П.С. Не верьте сказкам, что PPtP клиента на циске нет! Есть волшебная команда service internal, которая позволяет его использовать. Использовалась версия ИОСа c870-advsecurityk9-mz.124-15.T5
Конфиг 871-ой кошки:
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service internal
!
hostname c871spb-rzevka
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
!
aaa session-id common
clock timezone MSK 3
clock summer-time MSD recurring last Sun Mar 2:00 last Sun Oct 2:00
!
!
dot11 syslog
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.214.1 192.168.214.10
!
ip dhcp pool DCHP-POOL-1
import all
network 192.168.214.0 255.255.255.0
default-router 192.168.214.1
netbios-name-server 192.168.0.171
dns-server 192.168.214.1 192.168.100.254
lease 0 1
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
ip domain list bla-bla.local
ip domain name bla-bla.ru
ip host server2.bla-bla.local 192.168.0.171
ip host _ldap._tcp.dc._msdcs.bla-bla.local srv 1 1 389 server2.bla-bla.local
ip host vm-termserver.bla-bla.local 192.168.0.160
!
vpdn enable
!
vpdn-group 1
request-dialin
protocol pptp
pool-member 1
initiate-to ip aaa.aaa.aaa.226
!
!
!
username admin privilege 15 secret ********************
!
!
archive
log config
hidekeys
!
!
ip ssh maxstartups 5
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description TO_ISP
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface Vlan1
description Internal_LAN
ip address 192.168.214.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
interface Dialer0
mtu 1450
ip address 192.168.111.222 255.255.255.0
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer idle-timeout 0
dialer string 123
dialer vpdn
dialer-group 1
no cdp enable
ppp pfc local request
ppp pfc remote apply
ppp encrypt mppe auto
ppp chap hostname username1
ppp chap password 0 userpass1
!
ip forward-protocol nd
ip route 192.168.0.0 255.255.0.0 192.168.111.1
ip flow-cache timeout active 5
ip flow-export version 5
ip flow-export destination 192.168.100.242 9910
!
no ip http server
no ip http secure-server
ip dns server
ip nat inside source route-map nonat interface FastEthernet4 overload
!
ip access-list standard SNMP_ACCESS
permit 192.168.100.241
!
ip access-list extended FOR-NAT-ACL
permit ip 192.168.214.0 0.0.0.255 any
ip access-list extended From-INTERNET
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip host 255.255.255.255 any
deny ip host 0.0.0.0 any
deny udp any any eq 5060
deny tcp any any eq 5060
deny tcp any any eq 2000
deny udp any any eq 1720
deny tcp any any eq 1720
permit ip any any
!
ip sla 10
icmp-echo 192.168.111.1 source-interface Dialer0
timeout 3000
threshold 500
frequency 5
ip sla schedule 10 life forever start-time now
logging origin-id hostname
logging server-arp
logging 192.168.100.241
dialer-list 1 protocol ip permit
snmp-server community public RO SNMP_ACCESS
snmp-server ifindex persist
snmp-server location SPB-Rjevka
snmp-server contact admin@bla-bla.ru
snmp-server chassis-id c871
snmp-server host 192.168.100.241 public
no cdp run
!
!
route-map nonat permit 10
match ip address FOR-NAT-ACL
!
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
privilege level 15
transport input ssh
!
scheduler max-task-time 5000
ntp clock-period 17174962
ntp master
ntp server 213.41.245.21
ntp server 216.58.31.84
ntp server 216.52.237.153
end
Комментариев нет:
Отправить комментарий