Исходное сообщение
"Cisco 891 and Exchange Server 2013" Отправлено userok, 31-Июл-13 01:31
Доброе время суток! Нужна помощь в настройке железки. Досталась от ушедшего админа, а я сам не конфигурил раньше. Задача закрыть дыры если есть, оптимизировать конфиг если нужно и сделать доступным почтовый сервер. Текущий конфиг: Current configuration : 4878 bytes ! ! Last configuration change at 22:24:47 NN Tue Jul 30 2013 by xx ! NVRAM config last updated at 22:24:50 NN Tue Jul 30 2013 by xx ! version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname CISCO891 ! boot-start-marker boot-end-marker ! ! ! aaa new-model ! ! aaa authentication login default local ! ! ! ! ! aaa session-id common ! clock timezone NN 7 0 no ip source-route ! ! ! ip dhcp excluded-address 192.168.10.1 ! ! ip cef no ip bootp server ip domain name XYZ.local ip name-server xxx.xxx.xxx.xxx ip name-server xxx.xxx.xxx.xxx ip name-server 8.8.8.8 ip inspect name INSPECT_OUT dns ip inspect name INSPECT_OUT ntp ip inspect name INSPECT_OUT tcp router-traffic ip inspect name INSPECT_OUT udp router-traffic ip inspect name INSPECT_OUT http ip inspect name INSPECT_OUT https ip inspect name INSPECT_OUT ftp ip inspect name INSPECT_OUT sip ip inspect name INSPECT_OUT icmp router-traffic no ipv6 cef ! multilink bundle-name authenticated crypto pki token default removal timeout 0 ! ! license udi pid CISCO891-K9 sn XXXXXXXXX ! ! archive log config   logging enable   hidekeys username root privilege 15 secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX ! ! ip ssh time-out 60 ip ssh authentication-retries 2 ip ssh version 2 ! class-map match-any CCP-Transactional-1 match  dscp af21 match  dscp af22 match  dscp af23 class-map match-any CCP-Voice-1 match  dscp ef class-map match-any CCP-Routing-1 match  dscp cs6 class-map match-any CCP-Signaling-1 match  dscp cs3 match  dscp af31 class-map match-any CCP-Management-1 match  dscp cs2 ! ! policy-map CCP-QoS-Policy-1 class CCP-Voice-1   priority percent 20   police cir 512000    conform-action transmit    exceed-action drop class CCP-Signaling-1   bandwidth percent 5   police cir 64000    conform-action transmit    exceed-action drop class CCP-Routing-1   bandwidth percent 5   police cir 64000    conform-action transmit    exceed-action drop class CCP-Management-1   bandwidth percent 5   police cir 32000    conform-action transmit    exceed-action drop class CCP-Transactional-1   bandwidth percent 5   police cir 32000    conform-action transmit    exceed-action drop class class-default   fair-queue   random-detect   police cir 1024000    conform-action transmit    exceed-action drop ! ! ! ! ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface FastEthernet4 ! interface FastEthernet5 ! interface FastEthernet6 ! interface FastEthernet7 ! interface FastEthernet8 description === INTERNET === ip address aaa.bbb.ccc.38 255.255.255.224 ip access-group FIREWALL in no ip redirects no ip proxy-arp ip mtu 1492 ip flow ingress ip nat outside ip inspect INSPECT_OUT out no ip virtual-reassembly in ip verify unicast reverse-path duplex auto speed auto no cdp enable service-policy output CCP-QoS-Policy-1 ! interface GigabitEthernet0 no ip address shutdown duplex auto speed auto ! interface Vlan1 description === LAN === ip address 192.168.10.1 255.255.255.0 ip accounting output-packets ip mtu 1492 ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1412 ! interface Async1 no ip address encapsulation slip shutdown ! ip forward-protocol nd ! ! no ip http server no ip http secure-server ip dns server no ip nat service sip udp port 5060 ip nat inside source list NAT interface FastEthernet8 overload ip nat inside source static udp 192.168.10.4 5060 interface FastEthernet8 5060 ip nat inside source static tcp 192.168.10.5 995 interface FastEthernet8 995 ip nat inside source static tcp 192.168.10.5 993 interface FastEthernet8 993 ip nat inside source static tcp 192.168.10.5 25 interface FastEthernet8 25 ip route 0.0.0.0 0.0.0.0 aaa.bbb.ccc.33 ! ip access-list extended FIREWALL deny   ip host 0.0.0.0 any deny   ip 10.0.0.0 0.255.255.255 any deny   ip 172.16.0.0 0.15.255.255 any deny   ip 192.168.0.0 0.0.255.255 any deny   ip host 255.255.255.255 any deny   ip 224.0.0.0 15.255.255.255 any deny   ip any host 112.25.138.20 deny   ip host 112.25.138.20 any deny   udp 112.25.0.0 0.0.255.255 host 192.168.10.4 eq 5060 deny   tcp 112.25.0.0 0.0.255.255 host 192.168.10.4 deny   ip 112.0.0.0 0.255.255.255 any permit tcp any host aaa.bbb.ccc.38 eq www permit tcp any host aaa.bbb.ccc.38 eq 443 permit udp any host aaa.bbb.ccc.38 eq 5060 permit tcp any host aaa.bbb.ccc.38 eq 993 permit tcp any host aaa.bbb.ccc.38 eq 995 permit tcp any host aaa.bbb.ccc.38 eq smtp deny   ip any any ip access-list extended NAT permit ip 192.168.10.0 0.0.0.255 any ! logging esm config ! ! ! ! ! ! ! control-plane ! ! line con 0 line 1 modem InOut stopbits 1 speed 115200 flowcontrol hardware line aux 0 line vty 0 4 privilege level 15 transport input telnet ssh ! ntp update-calendar ntp server 192.168.10.2 prefer source FastEthernet0 end Где, aaa.bbb.ccc.38 - внешний IP адрес маршрутизатора 192.168.10.4 - Asterisk (IP-АТС) 192.168.10.5 - MS Exchange Server 2013 192.168.10.2 - DC, DNS, DHCP, NTP Server внутренней сети 112.25.138.20 - IP с которого пытались когда-то подломить Asterisk aaa.bbb.ccc.33 - шлюз провайдера Для корректной работы Exchange нужны порты: 80 443 993 995 25 про 53 не знаю нужен или нет Exchange Server подключен в общий коммутатор, в который и маршрутизатор (если нужна такая информация) Из внутренней сетки Telnet заходит на 25 порт, из внешней нет ((( Почта не бегает. В чём тут грабли?