Current configuration : 12353 bytes
!
version 12.4
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname WDF-2811-1
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 10 log
security passwords min-length 6
logging buffered 4096 debugging
logging console warnings
!
aaa new-model
!
!
aaa authentication login local_auth local
aaa authorization exec default local
!
aaa session-id common
!
resource policy
!
clock timezone EDT -5
clock summer-time EDT recurring
ip subnet-zero
no ip source-route
no ip gratuitous-arps
ip telnet hidden addresses
!
!
ip cef
ip inspect udp idle-time 1800
ip inspect dns-timeout 7
ip inspect tcp idle-time 14400
ip inspect name INTERNET ftp timeout 3600
ip inspect name INTERNET esmtp timeout 3600
ip inspect name INTERNET icmp timeout 3600
ip inspect name INTERNET isakmp timeout 3600
ip inspect name INTERNET ftps timeout 3600
ip inspect name INTERNET l2tp timeout 3600
ip inspect name INTERNET pop3 timeout 3600
ip inspect name INTERNET pop3s timeout 3600
ip inspect name INTERNET dns timeout 3600
ip inspect name INTERNET imap timeout 3600
ip inspect name INTERNET imaps timeout 3600
ip inspect name INTERNET tcp timeout 3600
ip inspect name INTERNET udp timeout 3600
ip inspect name INTERNET h323callsigalt timeout 3600
ip inspect name INTERNET h323gatestat timeout 3600
ip inspect name INTERNET h323 timeout 3600
!
!
ip flow-cache timeout active 1
no ip bootp server
no ip domain lookup
ip ssh time-out 60
ip ssh authentication-retries 5
ip ssh logging events
ip address-pool local
!
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key f2ada039a51ef1c024cf address 74.xxx.xxx.210 no-xauth
crypto isakmp key f2ada039a51ef1c024cf address 66.xxx.xxx.228 no-xauth
crypto isakmp keepalive 30 periodic
!
!
crypto ipsec transform-set P2P-VPN esp-3des esp-md5-hmac
!
crypto map VPN_MAP 10 ipsec-isakmp
set peer 74.xxx.xxx.210
set peer 66.xxx.xxx.228
set transform-set P2P-VPN
set pfs group2
match address NC-VPN-ACL
!
!
!
interface FastEthernet0/0
no ip address
no ip redirects
no ip unreachables
ip route-cache flow
duplex full
speed 100
no cdp enable
!
interface FastEthernet0/0.147
description ### Internet Connection ###
encapsulation dot1Q 147 native
ip address 216.xxx.xxx.142 255.255.255.252
ip access-group INTERNET_IN_ACL in
ip verify unicast source reachable-via rx allow-default 100
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly
no snmp trap link-status
crypto map VPN_MAP
!
interface FastEthernet0/0.389
description ### TLS to Cambridge ###
encapsulation dot1Q 389
ip address 10.66.64.1 255.255.255.0
no ip redirects
ip nbar protocol-discovery
ip inspect INTERNET in
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1400
no snmp trap link-status
!
interface FastEthernet0/1
no ip address
ip nat inside
ip virtual-reassembly
shutdown
duplex full
speed 100
!
interface FastEthernet0/1/0
description *** WDF-LAN ***
switchport access vlan 192
spanning-tree portfast
!
interface FastEthernet0/1/1
description *** WDF-LAN ***
switchport access vlan 192
spanning-tree portfast
!
interface FastEthernet0/1/2
description *** WDF-LAN ***
switchport access vlan 192
spanning-tree portfast
!
interface FastEthernet0/1/3
description *** WDF-LAN ***
switchport access vlan 192
spanning-tree portfast
!
interface FastEthernet0/1/4
description *** WDF-LAN ***
switchport access vlan 192
spanning-tree portfast
!
interface FastEthernet0/1/5
description *** WDF-LAN ***
switchport access vlan 192
spanning-tree portfast
!
interface FastEthernet0/1/6
description *** WDF-LAN ***
switchport access vlan 192
spanning-tree portfast
!
interface FastEthernet0/1/7
description *** WDF-LAN ***
switchport access vlan 192
spanning-tree portfast
!
interface FastEthernet0/1/8
description *** WDF-LAN ***
switchport access vlan 192
spanning-tree portfast
!
interface Vlan1
no ip address
!
interface Vlan147
no ip address
ip mtu 1400
!
interface Vlan192
description *** WDF-LAN ***
ip address 10.66.192.1 255.255.255.0
no ip unreachables
no ip proxy-arp
ip inspect INTERNET in
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1400
no snmp trap link-status
!
ip classless
ip route 0.0.0.0 0.0.0.0 216.xxx.xxx.141 name INTERNET
ip route 10.66.16.0 255.255.240.0 10.66.64.2 name Cam-LAN
ip route 10.66.32.0 255.255.224.0 10.66.64.2 name Cam-VM-INF
ip route 10.66.192.0 255.255.192.0 10.66.192.2 permanent name DRP-VM
!
no ip http server
no ip http secure-server
ip nat inside source route-map USER_OVERLOAD interface FastEthernet0/0.147 overload
ip nat inside source static 10.66.30.8 216.xxx.xxx.32 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.9 22 216.xxx.xxx.33 22 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.9 25 216.xxx.xxx.33 25 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 80 216.xxx.xxx.33 80 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 110 216.xxx.xxx.33 110 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 143 216.xxx.xxx.33 143 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.55 22 216.xxx.xxx.33 222 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 443 216.xxx.xxx.33 443 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 993 216.xxx.xxx.33 993 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 995 216.xxx.xxx.33 995 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.192.5 22 216.xxx.xxx.33 2222 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.6 22 216.xxx.xxx.34 22 route-map USER_OVERLOAD extendable
ip nat inside source static tcp 10.66.30.6 3389 216.xxx.xxx.34 3389 route-map USER_OVERLOAD extendable
ip nat inside source static 10.66.50.100 216.xxx.xxx.35 route-map 1-1-NAT-RM extendable
ip nat inside source static 10.66.30.7 216.xxx.xxx.36 route-map 1-1-NAT-RM extendable
ip nat inside source static 10.66.30.9 216.xxx.xxx.37 route-map 1-1-NAT-RM extendable
ip nat inside source static 10.66.192.5 216.xxx.xxx.38 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 80 216.xxx.xxx.39 80 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 110 216.xxx.xxx.39 110 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 143 216.xxx.xxx.39 143 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 443 216.xxx.xxx.39 443 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 993 216.xxx.xxx.39 993 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 995 216.xxx.xxx.39 995 route-map 1-1-NAT-RM extendable
!
ip access-list standard MGMT_ACL
remark ######### Management ACL ###################
permit 216.xxx.xxx.189 log
permit 216.xxx.xxx.141 log
permit 10.66.0.0 0.0.255.255 log
permit 192.168.7.0 0.0.0.255
permit any
ip access-list standard SSH_ACL
permit any log
!
ip access-list extended ACL-1-1-NAT
remark ##### ACL for 1-1 STATIC NAT TRANSLATIONS #####
remark ### No NAT for VPN connections
deny ip 10.66.0.0 0.0.255.255 192.168.7.0 0.0.0.255
remark ### SERVERS THAT ARE 1-1 NAT
permit ip host 10.66.30.2 any
permit ip host 10.66.30.7 any
permit ip host 10.66.30.8 any
permit ip host 10.66.30.9 any
permit ip host 10.66.30.55 any
permit ip host 10.66.50.90 any
permit ip host 10.66.50.100 any
permit ip host 10.66.192.5 any
permit ip host 172.16.1.1 any
remark ### BLOCK ALL OTHERS
deny ip any any
ip access-list extended ACL_NAT_PAT
remark ### NATTING FOR PORTS
ip access-list extended ACL_USER_OVERLOAD
remark ##### NO NAT ACL #####
remark ### No NAT for VPN connections
deny ip 10.66.0.0 0.0.255.255 192.168.7.0 0.0.0.255
remark ### No NAT for Servers
deny ip host 10.66.30.2 any
deny ip host 10.66.30.7 any
deny ip host 10.66.30.8 any
deny ip host 10.66.50.90 any
deny ip host 10.66.50.100 any
deny ip host 10.66.192.5 any
remark ### Nat two PAT'd servers & everything else
permit ip 10.66.0.0 0.0.255.255 any
ip access-list extended INTERNET_IN_ACL
remark ############### INBOUND ACL ########################
remark ***** Standard Anti-spoof restrictions
deny ip 192.168.0.0 0.0.255.255 any log-input
deny ip 172.16.0.0 0.15.255.255 any log-input
deny ip 10.0.0.0 0.255.255.255 any log-input
deny ip 127.0.0.0 0.255.255.255 any log-input
deny ip 255.0.0.0 0.255.255.255 any log-input
deny ip 224.0.0.0 31.255.255.255 any log-input
deny ip host 0.0.0.0 any log-input
remark ***** MGMT ACCESS
permit tcp host 216.xxx.xxx.189 host 216.xxx.xxx.142 eq telnet
permit tcp host 216.xxx.xxx.141 host 216.xxx.xxx.142 eq telnet
permit tcp any host 216.xxx.xxx.142 eq 22
remark ***** ICMP FROM INTERNET
permit icmp host 216.xxx.xxx.141 any
permit icmp host 66.xxx.xxx.228 any
deny icmp any any
remark ***** ALLOW P2P VPN CONNECTIONS IN
permit udp host 66.xxx.xxx.228 host 216.xxx.xxx.142 eq isakmp
permit udp host 74.xxx.xxx.210 host 216.xxx.xxx.142 eq isakmp
permit esp host 66.xxx.xxx.228 host 216.xxx.xxx.142
permit esp host 74.xxx.xxx.210 host 216.xxx.xxx.142
remark ***** ALLOW CONNECTIONS TO SERVERS
remark ** MAIL SERVER
permit tcp any host 216.xxx.xxx.33 eq smtp
permit tcp any host 216.xxx.xxx.33 eq pop3
permit tcp any host 216.xxx.xxx.33 eq 143
permit tcp any host 216.xxx.xxx.33 eq www
permit tcp any host 216.xxx.xxx.33 eq 443
permit tcp any host 216.xxx.xxx.33 eq 993
permit tcp any host 216.xxx.xxx.33 eq 995
permit tcp any host 216.xxx.xxx.33 eq 22
permit tcp any host 216.xxx.xxx.33 eq 222
permit tcp any host 216.xxx.xxx.33 eq 2222
remark ** MAIL SERVER INTERFACE 2
permit tcp any host 216.xxx.xxx.39 eq smtp
permit tcp any host 216.xxx.xxx.39 eq pop3
permit tcp any host 216.xxx.xxx.39 eq 143
permit tcp any host 216.xxx.xxx.39 eq 443
permit tcp any host 216.xxx.xxx.39 eq 993
permit tcp any host 216.xxx.xxx.39 eq 995
permit tcp any host 216.xxx.xxx.39 eq www
remark ** TS
permit tcp any host 216.xxx.xxx.34 eq 3389
remark ** NXS
permit tcp any host 216.xxx.xxx.34 eq 22
remark ** Jabber
permit tcp any host 216.xxx.xxx.36 eq 5222
permit tcp any host 216.xxx.xxx.36 eq 5223
permit tcp any host 216.xxx.xxx.36 eq 5269
remark ** VPN SERVER 1 - OPENVPN
permit tcp any host 216.xxx.xxx.35 eq 1194
remark ** VPN SERVER 2 - WINDOWS PPTP
permit gre any host 216.xxx.xxx.32
permit tcp any host 216.xxx.xxx.32 eq 1723
remark ** WEB Server
permit tcp any host 216.xxx.xxx.37 eq www
permit tcp any host 216.xxx.xxx.37 eq 443
remark ** DNS Server
permit tcp any host 216.xxx.xxx.38 eq domain
permit udp any host 216.xxx.xxx.38 eq domain
remark ***** DENY ALL OTHER TRAFFIC
deny ip any any log
ip access-list extended NC-VPN-ACL
remark ##### ACL FOR TRAFFIC THROUGH NC VPN #####
permit ip 10.66.0.0 0.0.255.255 192.168.7.0 0.0.0.255
!
logging trap debugging
logging facility local2
logging source-interface FastEthernet0/0.389
logging 192.168.7.139
snmp-server community public RO
snmp-server location DRP_Waterloo
route-map USER_OVERLOAD permit 10
match ip address ACL_USER_OVERLOAD
!
route-map 1-1-NAT-RM permit 10
match ip address ACL-1-1-NAT
!
!
!
control-plane
!
!
!
line con 0
exec-timeout 5 0
login authentication local_auth
transport output telnet
line aux 0
exec-timeout 15 0
login authentication local_auth
modem InOut
transport output telnet
stopbits 1
speed 115200
flowcontrol hardware
line vty 0 4
access-class MGMT_ACL in
login authentication local_auth
transport input telnet ssh
line vty 5 10
exec-timeout 15 0
login authentication local_auth
transport input telnet ssh
!
scheduler allocate 20000 1000
!
end