Вот сам конфиг (удалены адреса и некоторые строки из access-list 101 )service pad to-xot
service pad from-xot
no service pad
service timestamps debug datetime localtime show-timezone
service timestamps log datetime localtime show-timezone
service password-encryption
!
hostname 1111.Comp-RU
!
boot-start-marker
boot system flash c2800nm-adventerprisek9_ivs-mz.124-7a.bin
boot-end-marker
!
logging buffered 16000 debugging
no logging console
!
no aaa new-model
!
resource policy
!
clock timezone com 2
clock summer-time com recurring last Sun Mar 3:00 last Sun Oct 2:00
!
!
ip cef
!
!
no ip domain lookup
ip domain name Comp.RU
vpdn-group 1
! Default L2TP VPDN group
! Default PPTP VPDN group
accept-dialin
protocol any
virtual-template 1
!
!
!
voice-card 0
no dspfarm
!
!
voice rtp send-recv
!
voice service voip
allow-connections h323 to h323
allow-connections h323 to sip
allow-connections sip to h323
fax protocol t38 ls-redundancy 0 hs-redundancy 0 fallback pass-through g711alaw
h323
bearercap-ie signaling-only standard
modem passthrough nse codec g711alaw
sip
bind control source-interface FastEthernet0/1
bind media source-interface FastEthernet0/1
registrar server
!
!
voice class media 1
media flow-around
!
!
voice class codec 2
codec preference 1 g729br8
codec preference 2 g729r8
codec preference 3 g711ulaw
codec preference 4 g711alaw
!
!
!
!
!
!
!
voice register pool 1
id ip 10.10.1.200 mask 255.255.255.255
number 1 805
proxy 10.10.192.1
max registrations 42
!
!
voice translation-rule 1
rule 1 /74959370984/ /408/
!
voice translation-rule 2
rule 1 /^\(48\)\(.*\)/ /\2/
!
!
voice translation-profile To_USA
translate called 2
!
voice translation-profile from-msk
translate called 1
!
!
!
!
username mudak privilege 15 secret 5
username mudachok privilege 15 password 7
!
!
translation-rule 48
Rule 0 48 0
!
!
crypto keyring Interconnect
pre-shared-key address x.x.x.x key X0t1_1
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 20
hash md5
authentication pre-share
group 2
crypto isakmp key NeLs/,BdJBg address x1.x1.x1.x1 no-xauth
crypto isakmp key 32124023787856 address x2.x2.x2.x2
crypto isakmp keepalive 10
crypto isakmp profile Interconnect
keyring Interconnect
match identity address x.x.x.x 255.255.255.255
!
!
crypto ipsec transform-set EL-SV esp-3des esp-sha-hmac
crypto ipsec transform-set mudachok ah-md5-hmac esp-des esp-md5-hmac
mode transport
crypto ipsec transform-set Interconnect esp-3des esp-md5-hmac
!
crypto ipsec profile EL-SV
set transform-set EL-SV
!
crypto ipsec profile Interconnect
set transform-set Interconnect
set pfs group2
set isakmp-profile Interconnect
!
!
crypto map mudachok 1 ipsec-isakmp
set peer x2.x2.x2.x2
set transform-set mudachok
set pfs group2
match address mudachok
!
!
!
!
interface Tunnel0
description -* To Jopa *-
ip address 10.10.254.5 255.255.255.252
ip tcp adjust-mss 1380
ip ospf message-digest-key 1 md5 7 071D2A4A5F0E0D0911
ip ospf cost 15
tunnel source FastEthernet0/0.807
tunnel destination x3.x3.x3.x3
!
interface Tunnel1
description -* To berlin *-
ip address 10.10.254.9 255.255.255.252
ip tcp adjust-mss 1380
ip ospf message-digest-key 1 md5 7 05190D09304B5A051F
ip ospf cost 10
tunnel source FastEthernet0/0.807
tunnel destination x4.x4.x4.x4
tunnel mode ipip
!
interface Tunnel2
description -* To mudachok *-
ip address 10.10.254.13 255.255.255.252
ip access-group 150 in
ip mtu 1400
ip nat outside
ip virtual-reassembly
ip tcp adjust-mss 1360
tunnel source FastEthernet0/0.807
tunnel destination x2.x2.x2.x2
tunnel mode ipip
tunnel path-mtu-discovery
!
interface Tunnel3
description -* To Polan" *-
ip address 10.10.254.17 255.255.255.248
ip tcp adjust-mss 1380
ip ospf message-digest-key 1 md5 7 13171C141A0B10262D
ip ospf cost 12
tunnel source FastEthernet0/0.807
tunnel destination x5.x5.x5.x5
tunnel mode ipip
!
interface Tunnel4
description -* To PL_VoIP *-
ip address 10.10.254.33 255.255.255.252
ip tcp adjust-mss 1380
tunnel source FastEthernet0/0.811
tunnel destination x6.x6.x6.x6
!
interface Tunnel5
ip address x7.x7.x7.x7 255.255.255.252
ip accounting output-packets
ip mtu 1514
keepalive 10 3
tunnel source x8.x8.x8.x8
tunnel destination x.x.x.x
tunnel mode ipsec ipv4
tunnel protection ipsec profile Interconnect
!
interface Tunnel34001
description EL-SV
ip address x9.x9.x9.x9 255.255.255.252
tunnel source FastEthernet0/0.811
tunnel destination x1.x1.x1.x1
tunnel mode ipsec ipv4
tunnel protection ipsec profile EL-SV
!
interface FastEthernet0/0
description -* SOLO *-
no ip address
duplex auto
speed auto
no snmp trap link-status
no mop enabled
no clns route-cache
!
interface FastEthernet0/0.807
description SOLO_OUT
encapsulation dot1Q 807
ip address x10.x10.x10.x10 255.255.255.252
ip access-group 150 in
ip nat outside
ip virtual-reassembly
no snmp trap link-status
crypto map mudachok
!
interface FastEthernet0/0.811
encapsulation dot1Q 811
ip address x8.x8.x8.x8 255.255.255.252
ip access-group 150 in
no snmp trap link-status
!
interface FastEthernet0/1
ip address 10.10.192.1 255.255.255.0
ip access-group 101 in
ip accounting output-packets
ip nat inside
ip virtual-reassembly
ip policy route-map MailRoute
duplex auto
speed auto
h323-gateway voip interface
h323-gateway voip id Comp.RU ipaddr 10.10.192.1 1719
h323-gateway voip h323-id CentralIPIPgw
h323-gateway voip tech-prefix 1#
!
interface Virtual-Template1
ip unnumbered FastEthernet0/1
ip nat inside
no ip virtual-reassembly
peer default ip address pool VPN
no keepalive
ppp encrypt mppe auto
ppp authentication ms-chap-v2
!
router ospf 1
log-adjacency-changes
area 0 authentication message-digest
redistribute connected subnets
redistribute static route-map redistr-static
passive-interface default
no passive-interface Tunnel0
no passive-interface Tunnel1
no passive-interface Tunnel3
network 10.10.254.4 0.0.0.3 area 0
network 10.10.254.8 0.0.0.3 area 0
network 10.10.254.16 0.0.0.3 area 0
!
ip local pool VPN 10.10.125.1 10.10.125.24
ip route 0.0.0.0 0.0.0.0 вырезан ip name Def_GTW_Solo
ip route 10.0.0.53 255.255.255.255 вырезан ip name EL-SV-MVTS
ip route 10.0.0.54 255.255.255.255 вырезан ip name EL-SV-MVTS
ip route 10.9.10.8 255.255.255.252 вырезан ip name berlin_Voice
ip route x11.x11.x11.x11 255.255.255.255 вырезан ip name Bank
ip route x11.x11.x11.x11 255.255.255.255 вырезан ip name Barklays
ip route x3.x3.x3.x3 255.255.255.255 вырезан ip name Tunnel-to-Jopa
ip route x6.x6.x6.x6 255.255.255.255 вырезан ip name PL_VoIP
ip route x1.x1.x1.x1 255.255.255.255 вырезан ip name Jopa_VoIP
ip route 10.10.0.0 255.255.255.0 10.10.192.251 name Paris
ip route 10.10.1.200 255.255.255.255 10.10.254.34 name PL_VoIP_2N
ip route 10.10.3.0 255.255.255.248 10.10.254.34 name PL_VoIP_Lan
ip route 10.10.125.0 255.255.255.224 10.10.192.6 name VPN
ip route 10.10.233.0 255.255.255.0 10.10.192.100 name London
ip route 10.10.254.0 255.255.255.252 10.10.192.251 name Paris_Tunnel
ip route x4.x4.x4.x4 255.255.255.255 вырезан ip name Tunnel-to-berlin
ip route x5.x5.x5.x5 255.255.255.255 вырезан ip name Tunnel-to-USA
!
ip http server
no ip http secure-server
ip nat inside source list 160 interface Tunnel2 overload
ip nat inside source list 161 interface FastEthernet0/0.807 overload
ip nat inside source static tcp 10.10.192.4 25 interface FastEthernet0/0.807 25
ip nat inside source static tcp 10.10.192.109 25 10.10.254.13 25 extendable
ip nat inside source static tcp 10.10.192.4 443 x10.x10.x10.x10 443 extendable
ip nat inside source static tcp 10.10.192.6 1701 x10.x10.x10.x10 1701 extendable
ip nat inside source static tcp 10.10.192.6 1723 x10.x10.x10.x10 1723 extendable
ip nat inside source static tcp 10.10.192.8 3389 x10.x10.x10.x10 3389 extendable
ip nat inside source static tcp 10.10.192.100 4090 x10.x10.x10.x10 4090 extendable
ip nat inside source static udp 10.10.192.100 4090 x10.x10.x10.x10 4090 extendable
ip nat inside source static tcp 10.10.192.48 4899 x10.x10.x10.x10 4899 extendable
!
ip access-list extended mudachok
permit ip host x10.x10.x10.x10 host x2.x2.x2.x2
!
access-list 2 permit 10.10.0.0 0.0.255.255
access-list 3 permit 10.10.192.109
access-list 10 permit 10.10.0.0 0.0.0.255
access-list 101 remark -*CTC_mail_kaka.RU*-
access-list 101 remark -*FSZN*-
------
access-list 150 remark -* Block Internet *-
access-list 150 deny tcp any any eq www
access-list 150 deny tcp any any eq 1719
access-list 150 deny tcp any any eq 1720
access-list 150 deny udp any any eq 5060
access-list 150 deny tcp any any eq 5060
access-list 150 deny tcp any any eq telnet
access-list 150 permit ip any any
access-list 151 remark -* Block Key 1C *-
access-list 151 deny tcp any any eq 475
access-list 151 permit ip any any
access-list 160 remark ----- Route map via mudachok -----
access-list 160 permit ip host 10.10.192.109 10.10.254.12 0.0.0.3
access-list 160 deny ip host 10.10.192.109 10.10.0.0 0.0.255.255
access-list 160 permit ip host 10.10.192.109 any
access-list 161 remark ----- For NAT -----
access-list 161 deny ip host 10.10.192.109 any
access-list 161 deny ip host 10.10.254.13 any
access-list 161 permit ip 10.10.0.0 0.0.255.255 any
access-list 2001 remark ----- Jopa_Shape ------
access-list 2001 permit ip host 10.10.192.109 10.10.222.0 0.0.0.255
snmp-server community mudak.70716 RW
!
route-map redistr-static permit 100
match ip address 10
!
route-map MailRoute permit 10
description -- Route outgoing mail via mudachok --
match ip address 160
set ip next-hop 10.10.254.14
!
route-map MailRoute permit 20
description -- Route all other traffic --
!
!
!
tftp-server flash:c2800nm-adventerprisek9_ivs-mz.124-7a.bin
!
control-plane
!
!!
dial-peer voice 1000 voip
translation-profile outgoing from-msk
destination-pattern 74959370984
session target ras
dtmf-relay h245-signal h245-alphanumeric
fax protocol t38 ls-redundancy 5 hs-redundancy 2 fallback cisco
ip qos dscp cs5 media
no vad
!
dial-peer voice 555 voip
description --- From another devices ---
answer-address T
voice-class codec 2
dtmf-relay h245-signal h245-alphanumeric
fax protocol t38 ls-redundancy 5 hs-redundancy 2 fallback cisco
ip qos dscp cs5 media
no vad
!
dial-peer voice 400 voip
description --- to internal numbers ---
destination-pattern [4-7]..$
session target ras
dtmf-relay h245-signal h245-alphanumeric
ip qos dscp cs5 media
no vad
!
dial-peer voice 705 voip
translation-profile outgoing To_USA
huntstop
destination-pattern 48[5-7]T
session protocol sipv2
session target ipv4:10.10.1.200
dtmf-relay sip-notify rtp-nte
!
dial-peer voice 710 voip
description --- to Interconnect ---
huntstop
preference 1
destination-pattern .T
voice-class codec 2
session target ipv4:x.x.x.x1
dtmf-relay rtp-nte h245-signal h245-alphanumeric
fax-relay ecm disable
fax protocol t38 ls-redundancy 5 hs-redundancy 2 fallback cisco
ip qos dscp cs5 media
no vad
!
dial-peer voice 711 voip
description --- to Interconnect ---
huntstop
preference 2
destination-pattern .T
voice-class codec 2
session target ipv4:x.x.x.x0
dtmf-relay h245-signal h245-alphanumeric
fax-relay ecm disable
fax protocol t38 ls-redundancy 5 hs-redundancy 2 fallback cisco
ip qos dscp cs5 media
no vad
!
gateway
timer receive-rtp 1200
!
sip-ua
!
!
!
!
gatekeeper
zone local Comp.RU Comp.RU 10.10.192.1
zone local mainoffice Comp.RU
zone local Paris Comp.RU
zone local ua Comp.RU
zone local USA Comp.RU
zone local uasams Comp.RU
zone local msk Comp.RU
zone prefix mainoffice 4..
zone prefix Paris 5..
zone prefix uasams 61.
zone prefix ua 6..
zone prefix USA 7..
zone prefix msk 8..
zone prefix Comp.RU * gw-priority 10 CentralIPIPgw
gw-type-prefix 1#* default-technology
no shutdown
!
!
telephony-service
max-ephones 5
max-dn 10
ip source-address 10.10.192.1 port 2000
user-locale RU
network-locale RU
time-format 24
create cnf-files version-stamp 7960 Nov 14 2008 09:31:18
max-conferences 8 gain -6
transfer-system full-consult
!
!
ephone-dn 1
number 444
!
!
ephone-dn 2
number 443
hold-alert 30 originator
!
!
ephone 1
mac-address
type CIPC
button 1:1
!
!
banner motd #
Authorised Access only
This system is the property of CompGROUP.
UNAUTHORISED ACCESS TO THIS DEVICE IS PROHIBITED.
You must have explicit permission to access this
device. All activities performed on this device
are logged and violations of of this policy result
in disciplinary action.
#
alias exec ps show proc
cpu sort | excl 0.00%__0.00%__0.00%
alias exec hist show call hist voi br
alias exec act show call act voi br
alias exec histv show call hist vid br
alias exec actv show call act vid br
!
line con 0
line aux 0
line vty 0 4
exec-timeout 240 0
privilege level 15
logging synchronous
login local
!
scheduler allocate 20000 1000
ntp clock-period 17207692
ntp source FastEthernet0/0.807
ntp master
ntp server 10.10.192.1
!
end
Вариант для распечатки
(ok) on 21-Сен-10, 17:50 
