Cisco 2911 (офис)gnxrouter#sh ver
Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 20-Mar-12 18:57 by prod_rel_team
ROM: System Bootstrap, Version 15.0(1r)M15, RELEASE SOFTWARE (fc1)
gnxrouter uptime is 3 days, 15 hours, 48 minutes
System returned to ROM by reload at 14:10:33 UTC Mon Apr 7 2014
System restarted at 14:12:05 UTC Mon Apr 7 2014
System image file is "flash:c2900-universalk9-mz.SPA.151-4.M4.bin"
Last reload type: Normal Reload
Last reload reason: Reload Command
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
export@cisco.com.
Cisco CISCO2911/K9 (revision 1.0) with 487424K/36864K bytes of memory.
Processor board ID FCZ1606203P
3 Gigabit Ethernet interfaces
1 terminal line
1 Virtual Private Network (VPN) Module
DRAM configuration is 64 bits wide with parity enabled.
255K bytes of non-volatile configuration memory.
250880K bytes of ATA System CompactFlash 0 (Read/Write)
License Info:
License UDI:
-------------------------------------------------
Device# PID SN
-------------------------------------------------
*0 CISCO2911/K9 FCZ1606203P
Technology Package License Information for Module:'c2900'
-----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------
ipbase ipbasek9 Permanent ipbasek9
security securityk9 EvalRightToUse securityk9
uc uck9 EvalRightToUse uck9
data datak9 EvalRightToUse datak9
Configuration register is 0x2102
gnxrouter#sh license feature
Feature name Enforcement Evaluation Subscription Enabled RightToUse
ipbasek9 no no no yes no
securityk9 yes yes no yes yes
uck9 yes yes no yes yes
datak9 yes yes no yes yes
gatekeeper yes yes no no yes
SSL_VPN yes yes no no yes
ios-ips-update yes yes yes no yes
SNASw yes yes no no yes
hseck9 yes no no no no
cme-srst yes yes no no yes
WAAS_Express yes yes no no yes
Feature name Enforcement Evaluation Subscription Enabled RightToUse
UCVideo yes yes no no yes
Конфиг:
!
! Last configuration change at 04:47:08 UTC Fri Apr 11 2014 by Shtern
! NVRAM config last updated at 14:45:57 UTC Thu Apr 10 2014 by Shtern
! NVRAM config last updated at 14:45:57 UTC Thu Apr 10 2014 by Shtern
version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname gnxrouter
!
boot-start-marker
boot system flash:c2900-universalk9-mz.SPA.151-4.M4.bin
boot-end-marker
!
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 warnings
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication ppp default local
aaa authorization exec default local
aaa authorization network default local
!
!
!
!
!
aaa session-id common
!
!
no ipv6 cef
no ip source-route
ip cef
!
!
!
!
!
ip flow-cache timeout active 1
no ip bootp server
ip domain name yourdomain.com
ip name-server 88.205.249.1
ip name-server 88.205.232.3
ip name-server 8.8.8.8
ip inspect name FW tcp
ip inspect name FW udp
ip inspect name FW icmp
ip inspect name FW ftp
ip inspect name FW sip
ip inspect name FW router
ip inspect name FW telnet
ip inspect name FW l2tp
ip inspect name USG tcp
ip inspect name USG icmp
ip inspect name USG ftp
ip inspect name USG sip
ip inspect name USG pop3
ip inspect name USG router
ip inspect name USG pptp
ip inspect name USG udp
ip inspect name GSE pop3s
ip inspect name GSE udp
ip inspect name GSE tcp
ip inspect name GSE ftp
ip inspect name GSE icmp
ip inspect name GSE sip
ip inspect name GSE router
ip inspect name GSE telnet
ip inspect name GSE esmtp
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
!
!
!
!
!
crypto pki token default removal timeout 0
!
!
voice-card 0
!
!
!
!
!
!
!
license udi pid CISCO2911/K9 sn FCZ1606203P
license boot module c2900 technology-package securityk9
license boot module c2900 technology-package uck9
license boot module c2900 technology-package datak9
!
!
archive
log config
hidekeys
!
redundancy
!
!
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
crypto isakmp key XXXXXX address 1.1.1.2
!
!
crypto ipsec transform-set SET esp-aes
!
crypto map MAIN 1 ipsec-isakmp
set peer 1.1.1.2
set transform-set SET
match address baza_in
!
!
!
!
bba-group pppoe global
virtual-template 2
sessions max limit 100
sessions per-mac limit 1
sessions auto cleanup
!
!
interface Loopback0
no ip address
!
interface Null0
no ip unreachables
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description $ETH-SW-LAUNCH$$INTF-INFO-FE 0/0$$ETH-WAN$
ip address 192.168.14.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
duplex full
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no mop enabled
!
interface GigabitEthernet0/1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip flow egress
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/1.1
description BRIS local net$ETH-LAN$$FW_INSIDE$
encapsulation dot1Q 15
ip address 192.168.15.1 255.255.255.0
ip access-group bris_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip inspect FW in
ip virtual-reassembly in
no cdp enable
!
interface GigabitEthernet0/1.3
description GNX local net$FW_INSIDE$$ETH-LAN$
encapsulation dot1Q 1 native
ip address 192.168.12.1 255.255.255.0
ip access-group gnx_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat inside
ip inspect FW in
ip virtual-reassembly in
!
interface GigabitEthernet0/1.5
description USG local net$FW_INSIDE$$ETH-LAN$
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
ip access-group usg_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat inside
ip inspect USG in
ip virtual-reassembly in
no cdp enable
!
interface GigabitEthernet0/1.10
description ***GES***
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
ip access-group gse_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat inside
ip inspect GSE in
ip virtual-reassembly in
no cdp enable
!
interface GigabitEthernet0/2
ip address 1.1.1.1 255.255.255.0
ip inspect FW in
ip virtual-reassembly in
duplex auto
speed auto
crypto map MAIN
!
interface Dialer1
description $FW_OUTSIDE$
ip address negotiated
ip access-group outside_in in
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname XXXXXXXXXX
ppp chap password 7 XXXXXXXXXXXXXXXXX
no cdp enable
!
!
no ip forward-protocol nd
!
no ip http server
ip http port 8080
ip http access-class 3
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip flow-export version 9
ip flow-export destination 192.168.12.12 9996
ip flow-top-talkers
top 10
sort-by bytes
!
ip nat inside source list 2 interface Dialer1 overload
ip nat inside source static 192.168.12.11 interface Dialer1
ip nat inside source static tcp 192.168.12.11 80 interface Dialer1 8081
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 192.168.13.0 255.255.255.0 1.1.1.2
!
ip access-list extended baza_in
permit ip 192.168.12.0 0.0.0.255 192.168.13.0 0.0.0.255
ip access-list extended bris_in
remark BRIS ACL
remark SDM_ACL Category=1
remark allow BRIS to INET
permit ip 192.168.15.0 0.0.0.255 any
ip access-list extended gnx_in
remark GNX to INET
permit ip 192.168.12.0 0.0.0.255 any
remark GNX ACL
remark SDM_ACL Category=1
remark allow GNX to INET
ip access-list extended gse_in
remark GSE ACL
remark DENY from GSE to GNX&BRIS&USG
deny ip 192.168.30.0 0.0.0.255 192.168.12.0 0.0.0.255
deny ip 192.168.30.0 0.0.0.255 192.168.15.0 0.0.0.255
deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
remark allow GSE to INET
permit ip 192.168.30.0 0.0.0.255 any
ip access-list extended outside_in
permit ip host 212.220.X.X any
remark ICMP access
permit icmp any any
remark IP PHONES
permit tcp any any eq 8081
permit ip host 188.94.X.X any
permit ip host 31.10.X.X any
permit ip host 31.10.X.X any
permit ip host 94.101.X.X any
permit tcp 192.168.12.0 0.0.0.255 any eq www
permit ip host 5.141.X.X any
permit ip host 5.141.X.X any
permit ip host 94.101.X.X any
ip access-list extended usg_in
remark USG ACL
remark DENY from USG to GNX&BRIS
deny ip 192.168.20.0 0.0.0.255 192.168.12.0 0.0.0.255
deny ip 192.168.20.0 0.0.0.255 192.168.15.0 0.0.0.255
remark allow USG to INET
permit ip 192.168.20.0 0.0.0.255 any
!
access-list 1 remark HTTP Access-class list
access-list 1 remark SDM_ACL Category=1
access-list 1 permit 192.168.12.0 0.0.0.255
access-list 1 deny any
access-list 2 remark SDM_ACL Category=2
access-list 2 remark GNX
access-list 2 permit 192.168.12.0 0.0.0.255
access-list 2 remark BRIS
access-list 2 permit 192.168.15.0 0.0.0.255
access-list 2 remark USG
access-list 2 permit 192.168.20.0 0.0.0.255
access-list 2 remark GSE
access-list 2 permit 192.168.30.0 0.0.0.255
access-list 2 remark BAZA
access-list 2 permit 192.168.13.0 0.0.0.255
dialer-list 1 protocol ip permit
!
no cdp run
!
!
!
!
snmp-server community public RO
!
!
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
gatekeeper
shutdown
!
!
!
line con 0
transport output telnet
line aux 0
transport output telnet
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
access-class 23 in
password 7 XXXXXXXXX
transport input telnet ssh
line vty 5 15
access-class 23 in
password 7 XXXXXXXXXXX
transport input telnet ssh
!
scheduler allocate 20000 1000
end
Cisco 881(филиал):
baza#sh ver
Cisco IOS Software, C880 Software (C880DATA-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Wed 21-Mar-12 00:27 by prod_rel_team
ROM: System Bootstrap, Version 12.4(22r)YB5, RELEASE SOFTWARE (fc1)
baza uptime is 16 hours, 46 minutes
System returned to ROM by reload at 13:10:41 UTC Thu Apr 10 2014
System restarted at 13:11:17 UTC Thu Apr 10 2014
System image file is "flash:c880data-universalk9-mz.151-4.M4.bin"
Last reload type: Normal Reload
Last reload reason: Reload Command
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
export@cisco.com.
Cisco 881 (MPC8300) processor (revision 1.0) with 236544K/25600K bytes of memory.
Processor board ID FCZ1602C6PZ
5 FastEthernet interfaces
1 Virtual Private Network (VPN) Module
256K bytes of non-volatile configuration memory.
126000K bytes of ATA CompactFlash (Read/Write)
License Info:
License UDI:
-------------------------------------------------
Device# PID SN
-------------------------------------------------
*0 CISCO881-K9 FCZ1602C6PZ
License Information for 'c880-data'
License Level: advipservices Type: EvalRightToUse
Next reboot license Level: advipservices
Configuration register is 0x2102
baza#sh license feature
Feature name Enforcement Evaluation Subscription Enabled RightToUse
advipservices yes yes no yes yes
advsecurity no no no no no
ios-ips-update yes yes yes no yes
WAAS_Express yes yes no no yes
SSL_VPN yes yes no no yes
Конфиг:
baza#sh run
Building configuration...
Current configuration : 2184 bytes
!
! Last configuration change at 05:22:50 UTC Fri Apr 11 2014
! NVRAM config last updated at 05:22:51 UTC Fri Apr 11 2014
! NVRAM config last updated at 05:22:51 UTC Fri Apr 11 2014
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname baza
!
boot-start-marker
boot system flash:c880data-universalk9-mz.151-4.M4.bin
boot-end-marker
!
!
!
no aaa new-model
!
memory-size iomem 10
crypto pki token default removal timeout 0
!
!
ip source-route
!
!
!
!
!
ip cef
ip name-server 192.168.13.254
ip inspect name FW tcp
ip inspect name FW udp
ip inspect name FW icmp
ip inspect name FW ftp
ip inspect name FW sip
ip inspect name FW router
ip inspect name FW telnet
ip inspect name FW l2tp
no ipv6 cef
!
!
multilink bundle-name authenticated
license udi pid CISCO881-K9 sn FCZ1602C6PZ
license boot module c880-data level advipservices
!
!
username
!
!
!
!
!
!
crypto isakmp policy 1
encr aes
authentication pre-share
group 2
crypto isakmp key XXXXXXXX address 1.1.1.1
!
!
crypto ipsec transform-set SET esp-aes
!
crypto map MAIN 1 ipsec-isakmp
set peer 1.1.1.1
set transform-set SET
match address ACL_IPSEC
!
!
!
!
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
description ===WAN===
ip address 1.1.1.2 255.255.255.0
ip inspect FW in
ip virtual-reassembly in
duplex auto
speed auto
crypto map MAIN
!
interface Vlan1
ip address 192.168.13.254 255.255.255.0
ip nat inside
ip inspect FW in
ip virtual-reassembly in
!
interface Vlan21
no ip address
!
interface Dialer1
no ip address
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip route 0.0.0.0 0.0.0.0 1.1.1.1
ip route 192.168.12.0 255.255.255.0 1.1.1.1
!
ip access-list extended ACL_IPSEC
permit ip 192.168.13.0 0.0.0.255 192.168.12.0 0.0.0.255
!
dialer-list 1 protocol ip permit
!
!
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
privilege level 15
login local
transport input ssh
!
end
Как то так...
Вариант для распечатки
(ok) on 11-Апр-14, 09:31 
