Cisco 2911 (офис)

gnxrouter#sh ver
Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 20-Mar-12 18:57 by prod_rel_team

ROM: System Bootstrap, Version 15.0(1r)M15, RELEASE SOFTWARE (fc1)

gnxrouter uptime is 3 days, 15 hours, 48 minutes
System returned to ROM by reload at 14:10:33 UTC Mon Apr 7 2014
System restarted at 14:12:05 UTC Mon Apr 7 2014
System image file is "flash:c2900-universalk9-mz.SPA.151-4.M4.bin"
Last reload type: Normal Reload
Last reload reason: Reload Command

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco CISCO2911/K9 (revision 1.0) with 487424K/36864K bytes of memory.
Processor board ID FCZ1606203P
3 Gigabit Ethernet interfaces
1 terminal line
1 Virtual Private Network (VPN) Module
DRAM configuration is 64 bits wide with parity enabled.
255K bytes of non-volatile configuration memory.
250880K bytes of ATA System CompactFlash 0 (Read/Write)

License Info:

License UDI:

-------------------------------------------------
Device#   PID                   SN
-------------------------------------------------
*0        CISCO2911/K9          FCZ1606203P

Technology Package License Information for Module:'c2900'

-----------------------------------------------------------------
Technology    Technology-package           Technology-package
              Current       Type           Next reboot
------------------------------------------------------------------
ipbase        ipbasek9      Permanent      ipbasek9
security      securityk9    EvalRightToUse securityk9
uc            uck9          EvalRightToUse uck9
data          datak9        EvalRightToUse datak9

Configuration register is 0x2102

gnxrouter#sh license feature
Feature name             Enforcement  Evaluation  Subscription   Enabled  RightToUse
ipbasek9                 no           no          no             yes      no    
securityk9               yes          yes         no             yes      yes  
uck9                     yes          yes         no             yes      yes  
datak9                   yes          yes         no             yes      yes  
gatekeeper               yes          yes         no             no       yes  
SSL_VPN                  yes          yes         no             no       yes  
ios-ips-update           yes          yes         yes            no       yes  
SNASw                    yes          yes         no             no       yes  
hseck9                   yes          no          no             no       no    
cme-srst                 yes          yes         no             no       yes  
WAAS_Express             yes          yes         no             no       yes  
Feature name             Enforcement  Evaluation  Subscription   Enabled  RightToUse

UCVideo                  yes          yes         no             no       yes  

Конфиг:

!
! Last configuration change at 04:47:08 UTC Fri Apr 11 2014 by Shtern
! NVRAM config last updated at 14:45:57 UTC Thu Apr 10 2014 by Shtern
! NVRAM config last updated at 14:45:57 UTC Thu Apr 10 2014 by Shtern
version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname gnxrouter
!
boot-start-marker
boot system flash:c2900-universalk9-mz.SPA.151-4.M4.bin
boot-end-marker
!
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 warnings
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication ppp default local
aaa authorization exec default local
aaa authorization network default local
!
!
!
!
!
aaa session-id common
!
!
no ipv6 cef
no ip source-route
ip cef
!
!
!
!
!
ip flow-cache timeout active 1
no ip bootp server
ip domain name yourdomain.com
ip name-server 88.205.249.1
ip name-server 88.205.232.3
ip name-server 8.8.8.8
ip inspect name FW tcp
ip inspect name FW udp
ip inspect name FW icmp
ip inspect name FW ftp
ip inspect name FW sip
ip inspect name FW router
ip inspect name FW telnet
ip inspect name FW l2tp
ip inspect name USG tcp
ip inspect name USG icmp
ip inspect name USG ftp
ip inspect name USG sip
ip inspect name USG pop3
ip inspect name USG router
ip inspect name USG pptp
ip inspect name USG udp
ip inspect name GSE pop3s
ip inspect name GSE udp
ip inspect name GSE tcp
ip inspect name GSE ftp
ip inspect name GSE icmp
ip inspect name GSE sip
ip inspect name GSE router
ip inspect name GSE telnet
ip inspect name GSE esmtp
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
!
!
!
!
!
crypto pki token default removal timeout 0
!
!
voice-card 0
!
!
!
!
!
!
!
license udi pid CISCO2911/K9 sn FCZ1606203P
license boot module c2900 technology-package securityk9
license boot module c2900 technology-package uck9
license boot module c2900 technology-package datak9
!
!
archive
log config
  hidekeys
!
redundancy
!
!
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
crypto isakmp key XXXXXX address 1.1.1.2
!
!
crypto ipsec transform-set SET esp-aes
!
crypto map MAIN 1 ipsec-isakmp
set peer 1.1.1.2
set transform-set SET
match address baza_in
!
!
!
!
bba-group pppoe global
virtual-template 2
sessions max limit 100
sessions per-mac limit 1
sessions auto cleanup
!
!
interface Loopback0
no ip address
!
interface Null0
no ip unreachables
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description $ETH-SW-LAUNCH$$INTF-INFO-FE 0/0$$ETH-WAN$
ip address 192.168.14.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
duplex full
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no mop enabled
!
interface GigabitEthernet0/1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip flow egress
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/1.1
description BRIS local net$ETH-LAN$$FW_INSIDE$
encapsulation dot1Q 15
ip address 192.168.15.1 255.255.255.0
ip access-group bris_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip inspect FW in
ip virtual-reassembly in
no cdp enable
!
interface GigabitEthernet0/1.3
description GNX local net$FW_INSIDE$$ETH-LAN$
encapsulation dot1Q 1 native
ip address 192.168.12.1 255.255.255.0
ip access-group gnx_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat inside
ip inspect FW in
ip virtual-reassembly in
!
interface GigabitEthernet0/1.5
description USG local net$FW_INSIDE$$ETH-LAN$
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
ip access-group usg_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat inside
ip inspect USG in
ip virtual-reassembly in
no cdp enable
!
interface GigabitEthernet0/1.10
description ***GES***
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
ip access-group gse_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat inside
ip inspect GSE in
ip virtual-reassembly in
no cdp enable
!
interface GigabitEthernet0/2
ip address 1.1.1.1 255.255.255.0
ip inspect FW in
ip virtual-reassembly in
duplex auto
speed auto
crypto map MAIN
!
interface Dialer1
description $FW_OUTSIDE$
ip address negotiated
ip access-group outside_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname XXXXXXXXXX
ppp chap password 7 XXXXXXXXXXXXXXXXX
no cdp enable
!
!
no ip forward-protocol nd
!
no ip http server
ip http port 8080
ip http access-class 3
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip flow-export version 9
ip flow-export destination 192.168.12.12 9996
ip flow-top-talkers
top 10
sort-by bytes
!
ip nat inside source list 2 interface Dialer1 overload
ip nat inside source static 192.168.12.11 interface Dialer1
ip nat inside source static tcp 192.168.12.11 80 interface Dialer1 8081
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 192.168.13.0 255.255.255.0 1.1.1.2
!
ip access-list extended baza_in
permit ip 192.168.12.0 0.0.0.255 192.168.13.0 0.0.0.255
ip access-list extended bris_in
remark BRIS ACL
remark SDM_ACL Category=1
remark allow BRIS to INET
permit ip 192.168.15.0 0.0.0.255 any
ip access-list extended gnx_in
remark GNX to INET
permit ip 192.168.12.0 0.0.0.255 any
remark GNX ACL
remark SDM_ACL Category=1
remark allow GNX to INET
ip access-list extended gse_in
remark GSE ACL
remark DENY from GSE to GNX&BRIS&USG
deny   ip 192.168.30.0 0.0.0.255 192.168.12.0 0.0.0.255
deny   ip 192.168.30.0 0.0.0.255 192.168.15.0 0.0.0.255
deny   ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
remark allow GSE to INET
permit ip 192.168.30.0 0.0.0.255 any
ip access-list extended outside_in
permit ip host 212.220.X.X any
remark ICMP access
permit icmp any any
remark IP PHONES
permit tcp any any eq 8081
permit ip host 188.94.X.X any
permit ip host 31.10.X.X any
permit ip host 31.10.X.X any
permit ip host 94.101.X.X any
permit tcp 192.168.12.0 0.0.0.255 any eq www
permit ip host 5.141.X.X any
permit ip host 5.141.X.X any
permit ip host 94.101.X.X any
ip access-list extended usg_in
remark USG ACL
remark DENY from USG to GNX&BRIS
deny   ip 192.168.20.0 0.0.0.255 192.168.12.0 0.0.0.255
deny   ip 192.168.20.0 0.0.0.255 192.168.15.0 0.0.0.255
remark allow USG to INET
permit ip 192.168.20.0 0.0.0.255 any
!
access-list 1 remark HTTP Access-class list
access-list 1 remark SDM_ACL Category=1
access-list 1 permit 192.168.12.0 0.0.0.255
access-list 1 deny   any
access-list 2 remark SDM_ACL Category=2
access-list 2 remark GNX
access-list 2 permit 192.168.12.0 0.0.0.255
access-list 2 remark BRIS
access-list 2 permit 192.168.15.0 0.0.0.255
access-list 2 remark USG
access-list 2 permit 192.168.20.0 0.0.0.255
access-list 2 remark GSE
access-list 2 permit 192.168.30.0 0.0.0.255
access-list 2 remark BAZA
access-list 2 permit 192.168.13.0 0.0.0.255
dialer-list 1 protocol ip permit
!
no cdp run
!
!
!
!
snmp-server community public RO
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
gatekeeper
shutdown
!
!
!
line con 0
transport output telnet
line aux 0
transport output telnet
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
access-class 23 in
password 7 XXXXXXXXX
transport input telnet ssh
line vty 5 15
access-class 23 in
password 7 XXXXXXXXXXX
transport input telnet ssh
!
scheduler allocate 20000 1000
end

Cisco 881(филиал):

baza#sh ver
Cisco IOS Software, C880 Software (C880DATA-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Wed 21-Mar-12 00:27 by prod_rel_team

ROM: System Bootstrap, Version 12.4(22r)YB5, RELEASE SOFTWARE (fc1)

baza uptime is 16 hours, 46 minutes
System returned to ROM by reload at 13:10:41 UTC Thu Apr 10 2014
System restarted at 13:11:17 UTC Thu Apr 10 2014
System image file is "flash:c880data-universalk9-mz.151-4.M4.bin"
Last reload type: Normal Reload
Last reload reason: Reload Command

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

Cisco 881 (MPC8300) processor (revision 1.0) with 236544K/25600K bytes of memory.
Processor board ID FCZ1602C6PZ

5 FastEthernet interfaces
1 Virtual Private Network (VPN) Module
256K bytes of non-volatile configuration memory.
126000K bytes of ATA CompactFlash (Read/Write)

License Info:

License UDI:

-------------------------------------------------
Device#   PID                   SN
-------------------------------------------------
*0        CISCO881-K9           FCZ1602C6PZ

License Information for 'c880-data'
    License Level: advipservices   Type: EvalRightToUse
    Next reboot license Level: advipservices

Configuration register is 0x2102

baza#sh license feature
Feature name             Enforcement  Evaluation  Subscription   Enabled  RightToUse
advipservices            yes          yes         no             yes      yes  
advsecurity              no           no          no             no       no    
ios-ips-update           yes          yes         yes            no       yes  
WAAS_Express             yes          yes         no             no       yes  
SSL_VPN                  yes          yes         no             no       yes  

Конфиг:

baza#sh run
Building configuration...

Current configuration : 2184 bytes
!
! Last configuration change at 05:22:50 UTC Fri Apr 11 2014
! NVRAM config last updated at 05:22:51 UTC Fri Apr 11 2014
! NVRAM config last updated at 05:22:51 UTC Fri Apr 11 2014
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname baza
!
boot-start-marker
boot system flash:c880data-universalk9-mz.151-4.M4.bin
boot-end-marker
!
!
!
no aaa new-model
!
memory-size iomem 10
crypto pki token default removal timeout 0
!
!
ip source-route
!
!
!
!
!
ip cef
ip name-server 192.168.13.254
ip inspect name FW tcp
ip inspect name FW udp
ip inspect name FW icmp
ip inspect name FW ftp
ip inspect name FW sip
ip inspect name FW router
ip inspect name FW telnet
ip inspect name FW l2tp
no ipv6 cef
!
!
multilink bundle-name authenticated
license udi pid CISCO881-K9 sn FCZ1602C6PZ
license boot module c880-data level advipservices
!
!
username
!
!
!
!
!
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
crypto isakmp key XXXXXXXX address 1.1.1.1
!
!
crypto ipsec transform-set SET esp-aes
!
crypto map MAIN 1 ipsec-isakmp
set peer 1.1.1.1
set transform-set SET
match address ACL_IPSEC
!
!
!
!
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
description ===WAN===
ip address 1.1.1.2 255.255.255.0
ip inspect FW in
ip virtual-reassembly in
duplex auto
speed auto
crypto map MAIN
!
interface Vlan1
ip address 192.168.13.254 255.255.255.0
ip nat inside
ip inspect FW in
ip virtual-reassembly in
!
interface Vlan21
no ip address
!
interface Dialer1
no ip address
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip route 0.0.0.0 0.0.0.0 1.1.1.1
ip route 192.168.12.0 255.255.255.0 1.1.1.1
!
ip access-list extended ACL_IPSEC
permit ip 192.168.13.0 0.0.0.255 192.168.12.0 0.0.0.255
!
dialer-list 1 protocol ip permit
!
!
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
privilege level 15
login local
transport input ssh
!
end

Как то так...