>[оверквотинг удален]
>> 62.148.237.152
>> Так вот циска , блокирует
>> %FW-6-LOG_SUMMARY: 17 packets were dropped from 62.148.237.152:5060=> 82.112.32.254:1043
>> (target:class)-(ccp-zp-out-self:class-default)
>> Подскажите как его разрешить???
>> Все что потребуется, конфиги и т.д. могу выложить.
>> П.С. Циску настраивал с помощью CiscoCP. До установки cisco 2811 , раньше
>> все прекрасно работало на Dlink DFL-210.
> да, пожалуй куски конфига FW, но будет проще если под рукой вес
> конфиг (логин, итд конфиги не нужны)Building configuration...
Current configuration : 19187 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname cisco2811
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 warnings
logging console critical
enable secret 5 $1$lQxL$HzQupwz3ghC6/I/apgEDA.
enable password 7 014455560E5C555D74
!
aaa new-model
!
!
aaa authentication login local_authen local
aaa authentication dot1x default group radius
aaa authorization exec local_author local
!
!
aaa session-id common
clock timezone Russia 5
clock summer-time Russia date Mar 30 2003 2:00 Oct 26 2003 3:00
dot11 syslog
no ip source-route
!
!
ip cef
ip dhcp excluded-address 192.168.0.1 192.168.0.29
ip dhcp excluded-address 192.168.0.91 192.168.0.254
!
!
no ip bootp server
ip domain name dasseburg.com
ip name-server 94.230.128.3
ip name-server 94.230.129.3
ip port-map user-protocol--1 port tcp 3389
ip inspect name voip sip
ip ips config location http://192.168.0.5/ retries 1
ip ips notify SDEE
ip ips name sdm_ips_rule
!
ip ips signature-category
category all
retired true
category ios_ips basic
retired false
!
!
multilink bundle-name authenticated
!
parameter-map type regex sdm-regex-nonascii
pattern [^\x00-\x80]
parameter-map type urlfilter SDM_URLFILTER_MAP
server vendor websense 192.168.0.5 timeout 5
allow-mode on
exclusive-domain deny www.odnoklassniki.ru
exclusive-domain deny www.ekabu.ru
exclusive-domain deny odnoklassniki.ru
parameter-map type urlfilter TEST
!
voice-card 0
no dspfarm
!
!
!
voice service voip
allow-connections h323 to h323
allow-connections h323 to sip
allow-connections sip to h323
allow-connections sip to sip
redirect ip2ip
sip
registrar server expires max 3600 min 3600
redirect contact order best-match
no call service stop
!!
crypto pki trustpoint tti
revocation-check crl
rsakeypair tti
!
crypto pki trustpoint TP-self-signed-2863701609
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2863701609
revocation-check none
rsakeypair TP-self-signed-2863701609
!
crypto pki trustpoint test_trustpoint_config_created_for_sdm
subject-name e=sdmtest@sdmtest.com
revocation-check crl
!
!
crypto pki certificate chain tti
crypto pki certificate chain TP-self-signed-2863701609
certificate self-signed 01
3082024F 308201B8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32383633 37303136 3039301E 170D3130 30343137 31303232
35375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 38363337
30313630 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
810090DB 8907D5FA 0941D08D 235ADE02 B3B11781 37924948 183E76CB 5B343CE0
9F879631 33F89880 9568E7ED 8CB0CD11 A4745DA6 AF3DDFE4 2E1EC82C AB8FC8AB
80031D44 51844248 2A9C2876 72672C5D 3E1A7696 69D2C957 814D9D5F 5C5A453A
F55D71EA 0D616665 090231F8 09B07B7E 632C8DDC 981B8367 A9B038E6 392B33E1
F3310203 010001A3 77307530 0F060355 1D130101 FF040530 030101FF 30220603
551D1104 1B301982 17636973 636F3238 31312E64 61737365 62757267 2E636F6D
301F0603 551D2304 18301680 14D7B9CD 24392C84 C6634F01 81139669 70C1A02A
9C301D06 03551D0E 04160414 D7B9CD24 392C84C6 634F0181 13966970 C1A02A9C
300D0609 2A864886 F70D0101 04050003 81810013 918145F4 46750999 AAD755BD
BD8B8B11 E85D85A2 FA856015 BD592EB6 3A1C0770 65B11A8B EFD31157 18EE6C40
6B444EA8 F92C9167 F6BF5010 57CCC215 CB41F399 04396E9C ABB36AE7 6B357122
BF8A262E 087F322A 7021DC78 11D61B1E 22DE8C40 FFC0A3A9 1B8294C9 F09FB3B1
C897CD8D E3E08900 6D6095A5 857239D5 42E505
quit
crypto pki certificate chain test_trustpoint_config_created_for_sdm
!
!
username root privilege 15 password 7 08235A66232E5C19202627
archive
log config
hidekeys
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key xxxxxxxxxxx address 195.64.118.162
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to195.64.118.162
set peer 195.64.118.162
set transform-set ESP-3DES-SHA
match address 101
!
!
crypto key pubkey-chain rsa
named-key realm-cisco.pub
key-string
30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
F3020301 0001
quit
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
class-map type inspect match-all sdm-cls-VPNOutsideToInside-1
match access-group 103
class-map type inspect match-any neofon
match protocol sip
match protocol sip-tls
class-map type inspect match-all sdm-cls-VPNOutsideToInside-2
match access-group 112
class-map type inspect match-all sdm-nat-http-1
match access-group 109
match protocol http
class-map type inspect match-all sdm-nat-user-protocol--1-1
match access-group 110
match protocol user-protocol--1
class-map type inspect match-all SDM_GRE
match access-group name SDM_GRE
class-map type inspect match-any CCP_PPTP
match class-map SDM_GRE
class-map type inspect match-any SDM_AH
match access-group name SDM_AH
class-map type inspect match-any SDM_ESP
match access-group name SDM_ESP
class-map type inspect match-any SDM_VPN_TRAFFIC
match protocol isakmp
match protocol ipsec-msft
match class-map SDM_AH
match class-map SDM_ESP
class-map type inspect match-all SDM_VPN_PT
match access-group 102
match class-map SDM_VPN_TRAFFIC
class-map type inspect match-any ccp-cls-insp-traffic
match protocol pptp
match protocol cuseeme
match protocol dns
match protocol ftp
match protocol h323
match protocol https
match protocol icmp
match protocol imap
match protocol pop3
match protocol netshow
match protocol shell
match protocol realmedia
match protocol rtsp
match protocol smtp extended
match protocol sql-net
match protocol streamworks
match protocol tftp
match protocol vdolive
match protocol tcp
match protocol udp
class-map type inspect match-all ccp-insp-traffic
match class-map ccp-cls-insp-traffic
class-map type inspect match-any neofon-1
match protocol sip
match protocol sip-tls
match protocol tcp
match protocol udp
class-map type inspect match-any ccp-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp
class-map type inspect match-all sdm-cls-ccp-permit-1
match class-map neofon
match access-group name usi
class-map type inspect match-all sdm-cls-ccp-permit-2
match access-group name usi1
match class-map neofon-1
class-map type inspect match-all ccp-invalid-src
match access-group 100
class-map type inspect match-all ccp-icmp-access
match class-map ccp-cls-icmp-access
class-map type inspect match-all sdm-cls-ccp-pol-outToIn-1
match class-map neofon
match access-group name usi2
class-map type inspect match-all ccp-protocol-http
match protocol http
!
!
policy-map type inspect ccp-permit-icmpreply
class type inspect ccp-icmp-access
inspect
class class-default
pass
policy-map type inspect ccp-inspect
class type inspect ccp-invalid-src
drop log
class type inspect ccp-protocol-http
inspect
class type inspect ccp-insp-traffic
inspect
class class-default
drop log
policy-map type inspect ccp-permit
class type inspect sdm-cls-ccp-permit-2
pass
class type inspect SDM_VPN_PT
pass
class class-default
pass
policy-map type inspect ccp-pol-outToIn
class type inspect CCP_PPTP
pass
class type inspect sdm-cls-VPNOutsideToInside-1
inspect
class type inspect sdm-cls-ccp-pol-outToIn-1
pass
class type inspect sdm-nat-http-1
inspect
class type inspect sdm-nat-user-protocol--1-1
inspect
class type inspect sdm-cls-VPNOutsideToInside-2
inspect
class class-default
drop log
!
zone security out-zone
zone security in-zone
zone-pair security ccp-zp-self-out source self destination out-zone
service-policy type inspect ccp-permit-icmpreply
zone-pair security ccp-zp-out-zone-To-in-zone source out-zone destination in-zone
service-policy type inspect ccp-pol-outToIn
zone-pair security ccp-zp-in-out source in-zone destination out-zone
service-policy type inspect ccp-inspect
zone-pair security ccp-zp-out-self source out-zone destination self
service-policy type inspect ccp-permit
!
!
!
!
interface Null0
no ip unreachables
!
interface FastEthernet0/0
description UNITLINE$ETH-WAN$$FW_OUTSIDE$
no ip address
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip ips sdm_ips_rule in
ip virtual-reassembly
zone-member security out-zone
ip route-cache flow
shutdown
duplex auto
speed auto
no cdp enable
no mop enabled
!
interface FastEthernet0/1
description K-TELECOM$FW_OUTSIDE$$ETH-WAN$
ip address 82.112.32.254 255.255.255.252
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip ips sdm_ips_rule in
ip virtual-reassembly
zone-member security out-zone
ip route-cache flow
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map SDM_CMAP_1
!
interface FastEthernet0/1/0
description Planet VDSL
!
interface FastEthernet0/1/1
description Trunk to 3Com 4210
switchport trunk native vlan 2
switchport mode trunk
!
interface FastEthernet0/1/2
shutdown
!
interface FastEthernet0/1/3
!
interface Serial0/0/0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
shutdown
clock rate 2000000
!
interface Serial0/3/0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip route-cache flow
shutdown
clock rate 2000000
!
interface Vlan1
description $FW_INSIDE$
ip address 192.168.0.1 255.255.255.0
ip access-group 115 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip ips sdm_ips_rule out
ip virtual-reassembly
zone-member security in-zone
ip route-cache flow
ip tcp adjust-mss 1412
!
interface Vlan2
ip address 10.0.0.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip virtual-reassembly
ip route-cache flow
shutdown
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 82.112.32.253
!
!
ip http server
ip http access-class 7
ip http authentication local
ip http secure-server
ip dns server
ip dns spoofing
ip nat inside source static tcp 192.168.0.5 80 interface FastEthernet0/1 80
ip nat inside source static tcp 192.168.0.2 3389 interface FastEthernet0/1 3389
ip nat inside source route-map SDM_RMAP_7 interface FastEthernet0/1 overload
!
ip access-list extended SDM_AH
remark CCP_ACL Category=1
permit ahp any any
ip access-list extended SDM_ESP
remark CCP_ACL Category=1
permit esp any any
ip access-list extended SDM_GRE
remark CCP_ACL Category=1
permit gre any any
ip access-list extended SDM_HTTP
remark SDM_ACL Category=0
permit tcp any any eq www
ip access-list extended SDM_HTTPS
remark SDM_ACL Category=0
permit tcp any any eq 443
ip access-list extended SDM_SHELL
remark SDM_ACL Category=0
permit tcp any any eq cmd
ip access-list extended SDM_SSH
remark SDM_ACL Category=0
permit tcp any any eq 22
ip access-list extended SDM_TELNET
remark SDM_ACL Category=0
permit tcp any any eq telnet
ip access-list extended usi
remark CCP_ACL Category=128
permit ip host 62.148.235.152 any
ip access-list extended usi1
remark CCP_ACL Category=128
permit ip host 62.148.237.152 any
ip access-list extended usi2
remark CCP_ACL Category=128
permit ip host 62.148.237.152 any
!
logging trap debugging
logging facility local2
logging 192.168.0.5
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 2 remark SDM_ACL Category=2
access-list 2 permit 10.0.0.0 0.0.0.255
access-list 3 remark CCP_ACL Category=2
access-list 3 permit 192.168.0.0 0.0.0.255
access-list 4 remark HTTP Access-class list
access-list 4 remark SDM_ACL Category=1
access-list 4 permit 192.168.0.0 0.0.0.255
access-list 4 deny any
access-list 7 remark Auto generated by SDM Management Access feature
access-list 7 remark SDM_ACL Category=1
access-list 7 permit 192.168.0.0 0.0.0.255
access-list 8 remark CCP_ACL Category=2
access-list 8 permit 192.168.0.0 0.0.0.255
access-list 100 remark CCP_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip 82.112.32.252 0.0.0.3 any
access-list 100 permit ip 85.198.87.56 0.0.0.7 any
access-list 101 remark CCP_ACL Category=4
access-list 101 remark IPSec Rule
access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 102 remark CCP_ACL Category=128
access-list 102 permit ip host 195.64.118.162 any
access-list 103 remark CCP_ACL Category=0
access-list 103 remark IPSec Rule
access-list 103 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 104 remark VTY Access-class list
access-list 104 remark CCP_ACL Category=1
access-list 104 permit ip 192.168.0.0 0.0.0.255 any
access-list 104 permit ip host 94.190.61.192 any
access-list 104 deny ip any any
access-list 105 remark SDM_ACL Category=0
access-list 105 remark IPSec Rule
access-list 105 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 106 remark SDM_ACL Category=2
access-list 106 remark IPSec Rule
access-list 106 deny ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 106 remark IPSec Rule
access-list 106 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 106 permit ip 192.168.0.0 0.0.0.255 any
access-list 107 remark CCP_ACL Category=2
access-list 107 remark IPSec Rule
access-list 107 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 107 permit ip 192.168.0.0 0.0.0.255 any
access-list 108 remark SDM_ACL Category=0
access-list 108 remark IPSec Rule
access-list 108 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 109 remark CCP_ACL Category=0
access-list 109 permit ip any host 192.168.0.5
access-list 110 remark CCP_ACL Category=0
access-list 110 permit ip any host 192.168.0.2
access-list 111 remark SDM_ACL Category=0
access-list 111 remark IPSec Rule
access-list 111 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 112 remark CCP_ACL Category=0
access-list 112 remark IPSec Rule
access-list 112 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 115 remark Auto generated by SDM Management Access feature
access-list 115 remark CCP_ACL Category=1
access-list 115 permit ip any any
access-list 125 remark SDM_ACL Category=2
access-list 125 remark IPSec Rule
access-list 125 deny ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 125 permit ip 192.168.0.0 0.0.0.255 any
access-list 147 remark SDM_ACL Category=2
access-list 147 remark IPSec Rule
access-list 147 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 147 remark IPSec Rule
access-list 147 deny ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 147 permit ip 192.168.0.0 0.0.0.255 any
access-list 182 remark SDM_ACL Category=2
access-list 182 remark IPSec Rule
access-list 182 deny ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 182 permit ip 192.168.0.0 0.0.0.255 any
access-list 196 remark SDM_ACL Category=2
access-list 196 remark IPSec Rule
access-list 196 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 196 remark IPSec Rule
access-list 196 deny ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 196 permit ip 192.168.0.0 0.0.0.255 any
access-list 2018 remark SDM_ACL Category=2
access-list 2018 deny tcp host 192.168.0.5 eq www any
access-list 2018 remark IPSec Rule
access-list 2018 deny ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 2018 permit ip 192.168.0.0 0.0.0.255 any
access-list 2022 remark CCP_ACL Category=18
access-list 2022 permit ip 192.168.0.0 0.0.0.255 any
dialer-list 1 protocol ip permit
snmp-server community pu RW
snmp-server host 192.168.0.5 ligatura
no cdp run
!
!
!
route-map SDM_RMAP_4 permit 1
match ip address 196
!
route-map SDM_RMAP_5 permit 1
match ip address 125
!
route-map SDM_RMAP_6 permit 1
match ip address 2018
!
route-map SDM_RMAP_7 permit 1
match ip address 107
!
route-map SDM_RMAP_1 permit 1
match ip address 106
!
route-map SDM_RMAP_2 permit 1
match ip address 147
!
route-map SDM_RMAP_3 permit 1
match ip address 182
!
route-map SDM_RMAP_8 permit 1
match ip address 2022
!
!
!
!
control-plane
!
!
!
voice-port 0/2/0
input gain 10
output attenuation 10
mwi
no comfort-noise
cptone GB
description FXSPort 0
station-id name fxs_0_2_0
station-id number 2000
caller-id enable
!
voice-port 0/2/1
description FXSPort 1
station-id name fxs_0_2_1
station-id number 2001
!
voice-port 0/2/2
description FXSPort2
station-id name 2002
station-id number 2002
caller-id enable
!
voice-port 0/2/3
!
!
!
!
!
dial-peer voice 1 voip
description dummy_DialPeer_For_Primary_CUCM
shutdown
session protocol sipv2
session target ipv4:192.168.0.33
!
dial-peer voice 2000 pots
description Binds to FXS Port 0/2/0
destination-pattern 2000
port 0/2/0
authentication username 2000 password 7 124E5645470A19163F26
!
dial-peer voice 2001 pots
description Binds to FXS Port 0/2/1
destination-pattern 2001
port 0/2/1
authentication username 2001 password 7 03530859530E345E5B04
!
dial-peer voice 2 voip
description aterisk
destination-pattern 1...
session protocol sipv2
session target ipv4:192.168.0.33
dtmf-relay rtp-nte
codec g711ulaw
no vad
!
dial-peer voice 3 voip
description aterisk
destination-pattern 200[0-1]
session protocol sipv2
session target ipv4:192.168.0.33
dtmf-relay rtp-nte
codec g711ulaw
no vad
!
!
sip-ua
authentication username 1101 password 7 0758721E1B080C17021F
nat symmetric check-media-src
retry invite 3
retry response 3
retry bye 3
retry cancel 3
timers trying 1000
registrar ipv4:192.168.0.33 expires 60
sip-server ipv4:192.168.0.33:5060
notify telephone-event max-duration 500
!
!
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!
^C
!
line con 0
login authentication local_authen
transport output telnet
line aux 0
login authentication local_authen
transport output telnet
line vty 0 4
access-class 104 in
password 7 035308595358721E1B
authorization exec local_author
login authentication local_authen
length 0
transport input telnet ssh
!
scheduler allocate 20000 1000
ntp clock-period 17180022
ntp update-calendar
ntp server 218.211.253.172 source Vlan1 prefer
!
end
Версия для распечатки
SIP через Cisco 2811, 
Сыч, 16-Окт-10, 11:39 [смотреть все]
