 neighbor PG_BGP_RCOD remote-as 64513
 neighbor PG_BGP_RCOD next-hop-self
 neighbor PG_BGP_RCOD soft-reconfiguration inbound
 neighbor PG_BGP_RCOD route-map RM_BGP_TO_HUB out
 neighbor 172.30.1.1 peer-group PG_BGP_OCOD
 neighbor 172.30.1.2 peer-group PG_BGP_OCOD
 neighbor 172.30.2.1 peer-group PG_BGP_RCOD
 neighbor 172.30.2.2 peer-group PG_BGP_RCOD
 neighbor 172.30.30.129 remote-as 64530
 neighbor 172.30.30.129 next-hop-self
 distance bgp 150 150 150
!
ip nat translation timeout 450
ip nat translation tcp-timeout 300
ip nat translation udp-timeout 45
ip nat translation dns-timeout 5
ip nat translation port-timeout tcp 110 60
ip nat translation port-timeout tcp 25 60
ip nat translation port-timeout tcp 80 15
ip nat translation port-timeout udp 5060 180
ip nat translation max-entries all-host 400
ip nat inside source route-map ISP_1 interface GigabitEthernet0/0/1 overload
ip forward-protocol nd
no ip http server
no ip http secure-server
ip tftp source-interface GigabitEthernet0/0/0.300
ip tftp blocksize 8192
ip dns view default
 dns forwarder 1.1.1.1
 dns forwarder 9.9.9.9
ip dns view KOMOS.LOCAL.150
 domain name komos.local
 domain list komos.local
 domain round-robin
 dns forwarder 192.168.1.21
 dns forwarder 192.168.1.100
 dns forwarding source-interface GigabitEthernet0/0/0.150
ip dns view KOMOS.LOCAL.2
 domain name komos.local
 domain list komos.local
 domain round-robin
 dns forwarder 192.168.1.21
 dns forwarder 192.168.1.100
 dns forwarding source-interface GigabitEthernet0/0/0.2
ip dns view KOMOS.LOCAL.200
 domain name komos.local
 domain list komos.local
 domain round-robin
 dns forwarder 192.168.1.21
 dns forwarder 192.168.1.100
 dns forwarding source-interface GigabitEthernet0/0/0.200
ip dns view KOMOS.LOCAL.300
 domain name komos.local
 domain list komos.local
 domain round-robin
 dns forwarder 192.168.1.21
 dns forwarder 192.168.1.100
 dns forwarding source-interface GigabitEthernet0/0/0.300
ip dns view KOMOS.LOCAL.350
 domain name komos.local
 domain list komos.local
 domain round-robin
 dns forwarder 192.168.1.21
 dns forwarder 192.168.1.100
 dns forwarding source-interface GigabitEthernet0/0/0.350
ip dns view MILKOM-KOMOS.RU.150
 domain name milkom-komos.ru
 domain list milkom-komos.ru
 domain round-robin
 dns forwarder 192.168.8.200
 dns forwarder 192.168.8.201
 dns forwarding source-interface GigabitEthernet0/0/0.150
ip dns view MILKOM-KOMOS.RU.2
 domain name milkom-komos.ru
 domain list milkom-komos.ru
 domain round-robin
 dns forwarder 192.168.8.200
 dns forwarder 192.168.8.201
 dns forwarding source-interface GigabitEthernet0/0/0.2
ip dns view MILKOM-KOMOS.RU.200
 domain name milkom-komos.ru
 domain list milkom-komos.ru
 domain round-robin
 dns forwarder 192.168.8.200
 dns forwarder 192.168.8.201
 dns forwarding source-interface GigabitEthernet0/0/0.200
ip dns view MILKOM-KOMOS.RU.300
 domain name milkom-komos.ru
 domain list milkom-komos.ru
 domain round-robin
 dns forwarder 192.168.8.200
 dns forwarder 192.168.8.201
 dns forwarding source-interface GigabitEthernet0/0/0.300
ip dns view MILKOM-KOMOS.RU.350
 domain name milkom-komos.ru
 domain list milkom-komos.ru
 domain round-robin
 dns forwarder 192.168.8.200
 dns forwarder 192.168.8.201
 dns forwarding source-interface GigabitEthernet0/0/0.350
ip dns view UDMPF.LOCAL.150
 domain name udmpf.local
 domain list udmpf.local
 domain round-robin
 dns forwarder 10.8.0.12
 dns forwarder 10.8.0.11
 dns forwarding source-interface GigabitEthernet0/0/0.2
ip dns view UDMPF.LOCAL.2
 domain name udmpf.local
 domain list udmpf.local
 domain round-robin
 dns forwarder 10.8.0.11
 dns forwarder 10.8.0.12
 dns forwarding source-interface GigabitEthernet0/0/0.2
ip dns view-list DNS_AREA_LOCAL
ip dns view-list DNS_ACCESS_AREA_2
 view KOMOS.LOCAL.2 10
  restrict name-group 1
 view MILKOM-KOMOS.RU.2 20
  restrict name-group 2
 view UDMPF.LOCAL.2 30
  restrict name-group 3
 view default 100
ip dns view-list DNS_ACCESS_AREA_150
 view KOMOS.LOCAL.150 10
  restrict name-group 1
 view MILKOM-KOMOS.RU.150 20
  restrict name-group 2
 view UDMPF.LOCAL.150 30
  restrict name-group 3
 view default 100
ip dns view-list DNS_ACCESS_AREA_300
 view KOMOS.LOCAL.300 10
  restrict name-group 1
 view MILKOM-KOMOS.RU.300 20
  restrict name-group 2
 view default 100
ip dns view-list DNS_ACCESS_AREA_350
 view KOMOS.LOCAL.350 10
  restrict name-group 1
 view MILKOM-KOMOS.RU.350 20
  restrict name-group 2
 view default 100
ip dns view-list DNS_GUEST_AREA
 view default 10
ip dns view-list DNS_ACCESS_AREA_200
 view KOMOS.LOCAL.200 10
  restrict name-group 1
 view MILKOM-KOMOS.RU.200 20
  restrict name-group 2
 view default 100
ip dns name-list 1 permit .*\.KOMOS\.LOCAL
ip dns name-list 1 permit 192\.IN-ADDR
ip dns name-list 1 permit .*\.KOMOS-GROUP\.RU
ip dns name-list 1 permit .*\.KOMOS\.RU
ip dns name-list 2 permit .*\.MILKOM-KOMOS\.RU
ip dns name-list 2 permit 192\.IN-ADDR
ip dns name-list 3 permit .*\.UDMPF\.LOCAL
ip dns server view-group DNS_ACCESS_AREA_2
ip dns server
ip route 0.0.0.0 0.0.0.0 185.6.175.65 name --GARSTELECOM--
!
ip ssh version 2
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr aes128-cbc
!
!
ip prefix-list PFL_BGP_REDISTR_CON seq 10 permit 10.0.0.0/8 le 24
!
ip prefix-list PFL_TO_HUB seq 10 permit 10.1.128.0/21 le 24
!
ip access-list standard ACL_NAT_FEMTOCELL
 permit 10.1.135.0 0.0.0.15
!
ip access-list extended ACL_WAN_TO_SELF
 permit ip object-group OBJ_BRANCHES object-group STATIC_ISP_IP
 permit icmp any object-group STATIC_ISP_IP echo
 permit icmp any object-group STATIC_ISP_IP echo-reply
 permit udp any eq ntp object-group STATIC_ISP_IP
ip sla 1
 icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0/1
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 1 life forever start-time now
ip sla 2
 icmp-echo 8.8.4.4 source-interface GigabitEthernet0/0/1
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 2 life forever start-time now
ip sla 3
 icmp-echo 77.88.8.8 source-interface GigabitEthernet0/0/1
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 3 life forever start-time now
ip sla 4
 icmp-echo 77.88.8.1 source-interface GigabitEthernet0/0/1
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 4 life forever start-time now
ip sla 5
 icmp-echo 77.88.8.88 source-interface GigabitEthernet0/0/1
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 5 life forever start-time now
ip sla 6
 icmp-echo 77.88.8.2 source-interface GigabitEthernet0/0/1
 threshold 2000
 timeout 3000
 frequency 10
ip sla schedule 6 life forever start-time now
kron occurrence EveryDay at 1:00 recurring
 policy-list SaveBackup
!
kron policy-list SaveBackup
 cli write memory
!
logging origin-id hostname
logging source-interface GigabitEthernet0/0/0.300
logging host 10.4.244.4 transport udp port 515
access-list 1 remark -==MSK_LAN-USER==-
access-list 1 permit 192.168.20.0 0.0.0.63
access-list 1 permit 10.1.129.0 0.0.0.255
access-list 2 remark -==MSK_WIFI-USER==-
access-list 2 permit 10.1.130.0 0.0.0.255
access-list 2 permit 192.168.20.128 0.0.0.63
access-list 3 remark -==MSK_VOIP==-
access-list 3 permit 10.1.133.0 0.0.0.255
access-list 3 permit 192.168.20.64 0.0.0.63
access-list 4 permit 192.168.250.2
access-list 5 remark -==MSK_MGMT-SRV==-
access-list 5 permit 10.1.131.0 0.0.0.255
access-list 6 remark -==MSK_MGMT-NET==-
access-list 6 permit 10.1.132.0 0.0.0.255
access-list 6 permit 10.1.5.32 0.0.0.31
access-list 6 permit 10.1.50.24 0.0.0.3
access-list 7 remark -==P11_TO_IP-ATC_FROM_ROSFON==-
access-list 7 permit 10.1.13.2
access-list 7 permit 10.1.19.148
access-list 8 remark -==MSK_VIDEO==-
access-list 8 permit 10.1.134.0 0.0.0.255
access-list 10 remark -==NTP SERVERS==-
access-list 10 permit 91.226.136.136
access-list 10 permit 91.226.136.142
access-list 10 deny   any
access-list 11 remark -==NTP CLIENTS==-
access-list 11 permit 10.1.131.0 0.0.0.255
access-list 11 permit 10.1.132.0 0.0.0.255
access-list 11 permit 10.1.133.0 0.0.0.255
access-list 11 permit 10.1.5.32 0.0.0.31
access-list 11 permit 192.168.20.128 0.0.0.63
access-list 11 deny   any
!
!
route-map RM_BGP_REDISTR_CON permit 10 
 match ip address prefix-list PFL_BGP_REDISTR_CON
!
route-map ISP_1 permit 9 
 match ip address 1 2 3 4 5 6 7 8 ACL_NAT_FEMTOCELL
 match interface GigabitEthernet0/0/1
!
route-map RM_BGP_TO_HUB permit 10 
 match ip address prefix-list PFL_TO_HUB
!
route-map RM_BGP_FROM_HUB permit 10 
 set local-preference 1000
!
snmp-server community lmTUEsk6Yvlv RO
snmp-server host 10.1.122.227 lmTUEsk6Yvlv 
!
!
!
radius server IZH-RDS002
 address ipv4 10.4.0.248 auth-port 1645 acct-port 1646
 timeout 3
 retransmit 2
 key 7 011B1F0F7D2A272F094B17314003041D003B0C7F3A7C3F362F615539175A0D7F50425F502628001A6B5D45006070032A5915334B7D1317243A692E352965496459
!
radius server P11-RDS003
 address ipv4 10.1.122.248 auth-port 1645 acct-port 1646
 timeout 3
 retransmit 2
 key 7 0453120D29006D6E211E5C2F4B0D1F0B211C2C7D226D35161D55453F5700547A5D140F1C3E72405B61574707397E51265A4430002C135F29383D047F684D1C2F47
!
!
control-plane
!
!
line con 0
 logging synchronous
 login authentication CONSOLE
 transport input none
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 exec-timeout 120 0
 logging synchronous
 login authentication NPS
 length 0
 transport input ssh
line vty 5 15
 exec-timeout 120 0
 logging synchronous
 login authentication NPS
 transport input ssh
!
ntp source GigabitEthernet0/0/1
ntp access-group peer 10
ntp access-group serve 11
ntp master 3
ntp server 109.195.19.73
ntp server 88.147.254.227 prefer
!
!
!
!
!
end