Я новичок в настройках циско. Cisco 881-pci-k9. Подскажите, почему периодически вылетает интернет. Т.е. некоторое время работает, потом отключается, потом опять сам включается. Пытался сделать резервный канал, может что изменил, потом затею забросил, т.к. сказали что на мою железку нужно покупать лицензию чтоб была возможность реализовать резервный канал..
Не в этом ли загвоздка: route-map internet permit 10 и route-map second_internet permit 10?
cisco#sh run
Building configuration...Current configuration : 6270 bytes
!
! Last configuration change at 20:41:18 Moscow Wed Feb 27 2013 by denis
! NVRAM config last updated at 19:40:52 Moscow Wed Feb 27 2013 by denis
! NVRAM config last updated at 19:40:52 Moscow Wed Feb 27 2013 by denis
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname cisco
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
enable secret 4 WIt8jvB9k8OmgaoqfrYwU//PXImqYGmcAxH9SvUrP.Q
enable password xxxxxx
!
no aaa new-model
!
memory-size iomem 10
clock timezone Moscow 3 0
clock summer-time Moscow date Mar 30 2003 2:00 Oct 26 2003 3:00
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-3162754647
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3162754647
revocation-check none
rsakeypair TP-self-signed-3162754647
!
crypto pki trustpoint test_trustpoint_config_created_for_sdm
subject-name e=sdmtest@sdmtest.com
revocation-check crl
!
crypto pki trustpoint tti
revocation-check crl
!
!
crypto pki certificate chain TP-self-signed-3162754647
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33313632 37353436 3437301E 170D3133 30313330 32303135
35325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 31363237
35343634 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100B2D2 C2132BB4 0CE3E735 F98DADB4 E1A33E70 097D149D DED2FB23 359167B7
766179E3 316B35BB 76E199F5 6E55B5D1 30696D45 4C98B981 F1D4F804 29976B13
29D1CF69 7E93DA63 34837278 4C62796D 5DEE8070 9F4C671B AC59DE2A F4938291
0F2BFD2A 073DBBBF 415FC921 998CF530 AE1F5621 8DC5C0A4 18976F3D CF3562C3
8D710203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 145F0902 D236DDD0 C1720D17 5EA2CCF0 7F39BBBA 6E301D06
03551D0E 04160414 5F0902D2 36DDD0C1 720D175E A2CCF07F 39BBBA6E 300D0609
2A864886 F70D0101 05050003 81810091 494E30C8 0A1CFCA1 E010A08E BEE943F7
004FC9C3 D5481B34 F327487F 9F6F86CF 4BE08FF5 881980D5 9D0F5E88 93187F5D
501B9E54 67F99A0D 1AB12B8F 181238EC B0311916 35557479 65A544BA 1DF20C15
EAA60F81 5CB5D0BB 9F15BDBC 6BF8E175 CA0743F8 62B3050B 8CEAD8D9 D9516E5D
AE3FA4DC CC981E70 42F4379D 4DE9F6
quit
crypto pki certificate chain test_trustpoint_config_created_for_sdm
crypto pki certificate chain tti
ip source-route
!
!
!
!
!
ip cef
ip domain name metiz.pro
ip port-map user-protocol--1 port tcp 3389
no ipv6 cef
!
!
multilink bundle-name authenticated
license udi pid CISCO881-PCI-K9 sn xxxxxxxx
license boot module c880-data level advsecurity
!
!
username xxxxxx privilege 15 secret 4 WIt8jvB9k8OmgaoqfrYwU//PXImqYGmcAxH9SvUrP.Q
!
!
!
!
no ip ftp passive
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key XXXXXX address 84.47.x.x
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
!
!
crypto map SDM_CMAP_2 1 ipsec-isakmp
description Tunnel to84.47.x.x
set peer 84.47.x.x
set transform-set ESP-3DES-SHA1
match address 101
!
!
!
!
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
description in vlan2
switchport access vlan 2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
description internet$FW_OUTSIDE$$ETH-WAN$
ip address dhcp client-id FastEthernet4
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map SDM_CMAP_2
!
interface Vlan1
description lan$FW_INSIDE$$ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 192.168.5.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface Vlan2
description SecondInternet
ip address 192.168.1.3 255.255.255.0
ip nat outside
ip nat enable
ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip dns server
ip nat inside source list 102 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.5.2 3389 interface FastEthernet4 7717
!
access-list 23 remark CCP_ACL Category=17
access-list 23 permit 192.168.5.0 0.0.0.255
access-list 23 permit 84.0.0.0 0.255.255.255
access-list 100 permit ip 192.168.5.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 remark CCP_ACL Category=4
access-list 101 remark IPSec Rule
access-list 101 permit ip 192.168.5.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 101 permit ip 192.168.5.0 0.0.0.255 any
access-list 102 remark CCP_ACL Category=18
access-list 102 remark allow_smtp
access-list 102 permit tcp any host 195.161.113.197 eq smtp
access-list 102 remark allow_smtp
access-list 102 permit tcp any host 213.208.166.30 eq smtp
access-list 102 remark allow_smtp
access-list 102 permit tcp any host 213.248.54.203 eq smtp
access-list 102 remark alow_smtp
access-list 102 permit tcp any 194.85.88.0 0.0.0.255 eq smtp
access-list 102 remark allow_smtp
access-list 102 permit tcp any host 213.180.204.38 eq smtp
access-list 102 remark allow_smtp
access-list 102 permit tcp any host 194.67.23.111 eq smtp
access-list 102 remark allow_smtp
access-list 102 permit tcp any host 62.213.70.42 eq smtp
access-list 102 remark allow_smtp
access-list 102 permit tcp any host 195.34.32.101 eq smtp
access-list 102 remark block_smtp
access-list 102 deny tcp any any eq smtp
access-list 102 deny ip 192.168.5.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 102 permit ip 192.168.5.0 0.0.0.255 any
no cdp run
!
!
!
!
route-map internet permit 10
match ip address 102
match interface FastEthernet4
!
route-map second_internet permit 10
match ip address 102
match interface Vlan2
!
route-map second_internetexit permit 10
!
!
control-plane
!
banner exec ^C
---------------------------
Error. Access denied.
^C
!
line con 0
login local
line aux 0
line vty 0 4
access-class 23 in
login local
length 0
transport input telnet ssh
transport output telnet ssh
!
end cisco#
|
Вариант для распечатки
