rendered paste body=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2007.05.18 15:58:52 =~=~=~=~=~=~=~=~=~=~=~=
PIX Version 6.3(3)
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security50
hostname firewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
no names
access-list acl_vpn permit ip 10.170.1.0 255.255.255.0 10.170.9.0 255.255.255.0
access-list acl_vpn permit ip 10.230.0.0 255.255.0.0 10.170.9.0 255.255.255.0
pager lines 24
logging on
logging timestamp
logging trap warnings
logging host inside 10.170.1.22
icmp permit any inside
icmp permit any dmz1
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
ip local pool vpn-pool 10.170.9.1-10.170.9.254
no pdm history enable
arp timeout 14400
nat (inside) 0 access-list acl_vpn
nat (inside) 3 10.170.1.22 255.255.255.255 0 0
nat (inside) 3 10.170.1.61 255.255.255.255 0 0
nat (inside) 4 10.170.0.0 255.255.0.0 0 0
nat (inside) 4 10.230.0.0 255.255.0.0 0 0
nat (dmz1) 2 192.168.10.10 255.255.255.255 0 0
nat (dmz1) 5 192.168.10.20 255.255.255.255 0 0
access-group outside_in in interface outside
access-group inside_in in interface inside
access-group dmz_in in interface dmz1
route inside 10.170.2.0 255.255.255.0 10.170.1.11 1
route inside 10.170.3.0 255.255.255.0 10.170.1.11 1
route inside 10.170.4.0 255.255.255.0 10.170.1.11 1
route inside 10.170.6.0 255.255.255.0 10.170.1.11 1
route inside 10.170.7.0 255.255.255.0 10.170.1.11 1
route inside 10.230.0.0 255.255.0.0 10.170.1.250 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa-server ACE protocol radius
ntp server 10.170.1.52 source inside prefer
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
crypto ipsec transform-set vpn-transform esp-3des esp-md5-hmac
crypto dynamic-map vpn-map 10 set transform-set vpn-transform
crypto map vpn-map 10 ipsec-isakmp dynamic vpn-map
crypto map vpn-map client configuration address initiate
crypto map vpn-map client configuration address respond
crypto map vpn-map interface outside
isakmp enable outside
isakmp client configuration address-pool local vpn-pool outside
isakmp nat-traversal 3600
isakmp policy 10 authentication rsa-sig
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
vpngroup Users dns-server 10.170.1.55 10.230.1.208
vpngroup Users wins-server 10.170.1.1
vpngroup Users idle-time 1800
ca identity certissue 10.170.1.31:/certsrv/mscep/mscep.dll
ca configure certissue ra 1 20 crloptional
telnet timeout 5
ssh 10.170.1.0 255.255.255.0 inside
ssh 10.230.1.0 255.255.255.0 inside
ssh timeout 10
console timeout 0
terminal width 80