GWR1#sh run
Building configuration...

Current configuration : 34144 bytes
!
! Last configuration change at 22:30:04 EDT Mon Sep 12 2016 by <skipped>
! NVRAM config last updated at 22:32:16 EDT Mon Sep 12 2016 by <skipped>
! NVRAM config last updated at 22:32:16 EDT Mon Sep 12 2016 by <skipped>
version 15.2
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname GWR1
!
boot-start-marker
boot system flash:/c2900-universalk9-mz.SPA.152-4.M6.bin
boot-end-marker
!
!
logging buffered 51200 warnings
enable secret 5 <skipped>
enable password 7 <skipped>
!
aaa new-model
!
!
aaa group server radius RADGP01
 server <skipped> auth-port <skipped> acct-port <skipped>
 server <skipped>
!
aaa authentication login default local
aaa authentication login RADLIST group RADGP01 local
aaa authorization exec default local 
aaa accounting update periodic 30
aaa accounting network RADAcctList
 action-type start-stop
 group RADGP01
!
!
!
!
!
!
aaa session-id common
clock timezone EST -5 0
clock summer-time EDT recurring
!
no ip source-route
ip cef
!
!
ip port-map http port tcp <skipped> description http://<skipped>:<skipped>/f
ip port-map user-git port tcp <skipped>
ip port-map https port tcp <skipped> description https://<skipped>:<skipped>/rxhu
!
no ip dhcp use vrf connected
!
!
!
no ip domain lookup
ip domain name <skipped>
ip host remote.<skipped> <skipped>
ip host vpn.<skipped> <skipped>
ip host surveillance.<skipped> <skipped>
ip name-server <skipped>
ip name-server <skipped>
ip inspect log drop-pkt
ip inspect hashtable-size 2048
ip inspect tcp idle-time 1800
ip inspect name FW http
ip inspect name FW https
ip inspect name FW dns
ip inspect name FW ssh
ip inspect name FW telnet
ip inspect name FW icmp
ip inspect name FW ntp
ip inspect name FW ftps
ip inspect name FW ftp
ip inspect name FW sip
ip inspect name FW tftp
ip inspect name FW rtsp
ip inspect name FW esmtp
ip inspect name FW user-git
ip inspect redundancy update seconds 30
no ipv6 cef
!
parameter-map type inspect global
 log dropped-packets enable
 max-incomplete low 18000
 max-incomplete high 20000
 spoofed-acker off
multilink bundle-name authenticated
!
!
!
crypto pki trustpoint <skipped>
 enrollment selfsigned
 subject-name <skipped>
 revocation-check none
 rsakeypair <skipped>
!
crypto pki trustpoint <skipped>
 enrollment terminal pem
 fqdn <skipped>
 subject-name <skipped>
 revocation-check crl
 rsakeypair <skipped>
!
!
crypto pki certificate chain <skipped>
 certificate self-signed 01
	<skipped>
        quit
crypto pki certificate chain <skipped>
 certificate <skipped>
  <skipped>
        quit
 certificate ca <skipped>
  <skipped>
        quit
license udi pid CISCO2911/K9 sn <skipped>
!
!
archive
 log config
  hidekeys
 path ftp://<skipped>/rtrconfigs/GWR1-Running
 time-period 1440
object-group network _Ext_NTP_Servers 
 host <skipped>
 host <skipped>
 host <skipped>
 host <skipped>
!
object-group network FTP_VMs 
 description FTP Servers
 host <skipped>
 host <skipped>
!
object-group network MAIL_VMs 
 host <skipped>
!
object-group service Mgmt_Svcs 
 tcp eq <skipped>
 tcp range <skipped> <skipped>
!
object-group network Mgmt_VMs 
 host <skipped>
!
object-group network PBX_Clients 
 description  Remote SIP Phones and Trunks
 <skipped> 255.255.255.224
 <skipped> 255.255.255.0
 <skipped> 255.255.255.248
 <skipped> 255.255.255.248
 <skipped> 255.255.255.248
 <skipped> 255.255.255.248
 <skipped> 255.255.255.248
 <skipped> 255.255.255.248
 <skipped> 255.255.255.248
 host <skipped>
 <skipped> 255.255.255.248
 <skipped> 255.255.255.0
 <skipped> 255.255.255.0
!
object-group network PBX_Server 
 description PBX Server
 host <skipped>
!
object-group service SSH_Ports 
 tcp eq <skipped>
 tcp eq <skipped>
!
object-group network TEMP_SSH 
 host <skipped>
!
object-group network VMs_Blocked_100 
 host 172.16.100.<skipped>
 host 172.16.100.<skipped>
 host 172.16.100.<skipped>
 host 172.16.100.<skipped>
 host 172.16.100.<skipped>
 host 172.16.100.<skipped>
!
object-group network WWW_VMs 
 host <skipped>
 host <skipped>
!
object-group network External_DNS_Servers 
 host <skipped>
 host <skipped>
!
object-group network External_NTP_Servers 
 host <skipped>
 host <skipped>
 host <skipped>
 host <skipped>
!
object-group network LAN 
 172.16.100.0 255.255.255.0
 172.16.200.0 255.255.255.0
 172.16.250.0 255.255.255.0
 172.16.210.0 255.255.255.0
 172.16.150.0 255.255.255.0
!
object-group service PBXServices 
 tcp eq <skipped>
 tcp eq <skipped>
 udp eq <skipped>
 tcp eq <skipped>
 tcp eq <skipped>
 udp range <skipped> <skipped>
 tcp range <skipped> <skipped>
!
object-group network X_INBOUND_SERVERS 
 range <skipped> <skipped>
 <skipped> 255.255.240.0
 <skipped> 255.255.224.0
 <skipped>255.255.240.0
 <skipped> 255.255.240.0
 <skipped> 255.255.192.0
 <skipped> 255.255.0.0
 <skipped> 255.255.0.0
 <skipped> 255.255.240.0
 <skipped> 255.255.128.0
 <skipped> 255.255.224.0
!
object-group network Remote_VPN_Peers 
 192.168.108.0 255.255.255.0
 192.168.102.0 255.255.255.0
 192.168.100.0 255.255.255.0
 192.168.200.0 255.255.255.0
 192.168.103.0 255.255.255.0
 192.168.104.0 255.255.255.0
 192.168.105.0 255.255.255.0
 192.168.106.0 255.255.255.0
 192.168.109.0 255.255.255.0
 192.168.115.0 255.255.255.0
 192.168.107.0 255.255.255.0
!
object-group network RouteMap_Hosts 
 host 172.16.200.<skipped>
 host 172.16.200.<skipped>
 host 172.16.200.<skipped>
 host 172.16.200.<skipped>
 host 172.16.250.<skipped>
!
username <skipped> privilege 15 password 7 <skipped>
username <skipped> privilege 15 password 7 <skipped>
!
redundancy
no crypto engine software ipsec
!
!
!
!
!
no ip ftp passive
ip ftp username <skipped>
ip ftp password 7 <skipped>
ip ssh time-out 60
ip ssh source-interface GigabitEthernet0/0
ip ssh version 2
!
track 1 interface GigabitEthernet0/0 line-protocol
!
track 2 interface GigabitEthernet0/1 line-protocol
!
class-map match-all voip
 match access-group 105
!
policy-map sub-voip-child-map
 class voip
  bandwidth 20
policy-map voipmap
 class voip
  priority 192
 class class-default
  fair-queue
policy-map sub-voip-parent-map
 class class-default
  shape average 2000000
   service-policy sub-voip-child-map
!
! 
crypto keyring KeyRing  
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped>key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
  pre-shared-key address <skipped> key <skipped>
!
crypto vpn anyconnect flash0:/webvpn/anyconnect-win-3.1.07021-k9.pkg sequence 1
!
crypto vpn anyconnect flash0:/webvpn/anyconnect-macosx-i386-3.1.05152-k9.pkg sequence 2
!
crypto vpn anyconnect flash0:/webvpn/anyconnect-linux-64-3.1.05152-k9.pkg sequence 3
!
crypto vpn anyconnect flash0:/webvpn/anyconnect-linux-3.1.05152-k9.pkg sequence 4
!
crypto isakmp policy 159
 encr <skipped>
 hash <skipped>
 authentication pre-share
 group 2
 lifetime 10800
crypto isakmp invalid-spi-recovery
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   description *** <skipped> ***
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
   match identity address <skipped> 255.255.255.255 
crypto isakmp profile <skipped>
   keyring KeyRing
   match identity address <skipped> 255.255.255.255 
!
!
crypto ipsec transform-set vpnset <skipped>
 mode tunnel
!
!
!
crypto map vpnmaps 116 ipsec-isakmp 
 description *** <skipped> *** 
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
crypto map vpnmaps 2333 <skipped>
 description *** <skipped> ***
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
crypto map vpnmaps 7036 ipsec-isakmp 
 description *** <skipped> *** 
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
crypto map vpnmaps 7502 ipsec-isakmp 
 description *** <skipped> ***
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
crypto map vpnmaps 10814 ipsec-isakmp 
 description *** <skipped> *** 
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
crypto map vpnmaps 12102 ipsec-isakmp 
 description *** <skipped> *** 
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
crypto map vpnmaps 12108 ipsec-isakmp 
 description *** <skipped> *** 
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
crypto map vpnmaps 14032 ipsec-isakmp 
 description *** <skipped> *** 
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
crypto map vpnmaps 15325 ipsec-isakmp 
 description *** <skipped> ***
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
crypto map vpnmaps 22222 ipsec-isakmp 
 description *** <skipped> ***
 set peer <skipped>
 set peer <skipped>
 set transform-set vpnset 
 match address <skipped>
crypto map vpnmaps 25014 ipsec-isakmp 
 description *** <skipped> *** 
 set peer <skipped>
 set transform-set vpnset 
 set isakmp-profile <skipped>
 match address <skipped>
!
!         
!
!
!
interface Loopback0
 ip address 10.10.10.<skipped> 255.255.255.0
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 description Upstream Link
 ip address 67.<skipped>.<skipped>.21 255.255.<skipped>.<skipped>
 ip access-group Internet-inbound-ACL in
 ip nat outside
 ip inspect FW out
 ip virtual-reassembly in
 ip tcp adjust-mss 1460
 standby version 2
 standby 159 ip 67.<skipped>.<skipped>.20
 standby 159 priority 105
 standby 159 preempt delay minimum 60 reload 120 sync 120
 standby 159 name WANHA
 standby 159 track 2 decrement 10
 duplex full
 speed 100
 no cdp enable
 crypto map vpnmaps redundancy WANHA 
 service-policy output voipmap
!
interface GigabitEthernet0/1
 description Downstream Links
 no ip address
 no ip redirects
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.150
 description DMZ on LAN
 encapsulation dot1Q 150
 ip address 172.16.150.251 255.255.255.0
 no ip redirects
 ip virtual-reassembly in
 standby version 2
 standby 150 ip 172.16.150.254
 standby 150 priority 105
 standby 150 preempt delay minimum 60 reload 120 sync 120
 standby 150 track 1 decrement 10
 service-policy output sub-voip-parent-map
!
interface GigabitEthernet0/1.200
 description Servers and VMs
 encapsulation dot1Q 200
 ip address 172.16.200.251 255.255.255.0
 no ip redirects
 ip nat inside
 ip virtual-reassembly in
 standby version 2
 standby 200 ip 172.16.200.254
 standby 200 priority 105
 standby 200 preempt delay minimum 60 reload 120 sync 120
 standby 200 name LANHAVMs
 standby 200 track 1 decrement 10
!
interface GigabitEthernet0/1.210
 description VMotion
 encapsulation dot1Q 210
 ip address 172.16.210.251 255.255.255.0
 no ip redirects
 standby version 2
 standby 210 ip 172.16.210.254
 standby 210 priority 105
 standby 210 preempt delay minimum 60 reload 120 sync 120
 standby 210 track 1 decrement 10
!
interface GigabitEthernet0/1.250
 description Mgmt
 encapsulation dot1Q 250
 ip address 172.16.250.251 255.255.255.0
 no ip redirects
 ip nat inside
 ip virtual-reassembly in
 standby version 2
 standby 250 ip 172.16.250.254
 standby 250 priority 105
 standby 250 preempt delay minimum 60 reload 120 sync 120
 standby 250 track 1 decrement 10
!
interface GigabitEthernet0/2
 description Inband_Mgmt_Core
 ip address 10.2.2.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
ip local pool SSLVPN-net 10.10.10.2 10.10.10.150
ip forward-protocol nd
!
ip http server
ip http port <skipped>
ip http access-class 23
ip http authentication local
ip http secure-server
ip http secure-port <skipped>
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip dns server
ip nat pool NATedInternetBoundIPs 67.<skipped>.<skipped>.20 67.<skipped>.<skipped>.20 netmask 255.255.<skipped>.<skipped>
ip nat inside source list 199 pool NATedInternetBoundIPs overload
ip nat inside source static 172.16.200.20 67.<skipped>.<skipped>.24 route-map nonat reversible
ip nat inside source static tcp 172.16.200.180 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static tcp 172.16.250.220 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static tcp 172.16.190.205 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static tcp 172.16.100.71 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static tcp 172.16.100.72 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static tcp 172.16.100.73 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static tcp 172.16.100.74 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static tcp 172.16.100.75 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static tcp 172.16.100.76 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static tcp 172.16.250.150 <skipped> 67.<skipped>.<skipped>.25 <skipped> extendable
ip nat inside source static 172.16.200.25 67.<skipped>.<skipped>.26
ip nat inside source static 172.16.250.175 67.<skipped>.<skipped>.27 route-map nonat reversible
ip nat inside source static tcp 172.16.200.95 22 67.<skipped>.<skipped>.28 22 extendable
ip nat inside source static tcp 172.16.200.95 80 67.<skipped>.<skipped>.28 80 extendable
ip nat inside source static tcp 172.16.200.95 443 67.<skipped>.<skipped>.28 443 extendable
ip nat inside source static tcp 172.16.200.205 22 67.<skipped>.<skipped>.28 8022 extendable
ip nat inside source static 172.16.200.85 67.<skipped>.<skipped>.29 route-map nonat reversible
ip nat inside source static 172.16.200.30 67.<skipped>.<skipped>.30 route-map nonat reversible
ip route 0.0.0.0 0.0.0.0 67.<skipped>.<skipped>.17  <--upstream
ip route 172.16.100.0 255.255.255.0 10.2.2.2 <-- downstream
ip route 172.16.230.0 255.255.255.0 10.2.2.2
!
ip access-list extended Internet-Outbound-ACL_100
 permit ip any object-group LAN
 permit tcp object-group VMs_Blocked_100 eq <skipped> any
 deny   ip object-group VMs_Blocked_100 any
 permit ip any any
ip access-list extended -Internet-inbound-ACL
 permit tcp host <skipped> eq <skipped> any
 permit tcp any host 67.<skipped>.<skipped>.21 eq <skipped>
 permit tcp any host 67.<skipped>.<skipped>.22 eq <skipped>
 permit tcp any host 67.<skipped>.<skipped>.20 eq <skipped>
 permit object-group SSH_Ports any object-group TEMP_SSH
 permit tcp any object-group Mgmt_VMs eq <skipped>
 permit tcp any host 67.<skipped>.<skipped>.25 eq <skipped>
 permit object-group Mgmt_Svcs any object-group Mgmt_VMs
 permit tcp any object-group FTP_VMs eq <skipped>
 permit tcp any object-group FTP_VMs range <skipped> <skipped>
 permit tcp any object-group WWW_VMs eq <skipped>
 permit tcp any object-group WWW_VMs eq <skipped>
 permit tcp object-group INBOUND_SERVERS object-group MAIL_VMs eq <skipped>
 permit tcp any object-group MAIL_VMs eq <skipped>
 permit tcp any object-group MAIL_VMs eq <skipped>
 permit tcp any host 67.<skipped>.<skipped>.25 eq <skipped>
 permit tcp any host 67.<skipped>.<skipped>.23 eq <skipped>
 permit tcp any host 67.<skipped>.<skipped>.23 eq <skipped>
 permit tcp any host 67.<skipped>.<skipped>.21 eq <skipped>
 permit tcp any host 67.<skipped>.<skipped>.21 eq <skipped>
 permit udp any host 67.<skipped>.<skipped>.21 eq <skipped>
 permit udp any host 67.<skipped>.<skipped>.22 eq <skipped>
 permit udp any host 67.<skipped>.<skipped>.20 eq <skipped>
 permit udp host <skipped> host 67.<skipped>.<skipped>.20 eq <skipped>
 permit udp host <skipped> host 67.<skipped>.<skipped>.20 eq <skipped>
 permit udp object-group External_DNS_Servers eq <skipped> any
 permit udp object-group External_NTP_Servers host 67.<skipped>.<skipped>.21 eq <skipped>
 permit udp object-group External_NTP_Servers host 67.<skipped>.<skipped>.22 eq <skipped>
 permit udp object-group External_NTP_Servers host 67.<skipped>.<skipped>.20 eq <skipped>
 permit udp host 67.<skipped>.<skipped>.21 eq <skipped> host <skipped> eq <skipped>
 permit udp host 67.<skipped>.<skipped>.22 eq <skipped> host <skipped> eq <skipped>
 permit esp any host 67.<skipped>.<skipped>.21
 permit esp any host 67.<skipped>.<skipped>.22
 permit esp any host 67.<skipped>.<skipped>.20
 permit object-group PBXServices object-group PBX_Clients object-group PBX_Server
 permit icmp any any
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.108.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.108.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.104.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.104.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.102.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.102.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.107.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.107.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.115.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.115.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.100.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.100.0 0.0.0.255
 permit ip 10.10.10.0 0.0.0.255 192.168.100.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.200.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.200.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.106.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.106.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended LINE_ACL
 remark SSH & Telnet Access
 permit tcp 172.16.100.0 0.0.0.255 any
 permit tcp 172.16.200.0 0.0.0.255 any
 permit tcp 172.16.250.0 0.0.0.255 any
 permit tcp any any eq <skipped>
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.103.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.103.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.109.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.109.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended <skipped>
 permit ip 172.16.200.0 0.0.0.255 192.168.105.0 0.0.0.255
 permit ip 172.16.250.0 0.0.0.255 192.168.105.0 0.0.0.255
 deny   ip any any log-input
ip access-list extended UnixLab
 deny   ip any object-group LAN
 permit ip any any
!
ip radius source-interface GigabitEthernet0/1.200 
ip access-list log-update threshold 1
access-list 2 remark SNMP Control
access-list 2 permit <skipped>
access-list 2 permit <skipped>
access-list 2 deny   any log
access-list 23 remark HTTP Router Access
access-list 23 permit 172.16.100.0 0.0.0.255
access-list 23 permit 172.16.200.0 0.0.0.255
access-list 23 permit 172.16.250.0 0.0.0.255
access-list 23 deny   any log
access-list 100 deny   ip object-group RouteMap_Hosts object-group Remote_VPN_Peers
access-list 100 permit ip object-group RouteMap_Hosts any
access-list 100 permit ip any object-group RouteMap_Hosts
access-list 100 deny   ip any any
access-list 105 remark VOIP (SIP/IAX/RTP/IAX2) traffic gets top priority (5)
access-list 105 permit udp any any eq <skipped>
access-list 105 permit udp any any eq <skipped>
access-list 105 permit udp any any eq <skipped>
access-list 105 permit udp any any eq <skipped>
access-list 199 permit udp any object-group Ext_NTP_Servers eq ntp
access-list 199 deny   ip host 172.16.250.<skipped> any
access-list 199 deny   ip host 172.16.250.<skipped> any
access-list 199 deny   ip host 172.16.250.<skipped> any
access-list 199 deny   ip host 172.16.200.<skipped> any
access-list 199 deny   ip host 172.16.200.<skipped> any
access-list 199 deny   ip host 172.16.250.<skipped> any
access-list 199 deny   ip host 172.16.200.<skipped> any
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.108.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.108.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.102.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.102.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 199 deny   ip 10.10.10.0 0.0.0.255 192.168.100.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.200.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.200.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.103.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.103.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.105.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.105.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.104.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.104.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.106.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.106.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.107.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.107.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.109.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.109.0 0.0.0.255
access-list 199 deny   ip 172.16.200.0 0.0.0.255 192.168.115.0 0.0.0.255
access-list 199 deny   ip 172.16.250.0 0.0.0.255 192.168.115.0 0.0.0.255
access-list 199 permit ip 172.16.100.0 0.0.0.255 any
access-list 199 permit ip 172.16.190.0 0.0.0.255 any
access-list 199 permit ip 172.16.200.0 0.0.0.255 any
access-list 199 permit ip 172.16.250.0 0.0.0.255 any
access-list 199 permit ip host 67.<skipped>.<skipped>.20 any
access-list 199 permit udp host 67.<skipped>.<skipped>.20 any
access-list 199 permit udp host 67.<skipped>.<skipped>.21 any
access-list 199 deny   ip any any
cdp timer 240
!
route-map nonat permit 10
 match ip address 100
!
!
snmp-server community <skipped> RO 2
snmp-server location <skipped>
snmp-server contact <skipped>
snmp-server chassis-id GWR1 
snmp-server enable traps entity-sensor threshold
radius-server attribute 32 include-in-access-req format %h
radius-server host 172.16.200.<skipped> auth-port <skipped> acct-port <skipped> key 7 <skipped>
radius-server host 172.16.200.<skipped> key 7 <skipped>
radius-server host 172.16.200.<skipped> auth-port <skipped> acct-port <skipped> key 7 <skipped>
radius-server host 172.16.200.<skipped> key 7 <skipped>
!
!
!
control-plane
!
!
banner exec ^C You are now connected to GWR1. Proceed with Caution! ^C
banner login ^C
This system is solely for the use of authorized users for official purposes.  You have no
expectation of privacy in its use and to ensure that the system is functioning properly,
individuals using this computer system are subject to having all of their activities
monitored and recorded by system personnel.  Use of this system evidences an express
consent to such monitoring and agreement that if such monitoring reveals evidence of
possible abuse or criminal activity, system personnel may provide the results of such
monitoring to appropriate officials.
^C
!
line con 0
 exec-timeout 0 0
 password 7 <skipped>
 logging synchronous
 stopbits 1
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 access-class LINE_ACL in
 exec-timeout 5 0
 privilege level 15
 password 7 <skipped>
 logging synchronous
 transport input telnet ssh
 transport output telnet ssh
line vty 5 15
 access-class LINE_ACL in
 privilege level 15
 transport input telnet ssh
!         
scheduler allocate 20000 1000
ntp server <skipped>
ntp server <skipped>
ntp server <skipped>
!
!
webvpn gateway SSLVPN-GW
 ip address 67.<skipped>.<skipped>.21 port <skipped>  
 http-redirect port 80
 ssl trustpoint <skipped>
 logging enable
 inservice
 !
webvpn context SSLVPN-Context
 login-message "Welcome to <br /> <br /> <skipped>, SSL VPN Service!"
 aaa authentication list RADLIST
 gateway SSLVPN-GW
 max-users 10
 logging enable
 !
 ssl authenticate verify all
 inservice
 !
 policy group SSLVPN-Policy
   functions file-access
   functions file-browse
   functions file-entry
   functions svc-enabled
   functions svc-required
   banner "You will be now connected to our secure Networks."
   svc address-pool "SSLVPN-net" netmask 255.255.255.0
   svc default-domain <skipped>
   svc keep-client-installed
   svc dpd-interval client 600
   svc rekey method new-tunnel
   svc split include 172.16.200.0 255.255.255.0
   svc split include 172.16.250.0 255.255.255.0
   svc split include 172.16.100.0 255.255.255.0
   svc split include 10.10.10.0 255.255.255.0
   svc split include 192.168.100.0 255.255.255.0
   svc dns-server primary <skipped>
   svc dns-server secondary <skipped>
 default-group-policy SSLVPN-Policy
!
end

GWR1#